git subrepo clone https://leap.se/git/puppet_squid_deb_proxy puppet/modules/squid_deb_proxy

subrepo:
  subdir:   "puppet/modules/squid_deb_proxy"
  merged:   "08bfacc"
upstream:
  origin:   "https://leap.se/git/puppet_squid_deb_proxy"
  branch:   "master"
  commit:   "08bfacc"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo.git"
  commit:   "cb2995b"

9 files changed, 396 insertions, 0 deletions

diff --git a/puppet/modules/squid_deb_proxy/.gitrepo b/puppet/modules/squid_deb_proxy/.gitrepo
new file mode 100644
index 00000000..337c352b
--- /dev/null
+++ b/puppet/modules/squid_deb_proxy/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_squid_deb_proxy
+	branch = master
+	commit = 08bfaccaea01fd2d334946428504e71a51748e3d
+	parent = 76c57fa4441aafc3e4aef201962d31bd03236e3d
+	cmdver = 0.3.0
diff --git a/puppet/modules/squid_deb_proxy/README.md b/puppet/modules/squid_deb_proxy/README.md
new file mode 100644
index 00000000..c183c826
--- /dev/null
+++ b/puppet/modules/squid_deb_proxy/README.md
@@ -0,0 +1,8 @@
+This module installes squid-deb-proxy (server or client)
+see https://launchpad.net/squid-deb-proxy for more details
+
+Debian Support
+==============
+
+* As of 2013-07, squid-deb-proxy just arrived in jessie, so you need to
+  configure apt to use jessie. 
diff --git a/puppet/modules/squid_deb_proxy/files/Debian/squid-deb-proxy.conf b/puppet/modules/squid_deb_proxy/files/Debian/squid-deb-proxy.conf
new file mode 100644
index 00000000..2a528f84
--- /dev/null
+++ b/puppet/modules/squid_deb_proxy/files/Debian/squid-deb-proxy.conf
@@ -0,0 +1,91 @@
+
+#       WELCOME TO SQUID DEB PROXY
+#       ------------------
+#
+#       This config file is a version of a squid proxy file optimized
+#	as a configuration for a caching proxy for Debian/Ubuntu systems.
+#
+#       More information about squid and its configuration can be found here
+#       http://www.squid-cache.org/ and in the FAQ
+
+# settings that you may want to customize
+# ---------------------------------------
+
+# this file contains private networks (10.0.0.0/8, 172.16.0.0/12,
+# 192.168.0.0/16) by default, you can add/remove additional allowed
+# source networks in it to customize it for your setup
+acl allowed_networks src "/etc/squid-deb-proxy/autogenerated/allowed-networks-src.acl"
+
+# this file contains the archive mirrors by default,
+# if you use a different mirror, add it there
+acl to_archive_mirrors dstdomain "/etc/squid-deb-proxy/autogenerated/mirror-dstdomain.acl"
+
+# this contains the package blacklist
+acl blockedpkgs urlpath_regex "/etc/squid-deb-proxy/autogenerated/pkg-blacklist-regexp.acl"
+
+# default to a different port than stock squid
+http_port 8000
+
+# -------------------------------------------------
+# settings below probably do not need customization
+
+# user visible name
+visible_hostname squid-deb-proxy
+
+# we need a big cache, some debs are huge
+maximum_object_size 512 MB
+
+# use a different dir than stock squid and default to 40G
+cache_dir aufs /var/cache/squid-deb-proxy 40000 16 256
+
+# use different logs
+cache_access_log /var/log/squid-deb-proxy/access.log
+cache_log /var/log/squid-deb-proxy/cache.log
+cache_store_log /var/log/squid-deb-proxy/store.log
+
+# tweaks to speed things up
+cache_mem 200 MB
+maximum_object_size_in_memory 10240 KB
+
+# pid
+pid_filename /var/run/squid-deb-proxy.pid
+
+# refresh pattern for debs and udebs
+refresh_pattern deb$   129600 100% 129600
+refresh_pattern udeb$   129600 100% 129600
+refresh_pattern tar.gz$  129600 100% 129600
+
+# always refresh Packages and Release files
+refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz)$ 0 0% 0
+refresh_pattern \/Release(|\.gpg)$ 0 0% 0
+refresh_pattern \/InRelease$ 0 0% 0
+
+# handle meta-release and changelogs.ubuntu.com special
+# (fine to have this on debian too)
+refresh_pattern changelogs.ubuntu.com/*  0  1% 1
+
+# only allow connects to ports for http, https
+acl Safe_ports port 80
+acl Safe_ports port 443 563   
+
+# only allow ports we trust
+http_access deny !Safe_ports
+
+# do not allow to download from the pkg blacklist
+http_access deny blockedpkgs
+
+# allow access only to official archive mirrors
+# uncomment the third and fouth line to permit any unlisted domain
+http_access deny !to_archive_mirrors
+#http_access allow !to_archive_mirrors
+
+# don't cache domains not listed in the mirrors file
+# uncomment the third and fourth line to cache any unlisted domains
+cache deny !to_archive_mirrors
+#cache allow !to_archive_mirrors
+
+# allow access from our network and localhost
+http_access allow allowed_networks
+
+# And finally deny all other access to this proxy
+http_access deny all
diff --git a/puppet/modules/squid_deb_proxy/files/Ubuntu/squid-deb-proxy.conf b/puppet/modules/squid_deb_proxy/files/Ubuntu/squid-deb-proxy.conf
new file mode 100644
index 00000000..ab5bac8a
--- /dev/null
+++ b/puppet/modules/squid_deb_proxy/files/Ubuntu/squid-deb-proxy.conf
@@ -0,0 +1,89 @@
+
+#       WELCOME TO SQUID DEB PROXY
+#       ------------------
+#
+#       This config file is a version of a squid proxy file optimized
+#	as a configuration for a caching proxy for Ubuntu systems.
+#
+#       More information about squid and its configuration can be found here
+#       http://www.squid-cache.org/ and in the FAQ
+
+# settings that you may want to customize
+# ---------------------------------------
+
+# this file contains private networks (10.0.0.0/8, 172.16.0.0/12,
+# 192.168.0.0/16) by default, you can add/remove additional allowed
+# source networks in it to customize it for your setup
+acl allowed_networks src "/etc/squid-deb-proxy/autogenerated/allowed-networks-src.acl"
+
+# this file contains the *archive.ubuntu.com mirrors by default,
+# if you use a different mirror, add it there
+acl to_ubuntu_mirrors dstdomain "/etc/squid-deb-proxy/autogenerated/mirror-dstdomain.acl"
+
+# this contains the package blacklist
+acl blockedpkgs urlpath_regex "/etc/squid-deb-proxy/autogenerated/pkg-blacklist-regexp.acl"
+
+# default to a different port than stock squid
+http_port 8000
+
+# -------------------------------------------------
+# settings below probably do not need customization
+
+# user visible name
+visible_hostname squid-deb-proxy
+
+# we need a big cache, some debs are huge
+maximum_object_size 512 MB
+
+# use a different dir than stock squid and default to 40G
+cache_dir aufs /var/cache/squid-deb-proxy 40000 16 256
+
+# use different logs
+cache_access_log /var/log/squid-deb-proxy/access.log
+cache_log /var/log/squid-deb-proxy/cache.log
+cache_store_log /var/log/squid-deb-proxy/store.log
+
+# tweaks to speed things up
+cache_mem 200 MB
+maximum_object_size_in_memory 10240 KB
+
+# pid
+pid_filename /var/run/squid-deb-proxy.pid
+
+# refresh pattern for debs and udebs
+refresh_pattern deb$   129600 100% 129600
+refresh_pattern udeb$   129600 100% 129600
+refresh_pattern tar.gz$  129600 100% 129600
+
+# always refresh Packages and Release files
+refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz)$ 0 0% 0
+refresh_pattern \/Release(|\.gpg)$ 0 0% 0
+
+# handle meta-release and changelogs.ubuntu.com special
+refresh_pattern changelogs.ubuntu.com/*  0  1% 1
+
+# only allow connects to ports for http, https
+acl Safe_ports port 80
+acl Safe_ports port 443 563   
+
+# only allow ports we trust
+http_access deny !Safe_ports
+
+# do not allow to download from the pkg blacklist
+http_access deny blockedpkgs
+
+# allow access only to official ubuntu mirrors
+# uncomment the third and fouth line to permit any unlisted domain
+http_access deny !to_ubuntu_mirrors
+#http_access allow !to_ubuntu_mirrors
+
+# don't cache domains not listed in the mirrors file
+# uncomment the third and fourth line to cache any unlisted domains
+cache deny !to_ubuntu_mirrors
+#cache allow !to_ubuntu_mirrors
+
+# allow access from our network and localhost
+http_access allow allowed_networks
+
+# And finally deny all other access to this proxy
+http_access deny all
diff --git a/puppet/modules/squid_deb_proxy/files/allowed-networks-src.acl.d/20-custom b/puppet/modules/squid_deb_proxy/files/allowed-networks-src.acl.d/20-custom
new file mode 100644
index 00000000..d4058b80
--- /dev/null
+++ b/puppet/modules/squid_deb_proxy/files/allowed-networks-src.acl.d/20-custom
@@ -0,0 +1 @@
+# managed by puppet
diff --git a/puppet/modules/squid_deb_proxy/files/client/apt-avahi-discover b/puppet/modules/squid_deb_proxy/files/client/apt-avahi-discover
new file mode 100755
index 00000000..8dbc1be2
--- /dev/null
+++ b/puppet/modules/squid_deb_proxy/files/client/apt-avahi-discover
@@ -0,0 +1,138 @@
+#!/usr/bin/python
+#
+# use avahi to find a _apt_proxy._tcp provider and return
+# a http proxy string suitable for apt
+
+import asyncore
+import functools
+import os
+import socket
+import sys
+import time
+from subprocess	import Popen, PIPE, call
+from syslog import syslog, LOG_INFO, LOG_USER
+
+DEFAULT_CONNECT_TIMEOUT_SEC = 2
+
+def DEBUG(msg):
+    if "--debug" in sys.argv:
+        sys.stderr.write(msg + "\n")
+
+
+def get_avahi_discover_timeout():
+    APT_AVAHI_TIMEOUT_VAR = "APT::Avahi-Discover::Timeout"
+    p = Popen(
+        ["/usr/bin/apt-config", "shell", "TIMEOUT", APT_AVAHI_TIMEOUT_VAR], 
+        stdout=PIPE)
+    stdout, stderr = p.communicate()
+    if not stdout:
+        DEBUG(
+            "no timeout set, using default '%s'" % DEFAULT_CONNECT_TIMEOUT_SEC)
+        return DEFAULT_CONNECT_TIMEOUT_SEC
+    if not stdout.startswith("TIMEOUT="):
+        raise ValueError("got unexpected apt-config output: '%s'" % stdout)
+    varname, sep, value = stdout.strip().partition("=")
+    timeout = int(value.strip("'"))
+    DEBUG("using timeout: '%s'" % timeout)
+    return timeout
+
+@functools.total_ordering
+class AptAvahiClient(asyncore.dispatcher):
+    def __init__(self, addr):
+        asyncore.dispatcher.__init__(self)
+        if is_ipv6(addr[0]):
+            self.create_socket(socket.AF_INET6, socket.SOCK_STREAM)
+            self.connect( (addr[0], addr[1], 0, 0) )
+        else:
+            self.create_socket(socket.AF_INET, socket.SOCK_STREAM)
+            self.connect(addr)
+        self._time_init = time.time()
+        self.time_to_connect = sys.maxint
+        self.address = addr
+    def handle_connect(self):
+        self.time_to_connect = time.time() - self._time_init
+        self.close()
+    def __eq__(self, other):
+        return self.time_to_connect == other.time_to_connect
+    def __lt__(self, other):
+        return self.time_to_connect < other.time_to_connect
+    def __repr__(self):
+        return "<%s> %s: %s" % (
+            self.__class__.__name__, self.addr, self.time_to_connect)
+    def log(self, message):
+        syslog((LOG_INFO|LOG_USER), '%s\n' % str(message))
+    def log_info(self, message, type='info'):
+        if type not in self.ignore_log_types:
+            self.log('%s: %s' % (type, message))
+
+
+def is_ipv6(a):
+    return ':' in a
+
+def is_linklocal(addr):
+    # Link-local should start with fe80 and six null bytes
+    return addr.startswith("fe80::")
+
+def get_proxy_host_port_from_avahi():
+    service = '_apt_proxy._tcp'
+
+    # Obtain all of the services addresses from avahi, pulling the IPv6
+    # addresses to the top.
+    addr4 = []
+    addr6 = []
+    p = Popen(['avahi-browse', '-kprtf', service], stdout=PIPE)
+    DEBUG("avahi-browse output:")
+    for line in p.stdout:
+        DEBUG(" '%s'" % line)
+        if line.startswith('='):
+            tokens = line.split(';')
+            addr = tokens[7]
+            port = int(tokens[8])
+            if is_ipv6(addr):
+                # We need to skip ipv6 link-local addresses since 
+                # APT can't use them
+                if not is_linklocal(addr):
+                    addr6.append((addr, port))
+            else:
+                addr4.append((addr, port))
+
+    # Run through the offered addresses and see if we we have a bound local
+    # address for it.
+    addrs = []
+    for (ip, port) in addr6 + addr4:
+        try:
+            res = socket.getaddrinfo(ip, port, 0, 0, 0, socket.AI_ADDRCONFIG)
+            if res:
+                addrs.append((ip, port))
+        except socket.gaierror:
+            pass
+    if not addrs:
+        return None
+    
+    # sort by answering speed
+    hosts = []
+    for addr in addrs:
+        hosts.append(AptAvahiClient(addr))
+    # 2s timeout, arbitray
+    timeout = get_avahi_discover_timeout()
+    asyncore.loop(timeout=timeout)
+    DEBUG("sorted hosts: '%s'" % sorted(hosts))
+
+    # No host wanted to connect
+    if (all(h.time_to_connect == sys.maxint for h in hosts)):
+        return None
+
+    fastest_host = sorted(hosts)[0]
+    fastest_address = fastest_host.address
+    return fastest_address
+
+
+if __name__ == "__main__":
+    # Dump the approved address out in an appropriate format.
+    address = get_proxy_host_port_from_avahi()
+    if address:
+        (ip, port) = address
+        if is_ipv6(ip):
+            print "http://[%s]:%s/" % (ip, port)
+        else:
+            print "http://%s:%s/" % (ip, port)
diff --git a/puppet/modules/squid_deb_proxy/files/mirror-dstdomain.acl.d/20-custom b/puppet/modules/squid_deb_proxy/files/mirror-dstdomain.acl.d/20-custom
new file mode 100644
index 00000000..d4058b80
--- /dev/null
+++ b/puppet/modules/squid_deb_proxy/files/mirror-dstdomain.acl.d/20-custom
@@ -0,0 +1 @@
+# managed by puppet
diff --git a/puppet/modules/squid_deb_proxy/manifests/client.pp b/puppet/modules/squid_deb_proxy/manifests/client.pp
new file mode 100644
index 00000000..049f740a
--- /dev/null
+++ b/puppet/modules/squid_deb_proxy/manifests/client.pp
@@ -0,0 +1,16 @@
+# install squid-deb-proxy-client package
+class squid_deb_proxy::client {
+  package { 'squid-deb-proxy-client':
+    ensure => installed,
+  } ->
+
+  # ship newer client discover script than includes in squid-deb-proxy-client
+  # v. 0.8.13 to fix error messages being sent to stdout instead of stderr,
+  # see https://bugs.launchpad.net/ubuntu/+source/squid-deb-proxy/+bug/1505670
+  file { '/usr/share/squid-deb-proxy-client/apt-avahi-discover':
+    source => 'puppet:///modules/squid_deb_proxy/client/apt-avahi-discover',
+    mode   => '0755',
+    owner  => 'root',
+    group  => 'root',
+  }
+}
diff --git a/puppet/modules/squid_deb_proxy/manifests/server.pp b/puppet/modules/squid_deb_proxy/manifests/server.pp
new file mode 100644
index 00000000..b6c3b2ed
--- /dev/null
+++ b/puppet/modules/squid_deb_proxy/manifests/server.pp
@@ -0,0 +1,41 @@
+class squid_deb_proxy::server {
+  package { 'squid-deb-proxy':
+    ensure => installed,
+  }
+
+  service { 'squid-deb-proxy':
+    ensure    => running,
+    hasstatus => false,
+    require   => Package[ 'squid-deb-proxy' ],
+  }
+
+  file {'/etc/squid-deb-proxy/mirror-dstdomain.acl.d/20-custom':
+    source  => [ 'puppet:///modules/site_squid_deb_proxy/mirror-dstdomain.acl.d/20-custom',
+      'puppet:///modules/squid_deb_proxy/mirror-dstdomain.acl.d/20-custom' ],
+    notify  => Service[ 'squid-deb-proxy' ],
+    require => Package[ 'squid-deb-proxy' ],
+    mode    => '0644',
+    owner   => 'root',
+    group   => 'root',
+  }
+
+  file {'/etc/squid-deb-proxy/allowed-networks-src.acl.d/20-custom':
+    source  => [ 'puppet:///modules/site_squid_deb_proxy/allowed-networks-src.acl.d/20-custom',
+      'puppet:///modules/squid_deb_proxy/allowed-networks-src.acl.d/20-custom' ],
+    notify  => Service[ 'squid-deb-proxy' ],
+    require => Package[ 'squid-deb-proxy' ],
+    mode    => '0644',
+    owner   => 'root',
+    group   => 'root',
+  }
+
+  file { '/etc/squid-deb-proxy/squid-deb-proxy.conf':
+    source  => [ "puppet:///modules/site_squid_deb_proxy/${::operatingsystem}/squid-deb-proxy.conf",
+      "puppet:///modules/squid_deb_proxy/${::operatingsystem}/squid-deb-proxy.conf" ],
+    notify  => Service[ 'squid-deb-proxy' ],
+    require => Package[ 'squid-deb-proxy' ],
+    mode    => '0644',
+    owner   => 'root',
+    group   => 'root',
+  }
+}