add domain ACL

ansible/roles/win_proxy/files/allowed_domains.acl

@@ -0,0 +1,46 @@
+conda.anaconda.org
+repo.anaconda.com
+files.pythonhosted.org
+pypi.org
+pypi.python.org
+cran.r-project.org
+cran.ma.imperial.ac.uk
+cloud.r-project.org
+archive.canonical.com
+archive.ubuntu.com
+gb.archive.ubuntu.com
+mozilla.org
+aus5.mozilla.org
+dl.google.com
+stats.microsoft.com
+download.windowsupdate.com
+update.microsoft.com
+windowsupdate.com
+windowsupdate.microsoft.com
+download.microsoft.com
+ntservicepack.microsoft.com
+wustat.windows.com
+git.ecdf.ed.ac.uk
+cran.rstudio.com
+support.rstudio.org
+mynvivo.com
+auth0.com
+qsrinternational.com
+qsrulurudev.b2clogin.com
+services.qsrinternational.com
+api-nv.qsrinternational.com
+download.qsrinternational.com
+subscription-suite.io
+login.qsrinternational.com
+cdn-login.qsrinternational.com
+digicert.com
+rstudio.com
+rstudio.org
+fss-snd.scot
+os.uk
+clearinghouse.one.microso0ft.com
+msactivation.ucs.ed.ac.uk
+catalog.update.microsoft.com
+microsoft.com
+posit.co
+download1.rstudio.org

ansible/roles/win_proxy/tasks/main.yml

@@ -31,6 +31,14 @@
 - name: Include variables
   include_vars: rules.yml
 
+- name: Copy domain ACL file
+  ansible.builtin.template:
+    src: allowed_domains.acl
+    dest: "{{ squid_config_directory }}/{{ squid_allowed_domain_file }}"
+    owner: "{{ squid_user }}"
+    group: "{{ squid_group }}"
+    mode: "0644"
+
 - name: Configure squid
   ansible.builtin.template:
     src: "{{ squid_config_file }}.j2"

ansible/roles/win_proxy/vars/main.yml

@@ -17,6 +17,8 @@ squid_group: "{{ _squid_group[ansible_os_family] | default(_squid_group['default
 
 squid_config_directory: /etc/squid
 
+squid_allowed_domain_file: allowed_domains.acl
+
 squid_config_file: squid.conf
 
 squid_service: squid

ansible/roles/win_proxy/vars/rules.yml

@@ -2,6 +2,9 @@ squid_acls:
   - name: os_external
     classifier: src
     value: "10.24.0.0/16"
+  - name: allowed_domains
+    classifier: dstdomain
+    value: "{{ squid_config_directory }}/{{ squid_allowed_domain_file }}"
 
 squid_rules:
   - acl: to_localhost