# The only route out of the dev-server worker.
#
# It allows CONNECT tunnels to the package registries and refuses everything else. There is no
# interception and no certificate of ours in the middle: the proxy sees the host a client asks for
# and nothing more. That is the whole boundary, and it is worth being clear about what it is not -
# a package pulled from an allowed registry is still third-party code, which is why installs run
# with scripts disabled.
#
# Add a host here only when an install has failed for the want of it, and add the exact host.

http_port 3128

# One directive per line, and each domain written with a leading dot so it covers the host and
# its subdomains. Squid refuses a list that names both a domain and something beneath it, so
# registry.npmjs.org is not spelled out: .npmjs.org already includes it.
acl registries dstdomain .npmjs.org
acl registries dstdomain .pypi.org
acl registries dstdomain .pythonhosted.org
acl registries dstdomain .maven.apache.org
acl registries dstdomain .maven.org

acl ssl_ports port 443
acl connect_method method CONNECT

# CONNECT to an allowed registry on 443, and that is all. Plain HTTP is not allowed even to these
# hosts: every one of them serves HTTPS, so a plain request would be a downgrade, not a fallback.
http_access allow connect_method registries ssl_ports
http_access deny all

# Nothing is cached: with no cache there is no cache to poison, and the measured benefit of
# caching was npm's alone - where the worker's own shared npm cache already provides it.
cache deny all
cache_mem 8 MB

# Left at squid's own defaults, under /var/log/squid inside the container. Pointing them at
# /dev/stdout so they would reach `docker logs` does not work here: squid drops to the proxy user
# and the container's stdout is a root-owned pipe, which it then cannot open - and squid treats
# that as fatal, so the proxy would not start at all.
#
#   docker compose logs egress-proxy                  startup and configuration errors
#   docker compose exec egress-proxy tail -f /var/log/squid/access.log    who asked for what

# A client that cannot reach the internet should learn so quickly rather than hang.
connect_timeout 15 seconds
request_timeout 60 seconds

forwarded_for delete
httpd_suppress_version_string on