7 files changed, 93 insertions, 0 deletions
diff --git a/proxy/Dockerfile b/proxy/Dockerfile
new file mode 100644
index 0000000..f11141b
--- /dev/null
+++ b/proxy/Dockerfile
@@ -0,0 +1,6 @@
+FROM alpine:3.21
+RUN apk add --no-cache squid openssl
+COPY squid.conf /etc/squid/squid.conf
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/proxy/deploy.sh b/proxy/deploy.sh
new file mode 100644
index 0000000..3f5c6ba
--- /dev/null
+++ b/proxy/deploy.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$0")"
+
+if [ ! -f certs/server.crt ]; then
+    echo "Proxy: 未初期化のためスキップ (install.sh を実行してください)"
+    exit 0
+fi
+
+docker compose up -d --build
diff --git a/proxy/docker-compose.yml b/proxy/docker-compose.yml
new file mode 100644
index 0000000..81a7fa6
--- /dev/null
+++ b/proxy/docker-compose.yml
@@ -0,0 +1,9 @@
+services:
+  proxy:
+    build: .
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - ./certs/server.crt:/etc/squid/certs/server.crt:ro
+      - ./certs/server.key:/etc/squid/certs/server.key:ro
+      - /app/infra/vpn/users.conf:/etc/proxy/users.conf:ro
diff --git a/proxy/entrypoint.sh b/proxy/entrypoint.sh
new file mode 100644
index 0000000..b7cc6e2
--- /dev/null
+++ b/proxy/entrypoint.sh
@@ -0,0 +1,13 @@
+#!/bin/sh
+set -e
+
+# VPN と共有の users.conf から basic auth passwd ファイルを生成
+> /etc/squid/passwd
+while IFS=' ' read -r user pass || [ -n "$user" ]; do
+    [ -z "$user" ] && continue
+    case "$user" in \#*) continue ;; esac
+    echo "${user}:$(openssl passwd -apr1 "$pass")" >> /etc/squid/passwd
+done < /etc/proxy/users.conf
+chmod 600 /etc/squid/passwd
+
+exec squid -N -f /etc/squid/squid.conf
diff --git a/proxy/install.sh b/proxy/install.sh
new file mode 100644
index 0000000..58a8e53
--- /dev/null
+++ b/proxy/install.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$0")"
+
+echo "=== Proxy Install: proxy.yyamashita.com ==="
+bash "$(pwd)/renew-cert.sh"
+
+echo ""
+echo "=== Proxy 起動完了 ==="
+echo "  アドレス: https://proxy.yyamashita.com:8443"
+echo "  認証:     VPN と同じユーザー名/パスワード (Basic 認証)"
+echo "  証明書の更新: bash /app/infra/proxy/renew-cert.sh"
diff --git a/proxy/renew-cert.sh b/proxy/renew-cert.sh
new file mode 100644
index 0000000..8924d9b
--- /dev/null
+++ b/proxy/renew-cert.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$0")"
+
+DOMAIN="proxy.yyamashita.com"
+CADDY_DIR="/app/infra/caddy"
+CADDY_CERT_BASE="/data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${DOMAIN}/${DOMAIN}"
+
+echo "証明書を更新中..."
+mkdir -p certs
+
+if ! docker compose -f "$CADDY_DIR/docker-compose.yml" exec -T caddy \
+        cat "${CADDY_CERT_BASE}.crt" > certs/server.crt; then
+    echo "Error: 証明書の取得に失敗しました。Caddyfile に ${DOMAIN} が設定されているか確認してください。"
+    exit 1
+fi
+docker compose -f "$CADDY_DIR/docker-compose.yml" exec -T caddy \
+    cat "${CADDY_CERT_BASE}.key" > certs/server.key
+chmod 600 certs/server.key
+
+echo "証明書を更新しました。"
+bash "$(pwd)/deploy.sh"
diff --git a/proxy/squid.conf b/proxy/squid.conf
new file mode 100644
index 0000000..29ebd05
--- /dev/null
+++ b/proxy/squid.conf
@@ -0,0 +1,21 @@
+https_port 8443 cert=/etc/squid/certs/server.crt key=/etc/squid/certs/server.key
+
+auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd
+auth_param basic realm "Proxy"
+auth_param basic credentialsttl 2 hours
+
+acl authenticated proxy_auth REQUIRED
+http_access allow authenticated
+http_access deny all
+
+forwarded_for delete
+via off
+
+dns_nameservers 1.1.1.1 8.8.8.8
+
+cache_dir null /tmp
+cache deny all
+access_log stdio:/dev/stdout
+cache_log stdio:/dev/stderr
+cache_store_log none
+coredump_dir /tmp