38 lines
1.6 KiB
SquidConf
38 lines
1.6 KiB
SquidConf
# MAESTRO explicit forward-proxy policy template.
|
|
#
|
|
# This file deliberately starts with one RFC 6761 .invalid canary. Replace the
|
|
# host with an operator-approved exact hostname before enabling production
|
|
# traffic. Do not add a leading dot: `.example.com` also permits subdomains.
|
|
# Give each hostname+port pair its own two ACLs and one http_access line.
|
|
|
|
# Dedicated address reserved for this proxy. Do not bind another service here:
|
|
# systemd IPAddressAllow is address-based and cannot restrict the port.
|
|
http_port 127.0.0.2:3128
|
|
|
|
# Example exact pair: allowed.egress.invalid:443. This domain cannot resolve on
|
|
# the public DNS and therefore fails closed until the operator replaces it.
|
|
acl maestro_llm_host dstdomain -n allowed.egress.invalid
|
|
acl maestro_llm_port port 443
|
|
|
|
acl CONNECT method CONNECT
|
|
acl supported_methods method GET HEAD POST PUT PATCH DELETE OPTIONS CONNECT
|
|
|
|
# Reject unlisted methods, then allow only an exact hostname+port pair.
|
|
http_access deny !supported_methods
|
|
http_access allow maestro_llm_host maestro_llm_port
|
|
http_access deny all
|
|
|
|
# Forward only. Do not retain content or per-request access records.
|
|
cache deny all
|
|
cache_store_log none
|
|
access_log none
|
|
|
|
# Keep operational diagnostics from becoming a second request log.
|
|
debug_options ALL,0
|
|
|
|
# Optional short-lived metadata observation profile. It omits URL/path/query,
|
|
# request and response headers, bodies, and DNS names. Enabling it still records
|
|
# destination IP and timing, so review retention and file permissions first.
|
|
# logformat maestro_meta %ts.%03tu %rm %<A:%<p %Ss/%03>Hs %<st %tr
|
|
# access_log daemon:/var/log/squid/maestro-egress-metadata.log maestro_meta
|