## Eleva Speed egress proxy — tinyproxy configuration.
##
## Policy: deny everything by default, allow only the host regexes listed
## in /etc/tinyproxy/filter. The internal Docker network is the only
## source allowed to connect to this proxy.

User  tinyproxy
Group tinyproxy

Port 3128
Listen 0.0.0.0
Timeout 600

## Logging — to stderr (default). `LogFile ""` is NOT valid syntax;
## omitting the directive entirely makes tinyproxy log to stderr, which
## docker captures into `docker logs <container>`.
LogLevel Info

## Anonymous mode: pass only Host + Authorization through to upstream.
## Strips Via / X-Forwarded-For etc. so the proxy is not advertised.
DisableViaHeader Yes
Anonymous "Host"
Anonymous "Authorization"

## Inbound ACL — accept any RFC1918 source. docker-compose.prod.yml lets
## Docker auto-pick the internal-net subnet (was 172.20.0.0/16, removed
## after that range conflicted with another stack on the deploy host).
## The actual isolation is `internal: true` on internal-net + zero port
## mapping on the proxy — nothing outside Docker can reach :3128 anyway.
## These Allow lines are defense-in-depth, not the security boundary.
Allow 10.0.0.0/8
Allow 172.16.0.0/12
Allow 192.168.0.0/16
Allow 127.0.0.1

## Outbound filtering — strict allowlist on destination hostname.
## URLs are matched against /etc/tinyproxy/filter as extended regex.
Filter            "/etc/tinyproxy/filter"
FilterDefaultDeny Yes
FilterExtended    Yes
FilterCaseSensitive No
## Match against the URL's host component, not the full URL — this is what
## tinyproxy compares to entries in the filter file.
FilterURLs        No

## CONNECT (HTTPS tunneling): only allow standard TLS ports. Combined with
## the hostname filter above, this prevents tunneling to arbitrary
## destinations on non-web ports.
ConnectPort 443
ConnectPort 8443

## No transparent upstream proxy.
## No upstream chain.
## No XTinyproxy header.