# Copy to .env and fill in. docker compose picks .env up automatically.
#
# Squid SSL-bump caching forward proxy. Unlike the other stacks there is NO
# public hostname / Let's Encrypt cert -- this is a forward proxy. The TLS
# interception CA is generated on first deploy (deploy.sh) and never overwritten.

# ─── Who may use the proxy ──────────────────────────────────────────────────
# Space-separated CIDR(s) allowed to connect (Squid http_access). This is the
# REAL access gate -- keep it tight. Examples: 100.64.0.0/10 (Tailscale CGNAT),
# 10.0.0.0/8, 192.168.0.0/16.
TRUSTED_CIDR=100.64.0.0/10

# Host interface/IP to publish the proxy on, and the host-side port. Pin
# BIND_ADDR to a trusted interface (e.g. your Tailscale IP) -- a published
# Docker port BYPASSES the host INPUT firewall, so 0.0.0.0 exposes the proxy to
# every reachable network. Use 0.0.0.0 only if TRUSTED_CIDR + upstream
# firewalling already cover you.
BIND_ADDR=0.0.0.0
PROXY_PORT=3128

# ─── Cache sizing ───────────────────────────────────────────────────────────
CACHE_SIZE_MB=5000        # on-disk cache budget (MB)
MAX_OBJECT_SIZE_MB=256    # largest single object to cache (raise for ISOs/images)
CACHE_MEM_MB=256          # in-memory hot cache (MB)

# ─── Cache scope ────────────────────────────────────────────────────────────
# 0 = boost mode (default): cache everything per normal HTTP rules, and
#     force-cache the domains in cache-domains.txt / .regex with long TTLs.
# 1 = strict allowlist: store ONLY the listed domains; pass the rest through.
CACHE_ONLY_LISTED=0

# ─── TLS interception CA (generated on first deploy) ────────────────────────
CA_CN=Squid Proxy CA
CA_O=automations
CA_DAYS=3650
DYNAMIC_CERT_MEM_MB=8     # in-RAM cache of generated per-host leaf certs (MB)

# ─── Misc ───────────────────────────────────────────────────────────────────
VISIBLE_HOSTNAME=squid-proxy
# Local build tag for the image (built from ./Dockerfile).
SQUID_IMAGE_TAG=automations/squid:latest