---
- name: Deploy Squid Proxy Server
  hosts: proxy_servers
  become: true
  vars:
    squid_port: 3128
    squid_cache_dir: /var/spool/squid
    squid_cache_size_mb: 10000
    squid_allowed_networks:
      - "10.0.0.0/8"
      - "172.16.0.0/12"
      - "192.168.0.0/16"
  tasks:
    - name: Install Squid
      ansible.builtin.package:
        name: squid
        state: present

    - name: Create cache directory
      ansible.builtin.file:
        path: "{{ squid_cache_dir }}"
        state: directory
        owner: squid
        group: squid
        mode: "0755"

    - name: Deploy Squid configuration
      ansible.builtin.template:
        src: squid.conf.j2
        dest: /etc/squid/squid.conf
        owner: root
        group: squid
        mode: "0640"
        validate: "squid -k parse -f %s"
      notify: reload squid

    - name: Initialize cache directories
      ansible.builtin.command:
        cmd: squid -z
        creates: "{{ squid_cache_dir }}/00"

    - name: Enable and start Squid
      ansible.builtin.systemd:
        name: squid
        enabled: true
        state: started

    - name: Allow proxy port through firewall
      ansible.posix.firewalld:
        port: "{{ squid_port }}/tcp"
        permanent: true
        state: enabled
        immediate: true

  handlers:
    - name: reload squid
      ansible.builtin.command:
        cmd: squid -k reconfigure

# templates/squid.conf.j2
# Ansible managed

# Network settings
http_port {{ squid_port }}
visible_hostname {{ inventory_hostname }}

# Access control lists
acl localnet src {{ squid_allowed_networks | join(' ') }}
acl SSL_ports port 443
acl Safe_ports port 80 443 21 70 210 280 488 591 777 1025-65535
acl CONNECT method CONNECT
acl to_localhost dst 127.0.0.0/8

# Access rules
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny to_localhost
http_access allow localnet
http_access deny all

# Cache settings
cache_dir ufs {{ squid_cache_dir }} {{ squid_cache_size_mb }} 16 256
maximum_object_size 512 MB
cache_mem 512 MB
maximum_object_size_in_memory 10 MB

# Cache tuning
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

{% if squid_blocked_domains is defined %}
# Domain blocking
acl blocked_domains dstdomain {{ squid_blocked_domains | join(' ') }}
http_access deny blocked_domains
{% endif %}

# Logging
access_log daemon:/var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
cache_store_log daemon:/var/log/squid/store.log

# Timeouts
connect_timeout 30 seconds
read_timeout 5 minutes
request_timeout 2 minutes

# Privacy
forwarded_for delete
via off

- name: Configure Squid with LDAP authentication
  hosts: proxy_servers
  become: true
  vars:
    squid_auth_enabled: true
    ldap_server: "ldap.example.com"
    ldap_base_dn: "dc=example,dc=com"
  tasks:
    - name: Install LDAP helper
      ansible.builtin.package:
        name: squid-helpers
        state: present

    - name: Deploy authenticated config
      ansible.builtin.template:
        src: squid-auth.conf.j2
        dest: /etc/squid/squid.conf
        validate: "squid -k parse -f %s"
      notify: reload squid

- name: Monitor Squid proxy
  hosts: proxy_servers
  become: true
  tasks:
    - name: Check Squid cache stats
      ansible.builtin.command:
        cmd: squidclient -h localhost -p {{ squid_port }} mgr:info
      register: cache_info
      changed_when: false

    - name: Check connection count
      ansible.builtin.command:
        cmd: squidclient -h localhost -p {{ squid_port }} mgr:active_requests
      register: active
      changed_when: false

    - name: Parse cache hit ratio
      ansible.builtin.debug:
        msg: "{{ cache_info.stdout_lines | select('match', '.*Hit Ratio.*') | list }}"

# Validate configuration
squid -k parse

# Reload without restart
squid -k reconfigure

# Check access log
tail -f /var/log/squid/access.log

# Cache manager stats
squidclient mgr:info
squidclient mgr:utilization

# Rotate logs
squid -k rotate