squid.conf

http_port 127.0.0.1:3128

# Whitelist of allowed domains (extracted from http-domain-whitelist in opencode-sandbox-config.yaml)
acl whitelist dstdomain "/etc/squid/squid-whitelist.txt"

# Restrict proxy access to localhost only (prevents Docker-bridge peers from using this proxy)
acl localnet src 127.0.0.1/32

# Standard port ACLs
acl SSL_ports port 443
acl Safe_ports port 80
acl Safe_ports port 443
acl CONNECT method CONNECT

# Deny CONNECT to non-SSL ports
http_access deny CONNECT !SSL_ports

# Deny requests to non-safe ports
http_access deny !Safe_ports

# Allow whitelisted domains from localhost only
http_access allow localnet whitelist

# Deny everything else
http_access deny all

# Suppress access log noise to stdout
access_log none
cache_log /dev/null
cache_store_log none

# Suppress all squid debug/startup messages
debug_options ALL,0