squid.conf

# Squid proxy for domain-based allowlisting
# Supports HTTPS CONNECT and HTTP to allowed domains only

# Domain allowlist (file-based for hot-reload via squid -k reconfigure)
acl allowed_domains dstdomain "/etc/squid/allowed-domains.txt"

# Port definitions
acl SSL_ports port 443
acl Safe_ports port 80
acl Safe_ports port 443
acl CONNECT method CONNECT

# Deny non-safe ports
http_access deny !Safe_ports

# Deny CONNECT to non-SSL ports
http_access deny CONNECT !SSL_ports

# Allow CONNECT (HTTPS) to allowed domains
http_access allow CONNECT allowed_domains

# Allow HTTP to allowed domains
http_access allow allowed_domains

# Deny everything else
http_access deny all

# Listening port
http_port 3128

# Use Docker's embedded DNS resolver
dns_nameservers 127.0.0.11

# Log to files writable by the squid user (squid drops privileges,
# so it can't write to /dev/stdout or /dev/stderr).
# Debug with: docker exec agent2-proxy cat /var/log/squid/access.log
access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log

# No caching — pure forwarding proxy
cache deny all

# Suppress version in error pages and headers
httpd_suppress_version_string on

# Fast shutdown for container stop
shutdown_lifetime 1 seconds

# Suppress hostname warning
visible_hostname proxy

# PID file
pid_filename /run/squid.pid

# Coredump directory (required by squid)
coredump_dir /var/cache/squid