From 6cb291a9eabae2038633366561c790f247a79032 Mon Sep 17 00:00:00 2001
From: Alexandre Pires <c.alexandre.pires@gmail.com>
Date: Thu, 26 Sep 2024 12:03:33 +0200
Subject: [PATCH] Refactor squid configuration to include readiness and
 liveness probes, resource requests, and security context

---
 terraform/k8sapps/m3uproxy.tf                | 28 ++++++++++++++++++++
 terraform/k8sapps/resources/squid/squid.conf |  5 +++-
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/terraform/k8sapps/m3uproxy.tf b/terraform/k8sapps/m3uproxy.tf
index 3a41394..a13230f 100644
--- a/terraform/k8sapps/m3uproxy.tf
+++ b/terraform/k8sapps/m3uproxy.tf
@@ -210,6 +210,34 @@ resource "kubernetes_deployment" "proxy_pt" {
             protocol       = "TCP"
           }
 
+          readiness_probe {
+            tcp_socket {
+              port = "proxy"
+            }
+            initial_delay_seconds = 10
+            timeout_seconds       = 4
+          }
+
+          liveness_probe {
+            tcp_socket {
+              port = "proxy"
+            }
+            initial_delay_seconds = 10
+            timeout_seconds       = 4
+          }
+
+          resources {
+            requests = {
+              memory = "256Mi"
+            }
+          }
+
+          security_context {
+            allow_privilege_escalation = false
+            run_as_user                = 1000
+            run_as_group               = 1000
+          }
+
           volume_mount {
             name       = "squid-config"
             mount_path = "/etc/squid"
diff --git a/terraform/k8sapps/resources/squid/squid.conf b/terraform/k8sapps/resources/squid/squid.conf
index 2dd6b07..2ae942b 100644
--- a/terraform/k8sapps/resources/squid/squid.conf
+++ b/terraform/k8sapps/resources/squid/squid.conf
@@ -42,4 +42,7 @@ forwarded_for delete
 follow_x_forwarded_for deny all
 pipeline_prefetch on
 request_header_access From deny all
-request_header_access Server deny all
\ No newline at end of file
+request_header_access Server deny all
+pid_filename   none
+access_log     stdio:/dev/stdout
+cache_log      stdio:/dev/stderr
\ No newline at end of file