1
0
Fork
You've already forked ci-cache
0
Caching proxy to accelerate deployments during development, test and in CI setups. Squid Cache based.
  • Nix 100%
Johannes Bornhold d4f37be628
All checks were successful
/ deploy-docs (push) Successful in 32s
ci: Add Forgejo Actions workflow for Sphinx docs
2026年03月13日 15:33:59 +01:00
.config chore: Re-apply copier template and switch to codeberg flake inputs for docs 2026年02月28日 08:54:32 +01:00
.forgejo/workflows ci: Add Forgejo Actions workflow for Sphinx docs 2026年03月13日 15:33:59 +01:00
docs release: Version 0.9.21 2026年03月12日 11:19:25 +01:00
kustomize release: Version 0.9.21 2026年03月12日 11:19:25 +01:00
LICENSES chore: Add MIT license and REUSE compliance 2026年02月25日 20:05:48 +01:00
patches fix: Patch squid to skip revalidation flags with ignore-private 2026年03月12日 11:16:41 +01:00
rootfs/etc Fix store_id regex to match CDN split hash paths 2026年02月25日 13:10:40 +01:00
.bumpversion.toml build: Set version to 0.9.0, wire image tag into bump-my-version 2026年02月25日 00:00:12 +01:00
.gitignore feat: Remove deprecated Helm chart 2026年02月25日 19:36:51 +01:00
.gitlab-ci.yml Switch to streamLayeredImage and dockerTools.caCertificates 2026年02月25日 12:47:08 +01:00
CHANGELOG.md release: Version 0.9.21 2026年03月12日 11:19:25 +01:00
flake.lock fix: Remove buildEnv symlink to etc/squid before creating directory 2026年02月25日 00:15:00 +01:00
flake.nix feat: Add Nix flake for building squid container image 2026年02月24日 23:41:27 +01:00
LICENSE chore: Add MIT license and REUSE compliance 2026年02月25日 20:05:48 +01:00
packages.nix fix: Patch squid to skip revalidation flags with ignore-private 2026年03月12日 11:16:41 +01:00
README.md docs: note private registry references in README 2026年02月27日 12:41:37 +01:00
renovate.json5 feat: Apply default-repository copier template 2026年02月24日 23:59:58 +01:00
REUSE.toml chore: Add MIT license and REUSE compliance 2026年02月25日 20:05:48 +01:00
VERSION release: Version 0.9.21 2026年03月12日 11:19:25 +01:00

ci-cache

Squid-based caching proxy for container image pulls, Nix binary cache, and general HTTPS traffic. Includes SSL-bump for transparent HTTPS proxying and store_id-based deduplication of signed CDN blob URLs.

The container image is built with Nix (nix build .#container-image) and deployed via kustomize.

Status - Experimental

I use this only in my lab to accelerate machine re-builds and container image fetches.

Some kustomize manifests still reference a private GitLab registry. These need to be updated once container images are published on Codeberg.

Usage

Deploy via kustomize, referencing a tagged version or a commit hash:

resources:- https://gitlab.gitlab.k0s.lab.bo-tech.de/bv/charts/ci-cache.git//kustomize/overlays/full?ref=v0.9.0

The base deployment requires a squid-ca Secret with tls.crt and tls.key for SSL-bump certificate generation. The cert-manager-ca component can provision this automatically.

Kustomize

The kustomize/ directory contains a reusable base and optional components:

kustomize/
 base/ # Squid deployment, service, PVC, config
 components/
 ca-serve/ # Serves the CA cert over HTTP
 cert-manager-ca/ # Provisions the CA Secret via cert-manager
 refresh-patterns/ # Caching rules for registries, Nix cache, CDN blobs
 store-id/ # Store ID rewriting for signed CDN URL dedup
 overlays/
 full/ # Base + all components
 test/ # Fast iteration — emptyDir cache, debug logging

Consume via remote kustomize reference:

resources:- https://gitlab.example.com/bv/charts/ci-cache.git//kustomize/base?ref=v0.9.0components:- https://gitlab.example.com/bv/charts/ci-cache.git//kustomize/components/cert-manager-ca?ref=v0.9.0

Or use the overlays/full overlay which includes everything.

Building the container image

No pre-built images are available yet. Build locally with Nix:

nix build .#container-image
# Stream directly into a registry
./result | skopeo copy docker-archive:/dev/stdin docker://registry.example.com/squid:v0.9.0
# Or save to a file first
./result > squid.tar

Contact

johannes@bornhold.name

Pointers