# This configuration file requires squid 2.5+. It is untested with squid 3.x. # BASIC CONFIGURATION # ------------------------------------------------------------------------------ # port on which to listen http_port 8080 # set cache directory and size (6000 MB) - be sure to set the cache size to # about 10% less than the physical space available to leave room for squid's # swap files and other temp files cache_dir ufs /var/spool/squid 6000 16 256 cache_mgr jimendez@jornada.com.mx cache_effective_user proxy # set squid up as a web accelerator httpd_accel_host virtual httpd_accel_port 0 httpd_accel_uses_host_header on half_closed_clients off server_persistent_connections off client_persistent_connections off # LOGS # ------------------------------------------------------------------------------ log_icp_queries off #cache_access_log /var/log/squid/access.log cache_log /var/log/squid/cache.log cache_store_log /var/log/squid/store.log #emulate_httpd_log on #logformat combined %>a %ui %un [%{%d/%b/%Y:%H:%M:%S +0000}tl] "%rm %ru HTTP/%rv" %Hs %h" "%{User-Agent}>h" %Ss:%Sh #cache_access_log /var/log/squid/access.log combined # RESOURCES # ------------------------------------------------------------------------------ # amount of memory used for caching recently accessed objects - defaults to 8 MB cache_mem 128 MB maximum_object_size 10 MB # max cached object size maximum_object_size_in_memory 300 KB # max cached-in-memory object size # ACCESS CONTROL # ------------------------------------------------------------------------------ # Basic ACLs acl all src 0.0.0.0/0.0.0.0 acl localhost src 127.0.0.1/32 #acl ssl_ports port 443 563 acl safe_ports port 3128 8080 acl zope_servers src www.jornada.unam.mx acl manager proto cache_object acl connect method connect # deny requests to unknown ports http_access deny !safe_ports acl accelerated_protocols proto http https acl accelerated_domains dstdomain www.jornada.unam.mx acl accelerated_ports myport 8080 http_access allow accelerated_domains accelerated_ports accelerated_protocols # Purge access - zope servers can purge but nobody else acl purge method PURGE http_access allow zope_servers purge http_access deny purge # Reply access http_reply_access allow all # Cache manager setup - cache manager can only connect from localhost # only allow cache manager access from localhost http_access allow manager localhost #http_access deny manager # deny connect to other than ssl ports #http_access deny connect !ssl_ports #mgr:info for localhost: #acl report src www.jornada.unam.mx #http_access allow report # ICP access - anybody can access icp methods icp_access allow localhost # And finally deny all other access to this proxy http_access deny all # CACHE PEERS # ------------------------------------------------------------------------------ # CONFIGURE THE CACHE PEERS. FIRST PORT IS THE HTTP PORT, SECOND PORT # IS THE ICP PORT. REMEMBER TO ENABLE 'icp-server' ON YOUR 'zope.conf' # LISTENING ON THE ICP PORT YOU USE HERE. # acl in_backendpool dstdomain backendpool # cache_peer 127.0.0.1 parent 8080 9090 no-digest no-netdb-exchange # cache_peer 192.168.0.3 parent 8081 9091 no-digest no-netdb-exchange # cache_peer_access 127.0.0.1 allow in_backendpool # cache_peer_access 127.0.0.1 deny all # cache_peer_access 192.168.0.3 allow in_backendpool # cache_peer_access 192.168.0.3 deny all # IF YOU NEED TO FORWARD REQUESTS TO HOSTS NOT IN THE POOL THIS IS # WHERE YOU ALLOW THE TARGET DOMAINS # acl local_servers dstdomain some.mysite.com other.mysite.com # always_direct allow local_servers # THE FOLLOWING DIRECTIVE IS NEEDED TO MAKE 'backendpool' RESOLVE TO # THE POOL OF CACHE PEERS. # never_direct allow all # icp_access allow all # PROXY ON, NEEDED TO MAKE CACHE PEERS INTERCOMMUNICATE # httpd_accel_with_proxy on # REDIRECTOR PROGRAM # ------------------------------------------------------------------------------ redirect_program /etc/httpd/squid/iRedirector.py redirect_children 50 redirect_rewrites_host_header off # SPECIFY WHAT REQUESTS SQUID SHOULD CACHE # ------------------------------------------------------------------------------ # Control what squid caches. We want to have squid handle content that is not # personalized and that does not require any kind of authorization. # # 1) Always cache static content in squid acl static_content urlpath_regex -i \.(jpg|jpeg|gif|png|tiff|tif|svg|swf|ico|css|js|vsd|doc|ppt|pps|xls|pdf|mp3|mp4|m4a|ogg|mov|avi|wmv|sxw|zip|gz|bz2|tgz|tar|rar|odc|odb|odf|odg|odi|odp|ods|odt|sxc|sxd|sxi|sxw|dmg|torrent|deb|msi|iso|rpm)$ no_cache allow static_content # 2) (OPTIONAL) Prevent squid from caching an item that is the result of a POST acl post_requests method POST no_cache deny post_requests # 3) (OPTIONAL) Prevent squid from caching items with items in the query string # If this is uncommented, squid will treat a url with 2 different query strings # as 2 different urls when caching. # 4) Prevent squid from caching requests from authenticated users or conditional # GETs with an If-None-Match header (since squid doesn't know about ETags) # We use an external python method to check these conditions and pass in the # value of the __ac cookie (two different ways to allow for different cookie # delimiters), the HTTP Authorization header, and the If-None-Match header. # # Squid caches the results of the external python method, so for debugging, set # the options ttl=0 negative_ttl=0 so you can see what is going on # external_acl_type is_cacheable_type children=20 ttl=0 negative_ttl=0 %{Cookie:__ac} %{Cookie:;__ac} %{Authorization} %{If-None-Match} /etc/httpd/squid/squidAcl.py external_acl_type is_cacheable_type children=20 %{Cookie:__ac} %{Cookie:;__ac} %{Authorization} %{If-None-Match} /etc/httpd/squid/squidAcl.py acl is_cacheable external is_cacheable_type no_cache allow is_cacheable # Explicitly disallow squid from handling anything else no_cache deny all # SPECIFY EFFECTS OF A BROWSER REFRESH # ------------------------------------------------------------------------------ # RELOAD_INTO_IMS CAUSES WEIRD SQUID BEHAVIOR - IT APPEARS TO CAUSE FILES WITH # INAPPROPRIATE HEADERS TO END UP IN THE CACHE, AND AS A RESULT BROWSERS END # UP MAKING LOTS OF EXTRA (CONDITIONAL) REQUESTS WHEN THEY WOULD OTHERWISE MAKE # NO REQUESTS. DO NOT USE! # Tell squid how to handle expiration times for content with no explicit expiration # Assume static content is fresh for at least an hour and at most a day #refresh_pattern -i \.(jpg|jpeg|gif|png|tiff|tif|svg|swf|ico|css|js|vsd|doc|ppt|pps|xls|pdf|mp3|mp4|m4a|ogg|mov|avi|wmv|sxw|zip|gz|bz2|tar|rar|odc|odb|odf|odg|odi|odp|ods|odt|sxc|sxd|sxi|sxw|dmg|torrent|deb|msi|iso|rpm)$ 60 50% 1440 reload-into-ims #refresh_pattern . 0 20% 1440 # Change force-refresh requests into conditional gets using if-modified-since #reload_into_ims on # DEBUGGING # ------------------------------------------------------------------------------ # debug_options ALL,1 33,2 # use this for debugging acls # debug_options ALL,8 # MISCELLANEOUS # ------------------------------------------------------------------------------ # have squid handle all requests with ranges # range_offset_limit -1 # amount of time squid waits for existing requests to be serviced before shutting down shutdown_lifetime 1 seconds # allow squid to process multiple requests simultaneously if client is pipelining pipeline_prefetch on # allow white spaces to be included in URLs uri_whitespace allow # OTHER PARAMETERS THAT MAY BE OF INTEREST # ------------------------------------------------------------------------------ logfile_rotate 1 # reload_into_ims off # error_directory /usr/share/squid/errors/ refresh_pattern . 60 20% 4320 reload-into-ims