squid_acls:
  - name: Safe_ports
    classifier: port
    value: 80
  - name: Safe_ports
    classifier: port
    value: 443
  - name: SSL_ports
    classifier: port
    value: 443
  - name: os_external
    classifier: src
    value: "10.24.0.0/16"
  - name: agent_dl
    classifier: dst
    value: "{{ checkmk_server }}/32"
  - name: allowed_domains
    classifier: dstdomain
    value: "\"{{ squid_config_directory }}/{{ squid_allowed_domain_file }}\""

squid_rules:
  - acl: "!Safe_ports"
    decision: deny
  - acl: "CONNECT !SSL_ports"
    decision: deny
  - acl: to_localhost
    decision: deny
  - acl: os_external allowed_domains
    decision: allow
  - acl: agent_dl
    decision: allow
  - acl: localhost allowed_domains
    decision: allow
  - acl: all
    decision: deny