# The only route out of the dev-server worker.
#
# It allows CONNECT tunnels to the package registries and refuses everything else. There is no
# interception and no certificate of ours in the middle: the proxy sees the host a client asks for
# and nothing more. That is the whole boundary, and it is worth being clear about what it is not -
# a package pulled from an allowed registry is still third-party code, which is why installs run
# with scripts disabled.
#
# Add a host here only when an install has failed for the want of it, and add the exact host.

http_port 3128

acl registries dstdomain \
  registry.npmjs.org \
  .npmjs.org \
  pypi.org \
  files.pythonhosted.org \
  repo.maven.apache.org \
  repo1.maven.org

acl ssl_ports port 443
acl connect_method method CONNECT

# CONNECT to an allowed registry on 443, and that is all. Plain HTTP is not allowed even to these
# hosts: every one of them serves HTTPS, so a plain request would be a downgrade, not a fallback.
http_access allow connect_method registries ssl_ports
http_access deny all

# Nothing is cached: with no cache there is no cache to poison, and the measured benefit of
# caching was npm's alone - where the worker's own shared npm cache already provides it.
cache deny all
cache_mem 8 MB

# One line per request, so a refused host can be found without guessing.
access_log stdio:/dev/stdout
cache_log stdio:/dev/stderr

# A client that cannot reach the internet should learn so quickly rather than hang.
connect_timeout 15 seconds
request_timeout 60 seconds

forwarded_for delete
via off
httpd_suppress_version_string on