Make the server configs complete standalone files

1 file changed, 38 insertions, 22 deletions

diff --git a/custom/servers/lighttpd.conf b/custom/servers/lighttpd.confindex 3111ed0..6ae87e0 100644--- a/custom/servers/lighttpd.conf+++ b/custom/servers/lighttpd.conf@@ -1,5 +1,11 @@ # lighttpd configuration for cgit. #+# This is a complete lighttpd.conf rather than a snippet for conf-enabled, so+# nothing here is included from elsewhere and no distro base config is+# assumed. Check it and run it with+#     lighttpd -tt -f /path/to/lighttpd.conf   # check the syntax and modules+#     lighttpd -D -f /path/to/lighttpd.conf    # run it in the foreground+# # lighttpd runs the cgit.cgi binary directly through mod_cgi, so no FastCGI # bridge is needed. This is cgit's classic reference deployment, mod_cgi with # mod_alias and mod_setenv.@@ -16,29 +22,40 @@ # straight off disk and must never be routed through cgit.  -# --- Modules -----------------------------------------------------------------# Append the three modules cgit needs so the distro's base config is kept.-# mod_alias maps URL paths onto files, mod_setenv injects CGIT_CONFIG, and-# mod_cgi runs cgit.cgi.-server.modules += ( "mod_alias", "mod_setenv", "mod_cgi" )+# A plain assignment rather than "+=", since this config stands on its own and+# there is no distro base list to append to. mod_alias maps URL paths onto+# files, mod_setenv injects CGIT_CONFIG and the response headers, and mod_cgi+# runs cgit.cgi. Adding mod_accesslog here is what the access log below needs.+server.modules = (+    "mod_alias",+    "mod_setenv",+    "mod_cgi",+    "mod_accesslog",+)  -# --- Server basics ---------------------------------------------------------- server.port          = 80 server.username      = "http"             # Debian and Ubuntu use www-data server.groupname     = "http" server.document-root = "/usr/share/cgit"  # a valid docroot must exist, the                                           # alias rules below do the routing+server.pid-file      = "/run/lighttpd.pid" server.errorlog      = "/var/log/lighttpd/error.log"-# Access logging needs mod_accesslog. Load it and uncomment to enable.-#server.modules     += ( "mod_accesslog" )-#accesslog.filename  = "/var/log/lighttpd/access.log"+accesslog.filename   = "/var/log/lighttpd/access.log"++# Drop the version number from the Server header and from error pages.+server.tag           = "lighttpd"++# The only request body cgit ever reads is the auth-filter login form, and it+# stops after 4096 bytes. Nothing else here accepts an upload. The value is in+# kilobytes and the default of 0 means unlimited.+server.max-request-size = 64  -# --- MIME types for the static assets --------------------------------------- # mod_alias serves the assets off disk, so lighttpd must know their content # types. Without this the stylesheet is sent as application/octet-stream and-# the browser ignores it.+# the browser ignores it. Only these five files are served off disk, so this+# short table is the whole of it and no external mime file is needed. mimetype.assign = (     ".css" => "text/css",     ".js"  => "text/javascript",@@ -48,20 +65,19 @@ mimetype.assign = ( )  -# --- Virtual host, git.example.org -------------------------------------------# A top-level conditional, so it matches on both the port 80 socket and the-# optional TLS socket at the end of this file.+# The vhost, as a top-level conditional so it matches on both the port 80+# socket and the optional TLS socket at the end of this file. $HTTP["host"] == "git.example.org" {      # Which config cgit reads. It falls back to the compiled-in /etc/cgitrc,     # the same path used here, but setting it makes the location explicit.     setenv.add-environment = ( "CGIT_CONFIG" => "/etc/cgitrc" ) -    # --- Security headers ----------------------------------------------------    # Set here, not in cgit, so they also cover the static assets lighttpd-    # serves. script-src stays self because cgit loads only its own cgit.js,-    # and style-src allows inline for the diffstat bars. If you enable the-    # gravatar or libravatar avatar filter, add its host to img-src.+    # Security headers are set here, not in cgit, so they also cover the+    # static assets lighttpd serves. script-src stays self because cgit loads+    # only its own cgit.js, and style-src allows inline for the diffstat bars.+    # If you enable the gravatar or libravatar avatar filter, add its host to+    # img-src.     setenv.add-response-header = (         "Content-Security-Policy" => "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'self'",         "X-Content-Type-Options" => "nosniff",@@ -109,9 +125,9 @@ $HTTP["host"] == "git.example.org" { }  -# --- Optional HTTPS on 443 ---------------------------------------------------# Uncomment this whole block to enable TLS. The host block above is socket-# independent, so it serves cgit over this socket too once the crypto is set.+# Uncomment this whole block to enable TLS on 443. The host block above is+# socket independent, so it serves cgit over this socket too once the crypto+# is set. #server.modules += ( "mod_openssl" ) # #$SERVER["socket"] == ":443" {
diff --git a/custom/servers/lighttpd.conf b/custom/servers/lighttpd.conf
index 3111ed0..6ae87e0 100644
--- a/custom/servers/lighttpd.conf
+++ b/custom/servers/lighttpd.conf
@@ -1,5 +1,11 @@
 # lighttpd configuration for cgit.
 #
+# This is a complete lighttpd.conf rather than a snippet for conf-enabled, so
+# nothing here is included from elsewhere and no distro base config is
+# assumed. Check it and run it with
+#     lighttpd -tt -f /path/to/lighttpd.conf   # check the syntax and modules
+#     lighttpd -D -f /path/to/lighttpd.conf    # run it in the foreground
+#
 # lighttpd runs the cgit.cgi binary directly through mod_cgi, so no FastCGI
 # bridge is needed. This is cgit's classic reference deployment, mod_cgi with
 # mod_alias and mod_setenv.
@@ -16,29 +22,40 @@
 # straight off disk and must never be routed through cgit.
 
 
-# --- Modules ----------------------------------------------------------------
-# Append the three modules cgit needs so the distro's base config is kept.
-# mod_alias maps URL paths onto files, mod_setenv injects CGIT_CONFIG, and
-# mod_cgi runs cgit.cgi.
-server.modules += ( "mod_alias", "mod_setenv", "mod_cgi" )
+# A plain assignment rather than "+=", since this config stands on its own and
+# there is no distro base list to append to. mod_alias maps URL paths onto
+# files, mod_setenv injects CGIT_CONFIG and the response headers, and mod_cgi
+# runs cgit.cgi. Adding mod_accesslog here is what the access log below needs.
+server.modules = (
+    "mod_alias",
+    "mod_setenv",
+    "mod_cgi",
+    "mod_accesslog",
+)
 
 
-# --- Server basics ----------------------------------------------------------
 server.port          = 80
 server.username      = "http"             # Debian and Ubuntu use www-data
 server.groupname     = "http"
 server.document-root = "/usr/share/cgit"  # a valid docroot must exist, the
                                           # alias rules below do the routing
+server.pid-file      = "/run/lighttpd.pid"
 server.errorlog      = "/var/log/lighttpd/error.log"
-# Access logging needs mod_accesslog. Load it and uncomment to enable.
-#server.modules     += ( "mod_accesslog" )
-#accesslog.filename  = "/var/log/lighttpd/access.log"
+accesslog.filename   = "/var/log/lighttpd/access.log"
+
+# Drop the version number from the Server header and from error pages.
+server.tag           = "lighttpd"
+
+# The only request body cgit ever reads is the auth-filter login form, and it
+# stops after 4096 bytes. Nothing else here accepts an upload. The value is in
+# kilobytes and the default of 0 means unlimited.
+server.max-request-size = 64
 
 
-# --- MIME types for the static assets ---------------------------------------
 # mod_alias serves the assets off disk, so lighttpd must know their content
 # types. Without this the stylesheet is sent as application/octet-stream and
-# the browser ignores it.
+# the browser ignores it. Only these five files are served off disk, so this
+# short table is the whole of it and no external mime file is needed.
 mimetype.assign = (
     ".css" => "text/css",
     ".js"  => "text/javascript",
@@ -48,20 +65,19 @@ mimetype.assign = (
 )
 
 
-# --- Virtual host, git.example.org ------------------------------------------
-# A top-level conditional, so it matches on both the port 80 socket and the
-# optional TLS socket at the end of this file.
+# The vhost, as a top-level conditional so it matches on both the port 80
+# socket and the optional TLS socket at the end of this file.
 $HTTP["host"] == "git.example.org" {
 
     # Which config cgit reads. It falls back to the compiled-in /etc/cgitrc,
     # the same path used here, but setting it makes the location explicit.
     setenv.add-environment = ( "CGIT_CONFIG" => "/etc/cgitrc" )
 
-    # --- Security headers ---------------------------------------------------
-    # Set here, not in cgit, so they also cover the static assets lighttpd
-    # serves. script-src stays self because cgit loads only its own cgit.js,
-    # and style-src allows inline for the diffstat bars. If you enable the
-    # gravatar or libravatar avatar filter, add its host to img-src.
+    # Security headers are set here, not in cgit, so they also cover the
+    # static assets lighttpd serves. script-src stays self because cgit loads
+    # only its own cgit.js, and style-src allows inline for the diffstat bars.
+    # If you enable the gravatar or libravatar avatar filter, add its host to
+    # img-src.
     setenv.add-response-header = (
         "Content-Security-Policy" => "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'self'",
         "X-Content-Type-Options" => "nosniff",
@@ -109,9 +125,9 @@ $HTTP["host"] == "git.example.org" {
 }
 
 
-# --- Optional HTTPS on 443 --------------------------------------------------
-# Uncomment this whole block to enable TLS. The host block above is socket
-# independent, so it serves cgit over this socket too once the crypto is set.
+# Uncomment this whole block to enable TLS on 443. The host block above is
+# socket independent, so it serves cgit over this socket too once the crypto
+# is set.
 #server.modules += ( "mod_openssl" )
 #
 #$SERVER["socket"] == ":443" {