mirror of
https://github.com/Heretek-AI/The-Agency.git
synced 2026-11-07 10:06:01 -10:00
John Smith
ca822e0d6f
Squid denies unauthenticated requests before the destination rules so every audit line carries the expert name. Entrypoint removes the stale pid file (pid 1 in containers makes restarts see ghosts). All scripts executable. Renderer emits lowercase proxy mirrors.
43 lines
1.7 KiB
SquidConf
43 lines
1.7 KiB
SquidConf
# GENERATED, do not edit. Source: shared/templates/squid.conf.tmpl
|
|
# Rendered by scripts/render.ts from fleet.yaml and mcp/registry.jsonc.
|
|
# The allowlist file is mounted at /etc/squid/allowlist.txt; the password file is
|
|
# created at container start by the egress entrypoint from PROXY_PW_<NAME>.
|
|
http_port 3128
|
|
visible_hostname egress
|
|
# Writable by the unprivileged proxy user (the container drops ALL
|
|
# capabilities, so /run is out of reach).
|
|
pid_filename /var/log/squid/squid.pid
|
|
forwarded_for delete
|
|
via off
|
|
cache deny all
|
|
|
|
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd
|
|
auth_param basic children 5
|
|
auth_param basic realm Agency egress proxy
|
|
auth_param basic credentialsttl 1 hour
|
|
|
|
acl SSL_ports port 443 80
|
|
acl Safe_ports port 80 443
|
|
acl CONNECT method CONNECT
|
|
acl authed proxy_auth REQUIRED
|
|
acl allowed dstdomain "/etc/squid/allowlist.txt"
|
|
acl to_private dst 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 127.0.0.0/8 169.254.0.0/16 fc00::/7 fe80::/10 ::1/128
|
|
acl to_localhost dst 127.0.0.0/8
|
|
|
|
# One log line per request: time, elapsed, client, verdict/code, size,
|
|
# method, URL, and the expert's proxy username.
|
|
logformat agency %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %un
|
|
access_log stdio:/var/log/squid/access.log agency
|
|
|
|
# Deny first: authentication is required before anything else so every
|
|
# logged line carries the expert's name; then private, loopback,
|
|
# link-local, and metadata destinations are denied whatever the allowlist
|
|
# says. Only then the allowlist, then deny.
|
|
http_access deny !authed
|
|
http_access deny to_private
|
|
http_access deny to_localhost
|
|
http_access deny CONNECT !SSL_ports
|
|
http_access deny !Safe_ports
|
|
http_access allow authed allowed
|
|
http_access deny all
|