> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safesquid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# System configuration

<Note>
  CLI man page: `safesquid-general(5)`
</Note>

The **General** section (`safesquid-general(5)`) sets global hostname, connection pool, debug headers, and per-connection compression/buffering policy rows.

## Core mechanics

### First matching policy row

Each getter walks **Compression and buffering policies** top-down. The first enabled row whose `profiles` match wins. Empty profiles match all. No match → built-in defaults.

### CONNECT ports (cportrange)

The CONNECT port check applies only when a row matched. Port must be in the row list or CONNECT is blocked. When no row matched, all CONNECT ports are allowed (unless blocked elsewhere).

### Compression and chunked buffering

`compressin` zero → identity-only upstream Accept-Encoding; non-zero → full encodings (TRUE and AUTO behave the same today). `bufferchunked`: 0 never, 2 always, 1 encoded-only when Content-Encoding is identity.

<Frame caption="General policy row selection">
  <img src="https://mintcdn.com/safe-squid-labs-12a0916f/VRx-_vpMam8ezhZz/images/admin_guide/system_configuration_flowchart.svg?fit=max&auto=format&n=VRx-_vpMam8ezhZz&q=85&s=d63ec0fc51c52dfbbec97fbd0cc7572d" alt="General find flow" width="480" height="300" data-path="images/admin_guide/system_configuration_flowchart.svg" />
</Frame>

## Global fields

* **Proxy hostname** — Identity in Via and Kerberos scripts; blank uses system hostname.
* **Connection pool size / timeout** — Resizes upstream `serverpool` immediately on config update.
* **Send Debugging Headers To** — CLIENT, SERVER, BOTH, or NONE — see [Debug headers](/admin_guide/start_here/debug_response_headers).
* **Dynamic Categorization** — Referer categories applied to dependency requests.

## Examples

<Tip>
  ### CONNECT HTTPS only

  **Config:** First matching row cportrange `443` only.

  **Result:** CONNECT to 443 allowed; other ports blocked with security-restrictions template.
</Tip>

<Tip>
  ### Profile-specific buffering

  **Config:** Row 1 profiles `text-filter`, maxdbuffer 128K above catch-all maxdbuffer 0.

  **Result:** Text-filter connections buffer up to 128K; others stream without full download buffer.
</Tip>

<Tip>
  ### No row match

  **Config:** All policy rows disabled for connection.

  **Result:** CONNECT port check allows any port; default timeouts apply.
</Tip>

## How to verify

1. Test CONNECT to allowed and blocked ports.
2. Enable Trace Entry on a policy row; check native logs.
3. Debug headers CLIENT in browser devtools when enabled.


## Related topics

- [First configuration](/admin_guide/start_here/first_configuration.md)
- [Explicit Proxy Configuration](/getting_started/client_configuration/explicit_proxy.md)
- [Restore Configuration and Certificates](/deployment/restore_configuration_and_certificates.md)
- [Backup Strategy](/use_cases/scaling_and_high_availability/disaster_recovery.md)
- [Debug response headers](/admin_guide/start_here/debug_response_headers.md)