Imported from ibranibeny/SimulateSQLServerBehindSquidProxy (AGENTS.md). Install upstream with npx skills add ibranibeny/SimulateSQLServerBehindSquidProxy. Copyright stays with the author.

Project: Simulate SQL Server Arc Onboarding Behind Squid Proxy

Overview

Simulates two SQL Server instances joining Azure Arc through a Squid transparent proxy with FQDN whitelisting. SQL Server A has the required Arc FQDNs whitelisted and can onboard; SQL Server B does not and fails. This demonstrates proxy-based network controls for Arc onboarding.

Architecture

• Resource Group: sqlsquidproxy | Region: southeastasia
• IaC: Azure CLI (az) scripts — no ARM/Bicep/Terraform
• VMs: 3 Azure Linux VMs
  • vm-squid — Squid transparent proxy server
  • vm-sqlA — SQL Server with whitelisted FQDNs (successful Arc join)
  • vm-sqlB — SQL Server without whitelisted FQDNs (blocked Arc join)
• NSGs: Restrict outbound from SQL VMs to go through the proxy only; all inbound open for easy SSH/SQL access during workshop

Key Scripts

Azure Arc Required FQDNs (southeastasia)

When editing Squid ACL whitelists, use the official endpoint list. Key domains:

• login.microsoftonline.com, *.login.microsoft.com, pas.windows.net — Entra ID
• management.azure.com — Azure Resource Manager
• *.his.arc.azure.com — Hybrid Identity Service
• *.guestconfiguration.azure.com — Extension management
• guestnotificationservice.azure.com, *.guestnotificationservice.azure.com — Notifications
• *.servicebus.windows.net — Notification relay
• *.southeastasia.arcdataservices.com — Arc data processing (SQL Server)
• download.microsoft.com, packages.microsoft.com — Agent installation
• www.microsoft.com/pkiops/certs — Certificate updates
• dc.services.visualstudio.com — Telemetry (optional)

Reference: Azure Arc network requirements

Squid Proxy Configuration

• Port 3128 for explicit proxy; port 3129 for intercept (transparent) mode
• Transparent proxy requires iptables rules on the SQL VMs to redirect outbound 443 traffic through Squid
• Use ssl_bump with Squid for HTTPS interception, or use CONNECT tunneling with ACL domain whitelisting
• Per-source ACLs differentiate the two SQL VMs in a single squid.conf:
  • acl sqlA src <sqlA-ip> + http_access allow CONNECT SSL_ports sqlA arc_fqdns — whitelisted
  • acl sqlB src <sqlB-ip> + http_access deny sqlB arc_fqdns — blocked
• View config: ssh vm-squid "cat /etc/squid/squid.conf"
• View per-VM logs: grep '<vm-ip>' /var/log/squid/access.log
• Run bash scripts/compare-arc-status.sh to see config + logs + status side-by-side

Connected Machine Agent Proxy Config

# Set proxy on Arc agent (run on SQL VMs)
azcmagent config set proxy.url "http://<squid-vm-ip>:3128"

# Verify
azcmagent config get proxy.url

Reference: Manage agent proxy settings

Post-Deploy: Publish to GitHub

After a successful deployment, publish the project and create a workshop page:

1. Create GitHub repo: Create SimulateSQLServerBehindSquidProxy under ibranibeny (public, with description matching the Overview above)
2. Push code: Initialize git, commit all scripts/configs, push to the new repo
3. Publish workshop: Create/update a workshop page on ibranibeny.github.io with:
   • Architecture overview and diagram (Mermaid)
   • Step-by-step walkthrough: deploy → open NSGs → start VMs → check services → verify Arc diff
   • FQDN whitelist reference table
   • Troubleshooting tips from Common Pitfalls section
   • Link back to the source repo

GitHub Pages repo: ibranibeny/ibranibeny.github.io — add a page/post under the workshops section

Conventions

• All scripts use bash and Azure CLI (az)
• Scripts must be idempotent — safe to re-run
• Use set -euo pipefail in all bash scripts
• Prefix resource names consistently (e.g., sqlsquidproxy-vnet, sqlsquidproxy-nsg-squid)
• Tag all Azure resources: project=sqlsquidproxy, purpose=workshop
• Use variables at the top of scripts for region, RG name, VM sizes, credentials
• SQL Server VMs: use SQL Server on Linux (Ubuntu) images from marketplace
• Keep NO_PROXY=localhost,127.0.0.1 on SQL VMs

Common Pitfalls

• Transparent proxy with HTTPS requires either SSL bump (complex) or SNI-based filtering via ssl_bump peek + acl ssl::server_name
• Squid needs --with-openssl compiled for SSL bump; use squid-openssl package on Ubuntu
• Arc agent install script from portal already supports --proxy flag
• Wildcard FQDNs like *.his.arc.azure.com need Squid dstdomain ACLs (e.g., .his.arc.azure.com)
• NSG rules must block direct outbound internet from SQL VMs, forcing traffic through the proxy subnet
• iptables REDIRECT rules for transparent mode must exclude traffic to the proxy VM itself