# squid.conf.tmpl
#
# Rendered to /etc/squid/squid.conf by entrypoint.sh at container start:
#   - @VAR@ placeholders are substituted from the environment (.env);
#   - the cache policy (boost ACLs, storage gate, per-domain refresh_patterns)
#     is generated from cache-domains.txt / .regex into the include below.
#
# Role: EXPLICIT forward proxy with SSL-bump. Clients set HTTP(S)_PROXY to this
# host:3128. (Transparent/intercepting mode is future work -- see README.)

visible_hostname @VISIBLE_HOSTNAME@

# ── Listener: explicit proxy, SSL-bump enabled ──────────────────────────────
# tls-cert/tls-key are the local CA used to mint per-host leaf certs on the fly.
# The key is staged into /run by the entrypoint so the squid user can read it
# while the on-host key file stays 0600 root.
http_port 3128 ssl-bump \
  tls-cert=/run/squid/ca-cert.pem \
  tls-key=/run/squid/ca-key.pem \
  generate-host-certificates=on \
  dynamic_cert_mem_cache_size=@DYNAMIC_CERT_MEM_MB@MB

sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/lib/squid/ssl_db -M @DYNAMIC_CERT_MEM_MB@MB
sslcrtd_children 8 startup=1 idle=1

# Validate UPSTREAM certificates -- never silently MITM a broken origin cert.
sslproxy_cert_error deny all

# ── SSL-bump policy: peek at SNI → splice allowlist → bump everything else ──
acl step1 at_step SslBump1
acl splice_dom ssl::server_name "/etc/squid/splice-domains.txt"
ssl_bump peek step1
ssl_bump splice splice_dom
ssl_bump bump all

# ── Access control: deny-by-default, trusted clients only ───────────────────
acl SSL_ports port 443
acl Safe_ports port 80 443 21 70 210 1025-65535 280 488 591 777
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

# Cache manager: localhost only (used by the container healthcheck).
http_access allow localhost manager
http_access deny manager

acl trusted_clients src @TRUSTED_CIDR@
http_access allow localhost
http_access allow trusted_clients
http_access deny all

# ── Cache sizing ────────────────────────────────────────────────────────────
cache_mem @CACHE_MEM_MB@ MB
maximum_object_size_in_memory 1 MB
maximum_object_size @MAX_OBJECT_SIZE_MB@ MB
cache_dir ufs /var/cache/squid @CACHE_SIZE_MB@ 16 256
coredump_dir /var/cache/squid

# ── Cache policy (generated: boost ACLs, storage gate, per-domain TTLs) ─────
include /etc/squid/conf.d/cache-policy.conf

# Base refresh patterns (fallbacks; per-domain boosts live in the include and
# are matched first). Packages get long, confident TTLs; everything else is
# conservative and revalidates.
refresh_pattern -i \.(deb|rpm|apk|pkg|tar\.(gz|xz|zst|bz2)|whl|jar)$ 10080 100% 43200
refresh_pattern .  0  20%  4320

# ── Logging ─────────────────────────────────────────────────────────────────
access_log stdio:/var/log/squid/access.log
cache_log /var/log/squid/cache.log
logfile_rotate 7

# ── Privilege drop / lifecycle ──────────────────────────────────────────────
cache_effective_user squid
pid_filename /run/squid.pid
shutdown_lifetime 5 seconds