not particularly interesting (and to be fair also quite large) but it doesn't touch untrusted data: all it does is waiting for signals to either reload the config (and the socket) or terminate.

don't require the awkward `server' block, just use a `proxy' block: proxy { source address port xyz hostname foo stylesheet "URL" }