beanman109 / setup-https-squid-proxy.sh

wget -qO- 'https://beanman.net/gist/beanman109/setup-https-squid-proxy/raw/HEAD/setup-https-squid-proxy.sh' | bash

#!/usr/bin/env bash set -euo pipefail # ============================================================ # Interactive Squid HTTPS Proxy Installer with Let's Encrypt # Debian 12/13 # # Creates: # Firefox/FoxyProxy -> HTTPS proxy -> Squid -> Internet # # IMPORTANT: # In FoxyProxy, use the DOMAIN NAME, not the IP address. # ============================================================ RED="\033[31m" GREEN="\033[32m" YELLOW="\033[33m" BLUE="\033[34m" RESET="\033[0m" log() { echo -e "${GREEN}[OK]${RESET} $*"; } info() { echo -e "${BLUE}[INFO]${RESET} $*"; } warn() { echo -e "${YELLOW}[WARN]${RESET} $*"; } die() { echo -e "${RED}[ERROR]${RESET} $*" >&2; exit 1; } SQUID_USER="proxy" SQUID_GROUP="proxy" STOPPED_SERVICES=() require_root() { if [[ "${EUID}" -ne 0 ]]; then die "Run this script as root." fi } ask() { local prompt="$1" local default="${2:-}" local value if [[ -n "$default" ]]; then read -rp "$prompt [$default]: " value echo "${value:-$default}" else read -rp "$prompt: " value echo "$value" fi } ask_password_confirmed() { local pass1 pass2 while true; do read -rsp "Proxy password: " pass1 printf '\n' >&2 read -rsp "Confirm proxy password: " pass2 printf '\n' >&2 if [[ -z "$pass1" ]]; then warn "Password cannot be empty." >&2 continue fi if [[ "$pass1" != "$pass2" ]]; then warn "Passwords do not match." >&2 continue fi printf '%s' "$pass1" return 0 done } validate_domain() { local domain="$1" if [[ ! "$domain" =~ ^[A-Za-z0-9.-]+\.[A-Za-z]{2,}$ ]]; then die "Invalid domain: $domain" fi if [[ "$domain" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then die "Do not use an IP address. Use a real hostname, e.g. proxy.example.com" fi } validate_port() { local port="$1" if ! [[ "$port" =~ ^[0-9]+$ ]]; then die "Invalid port: $port" fi if (( port < 1 || port > 65535 )); then die "Port must be between 1 and 65535." fi } detect_proxy_user_group() { if id proxy >/dev/null 2>&1; then SQUID_USER="proxy" elif id squid >/dev/null 2>&1; then SQUID_USER="squid" else SQUID_USER="proxy" fi if getent group proxy >/dev/null 2>&1; then SQUID_GROUP="proxy" elif getent group squid >/dev/null 2>&1; then SQUID_GROUP="squid" else SQUID_GROUP="$SQUID_USER" fi } install_packages() { info "Installing required packages..." apt update if apt-cache show squid-openssl >/dev/null 2>&1; then apt install -y squid-openssl apache2-utils certbot openssl curl ca-certificates dnsutils else warn "squid-openssl package was not found." warn "Installing normal squid, but HTTPS proxy listener may not work." apt install -y squid apache2-utils certbot openssl curl ca-certificates dnsutils fi log "Packages installed." } check_squid_openssl() { info "Checking Squid OpenSSL support..." if squid -v 2>/dev/null | grep -qi openssl; then log "Squid appears to have OpenSSL support." else warn "Could not confirm OpenSSL support from squid -v." warn "If https_port fails later, install squid-openssl or use a TLS wrapper." fi } check_dns() { local domain="$1" info "Checking DNS for $domain..." local resolved_v4="" local resolved_v6="" resolved_v4="$(dig +short A "$domain" | tail -n1 || true)" resolved_v6="$(dig +short AAAA "$domain" | tail -n1 || true)" if [[ -z "$resolved_v4" && -z "$resolved_v6" ]]; then warn "No A or AAAA record found for $domain." warn "Let's Encrypt will fail unless this hostname points to this server." read -rp "Continue anyway? [y/N]: " yn [[ "${yn,,}" == "y" ]] || die "Stopped." else if [[ -n "$resolved_v4" ]]; then log "$domain A record: $resolved_v4" fi if [[ -n "$resolved_v6" ]]; then log "$domain AAAA record: $resolved_v6" else warn "$domain has no AAAA record. That is fine if you only want IPv4." fi fi return 0 } open_firewall() { local port="$1" info "Attempting to open firewall ports 80 and $port..." if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -qi active; then ufw allow 80/tcp || true ufw allow "$port/tcp" || true log "UFW rules added." else warn "UFW not active or not installed. Skipping UFW rules." fi if command -v iptables >/dev/null 2>&1; then iptables -C INPUT -p tcp --dport 80 -j ACCEPT 2>/dev/null || iptables -I INPUT -p tcp --dport 80 -j ACCEPT iptables -C INPUT -p tcp --dport "$port" -j ACCEPT 2>/dev/null || iptables -I INPUT -p tcp --dport "$port" -j ACCEPT log "Temporary iptables rules added." warn "iptables rules may not persist after reboot unless your VPS image saves them." fi } stop_port_80_services_if_needed() { STOPPED_SERVICES=() if ss -tulpn | grep -qE '(:80[[:space:]]|:80$|:80,)'; then warn "Something appears to be using port 80." echo ss -tulpn | grep ':80' || true echo read -rp "Temporarily stop nginx/apache2/caddy if running so Certbot can use port 80? [Y/n]: " yn yn="${yn:-Y}" if [[ "${yn,,}" == "y" ]]; then for svc in nginx apache2 caddy; do if systemctl is-active --quiet "$svc" 2>/dev/null; then systemctl stop "$svc" STOPPED_SERVICES+=("systemd:$svc") warn "Stopped $svc temporarily." fi done fi fi } restart_stopped_services() { if [[ ${#STOPPED_SERVICES[@]} -gt 0 ]]; then info "Restarting services stopped for Certbot..." for item in "${STOPPED_SERVICES[@]}"; do kind="${item%%:*}" name="${item#*:}" if [[ "$kind" == "systemd" ]]; then systemctl start "$name" || warn "Could not restart $name." fi done fi } get_certificate() { local domain="$1" local email="$2" if [[ -f "/etc/letsencrypt/live/$domain/fullchain.pem" && -f "/etc/letsencrypt/live/$domain/privkey.pem" ]]; then log "Existing Let's Encrypt cert found for $domain." read -rp "Use existing certificate? [Y/n]: " yn yn="${yn:-Y}" if [[ "${yn,,}" == "y" ]]; then return 0 fi fi stop_port_80_services_if_needed info "Requesting Let's Encrypt certificate for $domain..." if [[ -n "$email" ]]; then certbot certonly --standalone \ -d "$domain" \ --non-interactive \ --agree-tos \ --email "$email" else certbot certonly --standalone \ -d "$domain" \ --non-interactive \ --agree-tos \ --register-unsafely-without-email fi restart_stopped_services log "Certificate issued." } copy_certs() { local domain="$1" info "Copying certificate files into /etc/squid/certs..." mkdir -p /etc/squid/certs cp "/etc/letsencrypt/live/$domain/fullchain.pem" /etc/squid/certs/proxy-fullchain.pem cp "/etc/letsencrypt/live/$domain/privkey.pem" /etc/squid/certs/proxy-privkey.pem chown -R "$SQUID_USER:$SQUID_GROUP" /etc/squid/certs chmod 644 /etc/squid/certs/proxy-fullchain.pem chmod 600 /etc/squid/certs/proxy-privkey.pem log "Certificates copied." } create_auth() { local username="$1" local password="$2" info "Creating Squid username/password auth..." touch /etc/squid/passwd chown "$SQUID_USER:$SQUID_GROUP" /etc/squid/passwd chmod 640 /etc/squid/passwd printf '%s\n' "$password" | htpasswd -m -i /etc/squid/passwd "$username" >/dev/null chown "$SQUID_USER:$SQUID_GROUP" /etc/squid/passwd chmod 640 /etc/squid/passwd log "Proxy user created: $username" } test_auth_helper() { local username="$1" local password="$2" info "Testing Squid auth helper directly..." local result result="$(printf '%s %s\n' "$username" "$password" | /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd || true)" if echo "$result" | grep -q '^OK'; then log "Squid auth helper accepted the username/password." else warn "Squid auth helper did not accept the username/password." echo "Auth helper output:" echo "$result" die "Stopping because proxy auth would fail." fi } write_squid_config() { local domain="$1" local port="$2" local syntax="$3" local https_line if [[ "$syntax" == "new" ]]; then https_line="https_port $port tls-cert=/etc/squid/certs/proxy-fullchain.pem tls-key=/etc/squid/certs/proxy-privkey.pem" else https_line="https_port $port cert=/etc/squid/certs/proxy-fullchain.pem key=/etc/squid/certs/proxy-privkey.pem" fi info "Writing Squid config using syntax: $syntax" if [[ -f /etc/squid/squid.conf && ! -f /etc/squid/squid.conf.bak-before-https-proxy ]]; then cp /etc/squid/squid.conf /etc/squid/squid.conf.bak-before-https-proxy log "Backed up original config to /etc/squid/squid.conf.bak-before-https-proxy" fi cat > /etc/squid/squid.conf <<EOF # ============================================================ # Squid HTTPS/TLS encrypted forward proxy # Generated by setup-https-squid-proxy.sh # # Domain: $domain # Port: $port # # IMPORTANT: # In FoxyProxy, use host "$domain", not the server IP. # ============================================================ $https_line auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd auth_param basic realm HTTPS Proxy auth_param basic credentialsttl 2 hours acl authenticated proxy_auth REQUIRED acl SSL_ports port 443 acl Safe_ports port 80 acl Safe_ports port 443 acl Safe_ports port 1025-65535 acl CONNECT method CONNECT http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow authenticated http_access deny all cache deny all cache_mem 8 MB maximum_object_size 0 KB via off forwarded_for delete request_header_access X-Forwarded-For deny all request_header_access Via deny all request_header_access Cache-Control deny all access_log /var/log/squid/access.log cache_log /var/log/squid/cache.log cache_effective_user $SQUID_USER cache_effective_group $SQUID_GROUP visible_hostname $domain EOF } find_working_squid_syntax() { local domain="$1" local port="$2" write_squid_config "$domain" "$port" "new" if squid -k parse >/tmp/squid-parse.log 2>&1; then log "Squid config parsed successfully with tls-cert/tls-key syntax." return 0 fi warn "tls-cert/tls-key syntax failed. Trying older cert/key syntax..." cat /tmp/squid-parse.log || true write_squid_config "$domain" "$port" "old" if squid -k parse >/tmp/squid-parse.log 2>&1; then log "Squid config parsed successfully with cert/key syntax." return 0 fi cat /tmp/squid-parse.log || true die "Squid could not parse either HTTPS config style. Your Squid build may not support https_port/OpenSSL." } write_renewal_hook() { local domain="$1" info "Creating Certbot renewal hook..." mkdir -p /etc/letsencrypt/renewal-hooks/deploy cat > /etc/letsencrypt/renewal-hooks/deploy/squid-cert-copy.sh <<EOF #!/bin/bash set -e DOMAIN="$domain" SRC_CERT="/etc/letsencrypt/live/\$DOMAIN/fullchain.pem" SRC_KEY="/etc/letsencrypt/live/\$DOMAIN/privkey.pem" DST_DIR="/etc/squid/certs" DST_CERT="\$DST_DIR/proxy-fullchain.pem" DST_KEY="\$DST_DIR/proxy-privkey.pem" mkdir -p "\$DST_DIR" cp "\$SRC_CERT" "\$DST_CERT" cp "\$SRC_KEY" "\$DST_KEY" chown $SQUID_USER:$SQUID_GROUP "\$DST_CERT" "\$DST_KEY" chmod 644 "\$DST_CERT" chmod 600 "\$DST_KEY" systemctl reload squid || systemctl restart squid EOF chmod +x /etc/letsencrypt/renewal-hooks/deploy/squid-cert-copy.sh log "Renewal hook created at /etc/letsencrypt/renewal-hooks/deploy/squid-cert-copy.sh" } restart_squid_cleanly() { info "Restarting Squid cleanly..." systemctl stop squid >/dev/null 2>&1 || true sleep 2 pkill -9 squid >/dev/null 2>&1 || true sleep 1 systemctl start squid if systemctl is-active --quiet squid; then systemctl enable squid >/dev/null 2>&1 || true log "Squid is running." else systemctl status squid --no-pager -l || true tail -100 /var/log/squid/cache.log || true die "Squid failed to start." fi } test_listener() { local port="$1" info "Checking if Squid is listening on port $port..." if ss -tulpn | grep -q ":$port"; then log "Something is listening on port $port:" ss -tulpn | grep ":$port" || true else warn "Port $port does not appear in ss output." fi } test_proxy() { local domain="$1" local port="$2" local username="$3" local password="$4" info "Testing proxy with curl..." set +e local result result="$(curl -4 -sS --max-time 30 \ --proxy "https://$domain:$port" \ --proxy-user "$username:$password" \ https://chy.li/ip 2>&1)" local rc=$? set -e if [[ $rc -eq 0 ]]; then log "Proxy test succeeded. Outgoing IP:" echo "$result" else warn "Curl proxy test failed." echo "$result" echo warn "Check logs:" echo " tail -f /var/log/squid/cache.log" echo " tail -f /var/log/squid/access.log" fi } print_summary() { local domain="$1" local port="$2" local username="$3" echo echo "============================================================" echo " HTTPS Squid Proxy Setup Complete" echo "============================================================" echo echo "FoxyProxy settings:" echo echo " Proxy Type: HTTPS" echo " Host: $domain" echo " Port: $port" echo " Username: $username" echo " Password: the password you entered" echo echo "IMPORTANT:" echo " Use the hostname \"$domain\" in FoxyProxy." echo " Do NOT use the server IP address." echo echo "Test command:" echo echo " curl -v \\" echo " --proxy \"https://$domain:$port\" \\" echo " --proxy-user \"$username:YOUR_PASSWORD\" \\" echo " https://chy.li/ip" echo echo "Useful logs:" echo echo " tail -f /var/log/squid/cache.log" echo " tail -f /var/log/squid/access.log" echo echo "============================================================" } main() { require_root echo echo "============================================================" echo " Interactive Squid HTTPS Proxy + Let's Encrypt Installer" echo "============================================================" echo DOMAIN="$(ask "Proxy domain, e.g. proxy.example.com")" validate_domain "$DOMAIN" PORT="$(ask "HTTPS proxy port" "8443")" validate_port "$PORT" USERNAME="$(ask "Proxy username" "proxyuser")" if [[ -z "$USERNAME" ]]; then die "Username cannot be empty." fi PASSWORD="$(ask_password_confirmed)" EMAIL="$(ask "Email for Let's Encrypt renewal notices, or leave blank" "")" echo echo "Summary:" echo " Domain: $DOMAIN" echo " Port: $PORT" echo " Username: $USERNAME" if [[ -n "$EMAIL" ]]; then echo " LE Email: $EMAIL" else echo " LE Email: none" fi echo read -rp "Continue with install? [Y/n]: " confirm confirm="${confirm:-Y}" [[ "${confirm,,}" == "y" ]] || die "Cancelled." install_packages detect_proxy_user_group info "Detected Squid user/group: $SQUID_USER:$SQUID_GROUP" check_squid_openssl check_dns "$DOMAIN" open_firewall "$PORT" get_certificate "$DOMAIN" "$EMAIL" copy_certs "$DOMAIN" create_auth "$USERNAME" "$PASSWORD" test_auth_helper "$USERNAME" "$PASSWORD" find_working_squid_syntax "$DOMAIN" "$PORT" write_renewal_hook "$DOMAIN" restart_squid_cleanly test_listener "$PORT" test_proxy "$DOMAIN" "$PORT" "$USERNAME" "$PASSWORD" print_summary "$DOMAIN" "$PORT" "$USERNAME" } main "$@"