# General

http_port 3128
visible_hostname Proxy
forwarded_for delete
via off
cache_mem 2048 MB

# Log

logformat squid %tl.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<a %mt
access_log /var/log/squid/access.log squid

# Cache

coredump_dir /var/spool/squid

maximum_object_size 2048000000 bytes
cache_dir aufs /var/cache/squid 256000 128 256 max-size=2048000000
quick_abort_min -1


refresh_pattern dl-ssl.google.com  2160 100% 10080 ignore-no-cache reload-into-ims

#refresh_pattern http://dl-ssl.google.com/dl/linux/direct/mod-pagespeed-stable_current_i386.deb 129600 100% 129600 reload-into-ims
#refresh_pattern dl-ssl.google.com\/dl\/linux\/direct/.*\(.deb|.zip) 43200 80% 129600 reload-into-ims override-lastmod ignore-no-store refresh-ims store-stale 
#refresh_pattern ^http:\/\/dl-ssl.google.com.*\.(deb|zip)  43200 80% 129600 reload-into-ims
#refresh_pattern dl.google.com\/.*\.(deb)  129600 100% 129600 reload-into-ims
#refresh_pattern dl-ssl.google.com\/.*\.(deb)  129600 100% 129600 reload-into-ims


refresh_pattern -i appldnld\.apple\.com 129600 100% 129600 ignore-reload ignore-no-store override-expire override-lastmod ignore-must-revalidate
refresh_pattern -i phobos\.apple\.com 129600 100% 129600 ignore-reload ignore-no-store override-expire override-lastmod ignore-must-revalidate
refresh_pattern -i windowsupdate.com/.*\.(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims
refresh_pattern -i microsoft.com/.*\.(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims
refresh_pattern -i windows.com/.*\.(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims
refresh_pattern -i microsoft.com.akadns.net/.*\.(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims
refresh_pattern -i deploy.akamaitechnologies.com/.*\.(cab|exe|ms[i|u|f|p]|[ap]sf|wm[v|a]|dat|zip|psf) 43200 80% 129600 reload-into-ims
refresh_pattern -i download.oracle.com 5259487 20% 5259487 override-expire override-lastmod ignore-reload ignore-private ignore-auth

# refresh pattern for debs and udebs
#refresh_pattern deb$   129600 100% 129600 reload-into-ims
#refresh_pattern udeb$   129600 100% 129600 reload-into-ims
#refresh_pattern tar.gz$  129600 100% 129600 reload-into-ims

# always refresh Packages and Release files
refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
refresh_pattern \/Release(|\.gpg)$ 0 0% 0 refresh-ims
refresh_pattern \/InRelease$ 0 0% 0 refresh-ims
refresh_pattern \/(Translation-.*)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims

# handle meta-release and changelogs.ubuntu.com special
refresh_pattern changelogs.ubuntu.com/*  0  1% 1


#acl QUERY urlpath_regex cgi-bin \?
#cache deny QUERY

refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
#refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern -i cgi-bin        0       0%      0
refresh_pattern .               0       20%     4320

# Network ACL

acl localnet src 192.168.0.0/16 # RFC 1918 possible internal network
acl localnet src fc00::/7       # RFC 4193 local private network range
acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines

# Port ACL

acl SSL_ports port 443          # https
acl SSL_ports port 563          # snews
acl SSL_ports port 873          # rync
acl Safe_ports port 80 8080     # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443 563     # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl purge method PURGE
acl CONNECT method CONNECT

# Access Restrictions

http_access allow manager localhost localnet
http_access deny manager

http_access allow purge localhost
http_access deny purge

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

http_reply_access allow all
htcp_access deny all
icp_access allow all
always_direct allow all

# Request Headers Forcing

request_header_access Allow allow all
request_header_access Authorization allow all
request_header_access WWW-Authenticate allow all
request_header_access Proxy-Authorization allow all
request_header_access Proxy-Authenticate allow all
request_header_access Cache-Control allow all
request_header_access Content-Encoding allow all
request_header_access Content-Length allow all
request_header_access Content-Type allow all
request_header_access Date allow all
request_header_access Expires allow all
request_header_access Host allow all
request_header_access If-Modified-Since allow all
request_header_access Last-Modified allow all
request_header_access Location allow all
request_header_access Pragma allow all
request_header_access Accept allow all
request_header_access Accept-Charset allow all
request_header_access Accept-Encoding allow all
request_header_access Accept-Language allow all
request_header_access Content-Language allow all
request_header_access Mime-Version allow all
request_header_access Retry-After allow all
request_header_access Title allow all
request_header_access Connection allow all
request_header_access Proxy-Connection allow all
request_header_access User-Agent allow all
request_header_access Cookie allow all
request_header_access All deny all

# Response Headers Spoofing

reply_header_access Via deny all
reply_header_access X-Cache deny all
reply_header_access X-Cache-Lookup deny all


store_id_program /home/wall/store-id.pl /home/wall/store_db
store_id_children 5 startup=1


shutdown_lifetime 5