# DO NOT EDIT - This file is being maintained by Chef

# configure host name
visible_hostname <%= node.name %>

cache_mem  <%= node[:squid][:cache_mem] %>
<% if node[:squid][:version] > 2 -%>

workers <%= [ node[:cpu][:total] - 2, 1 ].max.ceil %>
cpu_affinity_map process_numbers=<%= (1..[ node[:cpu][:total] - 2, 1 ].max.ceil).to_a.join(',') %> cores=<%=(1..[ node[:cpu][:total] - 2, 1 ].max.ceil).to_a.join(',') %>

error_log_languages off
<% end -%>

max_filedescriptors 98304

<% if node[:squid][:version] > 3 -%>
# Use RFC6891 recommended max size
dns_packet_max 4096 bytes
# Use low initial retry interval (backoff start)
dns_retransmit_interval 2 seconds
# Set low timeout
dns_timeout 15 seconds
<% end -%>

# used by squidclient / munin
http_port 3128
# HTCP
htcp_port 4827
# ICP
icp_port 3130
log_icp_queries off

<% if node[:squid][:version] < 3 -%>
http_port 80 accel defaultsite=tile.openstreetmap.org tcpkeepalive=60,10,6 http11
<% else -%>
http_port 80 accel no-vhost defaultsite=tile.openstreetmap.org tcpkeepalive=60,10,6
<% end -%>

cache_effective_user proxy
cache_effective_group proxy

<% Array(node[:squid][:cache_dir]).each do |cache_dir| -%>
cache_dir <%= cache_dir %>
<% end -%>

<% if node[:squid][:version] < 3 -%>
cache_swap_log /var/spool/squid/%s
<% end -%>

cache_mgr webmaster@openstreetmap.org

quick_abort_min 0 KB
quick_abort_max 0 KB

read_ahead_gap 64 KB

maximum_object_size 256 KB
maximum_object_size_in_memory 64 KB

cache_replacement_policy heap LFUDA
memory_replacement_policy heap GDSF

server_persistent_connections on
<% if node[:squid][:version] < 3 -%>
persistent_request_timeout 1 minutes
<% else -%>
client_idle_pconn_timeout 1 minutes
<% end -%>
<% if node[:squid][:version] > 3 -%>
pconn_lifetime 5 minutes
<% end -%>

negative_ttl 15 seconds
<% if node[:squid][:version] < 3 -%>
pipeline_prefetch on
<% end -%>

read_timeout 90 seconds
request_timeout 90 seconds
connect_timeout 20 seconds
client_lifetime 1 hours

<% if node[:squid][:version] < 3 -%>
refresh_stale_hit 300 seconds
<% end -%>

# Recommended minimum configuration:
# ----------------------------------
<% if node[:squid][:version] < 3 -%>
acl all src all
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
<% end -%>
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost

http_access allow manager

http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
# ----------------------------------

acl purge_hosts src 127.0.0.0/8
acl PURGE method purge
http_access allow purge purge_hosts
http_access deny purge

forwarded_for on
follow_x_forwarded_for allow localhost

<% if node[:squid][:version] < 3 -%>
logformat openstreetmap %ts.%03tu %tr %>a %Ss/%03Hs %<st %rm %rp %Sh/%<A %mt "%{Referer}>h" "%{User-Agent}>h"
access_log <%= node[:squid][:access_log] %>
<% else -%>
logformat openstreetmap %ts.%03tu %tr %>a %Ss/%03>Hs %<st %rm %>rp %Sh/%<A %mt "%{Referer}>h" "%{User-Agent}>h"
access_log daemon:<%= node[:squid][:access_log] %>
<% end -%>
cache_log /var/log/squid/cache.log
cache_store_log none

client_db off
strip_query_terms off
<% if node[:squid][:version] > 2 -%>
# Work around bug in squid 3 that causes log_fqdn to be
# turned on by some of the (unused by us) default formats:
# http://lists.squid-cache.org/pipermail/squid-users/2016-February/thread.html#8999
url_rewrite_extras "%>a %un %>rm myip=%la myport=%lp"
store_id_extras "%>a %un %>rm myip=%la myport=%lp"
<% end -%>

digest_generation on

refresh_pattern .		0	50%	20160
refresh_pattern -i tile.openstreetmap.org 60 80% 20160 reload-into-ims

# ZERO required for logrotate to work properly
logfile_rotate 0

<% Dir.glob("/etc/squid/squid.conf.d/*.conf") do |file| -%>
<%= File.read(file) %>
<% end -%>

# MUST BE LAST ACL
# --------------
http_access deny all
htcp_access deny all
icp_access deny all
# --------------