squid_acls:
  - name: Safe_ports
    classifier: port
    value: 80
  - name: Safe_ports
    classifier: port
    value: 443
  - name: SSL_ports
    classifier: port
    value: 443
  - name: local
    classifier: src
    value: "127.0.0.1/32"
  - name: os_external
    classifier: src
    value: "10.24.0.0/16"
  - name: agent_dl
    classifier: dst
    value: "{{ checkmk_server }}/32"
  - name: choco
    classifier: dstdomain
    value: "{{ choco_hostname }}"
  - name: allowed_domains
    classifier: dstdomain
    value: "\"{{ squid_config_directory }}/{{ squid_allowed_domain_file }}\""
  #- name: authenticated_user
  #  classifier: proxy_auth
  #  value: "REQUIRED"

squid_rules:
  - acl: "!Safe_ports"
    decision: deny
  - acl: "CONNECT !SSL_ports"
    decision: deny
  - acl: to_localhost
    decision: deny
  - acl: os_external allowed_domains
    decision: allow
  - acl: agent_dl
    decision: allow
  - acl: choco
    decision: allow
  - acl: localhost allowed_domains
    decision: allow
  #- acl: authenticated_user
  #  decision: allow
  - acl: all
    decision: deny