squid.conf

acl SSL_ports port 443
acl Safe_ports port 80		# http
acl Safe_ports port 21		# ftp
acl Safe_ports port 443		# https
acl Safe_ports port 70		# gopher
acl Safe_ports port 210		# wais
acl Safe_ports port 1025-65535	# unregistered ports
acl Safe_ports port 280		# http-mgmt
acl Safe_ports port 488		# gss-http
acl Safe_ports port 591		# filemaker
acl Safe_ports port 777		# multiling http
acl CONNECT method CONNECT

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localhost
http_access allow all
#http_access deny all
ssl_bump server-first all

# Port 3128 is the HTTP Forwarding port, which allows for serving of error pages
# and icons, and in our case, the local CA cert. The other ports are used to
# intercept regular traffic and cache responses using firewall rules (listed
# elsewhere).
http_port 3128
http_port 3129 intercept
https_port 3130 cert=/etc/squid3/ssl_cert/ca.pem key=/etc/squid3/ssl_cert/privkey.pem generate-host-certificates=on intercept ssl-bump

maximum_object_size 512 MB
cache_dir aufs /var/spool/squid3 2024 2 8
cache_mem 200 MB
maximum_object_size_in_memory 100 MB
cache_replacement_policy heap LFUDA

refresh_pattern Packages\.bz2$ 0       20%     4320 refresh-ims
refresh_pattern Sources\.bz2$  0       20%     4320 refresh-ims
refresh_pattern Release\.gpg$  0       20%     4320 refresh-ims
refresh_pattern Release$       0       20%     4320 refresh-ims
refresh_pattern -i .(udeb|tar.gz|deb|rpm|exe|zip|tar|tgz|bz2|ram|rar|bin)$  129600 100% 129600 override-expire ignore-no-cache ignore-no-store
refresh_pattern -i .(jar|pom)$  129600 100% 129600 override-expire ignore-no-cache ignore-no-store ignore-must-revalidate
refresh_pattern .              0       20%     4320