feat(noauth): domains reachable without proxy authentication; list and setup fixes

.github/workflows/ci.yml

@@ -569,9 +569,25 @@ jobs:
           test -s before/sha256
           sudo sha256sum -c before/sha256
 
-          # 3. modes and ownership in the config tree unchanged
+          # 3. modes and ownership in the config tree unchanged, with one expected addition
+          #    (since 7.3.8, ADR-016): update-all/reconcile create an EMPTY noauth.domains next
+          #    to every instance's blocklists/<name>/blocked.domains, with that file's mode and
+          #    owner. It is expected only where the previous release had none; any other
+          #    difference (also next to the admin's own /etc/linuxmuster-squid/blocked.domains)
+          #    still fails.
           sudo find /etc/linuxmuster-squid -printf '%m %U:%G %p\n' | sort > after/etc-modes
-          diff -u before/etc-modes after/etc-modes
+          cp before/etc-modes before/etc-modes.expected
+          while read -r mode owner path; do
+            noauth_file="${path%/blocked.domains}/noauth.domains"
+            if awk -v p="$noauth_file" '$3 == p { found = 1 } END { exit !found }' before/etc-modes; then
+              continue
+            fi
+            echo "$mode $owner $noauth_file" >> before/etc-modes.expected
+            sudo test -f "$noauth_file" || { echo "missing: $noauth_file"; exit 1; }
+            if sudo test -s "$noauth_file"; then echo "not empty: $noauth_file"; exit 1; fi
+          done < <(awk '$3 ~ /^\/etc\/linuxmuster-squid\/blocklists\/[^\/]+\/blocked\.domains$/' before/etc-modes)
+          sort -o before/etc-modes.expected before/etc-modes.expected
+          diff -u before/etc-modes.expected after/etc-modes
 
           # 4. the instance record is written by the software, not the admin, and the
           #    postinst rewrites `image:` on purpose (update-all). Every key the admin

.github/workflows/release.yml

@@ -480,9 +480,25 @@ jobs:
           test -s before/sha256
           sudo sha256sum -c before/sha256
 
-          # 3. modes and ownership in the config tree unchanged
+          # 3. modes and ownership in the config tree unchanged, with one expected addition
+          #    (since 7.3.8, ADR-016): update-all/reconcile create an EMPTY noauth.domains next
+          #    to every instance's blocklists/<name>/blocked.domains, with that file's mode and
+          #    owner. It is expected only where the previous release had none; any other
+          #    difference (also next to the admin's own /etc/linuxmuster-squid/blocked.domains)
+          #    still fails.
           sudo find /etc/linuxmuster-squid -printf '%m %U:%G %p\n' | sort > after/etc-modes
-          diff -u before/etc-modes after/etc-modes
+          cp before/etc-modes before/etc-modes.expected
+          while read -r mode owner path; do
+            noauth_file="${path%/blocked.domains}/noauth.domains"
+            if awk -v p="$noauth_file" '$3 == p { found = 1 } END { exit !found }' before/etc-modes; then
+              continue
+            fi
+            echo "$mode $owner $noauth_file" >> before/etc-modes.expected
+            sudo test -f "$noauth_file" || { echo "missing: $noauth_file"; exit 1; }
+            if sudo test -s "$noauth_file"; then echo "not empty: $noauth_file"; exit 1; fi
+          done < <(awk '$3 ~ /^\/etc\/linuxmuster-squid\/blocklists\/[^\/]+\/blocked\.domains$/' before/etc-modes)
+          sort -o before/etc-modes.expected before/etc-modes.expected
+          diff -u before/etc-modes.expected after/etc-modes
 
           # 4. the instance record is written by the software, not the admin, and the
           #    postinst rewrites `image:` on purpose (update-all). Every key the admin

README.md

@@ -38,7 +38,11 @@ the same AD/Kerberos infrastructure the school already operates.
   authentication via `negotiate_kerberos_auth`, authorization via
   `ext_kerberos_ldap_group_acl` against the instance's AD group. HTTPS is
   **not decrypted** (SNI peek/splice or CONNECT `dstdomain`). Per-instance domain
-  blocklist: HTTP → 403, HTTPS → the TLS handshake is cut (no block page without decryption).
+  blocklist: HTTP → 403, HTTPS → certificate warning in the browser (squid's 403 inside TLS
+  with an untrusted throwaway certificate; the blocked server is never contacted, allowed traffic
+  is never decrypted).
+  Optional per-instance list of domains reachable without proxy login from the school subnets
+  (e.g. Microsoft 365; the blocklist still wins).
 - **Control Plane:** hardened systemd service with **REST API** (FastAPI) and
   **CLI** (Typer, thin client) — creates instances, configures policies, and
   **updates digest-pinned with health-check auto-rollback**. Shipped as a
@@ -76,8 +80,9 @@ sudo lmnsquid create --school all --role students --ad-group role-student \
   --realm EXAMPLE.ORG --visible-hostname proxy.example.org \
   --keytab-secret proxy.keytab --http-port 3129 --school-subnets 10.0.0.0/8
 ```
-> `REALM=EXAMPLE.ORG bash /usr/share/linuxmuster-squid/scripts/discover-ad-facts.sh` (on the DC)
-> prints the global role groups, the internet groups per school and the two `create` commands.
+> `bash /usr/share/linuxmuster-squid/scripts/discover-ad-facts.sh` (on the DC) reads the realm
+> there and prints the global role groups, the internet groups per school and the `create`
+> commands.
 > `--image` defaults to the maintained, digest-pinned image.
 
 **3. Everyday commands:**
@@ -90,9 +95,11 @@ lmnsquid update all-teachers               # -> maintained default image (health
 lmnsquid update-all                        # every instance -> default image
 lmnsquid rollback all-teachers             # to the last known-good
 lmnsquid reconcile                         # re-apply stored state (restore / after a crash)
-lmnsquid blocklist all-students add example.org    # block a domain + subdomains (HTTP 403, HTTPS TLS abort)
+lmnsquid blocklist all-students add example.org    # block a domain + subdomains (HTTP 403, HTTPS cert warning)
 lmnsquid blocklist all-students reload             # apply without restart; list / remove likewise
-lmnsquid rm all-students                   # container + cache/log volumes + blocklist (--keep-logs keeps the logs)
+lmnsquid noauth all-students add sharepoint.com    # reachable WITHOUT proxy login from the school subnets
+lmnsquid noauth all-students reload                # (exam mode and Internetsperre do not apply: docs/operations.md)
+lmnsquid rm all-students                   # container + cache/log volumes + both lists (--keep-logs keeps the logs)
 lmnsquid version
 ```
 

RELEASE.md

@@ -64,6 +64,21 @@ does not yet exist — every `lmnsquid create --image ghcr.io/…@sha256:<digest
 
 ## Ongoing releases
 
+**A release whose `image/` changed pins that image before it is tagged.** The control plane
+installs and updates instances with `DEFAULT_IMAGE` (`controlplane/lmnsquid/models.py`); a
+changed template that is not pinned never reaches an installed system. Order: merge the change
+→ `build-image.yml` builds and pushes it on `main` (the digest is in the job log, "Report
+digest") → a PR sets `DEFAULT_IMAGE` to that `@sha256:` digest (by hand while Renovate is
+disabled) → CI green → set the changelog version and tag. The package upgrade then moves every
+instance onto the new image (`update-all` in the postinst, health-gated with rollback).
+**7.3.8** is such a release: the noauth list (ADR-016) and `lists-sync.sh` live in the image;
+until the digest is pinned, `lmnsquid noauth <name> reload` answers 409 and the lists still
+reach squid unfiltered. The E2E service `squid-old` and the integration test
+`test_real_old_image_ignores_the_noauth_list` deliberately keep testing the image 7.3.7 pins
+(`…@sha256:d13625b5…`, a constant in `scripts/tests/e2e_kerberos.sh` and
+`controlplane/tests/test_docker_integration.py`), i.e. what instances run until the upgrade
+replaces their containers; they do not follow `DEFAULT_IMAGE` and need no change for the pin.
+
 Code + docs + a `debian/changelog` bullet in the same commit (Conventional Commits) → push →
 CI green (`ci.yml`: fast tier, container build, install smoke, upgrade smoke) → Kevin sets the
 release version in the changelog head and tags `v<version>` → `release.yml` builds, smokes and

controlplane/lmnsquid/api.py

@@ -13,10 +13,17 @@
 from fastapi import Depends, FastAPI, HTTPException, Request, status
 from fastapi.responses import JSONResponse
 
-from .blocklist import Blocklist
+from .blocklist import Blocklist, noauth_list
 from .config import Settings
 from .docker_service import DockerService
-from .models import DEFAULT_IMAGE, BlocklistEntry, Instance, InstancePatch, UpdateRequest
+from .models import (
+    DEFAULT_IMAGE,
+    BlocklistEntry,
+    Instance,
+    InstancePatch,
+    NoauthEntry,
+    UpdateRequest,
+)
 from .reconciler import Reconciler
 from .security import make_verify_token
 from .store import Store
@@ -38,6 +45,7 @@ def create_app(
     """Build the FastAPI app wiring routes to the store, reconciler and docker service."""
     verify = make_verify_token(settings)
     blocklist = Blocklist(settings.blocklists_dir)
+    noauth = noauth_list(settings.blocklists_dir)
     app = FastAPI(title="linuxmuster-squid control plane")
 
     @app.exception_handler(DockerException)
@@ -218,6 +226,68 @@ def reload_blocklist(name: str) -> dict[str, Any]:
                 status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail=str(exc)
             ) from exc
 
+    # ------------------------------------------- domains without proxy auth (ADR-016)
+    @app.get("/v1/instances/{name}/noauth", dependencies=auth)
+    async def get_noauth(name: str) -> dict[str, Any]:
+        _require(name)
+        return {"name": name, "domains": noauth.read(name)}
+
+    @app.post("/v1/instances/{name}/noauth", dependencies=auth)
+    async def add_noauth_domain(name: str, entry: NoauthEntry) -> dict[str, Any]:
+        """Let ``entry.domain`` and its subdomains through without proxy auth (after ``reload``)."""
+        _require(name)
+        domains = noauth.add(name, entry.domain)
+        audit.info("noauth add name=%s domain=%s", name, entry.domain)
+        return {"name": name, "domains": domains}
+
+    @app.delete("/v1/instances/{name}/noauth/{domain}", dependencies=auth)
+    async def remove_noauth_domain(name: str, domain: str) -> dict[str, Any]:
+        _require(name)
+        try:
+            domains = noauth.remove(name, domain)
+        except ValueError as exc:
+            raise HTTPException(
+                status_code=status.HTTP_422_UNPROCESSABLE_ENTITY, detail=str(exc)
+            ) from exc
+        except KeyError as exc:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail=f"{domain!r} is not on the noauth list of {name!r}",
+            ) from exc
+        audit.info("noauth remove name=%s domain=%s", name, domain)
+        return {"name": name, "domains": domains}
+
+    @app.post("/v1/instances/{name}/noauth/reload", dependencies=auth)
+    def reload_noauth(name: str) -> dict[str, Any]:
+        """Re-read the lists (lists-sync.sh, ``squid -k reconfigure``), refused if the image
+        has no noauth list.
+
+        An image from before ADR-016 has no noauth ACL in its squid.conf and never reads the
+        list: answer 409 instead of a silent "reloaded". (A ``noauth.domains`` that appeared
+        after the container started is read by this reload.)
+        """
+        _require(name)
+        audit.info("noauth reload name=%s", name)
+        try:
+            if not docker.noauth_active(name):
+                raise HTTPException(
+                    status_code=status.HTTP_409_CONFLICT,
+                    detail=(
+                        f"the data-plane image of {name!r} does not support the noauth list, "
+                        "so the list has no effect: it needs a linuxmuster-squid release whose "
+                        "pinned data-plane image supports it; installing that release moves the "
+                        "instances onto that image (update-all), and `lmnsquid update "
+                        f"{name}` moves this one if it stayed on its old image"
+                    ),
+                )
+            return docker.reload(name)
+        except LookupError as exc:
+            raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail=str(exc)) from exc
+        except RuntimeError as exc:
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail=str(exc)
+            ) from exc
+
     # ----------------------------------------------------------- lifecycle ops
     @app.post("/v1/instances/{name}/start", dependencies=auth)
     async def start_instance(name: str) -> dict[str, Any]: