From 4509fcdd27b000c1d3e15b4f59abf7d819869d00 Mon Sep 17 00:00:00 2001
From: Max Schmitt <max@schmitt.mx>
Date: Fri, 4 Sep 2026 01:06:34 -0400
Subject: [PATCH 1/2] Make squid image builds resilient to Alpine CDN TLS
 flakes.

CI failed because apk could not fetch APKINDEX over TLS from dl-cdn, which then looked like a missing squid package.
---
 squid/Dockerfile | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/squid/Dockerfile b/squid/Dockerfile
index 74483b6..12f6b8b 100644
--- a/squid/Dockerfile
+++ b/squid/Dockerfile
@@ -2,9 +2,30 @@ FROM alpine:3.23
 
 EXPOSE 3128
 
-ADD ./squid/squid.conf /etc/squid/squid.conf
-
-RUN apk add --no-cache squid
+# Alpine's CDN occasionally fails apk with "TLS: unspecified error", which
+# then looks like a missing squid package. Try the CDN, then a second mirror.
+RUN set -eux; \
+    ok=0; \
+    for mirror in \
+        https://dl-cdn.alpinelinux.org/alpine \
+        https://mirror.math.princeton.edu/pub/alpinelinux; do \
+      printf '%s\n' \
+        "${mirror}/v3.23/main" \
+        "${mirror}/v3.23/community" \
+        > /etc/apk/repositories; \
+      attempt=0; \
+      while [ "$attempt" -lt 3 ]; do \
+        if apk add --no-cache squid; then \
+          ok=1; \
+          break; \
+        fi; \
+        attempt=$((attempt + 1)); \
+        sleep $((attempt * 2)); \
+      done; \
+      [ "$ok" = 1 ] && break; \
+    done; \
+    [ "$ok" = 1 ]
 
+COPY ./squid/squid.conf /etc/squid/squid.conf
 COPY ./squid/entrypoint.sh /usr/local/bin/squid-entrypoint
 ENTRYPOINT ["/usr/local/bin/squid-entrypoint"]

From c7c9afa2e2f99798b8c1c0382de4ae54830f94e3 Mon Sep 17 00:00:00 2001
From: Max Schmitt <max@schmitt.mx>
Date: Fri, 4 Sep 2026 01:08:48 -0400
Subject: [PATCH 2/2] Bump the squid image to Alpine 3.24.

The failed CI job looked like a transient Alpine CDN TLS error; moving to the current stable release picks up newer apk/ca-certificates.
---
 squid/Dockerfile | 26 ++------------------------
 1 file changed, 2 insertions(+), 24 deletions(-)

diff --git a/squid/Dockerfile b/squid/Dockerfile
index 12f6b8b..3f55b04 100644
--- a/squid/Dockerfile
+++ b/squid/Dockerfile
@@ -1,30 +1,8 @@
-FROM alpine:3.23
+FROM alpine:3.24
 
 EXPOSE 3128
 
-# Alpine's CDN occasionally fails apk with "TLS: unspecified error", which
-# then looks like a missing squid package. Try the CDN, then a second mirror.
-RUN set -eux; \
-    ok=0; \
-    for mirror in \
-        https://dl-cdn.alpinelinux.org/alpine \
-        https://mirror.math.princeton.edu/pub/alpinelinux; do \
-      printf '%s\n' \
-        "${mirror}/v3.23/main" \
-        "${mirror}/v3.23/community" \
-        > /etc/apk/repositories; \
-      attempt=0; \
-      while [ "$attempt" -lt 3 ]; do \
-        if apk add --no-cache squid; then \
-          ok=1; \
-          break; \
-        fi; \
-        attempt=$((attempt + 1)); \
-        sleep $((attempt * 2)); \
-      done; \
-      [ "$ok" = 1 ] && break; \
-    done; \
-    [ "$ok" = 1 ]
+RUN apk add --no-cache squid
 
 COPY ./squid/squid.conf /etc/squid/squid.conf
 COPY ./squid/entrypoint.sh /usr/local/bin/squid-entrypoint