vault-para/100-project/Infrastructure/VPS/https proxy.md at refactor/structure

Files

T

windyboy daf4aa3dfa Add P.A.R.A. methodology documentation and restructure Personal folder

- Created Methodology.md to outline the P.A.R.A. system and its components.
- Added Outline.md for a structured overview of P.A.R.A. content.
- Documented PKM content organization decisions in PKM-Consolidation-Decision.md.
- Introduced Workflows.md to explain practical applications of P.A.R.A. in work scenarios.
- Moved sensitive information to security-sensitive folder and restructured the Personal folder to align with P.A.R.A. principles.
- Archived backup files including Matrix Me.md and TTG Cookies.md.
- Implemented a comprehensive refactor of the Personal folder to improve organization and security.

2025-12-29 15:37:17 +08:00

3.0 KiB

Raw Permalink Blame History

version: "3.8"

services:
  squid:
    image: ubuntu/squid:latest
    container_name: squid-proxy
    restart: unless-stopped
    volumes:
      - ./config/squid.conf:/etc/squid/squid.conf:ro
      - squid_cache:/var/spool/squid
      - squid_logs:/var/log/squid
    networks:
      - proxy-net
      - traefik
    # 只在本地暴露端口（可选，用于调试）
    ports:
    #  - "127.0.0.1:3128:3128"
    healthcheck:
      test: ["CMD", "squidclient", "-h", "localhost", "mgr:info", "||", "exit", "1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik"
      
      # Squid 管理界面路由
      #- "traefik.http.routers.squid-mgr.rule=Host(`squid.yourdomain.com`) && PathPrefix(`/squid-internal-mgr`)"
      #- "traefik.http.routers.squid-mgr.entrypoints=websecure"
      #- "traefik.http.routers.squid-mgr.tls.certresolver=letsencrypt"
      #- "traefik.http.routers.squid-mgr.middlewares=squid-auth"
      #- "traefik.http.services.squid-mgr.loadbalancer.server.port=3128"
      
      # Basic Auth 中间件
      #- "traefik.http.middlewares.squid-auth.basicauth.users=admin:$$apr1$$8EVjn/nj$$GiLUZqcbueTFeD23SuB6x0"

  nghttpx:
    image: jehrhart/nghttp2docker
    container_name: nghttpx-proxy
    restart: unless-stopped
    volumes:
      - ./config/nghttpx.conf:/nghttpx/nghttpx.conf:ro
    command: nghttpx --conf /nghttpx/nghttpx.conf
    depends_on:
      squid:
        condition: service_healthy
    networks:
      - proxy-net
      - traefik
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/", "||", "exit", "1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik"
      
      # HTTP/2 代理主路由
      - "traefik.http.routers.nghttpx.rule=Host(`proxy.yourdomain.com`)"
      - "traefik.http.routers.nghttpx.entrypoints=websecure"
      - "traefik.http.routers.nghttpx.tls.certresolver=letsencrypt"
      - "traefik.http.routers.nghttpx.tls.options=modern@file"
      - "traefik.http.services.nghttpx.loadbalancer.server.port=8080"
      
      # HTTP 到 HTTPS 重定向
      - "traefik.http.routers.nghttpx-http.rule=Host(`proxy.yourdomain.com`)"
      - "traefik.http.routers.nghttpx-http.entrypoints=web"
      - "traefik.http.routers.nghttpx-http.middlewares=redirect-to-https@docker"
      
      # 中间件
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"
      
      # 可选：添加速率限制
      - "traefik.http.routers.nghttpx.middlewares=rate-limit@docker"
      - "traefik.http.middlewares.rate-limit.ratelimit.average=100"
      - "traefik.http.middlewares.rate-limit.ratelimit.burst=50"

networks:
  traefik:
    external: true

volumes:
  squid_cache:
    driver: local
  squid_logs:
    driver: local

3.0 KiB Raw Permalink Blame History

3.0 KiB

Raw Permalink Blame History