# Squid configuration for VPN proxy
http_port 3128

# Allow access from any IP (since we're in a container)
acl localnet src 0.0.0.1-0.255.255.255
acl localnet src 10.0.0.0/8
acl localnet src 100.64.0.0/10
acl localnet src 169.254.0.0/16
acl localnet src 172.16.0.0/12
acl localnet src 192.168.0.0/16
acl localnet src fc00::/7
acl localnet src fe80::/10

# Allow all HTTP and HTTPS traffic
acl SSL_ports port 443
acl Safe_ports port 80
acl Safe_ports port 21
acl Safe_ports port 443
acl Safe_ports port 70
acl Safe_ports port 210
acl Safe_ports port 1025-65535
acl Safe_ports port 280
acl Safe_ports port 488
acl Safe_ports port 591
acl Safe_ports port 777
acl CONNECT method CONNECT

# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# Allow localhost management
http_access allow localhost manager
http_access deny manager

# Allow access from local networks
http_access allow localnet
http_access allow localhost

# Allow all other traffic (since we're proxying through VPN)
http_access allow all

# Cache settings (minimal for proxy)
cache_dir ufs /var/cache/squid 100 16 256
maximum_object_size 1024 MB

# Logging
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log

# Don't forward private IPs
never_direct allow all

# Forward all requests through the VPN interface
forwarded_for off
via off

# Hide client IP
forwarded_for delete