# Dedicated Squid config for the dify-agent local_sandbox SSRF proxy.
# All traffic on this proxy is restricted to:
#   - agent_backend /agent-stub/* endpoints
#   - Dify API /files/* endpoints (signed upload/download URLs)
# External internet is allowed; all other private-network destinations are denied.

include /etc/squid/dify_common.conf

acl dst_agent_backend dstdomain agent_backend
acl dst_dify_api dstdomain api
acl path_files urlpath_regex -i ^/files/
acl path_agent_stub urlpath_regex -i ^/agent-stub/

http_port ${HTTP_PORT}

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow dst_agent_backend path_agent_stub
http_access allow dst_dify_api path_files
http_access deny to_private_networks
http_access allow all