fix(security_file_certgen): not found

Dockerfile

@@ -1,36 +1,15 @@
 # Use Ubuntu as the base image
-FROM ubuntu:22.04
+FROM ubuntu:24.04
 
 # Set environment variables to avoid interactive prompts during installation
 ENV DEBIAN_FRONTEND=noninteractive
 
-# Install Squid and required packages
+# Install Squid
 RUN apt-get update && \
-    apt-get install -y squid openssl ca-certificates libssl-dev && \
+    apt-get install -y squid && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 
-# Create SSL certificate directory
-RUN mkdir -p /etc/squid/certs
-
-# Generate a private key and self-signed certificate for HTTPS support
-RUN openssl req -new -newkey rsa:2048 -sha256 -days 365 -nodes -x509 \
-    -keyout /etc/squid/certs/squid.key \
-    -out /etc/squid/certs/squid.pem \
-    -subj "/C=ID/ST=Jawa Barat/L=Bogor/O=Nix Foundation/CN=localhost"
-
-# Create certificate database for SSL bumping
-RUN cd /etc/squid/certs && \
-    openssl x509 -in squid.pem -outform DER -out squid.der && \
-    openssl dhparam -outform PEM -out /etc/squid/certs/dhparam.pem 2048
-
-# Set proper permissions for certificates
-RUN chmod 644 /etc/squid/certs/squid.pem
-RUN chmod 600 /etc/squid/certs/squid.key
-RUN chmod 644 /etc/squid/certs/squid.der
-RUN chmod 644 /etc/squid/certs/dhparam.pem
-RUN chown -R proxy:proxy /etc/squid/certs
-
 # Create directories for logs and cache
 RUN mkdir -p /var/log/squid && \
     mkdir -p /var/spool/squid && \
@@ -53,58 +32,8 @@ cache_swap_low 90\n\
 # Anonymize headers\n\
 forwarded_for delete\n\
 via off\n\
-request_header_access Allow allow all\n\
-request_header_access Authorization allow all\n\
-request_header_access WWW-Authenticate allow all\n\
-request_header_access Proxy-Authorization allow all\n\
-request_header_access Proxy-Authenticate allow all\n\
-request_header_access Cache-Control allow all\n\
-request_header_access Content-Encoding allow all\n\
-request_header_access Content-Length allow all\n\
-request_header_access Content-Type allow all\n\
-request_header_access Date allow all\n\
-request_header_access Expires allow all\n\
-request_header_access Host allow all\n\
-request_header_access If-Modified-Since allow all\n\
-request_header_access Last-Modified allow all\n\
-request_header_access Location allow all\n\
-request_header_access Pragma allow all\n\
-request_header_access Accept allow all\n\
-request_header_access Accept-Charset allow all\n\
-request_header_access Accept-Encoding allow all\n\
-request_header_access Accept-Language allow all\n\
-request_header_access Content-Language allow all\n\
-request_header_access Mime-Version allow all\n\
-request_header_access Retry-After allow all\n\
-request_header_access Title allow all\n\
-request_header_access Connection allow all\n\
-request_header_access Proxy-Connection allow all\n\
-request_header_access User-Agent allow all\n\
-request_header_access Cookie allow all\n\
-request_header_access All deny all\n\
-\n\
-# Remove sensitive headers\n\
-response_header_access Server deny all\n\
-response_header_access X-Powered-By deny all\n\
-response_header_access X-AspNet-Version deny all\n\
-response_header_access X-AspNetMvc-Version deny all\n\
-response_header_access X-Developer deny all\n\
-response_header_access X-Originating-IP deny all\n\
-response_header_access X-Client-IP deny all\n\
-response_header_access X-Host deny all\n\
-response_header_access X-Forwarded-For deny all\n\
-response_header_access X-Forwarded-Host deny all\n\
-response_header_access X-Forwarded-Server deny all\n\
-response_header_access Via deny all\n\
-response_header_access All allow all\n\
 \n\
 # Access control lists\n\
-acl all src 0.0.0.0/0\n\
-acl localnet src 10.0.0.0/8\n\
-acl localnet src 172.16.0.0/12\n\
-acl localnet src 192.168.0.0/16\n\
-acl localnet src fc00::/7\n\
-acl localnet src fe80::/10\n\
 acl SSL_ports port 443\n\
 acl Safe_ports port 80\n\
 acl Safe_ports port 443\n\
@@ -122,15 +51,6 @@ http_access deny CONNECT !SSL_ports\n\
 # Final deny rule\n\
 http_access deny all\n\
 \n\
-# SSL bumping for HTTPS support\n\
-acl ssl_ports port 443\n\
-ssl_bump server-first all\n\
-sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/lib/ssl_db -M 4MB\n\
-sslcrtd_children 5\n\
-\n\
-# High anonymity settings\n\
-header_replace User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\n\
-\n\
 # Logging\n\
 access_log /var/log/squid/access.log\n\
 cache_log /var/log/squid/cache.log\n\
@@ -150,14 +70,10 @@ half_closed_clients off' > /etc/squid/squid.conf
 RUN chown root:proxy /etc/squid/squid.conf && \
     chmod 644 /etc/squid/squid.conf
 
-# Create SSL database for certificate generation
-RUN /usr/lib/squid/security_file_certgen -c -s /var/lib/ssl_db -M 4MB && \
-    chown -R proxy:proxy /var/lib/ssl_db
-
 # Initialize cache directory
 RUN squid -z
 
-# Expose HTTP port (HTTPS will be handled through CONNECT method)
+# Expose HTTP port
 EXPOSE 7860
 
 # Health check

README.md

@@ -1,12 +1,79 @@
 ---
-title: xin
-emoji: 📚
+title: High Anonymity Squid Proxy
+emoji: 🌐
 colorFrom: indigo
 colorTo: purple
 sdk: docker
 pinned: false
 license: mit
-short_description: Hello World!
+short_description: A high anonymity Squid proxy server
 app_port: 7860
 ---
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+
+# High Anonymity Squid Proxy
+
+This is a Dockerized Squid proxy server configured for high anonymity. It removes identifying headers and supports both HTTP and HTTPS connections through the CONNECT method.
+
+## Features
+
+- High anonymity mode (removes identifying headers)
+- Support for HTTP and HTTPS websites
+- Configurable port (default: 7860)
+- Access logging
+- Performance optimizations
+
+## How It Works
+
+This proxy works by:
+
+1. Handling HTTP requests directly with header anonymization
+2. Tunneling HTTPS requests through the CONNECT method (without decrypting them)
+
+The proxy does not decrypt HTTPS traffic, which means:
+- It works with all HTTPS websites
+- It maintains user privacy (the proxy cannot see HTTPS content)
+- Some advanced filtering features are not available for HTTPS traffic
+
+## Configuration
+
+The proxy is configured with the following settings:
+
+- Port: 7860
+- Anonymity: High (removes Via, Forwarded-For, and other identifying headers)
+- User-Agent: Spoofed to Chrome 91
+- Access Control: Open to all IPs (0.0.0.0/0)
+
+## Deployment on Hugging Face Spaces
+
+1. Create a new Space on Hugging Face
+2. Select "Docker" as the SDK
+3. Upload the Dockerfile and this README.md
+4. The proxy will automatically start on port 7860
+
+## Usage
+
+After deployment, you can use the proxy by connecting to the Space URL on port 7860:
+
+```
+http://<your-space-name>.hf.space:7860
+```
+
+## Customization
+
+To customize the configuration, you can modify the squid.conf generation section in the Dockerfile. Some common customizations:
+
+- Change the port: Modify the `http_port` directive in the squid.conf
+- Adjust anonymity settings: Edit the header removal sections
+- Restrict access by IP: Modify the ACL settings
+
+## Security Considerations
+
+This proxy is configured for high anonymity but is open to all IP addresses by default. For production use, consider:
+
+1. Restricting access by IP address
+2. Adding authentication
+3. Regularly updating the base Ubuntu image
+
+## License
+
+This project is licensed under the MIT License.