# This configuration file requires squid 2.5+. It is untested with squid 3.x.
# BASIC CONFIGURATION
# ------------------------------------------------------------------------------
# port on which to listen
http_port 8080
# set cache directory and size (6000 MB) - be sure to set the cache size to
# about 10% less than the physical space available to leave room for squid's
# swap files and other temp files
cache_dir ufs /var/spool/squid 6000 16 256
cache_mgr jimendez@jornada.com.mx
cache_effective_user proxy
# set squid up as a web accelerator
httpd_accel_host virtual
httpd_accel_port 0
httpd_accel_uses_host_header on
half_closed_clients off
server_persistent_connections off
client_persistent_connections off
# LOGS
# ------------------------------------------------------------------------------
log_icp_queries off
#cache_access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log
#emulate_httpd_log on
#logformat combined %>a %ui %un [%{%d/%b/%Y:%H:%M:%S +0000}tl] "%rm %ru HTTP/%rv" %Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh
#cache_access_log /var/log/squid/access.log combined
# RESOURCES
# ------------------------------------------------------------------------------
# amount of memory used for caching recently accessed objects - defaults to 8 MB
cache_mem 128 MB
maximum_object_size 10 MB # max cached object size
maximum_object_size_in_memory 300 KB # max cached-in-memory object size
# ACCESS CONTROL
# ------------------------------------------------------------------------------
# Basic ACLs
acl all src 0.0.0.0/0.0.0.0
acl localhost src 127.0.0.1/32
#acl ssl_ports port 443 563
acl safe_ports port 3128 8080
acl zope_servers src www.jornada.unam.mx
acl manager proto cache_object
acl connect method connect
# deny requests to unknown ports
http_access deny !safe_ports
acl accelerated_protocols proto http https
acl accelerated_domains dstdomain www.jornada.unam.mx
acl accelerated_ports myport 8080
http_access allow accelerated_domains accelerated_ports accelerated_protocols
# Purge access - zope servers can purge but nobody else
acl purge method PURGE
http_access allow zope_servers purge
http_access deny purge
# Reply access
http_reply_access allow all
# Cache manager setup - cache manager can only connect from localhost
# only allow cache manager access from localhost
http_access allow manager localhost
#http_access deny manager
# deny connect to other than ssl ports
#http_access deny connect !ssl_ports
#mgr:info for localhost:
#acl report src www.jornada.unam.mx
#http_access allow report
# ICP access - anybody can access icp methods
icp_access allow localhost
# And finally deny all other access to this proxy
http_access deny all
# CACHE PEERS
# ------------------------------------------------------------------------------
# CONFIGURE THE CACHE PEERS. FIRST PORT IS THE HTTP PORT, SECOND PORT
# IS THE ICP PORT. REMEMBER TO ENABLE 'icp-server' ON YOUR 'zope.conf'
# LISTENING ON THE ICP PORT YOU USE HERE.
# acl in_backendpool dstdomain backendpool
# cache_peer 127.0.0.1 parent 8080 9090 no-digest no-netdb-exchange
# cache_peer 192.168.0.3 parent 8081 9091 no-digest no-netdb-exchange
# cache_peer_access 127.0.0.1 allow in_backendpool
# cache_peer_access 127.0.0.1 deny all
# cache_peer_access 192.168.0.3 allow in_backendpool
# cache_peer_access 192.168.0.3 deny all
# IF YOU NEED TO FORWARD REQUESTS TO HOSTS NOT IN THE POOL THIS IS
# WHERE YOU ALLOW THE TARGET DOMAINS
# acl local_servers dstdomain some.mysite.com other.mysite.com
# always_direct allow local_servers
# THE FOLLOWING DIRECTIVE IS NEEDED TO MAKE 'backendpool' RESOLVE TO
# THE POOL OF CACHE PEERS.
# never_direct allow all
# icp_access allow all
# PROXY ON, NEEDED TO MAKE CACHE PEERS INTERCOMMUNICATE
# httpd_accel_with_proxy on
# REDIRECTOR PROGRAM
# ------------------------------------------------------------------------------
redirect_program /etc/httpd/squid/iRedirector.py
redirect_children 50
redirect_rewrites_host_header off
# SPECIFY WHAT REQUESTS SQUID SHOULD CACHE
# ------------------------------------------------------------------------------
# Control what squid caches. We want to have squid handle content that is not
# personalized and that does not require any kind of authorization.
#
# 1) Always cache static content in squid
acl static_content urlpath_regex -i \.(jpg|jpeg|gif|png|tiff|tif|svg|swf|ico|css|js|vsd|doc|ppt|pps|xls|pdf|mp3|mp4|m4a|ogg|mov|avi|wmv|sxw|zip|gz|bz2|tgz|tar|rar|odc|odb|odf|odg|odi|odp|ods|odt|sxc|sxd|sxi|sxw|dmg|torrent|deb|msi|iso|rpm)$
no_cache allow static_content
# 2) (OPTIONAL) Prevent squid from caching an item that is the result of a POST
acl post_requests method POST
no_cache deny post_requests
# 3) (OPTIONAL) Prevent squid from caching items with items in the query string
# If this is uncommented, squid will treat a url with 2 different query strings
# as 2 different urls when caching.
# 4) Prevent squid from caching requests from authenticated users or conditional
# GETs with an If-None-Match header (since squid doesn't know about ETags)
# We use an external python method to check these conditions and pass in the
# value of the __ac cookie (two different ways to allow for different cookie
# delimiters), the HTTP Authorization header, and the If-None-Match header.
#
# Squid caches the results of the external python method, so for debugging, set
# the options ttl=0 negative_ttl=0 so you can see what is going on
# external_acl_type is_cacheable_type children=20 ttl=0 negative_ttl=0 %{Cookie:__ac} %{Cookie:;__ac} %{Authorization} %{If-None-Match} /etc/httpd/squid/squidAcl.py
external_acl_type is_cacheable_type children=20 %{Cookie:__ac} %{Cookie:;__ac} %{Authorization} %{If-None-Match} /etc/httpd/squid/squidAcl.py
acl is_cacheable external is_cacheable_type
no_cache allow is_cacheable
# Explicitly disallow squid from handling anything else
no_cache deny all
# SPECIFY EFFECTS OF A BROWSER REFRESH
# ------------------------------------------------------------------------------
# RELOAD_INTO_IMS CAUSES WEIRD SQUID BEHAVIOR - IT APPEARS TO CAUSE FILES WITH
# INAPPROPRIATE HEADERS TO END UP IN THE CACHE, AND AS A RESULT BROWSERS END
# UP MAKING LOTS OF EXTRA (CONDITIONAL) REQUESTS WHEN THEY WOULD OTHERWISE MAKE
# NO REQUESTS. DO NOT USE!
# Tell squid how to handle expiration times for content with no explicit expiration
# Assume static content is fresh for at least an hour and at most a day
#refresh_pattern -i \.(jpg|jpeg|gif|png|tiff|tif|svg|swf|ico|css|js|vsd|doc|ppt|pps|xls|pdf|mp3|mp4|m4a|ogg|mov|avi|wmv|sxw|zip|gz|bz2|tar|rar|odc|odb|odf|odg|odi|odp|ods|odt|sxc|sxd|sxi|sxw|dmg|torrent|deb|msi|iso|rpm)$ 60 50% 1440 reload-into-ims
#refresh_pattern . 0 20% 1440
# Change force-refresh requests into conditional gets using if-modified-since
#reload_into_ims on
# DEBUGGING
# ------------------------------------------------------------------------------
# debug_options ALL,1 33,2 # use this for debugging acls
# debug_options ALL,8
# MISCELLANEOUS
# ------------------------------------------------------------------------------
# have squid handle all requests with ranges
# range_offset_limit -1
# amount of time squid waits for existing requests to be serviced before shutting down
shutdown_lifetime 1 seconds
# allow squid to process multiple requests simultaneously if client is pipelining
pipeline_prefetch on
# allow white spaces to be included in URLs
uri_whitespace allow
# OTHER PARAMETERS THAT MAY BE OF INTEREST
# ------------------------------------------------------------------------------
logfile_rotate 1
# reload_into_ims off
# error_directory /usr/share/squid/errors/
refresh_pattern . 60 20% 4320 reload-into-ims