install-and-configure-squid.yaml

---
- name: Install and configure squid
  # https://linuxize.com/post/how-to-install-and-configure-squid-proxy-on-ubuntu-20-04/
  hosts: all
  gather_facts: True
  vars:
    config_location: /etc/squid/squid.conf
    passwords_loc: /etc/squid/squid_password
  tasks:
    - name: Install the package
      become: True
      apt:
        update_cache: yes
        pkg:
          - squid
        state: latest

    - name: "Backup {{ config_location }}"
      become: True
      copy:
        remote_src: True
        src: "{{ config_location }}"
        dest: "{{ config_location }}.bak"

    - name: "Change default port from 3128 to {{ squid.port }}"
      become: True
      replace:
        path: "{{ config_location }}"
        regexp: '^host_port'
        replace: "http_port {{ squid.port }}"

    - name: "Generate authentication information" 
      shell: "echo {{ squid.username }}:$(openssl passwd -6 {{ squid.password }})\n"
      register: auth_output

    - name: "Ensure {{ passwords_loc }} exists"
      become: True
      file:
        path: "{{ passwords_loc }}"
        state: touch
        mode: 0644

    - name: "Add authentication line to {{ passwords_loc }}"
      become: True
      lineinfile:
        dest: "{{ passwords_loc }}"
        line: "{{ auth_output.stdout }}"

    - name: Find basic_ncsa_auth file location
      become: True
      ansible.builtin.find:
        paths: "/usr"
        patterns: "basic_ncsa_auth"
        recurse: yes
      register: basic_ncsa_auth_location

    - name: "Add ACL config to {{ config_location }}"
      become: True
      blockinfile:
        dest: "{{ config_location }}"
        marker: "### ANSIBLE MANAGED BLOCK for ACL CONFIG"
        insertafter: "include /etc/squid/conf.d/*"
        block: |
          auth_param basic program {{ basic_ncsa_auth_location.files[0].path }} {{ passwords_loc }}
          auth_param basic realm proxy
          acl authenticated proxy_auth REQUIRED

    - name: "Add access config to {{ config_location }}"
      become: True
      blockinfile:
        marker: "### ANSIBLE MANAGED BLOCK for access config"
        dest: "{{ config_location }}"
        insertafter: "http_access allow localhost"
        block: |
          http_access allow authenticated

    - name: Reload systemd service
      include_tasks: tasks-reload-systemd-service.yaml
      vars:
        service_name: "squid"
        become: True

    - include_tasks: tasks-allow-ports.yaml
      vars:
        ports: 
          - "{{ squid.port }}"

    - debug:
        msg: >-
          You can now use this server as a proxy. The hostname is
          "{{ hostvars[inventory_hostname]['ansible_env'].SSH_CONNECTION.split(' ')[2] }}" 
          and port is "{{ squid.port }}". Please expose this port on your router too for external access.
          Use the username and password as the auth details.