# Filename: squid.conf
# Purpose:  "squid" 7.5 configuration file
# License:  Same as for "squid"
# Revision: 230316

#---------------------------------------------------------------------

sslcrtd_program       __META_PREFIX__/libexec/security_file_certgen \
-s __META_CACHEDIR__/ssl_db -M 64MB

visible_hostname      __META_HOSTNAME__
access_log            /var/log/squid/access.log
cache_log             /var/log/squid/cache.log
cache_dir             ufs __META_CACHEDIR__ 20000 256 256
cache_store_log           __META_CACHEDIR__/cache-store.log
cache_effective_user      squid
cache_effective_group     squid
maximum_object_size       5 MB
range_offset_limit        2 MB
forwarded_for             delete

cache_peer 127.0.0.1 \
parent 4000 0 no-query originserver name=pleroma_backend

acl trusted src 127.0.0.0/8

# To add your own external IPV4 addresses to the "trusted" list,  pro-
# ceed as follows:
#
# acl trusted src 1.2.3.4
# acl trusted src 5.6.7.8
# etc.

#---------------------------------------------------------------------

# This is a safety measure:
#
memory_pools_limit 64 MB

# This disables caching for web servers running on the local system:
# acl dontcache dstdomain 127.0.0.1
# no_cache deny dontcache

#---------------------------------------------------------------------

# Needed for squidclient "mgr:" operations to work correctly:
# cachemgr_passwd none offline_toggle

# url_rewrite_program  __META_PREFIX__/etc/squid-rewrite-localtree
# url_rewrite_children 30

# acl manager proto cache_object
acl localhost    src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1

# acl localnet src 10.0.0.0/8     # RFC1918 possible internal network
# acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
# acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
# acl localnet src fc00::/7       # RFC 4193 local private network range
# acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines

acl SSL_ports  port 443
acl Safe_ports port 80            # http
acl Safe_ports port 21            # ftp
acl Safe_ports port 443           # https
acl Safe_ports port 3128          # squid
acl Safe_ports port 3129          # squid
acl Safe_ports port 4000          # pleroma
acl Safe_ports port 1025-65535    # unregistered ports

# acl Safe_ports port 70          # gopher
# acl Safe_ports port 210         # wais
# acl Safe_ports port 280         # http-mgmt
# acl Safe_ports port 488         # gss-http
# acl Safe_ports port 591         # filemaker
# acl Safe_ports port 777         # multiling http

acl CONNECT method CONNECT

# Only allow cachemgr access from localhost
http_access allow manager trusted
http_access deny  manager

# Deny requests to specified unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# To be documented:
# http_access deny to_localhost

#---------------------------------------------------------------------

# acl blocksites url_regex -i "__META_PREFIX__/etc/squid-block.acl"
# http_access deny blocksites

acl SedoParking dst 82.98.86.0/24
http_access deny SedoParking

#---------------------------------------------------------------------

acl  purge method PURGE
http_access allow purge trusted
http_access deny  purge

http_access allow trusted
http_access deny  all

#---------------------------------------------------------------------

http_port 3128 accel ssl-bump \
tls-cert=__META_PREFIX__/etc/ssl/squid-ca.pem \
generate-host-certificates=on \
dynamic_cert_mem_cache_size=16MB

ssl_bump bump all

#---------------------------------------------------------------------

# To be documented:
# hierarchy_stoplist cgi-bin ?

#---------------------------------------------------------------------

# To use a disk cache, uncomment the  "cache_dir"  and  "coredump_dir"
# settings and  change the specified directory path as desired.  Addi-
# tionally, create the specified  directory and "chmod" it to 777  or,
# alternately, "chown" it to nobody.nogroup and "chmod" it to 770. The
# second approach is more secure.  Finally,  change the number  before
# "256 256" here to the desired maximum disk-cache size,  expressed in
# megabytes. If the disk cache directory is located in a RAM disk, the
# number should be small (possibly 15).  Otherwise,  use 100 to 100000
# or above  (depending on the free space in the associated disk parti-
# tion).

# To use a memory cache only (without a disk cache),  comment-out  the
# "cache_dir" and "coredump_dir" settings.

cache_dir ufs __META_CACHEDIR__ 20000 256 256
coredump_dir  __META_CACHEDIR__

#---------------------------------------------------------------------

# These  settings  set up a copy of "squid" for archival purposes.  If
# this works  correctly,  files that go in  aren't  updated or expired
# [for about 100 years].

refresh_pattern . 52560000 100% 52560000 \
override-expire override-lastmod \
ignore-reload   ignore-no-cache \
ignore-no-store ignore-private

offline_mode on

#---------------------------------------------------------------------

# For  a safe setup  that should  work with most systems,  "cache_mem"
# should be set to: 32 MB

# For systems with a large amount of RAM, "cache_mem" should be set to
# a larger value, possibly 64 MB or 128 MB.

cache_mem 32 MB
