# Tinyproxy Filter: ONE regex per line, matched against the bare
# domain for CONNECT requests (the log shows e.g. filtered domain
# "xcmapi.org" -- no scheme, no :port suffix).
#
# CRITICAL: Tinyproxy compiles these as POSIX BASIC regex, not
# extended regex. Extended syntax (+ ? ( ) |) does NOT work here:
# an extended-style anchored pattern (^(.+\.)?xcmapi\.org$) was
# verified on 2026-10-26 to deny even xcmapi.org itself, while the
# basic-syntax equivalent below allows it. In basic regex, groups
# are \(...\), repetition of a group is \(...\)*, and + ? ( ) are
# literal characters. Do NOT "modernize" these patterns.
#
# Each entry is anchored (^...$) to the domain and its subdomains
# only: a bare substring "github.com" would also match
# "evilgithub.com". The \(.*\.\)* prefix matches zero or more
# "label." segments, so xcmapi.org and api.xcmapi.org match, while
# notxcmapi.org and xcmapi.org.evil.com do not.
^\(.*\.\)*xcmapi\.org$
^\(.*\.\)*github\.com$
^\(.*\.\)*githubusercontent\.com$
^\(.*\.\)*pypi\.org$
^\(.*\.\)*pythonhosted\.org$
^\(.*\.\)*npmjs\.org$