# ---------------------------------------------------------------------------
# Outbound HTTP(S) forward proxy for the backend container.
#
# WHY THIS EXISTS
# Containers on this host have no outbound network access: the docker bridge
# has no working NAT, so from inside a container both DNS and direct-IP HTTPS
# time out. The docker daemon itself (host network namespace) does have
# internet, which is why `docker pull` works while a build or a runtime cURL
# call does not. Restoring the bridge NAT needs root, which we do not have.
#
# This proxy runs in a container started with `--network host`, so it inherits
# the host's working network, and republishes it to the bridge on the docker
# gateway address only. The backend then reaches Gemini and the ERP API through
# it via the standard https_proxy environment variable, which libcurl (and
# therefore PHP cURL) honours without any application code change.
#
# REMOVE THIS once the host's docker NAT rules are fixed by an administrator.
# ---------------------------------------------------------------------------

User nobody
Group nobody

# Bind to the proposal-management_default bridge gateway, NOT 0.0.0.0. With
# --network host a 0.0.0.0 bind would expose an open forward proxy to the
# public internet, which would be found and abused within hours.
Listen 172.30.0.1
Port 18080

# Only the bridge subnet may use the proxy. Combined with the Listen address
# above this is unreachable from outside the host.
Allow 172.30.0.0/16

# CONNECT is what HTTPS needs. Restrict it to 443 so this cannot be used as a
# general-purpose TCP tunnel to arbitrary ports.
ConnectPort 443

Timeout 600
MaxClients 100
LogLevel Info

# Do not advertise the proxy to upstream servers.
DisableViaHeader Yes