# Squid transparent MITM proxy for E2E test network
# Intercepts HTTP/HTTPS from simulated machines and proxies to real internet

# Regular forward proxy port (required by Squid even in intercept mode)
http_port 3127

# Transparent interception ports
http_port 3128 intercept
https_port 3129 intercept ssl-bump \
    cert=/etc/squid/ssl/squid-ca.pem \
    generate-host-certificates=on \
    dynamic_cert_mem_cache_size=4MB

# SSL bump: peek at SNI, then bump (MITM) all connections
acl step1 at_step SslBump1
ssl_bump peek step1
ssl_bump bump all

# Allow all traffic (the E2E network is fully trusted)
http_access allow all

# Cache settings (speeds up repeated package downloads)
cache_dir ufs /var/spool/squid 200 16 256
maximum_object_size 512 MB

# SSL certificate database
sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/spool/squid/ssl_db -M 4MB

# Logging
access_log stdio:/var/log/squid/access.log
cache_log /var/log/squid/cache.log

# Resolve via Docker's embedded resolver, which relays to the host's DNS.
# Same reason as the resolver's forward-zone (config/resolver/unbound.conf):
# hardcoding public resolvers breaks the harness on any network that blocks
# direct UDP/53 egress, and squid is what every simulated container's HTTP(S)
# egress transits — so a squid that can't resolve fails every apt fetch and
# every `bun add` with "connection refused".
dns_nameservers 127.0.0.11

# Timeouts
connect_timeout 30 seconds
read_timeout 60 seconds