Add documentation on limiting squid access to certain stratum 1s #223
Conversation
| :: | ||
|
|
||
| acl cvmfs dst <a stratum 1 host name> | ||
| acl cvmfs dst <another stratum 1 host name> |
There was a problem hiding this comment.
I'm not sure if this works, seems like you can't redefine an ACL with same name.
I got an error like this (in output of sudo systemctl status squid.service):
FATAL: Bungled /etc/squid/squid.conf line 8: acl stratum_ones src <PRIVATE_STRATUM1_IP>
(where <PRIVATE_STRATUM1_IP> was an actual IP address, with < >)
You can put domains and IPs on one single line though, like:
acl stratum_ones dstdomain .eessi.science <PRIVATE_STRATUM1_IP>
There was a problem hiding this comment.
Perhaps newer squids changes the config syntax... but in your example, it's a src ACL and not a dst ACL. Could this be the problem?
| acl cvmfs dst <a stratum 1 host name> | ||
| acl cvmfs dst <another stratum 1 host name> |
There was a problem hiding this comment.
I recommend instead using dstdom_regex because it does a string match instead of looking up the names in the DNS and caching them. That makes it able to tolerate chages in IP addresses of the destination name without having to reload squid. So the example would be:
acl cvmfshost dstdom_regex ^(a\.stratum1\.host|another\.stratum1\.host)$
I'm not sure if there can be mutiple regexes for the same name, I haven't tried it. Probably there could be.
There was a problem hiding this comment.
Or maybe a better example would be since those two are in the same "domain":
acl cvmfshost dstdom_regex ^(a|another)\.stratum1\.host)$
No description provided.