# Network rules for this project, on top of the package defaults. Commit this file;
# personal or secret rules go to local/egress.conf.
#
# Policy: everything is allowed except what is blocked; private networks, names without a
# dot and ports other than 80/443 are always blocked unless allowed here.
#
#   allow        <domain>...     .domain = the domain and all subdomains
#   allow-regex  <regex>...
#   block        <domain>...
#   block-regex  <regex>...
#   connect      <host:port>...  tunnel to a non-443 port or an internal address
#   expect-block <url>           self-test (opencode-sandbox egress verify)
#   expect-pass  <url>
#
# Example: allow internal services but keep production out of reach
#   allow   git.example.internal ci.example.internal
#   block   .example.internal
#   connect git.example.internal:2222     # git over SSH
#   expect-block https://prod.example.internal/