# Egress proxy for the agent runner.
# Deny-by-default: only hosts matching allowlist.txt beside this file may be
# reached.
# The auditor container has NO other route to the internet (its network is
# marked `internal`), so this file is the whole egress policy.
# Stay root: this is a throwaway single-purpose container. Dropping privileges
# is pointless here and loses access to the log file.
User root
Group root
Port 8888
Timeout 600
# Bind on all interfaces inside the container network namespace.
Listen 0.0.0.0
# Only the sandbox network can talk to us; the isolated net is 172.x private.
Allow 0.0.0.0/0

# Allow CONNECT to 443 (HTTPS to model APIs) and 80.
ConnectPort 443
ConnectPort 80

# Host allowlist. FilterDefaultDeny means: block everything except matches.
Filter "/etc/tinyproxy/allowlist.txt"
# Extended POSIX regexes (the allowlist uses ERE syntax).
FilterType ere
FilterDefaultDeny Yes
# Match against the requested hostname, not the URL path.
FilterURLs Off

LogLevel Connect
# tinyproxy refuses to open /dev/stdout (symlink safety check), so log to a
# file inside the container. Read denials with:
#   docker compose exec egress-proxy cat /tmp/tinyproxy.log
LogFile "/tmp/tinyproxy.log"