Infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

flatpak-cache: tighten permissions and fix paths to CA

Browse source 
Signed-off-by: Leo Puvilland <leo@craftcat.dev>
This commit is contained in:
Leo Puvilland 2024-05-05 09:45:42 -07:00
parent 2abfed4708
commit f2bfbb8cd7
No known key found for this signature in database
GPG key ID: 20EA96682F9368EB
2 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
roles/flatpak-cache/tasks/main.yml
View file

@ -32,7 +32,7 @@
- config - config
- name: Install squid configuration file - name: Install squid configuration file
template: src=squid.conf dest=/etc/squid/squid.conf template: src=squid.conf dest=/etc/squid/squid.conf owner=squid group=squid
tags: tags:
- flatpak-cache - flatpak-cache
- config - config
@ -43,7 +43,7 @@
dest: /etc/pki/squid/ dest: /etc/pki/squid/
owner: squid owner: squid
group: squid group: squid
mode: 0644 mode: 0640
with_items: with_items:
- "{{private}}/files/flatpak-cache-certs/production/pki/ca.crt" - "{{private}}/files/flatpak-cache-certs/production/pki/ca.crt"
- "{{private}}/files/flatpak-cache-certs/production/pki/private/ca.key" - "{{private}}/files/flatpak-cache-certs/production/pki/private/ca.key"

2
roles/flatpak-cache/templates/squid.conf
View file

@ -29,7 +29,7 @@ http_access deny all
# Trust proxies to have correct X-Forwarded-For # Trust proxies to have correct X-Forwarded-For
follow_x_forwarded_for allow proxies follow_x_forwarded_for allow proxies
http_port 3128 tcpkeepalive=60,30,3 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB tls-cert=/etc/pki/squid/ca/ca.crt tls-key=/etc/pki/squid/key/ca.key tls-dh=prime256v1:/etc/pki/squid/dhparam/dh.pem http_port 3128 tcpkeepalive=60,30,3 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB tls-cert=/etc/pki/squid/ca.crt tls-key=/etc/pki/squid/ca.key tls-dh=prime256v1:/etc/pki/squid/dh.pem
sslcrtd_program /usr/lib64/squid/security_file_certgen -s /var/lib/squid/ssl_db -M 20MB sslcrtd_program /usr/lib64/squid/security_file_certgen -s /var/lib/squid/ssl_db -M 20MB
sslcrtd_children 5 sslcrtd_children 5