# SQUID configuration for OLPC School server # April 2007 # ############################### # Network Interface {% if dansguardian_enabled %} http_port 127.0.0.1:3130 {% else %} http_port 0.0.0.0:3128 transparent {% endif %} icp_port 0 ############################## # Access Control Lists # These are used throughout this file # #acl manager proto cache_object # any match on url regular expression is immediately permitted acl allow_urlregex url_regex -i "/etc/{{ proxy }}/allowregex.rules" http_access allow allow_urlregex # a match on reqular expression denies access (enabled by gw_squid_whitelist variable) acl deny_urlregex url_regex -i "/etc/{{ proxy }}/denyregex.rules" # any match of ip address is immediately permitted acl f_dstaddress dst "/etc/{{ proxy }}/dstaddress.rules" http_access allow f_dstaddress ## domain names: # define a group of domains that may be denied below acl whitelist dstdomain "/etc/{{ proxy }}/sites.whitelist.txt" acl school src 172.18.0.0/16 acl localhost src 127.0.0.1/32 acl to_localhost dst 127.0.0.0/8 acl to_schoolserver dst 178.16.0.0/16 # to schoolserver or other local hosts. acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp {% if gw_block_https == True %} #acl Safe_ports port 443 # https {% else %} acl Safe_ports port 443 # https {% endif %} acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT acl QUERY urlpath_regex cgi-bin \? acl apache rep_header Server ^Apache ############### # # Append the search domain # # This means that requests for 'http://schoolserver/' # get resolved the way you would expect (using the same # search domain that laptops and the XS have defined in # resolv.conf # # NOTE: it must start with a dot # append_domain .{{ iiab_domain }} ############################### # Cache controls # The default is to cache everything # The following prevents caching of known scripts, etc cache deny QUERY # Don't cache or otherwise meddle with local requests. always_direct allow to_schoolserver cache deny to_schoolserver # Common server don't quite work right... # Apache mod_gzip and mod_deflate known to be broken so don't trust # Apache to signal ETag correctly on such responses ### Not ported to v3 ###broken_vary_encoding allow apache ############################### # Cache Tuning # # Memory cache size cache_mem 100 MB # Cache object replacement hysteresis cache_swap_low 92 cache_swap_high 95 # Maximum object size cached maximum_object_size 32 MB # Maximum object size cached in memory maximum_object_size_in_memory 48 KB # For more information about the GDSF and LFUDA cache replacement # policies see http://www.hpl.hp.com/techreports/1999/HPL-1999-69.html # and http://fog.hpl.external.hp.com/techreports/98/HPL-98-173.html. cache_replacement_policy heap LFUDA memory_replacement_policy heap GDSF # IP cache tuning ipcache_size 4096 ipcache_low 93 ipcache_high 95 # Fully Qualified Domain Name cache (used other than loggin ?) fqdncache_size 1024 # Where is the cache stored on disk ? # Parameters # Type (ufs, aufs, or COSS) # | Where # | | Size (in MB) # | | | # | | | L1 (directories) # | | | | L2 (directories) # | | | | | #cache_dir aufs /library/cache 20000 32 256 cache_dir ufs /library/cache 200 16 128 ############################### # Logging # # What logformat should be used for debugging ? in trial ? logformat squid %ts.%03tu %6tr %>a %Ss/%03>Hs %