https://github.com/thias/puppet-squid3/blob/master/templates/squid.conf.short.erb#L41-43

I've implemented Squid as a whitelist HTTP proxy for a secure network segment. the config looks like the following:

# user-defined ACLs
acl whitelist dstdomain foo.com
acl whitelist dstdomain bar.com
acl whitelist dstdomain baz.com

# user-defined http_accesses
http_access allow whitelist
http_access allow localnet
http_access allow localhost
http_access deny all

http_access allow localnet will allow all requests from my "secure intranet segment". if I add an additional http_access deny all to "user-defined http_accesses", then the behavior is consistent with my goals/expectations but results in duplicate http_access deny all rules.

a potential fix would be to have these rules as default values on a parameter or to not include any defaults and document that adding http_access deny all is probably a very good idea. the module seems to assume you know how to read/write squid.conf, I don't think it's unfair to tell users they need to explicitly manage all the rules.