# How many instances of our filter to we want running
redirect_children 5

on_unsupported_protocol tunnel all

acl blocked_websites dstdomain "/etc/squid/blocked.acl"
http_access deny blocked_websites

acl ssl_bypass_domains ssl::server_name "/etc/squid/ssl_bump_bypass_domains.conf"
acl ssl_bypass_ips     dst              "/etc/squid/ssl_bump_bypass_ips.conf"

deny_info ERR_ACCESS_DENIED  blocked_websites
acl step1 at_step SslBump1
ssl_bump peek step1
ssl_bump splice ssl_bypass_domains
ssl_bump splice ssl_bypass_ips
ssl_bump bump all

acl CONNECT method CONNECT

# The following two lines are an example of how we can leaverage squid to block ports, there can be as
# many acl statements adding ports to Safe_ports as are needed.
#acl Safe_ports port 443         # https
#http_access deny !Safe_ports

# Users need to connect to non 443 ports for https traffic. We comment out the standard deny here.
#acl SSL_ports port 443
#http_access deny CONNECT !SSL_ports

http_access allow localhost manager
http_access deny manager
http_access allow localhost
http_access deny all

#http_port 3128
http_port 3128 ssl-bump cert=/usr/local/squid/etc/ssl_cert/squid.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB
sslcrtd_program /usr/local/squid/libexec/security_file_certgen -s /usr/local/squid/var/logs/ssl_db -M 4MB

http_upgrade_request_protocols OTHER allow all

coredump_dir /var/spool/squid

refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern (Release|Packages(.gz)*)$      0       20%     2880
refresh_pattern .               0       20%     4320

forwarded_for delete
via off

url_rewrite_program /bin/bash -c "/etc/squid/kasm_squid_adapter"

# Ensure compatibility with base operating systems by using a sane number of file descriptors
max_filedescriptors 1048576

