49 lines
2.2 KiB
Plaintext
49 lines
2.2 KiB
Plaintext
# The only route out of the dev-server worker.
|
|
#
|
|
# It allows CONNECT tunnels to the package registries and refuses everything else. There is no
|
|
# interception and no certificate of ours in the middle: the proxy sees the host a client asks for
|
|
# and nothing more. That is the whole boundary, and it is worth being clear about what it is not -
|
|
# a package pulled from an allowed registry is still third-party code, which is why installs run
|
|
# with scripts disabled.
|
|
#
|
|
# Add a host here only when an install has failed for the want of it, and add the exact host.
|
|
|
|
http_port 3128
|
|
|
|
# One directive per line, and each domain written with a leading dot so it covers the host and
|
|
# its subdomains. Squid refuses a list that names both a domain and something beneath it, so
|
|
# registry.npmjs.org is not spelled out: .npmjs.org already includes it.
|
|
acl registries dstdomain .npmjs.org
|
|
acl registries dstdomain .pypi.org
|
|
acl registries dstdomain .pythonhosted.org
|
|
acl registries dstdomain .maven.apache.org
|
|
acl registries dstdomain .maven.org
|
|
|
|
acl ssl_ports port 443
|
|
acl connect_method method CONNECT
|
|
|
|
# CONNECT to an allowed registry on 443, and that is all. Plain HTTP is not allowed even to these
|
|
# hosts: every one of them serves HTTPS, so a plain request would be a downgrade, not a fallback.
|
|
http_access allow connect_method registries ssl_ports
|
|
http_access deny all
|
|
|
|
# Nothing is cached: with no cache there is no cache to poison, and the measured benefit of
|
|
# caching was npm's alone - where the worker's own shared npm cache already provides it.
|
|
cache deny all
|
|
cache_mem 8 MB
|
|
|
|
# Left at squid's own defaults, under /var/log/squid inside the container. Pointing them at
|
|
# /dev/stdout so they would reach `docker logs` does not work here: squid drops to the proxy user
|
|
# and the container's stdout is a root-owned pipe, which it then cannot open - and squid treats
|
|
# that as fatal, so the proxy would not start at all.
|
|
#
|
|
# docker compose logs egress-proxy startup and configuration errors
|
|
# docker compose exec egress-proxy tail -f /var/log/squid/access.log who asked for what
|
|
|
|
# A client that cannot reach the internet should learn so quickly rather than hang.
|
|
connect_timeout 15 seconds
|
|
request_timeout 60 seconds
|
|
|
|
forwarded_for delete
|
|
httpd_suppress_version_string on
|