# RootNode Academy shared egress proxy — one instance, not per-student.
# Destination allowlisting only; the firewall (egress.js) is the actual enforcement boundary
# that makes this proxy unbypassable, not the other way around
# (docs/PHASE1_PLATFORM_FOUNDATION.md §5/§6, correction B).

http_port 3128

acl allowed_dst dstdomain "/etc/squid/allowlist.txt"
acl SSL_ports port 443
acl Safe_ports port 80 443
acl CONNECT method CONNECT

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow allowed_dst
http_access deny all

# Audit/troubleshooting log — requirement #7. Squid's default access log format already
# includes timestamp, client IP, method, URL, and result code, which is what "why did this
# scenario's image pull fail" support needs.
access_log /var/log/squid/access.log squid
cache deny all