Merge pull request #184 from bbrowning/golang-paude-proxy

Replace squid with paude-proxy

Author: bbrowning

CONTRIBUTING.md

@@ -176,13 +176,10 @@ paude/
 │   │   ├── Dockerfile             # Agent container image
 │   │   ├── entrypoint.sh          # Container entrypoint
 │   │   ├── entrypoint-session.sh  # Session entrypoint
-│   │   ├── credential-watchdog.sh # Credential refresh watchdog
 │   │   └── tmux.conf              # Tmux configuration
 │   └── proxy/
-│       ├── Dockerfile             # Squid proxy container image
-│       ├── entrypoint.sh          # Proxy container entrypoint
-│       ├── squid.conf             # Proxy allowlist configuration
-│       └── ERR_CUSTOM_ACCESS_DENIED  # Custom error page
+│       ├── Dockerfile             # Proxy container image (paude-proxy)
+│       └── entrypoint.sh          # Proxy container entrypoint
 ├── tests/                 # Python tests (pytest)
 ├── examples/              # Example configurations
 ├── docs/                  # Documentation

README.md

@@ -134,7 +134,7 @@ Export agent telemetry (metrics, logs, traces) to any OTLP-compatible collector:
 paude create --otel-endpoint http://collector:4318 my-project
 ```
 
-The endpoint hostname is automatically added to the proxy allowlist and non-standard ports (like 4318) are opened in the squid proxy. Supported agents: Claude Code, Gemini CLI, OpenClaw. Set `otel-endpoint` in `~/.config/paude/defaults.json` to apply globally.
+The endpoint hostname is automatically added to the proxy allowlist and non-standard ports (like 4318) are opened in the proxy. Supported agents: Claude Code, Gemini CLI, OpenClaw. Set `otel-endpoint` in `~/.config/paude/defaults.json` to apply globally.
 
 ### Passing a Task
 

containers/paude/Dockerfile

@@ -81,15 +81,14 @@ RUN useradd -M -d /home/paude -s /bin/bash -g 0 paude && \
 # It gets installed at user-side build time via a runtime layer.
 # See src/paude/config/claude_layer.py for the installation logic.
 
-# Copy entrypoints and watchdog script
+# Copy entrypoints
 USER root
 COPY --chmod=755 entrypoint.sh /usr/local/bin/entrypoint.sh
 COPY --chmod=755 entrypoint-session.sh /usr/local/bin/entrypoint-session.sh
 COPY --chmod=755 entrypoint-lib-credentials.sh /usr/local/bin/entrypoint-lib-credentials.sh
 COPY --chmod=755 entrypoint-lib-config.sh /usr/local/bin/entrypoint-lib-config.sh
 COPY --chmod=755 entrypoint-lib-install.sh /usr/local/bin/entrypoint-lib-install.sh
 COPY --chmod=755 entrypoint-lib-openclaw.sh /usr/local/bin/entrypoint-lib-openclaw.sh
-COPY --chmod=755 credential-watchdog.sh /usr/local/bin/credential-watchdog.sh
 COPY --chmod=755 patch-proxy-fetch.sh /usr/local/bin/patch-proxy-fetch.sh
 COPY --chmod=755 patch-gemini-otel-proxy.sh /usr/local/bin/patch-gemini-otel-proxy.sh
 COPY --chmod=755 patch-openclaw-otel-proxy.sh /usr/local/bin/patch-openclaw-otel-proxy.sh

containers/paude/credential-watchdog.sh

@@ -49,6 +49,39 @@ wait_for_git() {
     wait_for_path "/pvc/workspace/.git" "git repository" 120 "continue"
 }
 
+# Detect the system CA bundle path across distros.
+_find_sys_ca_bundle() {
+    local path
+    for path in \
+        /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \
+        /etc/ssl/certs/ca-certificates.crt \
+        /etc/ssl/ca-bundle.pem \
+        /etc/ssl/cert.pem; do
+        if [[ -f "$path" ]]; then
+            echo "$path"
+            return 0
+        fi
+    done
+    return 1
+}
+
+# Build custom CA bundle with paude-proxy CA cert if injected.
+# Concatenates the system CA bundle with the proxy CA cert into a
+# writable /tmp path — no root or update-ca-trust needed (works with
+# OpenShift arbitrary UIDs and non-CentOS base images like Debian).
+setup_ca_trust() {
+    local ca_cert="/etc/pki/ca-trust/source/anchors/paude-proxy-ca.crt"
+    local custom_bundle="/tmp/paude-ca-bundle.pem"
+    local sys_bundle
+    sys_bundle=$(_find_sys_ca_bundle) || return 0
+
+    if [[ -f "$ca_cert" ]]; then
+        cat "$sys_bundle" "$ca_cert" > "$custom_bundle" 2>/dev/null || true
+    else
+        cp "$sys_bundle" "$custom_bundle" 2>/dev/null || true
+    fi
+}
+
 # Set up credentials from tmpfs-based storage (/credentials)
 setup_credentials() {
     local config_path="/credentials"

containers/paude/entrypoint-lib-credentials.sh

@@ -56,6 +56,10 @@ fi
 # git config --global creates .gitconfig if it doesn't exist
 git config --global --add safe.directory '*' 2>/dev/null || true
 
+# Update CA trust early (before any HTTPS calls like agent install)
+# The CA cert is injected by the host after the container starts.
+setup_ca_trust
+
 # Wait for and set up tmpfs-based credentials
 # Order matters: setup_credentials copies host config into ~/.claude (real dir),
 # then persist_agent_config merges it into /pvc/.claude (preserving existing
@@ -65,16 +69,6 @@ setup_credentials
 persist_agent_config
 wait_for_git
 
-# Start credential watchdog in background (OpenShift only)
-# The watchdog removes credentials after inactivity when no tmux clients are attached
-# Only start if not already running (avoid duplicates on reconnect)
-if [[ -d /credentials ]] && [[ "${PAUDE_CREDENTIAL_WATCHDOG:-1}" == "1" ]]; then
-    if ! pgrep -f "credential-watchdog.sh" >/dev/null 2>&1; then
-        nohup /usr/local/bin/credential-watchdog.sh >> /tmp/credential-watchdog.log 2>&1 &
-        echo "Credential watchdog started (timeout: ${PAUDE_CREDENTIAL_TIMEOUT:-60}m)"
-    fi
-fi
-
 # Add PVC local bin to PATH (for agent and other tools installed to PVC)
 # Also keep home .local/bin for tools installed during image build
 export PATH="/pvc/.local/bin:$HOME/.local/bin:$PATH"

containers/paude/entrypoint-session.sh

@@ -5,7 +5,7 @@
 # which does NOT respect HTTP_PROXY / HTTPS_PROXY env vars.  This script
 # patches the compiled sdk.js to pass an httpAgentOptions factory that
 # returns an HttpsProxyAgent (already a gemini-cli dependency) so OTEL
-# exports go through the squid proxy.
+# exports go through the proxy.
 #
 # The OTEL SDK v0.211.0 (used by gemini-cli v0.35.3) supports
 # httpAgentOptions as either AgentOptions or an HttpAgentFactory function.

containers/paude/patch-gemini-otel-proxy.sh

@@ -4,7 +4,7 @@
 # The @opentelemetry/otlp-exporter-base package creates http/https Agents
 # that do NOT respect HTTP_PROXY / HTTPS_PROXY env vars.  This script
 # patches the compiled transport layer to return proxy-aware agents so
-# OTEL exports go through the squid proxy.
+# OTEL exports go through the proxy.
 #
 # OpenClaw bundles its diagnostics-otel plugin into
 # /app/dist/extensions/diagnostics-otel/index.js, so the primary patch

containers/paude/patch-openclaw-otel-proxy.sh

@@ -1,13 +1,18 @@
+# Build stage — compile paude-proxy from source
+FROM golang:1.23 AS builder
+WORKDIR /app
+ARG PAUDE_PROXY_VERSION=2b868f8740185df6912a009030a9d60c9ccc1f83
+RUN git init . && \
+    git fetch --depth 1 https://github.com/bbrowning/paude-proxy.git ${PAUDE_PROXY_VERSION} && \
+    git checkout FETCH_HEAD && \
+    CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /paude-proxy ./cmd/paude-proxy/
+
+# Runtime stage
 FROM quay.io/centos/centos:stream10
 
-# Enable CRB and EPEL repository, install Squid + dnsmasq + debugging tools
-RUN dnf install -y dnf-plugins-core && \
-    dnf config-manager --set-enabled crb && \
-    dnf install -y epel-release && \
-    dnf install -y --allowerasing squid dnsmasq curl wget bind-utils iputils && \
-    dnf clean all && \
-    # Ensure squid runtime directories are writable (needed for OpenShift random UIDs)
-    chmod -R 777 /var/spool/squid /var/log/squid /run/squid 2>/dev/null || true
+# dnsmasq for DNS forwarding (needed by tools like Rust reqwest on internal networks)
+# curl for health checks and debugging
+RUN dnf install -y dnsmasq curl && dnf clean all
 
 # Install tini init process for multi-process signal handling
 ARG TINI_VERSION=v0.19.0
@@ -22,13 +27,14 @@ RUN ARCH=$(uname -m) && \
     chmod +x /usr/local/bin/tini && \
     tini --version
 
-# Copy allowlist configuration, custom error page, and entrypoint
-COPY squid.conf /etc/squid/squid.conf
-COPY ERR_CUSTOM_ACCESS_DENIED /usr/share/squid/errors/en/ERR_CUSTOM_ACCESS_DENIED
+COPY --from=builder /paude-proxy /usr/local/bin/paude-proxy
 COPY --chmod=755 entrypoint.sh /usr/local/bin/paude-entrypoint.sh
 
-# Squid runs on port 3128
+# Writable directories for OpenShift arbitrary UIDs
+RUN mkdir -p /data/ca /tmp && chmod 777 /data/ca /tmp
+# dnsmasq needs writable pid directory
+RUN mkdir -p /run/dnsmasq && chmod 777 /run/dnsmasq
+
 EXPOSE 3128
 
-ENTRYPOINT ["/usr/local/bin/paude-entrypoint.sh"]
-CMD ["-NYC"]
+ENTRYPOINT ["/usr/local/bin/tini", "--", "/usr/local/bin/paude-entrypoint.sh"]