<tal:def define="global ports python:protocol_port_map.values();
                 global protocols python:protocol_port_map.keys();
		 global hosts python:host_zope_map.keys();
		 global zope_hosts python:unique_values([d['zope_host'] for d in host_zope_map.values()]);
"
/>
# This configuration file requires squid 2.5+.  It is untested with squid 3.x.

# BASIC CONFIGURATION
# ------------------------------------------------------------------------------

<tal:effective_user tal:condition="not:squid_direct">
# The user and group that squid will run as when started as root
# (ignored if you don't run squid as root)
cache_effective_user <tal:user replace="squid_user" />
cache_effective_group <tal:user replace="squid_user" />
</tal:effective_user>

# port on which to listen
<tal:port condition="squid_direct">http_port 80</tal:port>
<tal:port condition="not:squid_direct">http_port <tal:port replace="squid_port" /></tal:port>

# set cache directory and size (<tal:dir replace="squid_cache_size_mb" /> MB) - be sure to set the cache size to
# about 10% less than the physical space available to leave room for squid's
# swap files and other temp files
cache_dir ufs <tal:dir replace="squid_cache_dir" /> <tal:dir replace="squid_cache_size_mb" /> 16 256
cache_mgr <tal:email replace="squid_admin_email" />

# set squid up as a web accelerator
httpd_accel_host virtual
httpd_accel_port 0
httpd_accel_uses_host_header on


# LOGS
# ------------------------------------------------------------------------------
log_icp_queries off
# cache_access_log /var/log/squid/access.log
# cache_log /var/log/squid/cache.log
# cache_store_log /var/log/squid/store.log
# emulate_httpd_log off


# RESOURCES
# ------------------------------------------------------------------------------
# amount of memory used for caching recently accessed objects - defaults to 8 MB
cache_mem 64 MB  
maximum_object_size 10 MB 		# max cached object size
maximum_object_size_in_memory 300 KB	# max cached-in-memory object size


# ACCESS CONTROL
# ------------------------------------------------------------------------------

# Basic ACLs
acl all src 0.0.0.0/0.0.0.0
acl localhost src 127.0.0.1/32
acl ssl_ports port 443 563
acl safe_ports port 80 443

acl zope_servers src <tal:ips repeat="ip zope_hosts"><tal:ip replace="ip" /> </tal:ips>
acl manager proto cache_object
acl connect method connect

<tal:acl tal:condition="squid_direct">
# deny requests to unknown ports
http_access deny !safe_ports

acl accelerated_protocols proto http https
acl accelerated_domains dstdomain <tal:hosts repeat="host hosts"><tal:host replace="host" /> </tal:hosts>
acl accelerated_ports myport <tal:ports repeat="port ports"><tal:port replace="port" /> </tal:ports>

http_access allow accelerated_domains accelerated_ports accelerated_protocols
</tal:acl><tal:acl tal:condition="not:squid_direct">
# Assumes apache rewrite rule looks like this:
# RewriteRule ^/(.*)/$ http://127.0.0.1:3128/http/%{SERVER_NAME}/80/$1 [L,P]
acl accelerated_protocols proto http
acl accelerated_hosts dst 127.0.0.0/8
acl accelerated_ports myport <tal:port replace="squid_port" />
<tal:proto repeat="ppinfo python:protocol_port_map.items()"><tal:hosts tal:define="proto python:ppinfo[0]; port python:ppinfo[1];" repeat="host hosts">
acl accelerated_urls urlpath_regex ^/<tal:proto replace="proto" />/<tal:host replace="host" />/<tal:port replace="port" /></tal:hosts></tal:proto>
http_access allow accelerated_hosts accelerated_ports accelerated_urls accelerated_protocols
</tal:acl>

# Purge access - zope servers can purge but nobody else
acl purge method PURGE
http_access allow zope_servers purge
http_access deny purge

# Reply access
http_reply_access allow all

# Cache manager setup - cache manager can only connect from localhost
# only allow cache manager access from localhost
http_access allow manager localhost
http_access deny manager
# deny connect to other than ssl ports
http_access deny connect !ssl_ports

# ICP access - anybody can access icp methods
icp_access allow localhost

# And finally deny all other access to this proxy
http_access deny all


# CACHE PEERS
# ------------------------------------------------------------------------------

# CONFIGURE THE CACHE PEERS. FIRST PORT IS THE HTTP PORT, SECOND PORT
# IS THE ICP PORT. REMEMBER TO ENABLE 'icp-server' ON YOUR 'zope.conf'
# LISTENING ON THE ICP PORT YOU USE HERE.
# acl in_backendpool dstdomain backendpool
# cache_peer 127.0.0.1 parent 8080 9090 no-digest no-netdb-exchange
# cache_peer 192.168.0.3 parent 8081 9091 no-digest no-netdb-exchange

# cache_peer_access 127.0.0.1 allow in_backendpool
# cache_peer_access 127.0.0.1 deny all

# cache_peer_access 192.168.0.3 allow in_backendpool
# cache_peer_access 192.168.0.3 deny all

# IF YOU NEED TO FORWARD REQUESTS TO HOSTS NOT IN THE POOL THIS IS
# WHERE YOU ALLOW THE TARGET DOMAINS
# acl local_servers dstdomain some.mysite.com other.mysite.com
# always_direct allow local_servers

# THE FOLLOWING DIRECTIVE IS NEEDED TO MAKE 'backendpool' RESOLVE TO
# THE POOL OF CACHE PEERS.
# never_direct allow all
# icp_access allow all

# PROXY ON, NEEDED TO MAKE CACHE PEERS INTERCOMMUNICATE
# httpd_accel_with_proxy on


# REDIRECTOR PROGRAM
# ------------------------------------------------------------------------------

redirect_program <tal:dir replace="squid_config_dir" />/iRedirector.py
redirect_children 20
redirect_rewrites_host_header off


# SPECIFY WHAT REQUESTS SQUID SHOULD CACHE
# ------------------------------------------------------------------------------

# Control what squid caches.  We want to have squid handle content that is not
# personalized and that does not require any kind of authorization.
#
# 1) Always cache static content in squid

acl static_content urlpath_regex -i \.(jpg|jpeg|gif|png|tiff|tif|svg|swf|ico|css|js|vsd|doc|ppt|pps|xls|pdf|mp3|mp4|m4a|ogg|mov|avi|wmv|sxw|zip|gz|bz2|tgz|tar|rar|odc|odb|odf|odg|odi|odp|ods|odt|sxc|sxd|sxi|sxw|dmg|torrent|deb|msi|iso|rpm)$
no_cache allow static_content

# 2) (OPTIONAL) Prevent squid from caching an item that is the result of a POST

acl post_requests method POST
no_cache deny post_requests

# 3) (OPTIONAL) Prevent squid from caching items with items in the query string
# If this is uncommented, squid will treat a url with 2 different query strings
# as 2 different urls when caching.


# 4) Prevent squid from caching requests from authenticated users or conditional
# GETs with an If-None-Match header (since squid doesn't know about ETags)
# We use an external python method to check these conditions and pass in the
# value of the __ac cookie (two different ways to allow for different cookie
# delimiters), the HTTP Authorization header, and the If-None-Match header.
#
# Squid caches the results of the external python method, so for debugging, set
# the options ttl=0 negative_ttl=0 so you can see what is going on

# external_acl_type is_cacheable_type children=20 ttl=0 negative_ttl=0 %{Cookie:__ac} %{Cookie:;__ac} %{Authorization} %{If-None-Match} <tal:dir replace="squid_config_dir" />/squidAcl.py

external_acl_type is_cacheable_type children=20 %{Cookie:__ac} %{Cookie:;__ac} %{Authorization} %{If-None-Match} <tal:dir replace="squid_config_dir" />/squidAcl.py
acl is_cacheable external is_cacheable_type
no_cache allow is_cacheable

# Explicitly disallow squid from handling anything else
no_cache deny all


# SPECIFY EFFECTS OF A BROWSER REFRESH
# ------------------------------------------------------------------------------

# RELOAD_INTO_IMS CAUSES WEIRD SQUID BEHAVIOR - IT APPEARS TO CAUSE FILES WITH
# INAPPROPRIATE HEADERS TO END UP IN THE CACHE, AND AS A RESULT BROWSERS END
# UP MAKING LOTS OF EXTRA (CONDITIONAL) REQUESTS WHEN THEY WOULD OTHERWISE MAKE
# NO REQUESTS.  DO NOT USE!

# Tell squid how to handle expiration times for content with no explicit expiration
# Assume static content is fresh for at least an hour and at most a day
#refresh_pattern -i  \.(jpg|jpeg|gif|png|tiff|tif|svg|swf|ico|css|js|vsd|doc|ppt|pps|xls|pdf|mp3|mp4|m4a|ogg|mov|avi|wmv|sxw|zip|gz|bz2|tar|rar|odc|odb|odf|odg|odi|odp|ods|odt|sxc|sxd|sxi|sxw|dmg|torrent|deb|msi|iso|rpm)$ 60 50% 1440 reload-into-ims
#refresh_pattern . 0 20%	1440

# Change force-refresh requests into conditional gets using if-modified-since
#reload_into_ims on

# DEBUGGING
# ------------------------------------------------------------------------------
# debug_options ALL,1 33,2 # use this for debugging acls
# debug_options ALL,8


# MISCELLANEOUS
# ------------------------------------------------------------------------------
# have squid handle all requests with ranges
# range_offset_limit -1

# amount of time squid waits for existing requests to be serviced before shutting down
shutdown_lifetime 1 seconds

# allow squid to process multiple requests simultaneously if client is pipelining
pipeline_prefetch on

# allow white spaces to be included in URLs
uri_whitespace allow


# OTHER PARAMETERS THAT MAY BE OF INTEREST
# ------------------------------------------------------------------------------

# logfile_rotate 0
# reload_into_ims off
# error_directory /usr/share/squid/errors/

 
