CLI man page:
safesquid-general(5)safesquid-general(5)) sets global hostname, connection pool, debug headers, and per-connection compression/buffering policy rows.
Core mechanics
First matching policy row
Each getter walks Compression and buffering policies top-down. The first enabled row whoseprofiles match wins. Empty profiles match all. No match → built-in defaults.
CONNECT ports (cportrange)
The CONNECT port check applies only when a row matched. Port must be in the row list or CONNECT is blocked. When no row matched, all CONNECT ports are allowed (unless blocked elsewhere).Compression and chunked buffering
compressin zero → identity-only upstream Accept-Encoding; non-zero → full encodings (TRUE and AUTO behave the same today). bufferchunked: 0 never, 2 always, 1 encoded-only when Content-Encoding is identity.
General policy row selection
Global fields
- Proxy hostname — Identity in Via and Kerberos scripts; blank uses system hostname.
- Connection pool size / timeout — Resizes upstream
serverpoolimmediately on config update. - Send Debugging Headers To — CLIENT, SERVER, BOTH, or NONE — see Debug headers.
- Dynamic Categorization — Referer categories applied to dependency requests.
Examples
How to verify
- Test CONNECT to allowed and blocked ports.
- Enable Trace Entry on a policy row; check native logs.
- Debug headers CLIENT in browser devtools when enabled.