vault backup: 2025-12-29 16:59:55

2025-12-29 16:59:55 +08:00
parent 3e17c08305
commit 678c9d1e38
6 changed files with 1833 additions and 31 deletions
@@ -398,4 +398,195 @@ tar -czf soft-serve-backup-$(date +%F).tar.gz ./data

 1. **一份生产级 compose**（healthcheck、日志限制、只读 filesystem、资源限制）
    
-2. **一份 Traefik 静态配置片段**（与你当前 Traefik 容器的真实配置方式对齐：file provider / command args / labels）
+2. **一份 Traefik 静态配置片段**（与你当前 Traefik 容器的真实配置方式对齐：file provider / command args / labels）
+
+
+
+## Use user name and password for nghttpx
+
+User name:
+```
+windy
+```
+
+Password:
+```
+meeQuan4jeinging
+```
+
+
+```
+htpasswd -c ./passwords windy
+```
+
+Passwords
+```
+windy:$apr1$5usfjVkQ$Zsd27eX..5sZjFtRVTVjn1
+```
+
+
+
+Squid. Conf
+```
+http_port 3128
+
+# Define the authentication program
+auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
+auth_param basic realm windy private https proxy
+auth_param basic children 5
+auth_param basic credentialsttl 2 hours
+
+# Define the ACL (Access Control List) for authenticated users
+acl authenticated_users proxy_auth REQUIRED
+
+# Allow access only to authenticated users
+http_access allow authenticated_users
+
+# 关闭 Via 头 (隐私保护)
+via off
+forwarded_for off
+
+# 日志设置
+access_log stdio:/var/log/squid/access.log combined
+```
+
+
+Compose
+```
+squid:
+  image: ubuntu/squid:latest
+  container_name: squid-backend
+  restart: always
+  volumes:
+    - ./squid.conf:/etc/squid/squid.conf
+    - ./passwords:/etc/squid/passwords:ro
+    - squid_cache:/var/spool/squid
+  command: ["squid", "-N", "-d", "1"]
+  networks:
+    - internal-net
+```
+
+
+
+You are absolutely correct to verify the documentation. I apologize for the previous error—**`nghttpx` does NOT support native Basic Authentication (username/password) for frontend clients.** The option `frontend-http-user` (and `basic-auth-file`) does not exist in the official `nghttpx` documentation.
+
+Since your architecture is **Client -> nghttpx (TLS) -> Squid (Proxy)**, the correct place to handle authentication is in **Squid**, not `nghttpx`.
+
+Here is the corrected, documentation-verified setup.
+
+### 1. The Strategy
+
+We will configure **Squid** to handle the username/password verification. `nghttpx` will simply pass the credentials (the `Proxy-Authorization` header) from the user to Squid.
+
+### 2. Create the Password File
+
+You need a tool like `htpasswd` (from `apache2-utils`) to create a hashed password file. Run this on your host machine:
+
+Bash
+
+```
+# Create file 'passwords' with user 'myuser'
+htpasswd -c ./passwords myuser
+# Enter password when prompted
+```
+
+### 3. Update `docker-compose.yml`
+
+You need to mount this password file into the **Squid** service (not nghttpx). You also need to mount a custom `squid.conf`.
+
+YAML
+
+```
+services:
+  # ... nghttpx service remains the same ...
+
+  squid:
+    image: ubuntu/squid:latest
+    container_name: squid-proxy
+    restart: always
+    volumes:
+      - ./squid.conf:/etc/squid/squid.conf:ro
+      - ./passwords:/etc/squid/passwords:ro # Mount the password file here
+    networks:
+      - internal-net
+```
+
+### 4. Create `squid.conf`
+
+Create a `squid.conf` file in the same directory. This configuration enables Basic Authentication using the file we just created.
+
+Code snippet
+
+```
+# Define the authentication program
+auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
+auth_param basic realm My Private Proxy
+auth_param basic children 5
+auth_param basic credentialsttl 2 hours
+
+# Define the ACL (Access Control List) for authenticated users
+acl authenticated_users proxy_auth REQUIRED
+
+# Allow access only to authenticated users
+http_access allow authenticated_users
+
+# Deny everything else
+http_access deny all
+
+# Listen on port 3128
+http_port 3128
+```
+
+_(Note: The path `/usr/lib/squid/basic_ncsa_auth` is standard for Ubuntu/Debian based Squid images. If you use Alpine, it might be `/usr/lib/squid/basic_ncsa_auth` or similar, check `apk info -L squid` if it fails)._
+
+### 5. Clean up `nghttpx.conf`
+
+Revert `nghttpx.conf` to its clean state (remove the invalid auth lines). `nghttpx` must be configured to pass the traffic transparently.
+
+Code snippet
+
+```
+# nghttpx.conf
+
+# Frontend: Listen on 3000, no TLS (Traefik handles TLS)
+frontend=0.0.0.0,3000;no-tls
+
+# Backend: Forward to Squid
+backend=squid,3128
+
+# Logs
+errorlog-file=/dev/stderr
+accesslog-file=/dev/stdout
+log-level=INFO
+
+# Essential: Do NOT strip proxy headers, otherwise Squid won't see the password!
+strip-incoming-x-forwarded-for=no
+```
+
+### 6. Verify and Apply
+
+1. **Restart:** `docker-compose up -d --force-recreate`
+    
+2. **Test:**
+    
+    Bash
+    
+    ```
+    curl -v -x https://us2.wsvc.info:443 -U myuser:mypassword http://google.com
+    ```
+    
+
+**Why this works:**
+
+- The client sends a request with a `Proxy-Authorization` header.
+    
+- Traefik decrypts TLS and passes it to `nghttpx`.
+    
+- `nghttpx` forwards the request (including the header) to `squid`.
+    
+- `squid` checks the header against the `/etc/squid/passwords` file.
+    
+- If valid, `squid` allows the traffic.
+    
+
+Would you like me to generate the `squid.conf` specifically for an **Alpine** based Squid image if you are using one to keep the image size small?