new rule and fix domain allowlist

ansible/playbooks/win_proxy.yml

@@ -5,6 +5,7 @@
     ansible_ssh_private_key_file: /etc/ansible/keys/proxy.key
     ansible_user: ubuntu
   vars_files:
+    - ../vars/checkmk.yml
     - ../vars/common.yml
   roles:
     - role: win_proxy

ansible/roles/win_proxy/files/allowed_domains.acl

@@ -1,46 +1,38 @@
+.microsoft.com
 conda.anaconda.org
 repo.anaconda.com
 files.pythonhosted.org
-pypi.org
+.pypi.org
-pypi.python.org
+.pypi.python.org
-cran.r-project.org
+.r-project.org
 cran.ma.imperial.ac.uk
-cloud.r-project.org
 archive.canonical.com
 archive.ubuntu.com
 gb.archive.ubuntu.com
-mozilla.org
+.mozilla.org
-aus5.mozilla.org
 dl.google.com
-stats.microsoft.com
+.windowsupdate.com
-download.windowsupdate.com
-update.microsoft.com
-windowsupdate.com
-windowsupdate.microsoft.com
-download.microsoft.com
-ntservicepack.microsoft.com
 wustat.windows.com
 git.ecdf.ed.ac.uk
 cran.rstudio.com
 support.rstudio.org
 mynvivo.com
 auth0.com
-qsrinternational.com
+.qsrinternational.com
 qsrulurudev.b2clogin.com
-services.qsrinternational.com
-api-nv.qsrinternational.com
-download.qsrinternational.com
 subscription-suite.io
-login.qsrinternational.com
+.digicert.com
-cdn-login.qsrinternational.com
-digicert.com
 rstudio.com
 rstudio.org
 fss-snd.scot
 os.uk
-clearinghouse.one.microso0ft.com
 msactivation.ucs.ed.ac.uk
-catalog.update.microsoft.com
-microsoft.com
 posit.co
-download1.rstudio.org
+download1.rstudio.org
+ecs.office.com
+.office.net
+.officeapps.live
+.live.com
+download-installer.cdn.mozilla.net
+update.code.visualstudio.com
+.adobe.com

ansible/roles/win_proxy/vars/rules.yml

@@ -2,16 +2,21 @@ squid_acls:
   - name: os_external
     classifier: src
     value: "10.24.0.0/16"
+  - name: agent_dl
+    classifier: dst
+    value: "{{ checkmk_server }}/32"
   - name: allowed_domains
     classifier: dstdomain
-    value: "{{ squid_config_directory }}/{{ squid_allowed_domain_file }}"
+    value: "\"{{ squid_config_directory }}/{{ squid_allowed_domain_file }}\""
 
 squid_rules:
   - acl: to_localhost
     decision: deny
-  - acl: os_external
+  - acl: os_external allowed_domains
     decision: allow
-  - acl: localhost
+  - acl: agent_dl
+    decision: allow
+  - acl: localhost allowed_domains
     decision: allow
   - acl: all
     decision: deny