---

# === ПОРТ 3144 (Вариант 12) с SSL-Bump ===
http_port 3144 ssl-bump \
  cert=/etc/squid/ssl/bump.pem \
  generate-host-certificates=on \
  dynamic_cert_mem_cache_size=20MB

# === ACL для локальной сети (Вариант 12) ===
# ВАЖНО: убираем перекрывание с 192.168.0.0/16
acl localnet src 192.168.12.0/24

# === ACL для безопасных портов ===
acl SSL_ports port 443
acl Safe_ports port 80
acl Safe_ports port 443

# === SSL-Bump настройки ===
acl step1 at_step SslBump1
ssl_bump peek step1
ssl_bump bump all

# === ACL для промежуточных запросов ===
acl intermediate_fetching transaction_initiator certificate-fetching
http_access allow intermediate_fetching

# === ПРАВИЛА ДОСТУПА ===
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access deny all

# === КЭШИРОВАНИЕ ===
cache_dir ufs /var/spool/squid 4096 32 256
cache_effective_user proxy
cache_effective_group proxy

# === ЛОГИ ===
access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log

# === SSL НАСТРОЙКИ (убрали устаревшие директивы) ===
sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/lib/squid/ssl_db -M 20MB
sslproxy_cert_error allow all

# === REFRESH PATTERNS ===
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320

# === PID файл ===
pid_filename /var/run/squid.pid