Make the server configs complete standalone files

1 file changed, 215 insertions, 142 deletions

diff --git a/custom/servers/nginx.conf b/custom/servers/nginx.confindex 76ac260..3b0b7ef 100644--- a/custom/servers/nginx.conf+++ b/custom/servers/nginx.conf@@ -1,8 +1,10 @@ # nginx configuration for cgit. #-# nginx cannot run CGI programs itself, so a small bridge called fcgiwrap-# runs the cgit.cgi binary and speaks FastCGI to nginx. Starting fcgiwrap is-# covered in the notes at the end of this file.+# This is a complete nginx.conf rather than a snippet for conf.d or+# sites-enabled, so nothing here is included from elsewhere. Install it and+# reload, or point nginx straight at it to try it out.+#     nginx -t -c /path/to/nginx.conf     # check the syntax+#     nginx -c /path/to/nginx.conf        # run it # # Paths assumed below, edit them to match your install. #   cgit CGI binary   /usr/lib/cgit/cgit.cgi@@ -16,166 +18,237 @@ # base from SCRIPT_NAME. The five static assets are served straight off disk # and must never be routed through cgit. Passing PATH_INFO through is the # single most important part of the config below.+#+# nginx cannot run CGI programs itself, so a small bridge called fcgiwrap runs+# the cgit.cgi binary and speaks FastCGI to nginx. Nothing below works until+# that socket exists. On Debian and Ubuntu the packaged systemd socket+# provides /run/fcgiwrap.socket, so enabling it is enough.+#     apt install fcgiwrap+#     systemctl enable --now fcgiwrap.socket+# The socket must be readable by nginx's user. The packaged unit runs fcgiwrap+# as www-data, which nginx also uses on those systems. Without systemd you can+# run+#     spawn-fcgi -s /run/fcgiwrap.socket -M 660 -- /usr/sbin/fcgiwrap+# or run fcgiwrap over TCP and point fastcgi_pass at 127.0.0.1:9000.  -# --- Optional HTTP to HTTPS redirect -----------------------------------------# Delete this whole server block if you serve plain HTTP only.-server {-    listen      80;-    listen      [::]:80;-    server_name git.example.org;+# The user nginx drops to after binding the ports. It is www-data on Debian+# and Ubuntu, nginx on RHEL and Fedora, and http on Arch and Alpine. It has to+# match whatever owns the fcgiwrap socket.+user                 www-data;+worker_processes     auto;+pid                  /run/nginx.pid; -    # ACME http-01 challenge files, if you use certbot in webroot mode.-    location ^~ /.well-known/acme-challenge/ {-        root /var/www/html;-    }+# Startup and worker errors. Per-site request logs are set in the vhost.+error_log            /var/log/nginx/error.log warn; -    # Everything else moves to HTTPS.-    location / {-        return 301 https://$host$request_uri;-    }+events {+    worker_connections 1024; }  -# --- Main site ---------------------------------------------------------------# Written for TLS on 443. For a quick plain-HTTP test, change the two listen-# lines to port 80, delete the redirect block above, and delete the four ssl-# lines below. Everything else stays the same.-server {-    listen      443 ssl;-    listen      [::]:443 ssl;-    http2       on;-    server_name git.example.org;--    ssl_certificate     /etc/letsencrypt/live/git.example.org/fullchain.pem;-    ssl_certificate_key /etc/letsencrypt/live/git.example.org/privkey.pem;-    ssl_protocols       TLSv1.2 TLSv1.3;-    ssl_ciphers         HIGH:!aNULL:!MD5;--    # --- Security headers ----------------------------------------------------    # These sit here, not in cgit, because they must also cover the static-    # assets nginx serves directly. cgit loads only its own /cgit.js and uses-    # inline style on the diffstat bars, so script-src stays self while-    # style-src allows inline. always applies them to error responses too. If-    # you enable the gravatar or libravatar avatar filter, add its host to-    # img-src, for example https://www.gravatar.com or https://seccdn.libravatar.org.-    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'self'" always;-    add_header X-Content-Type-Options "nosniff" always;-    add_header Referrer-Policy "no-referrer" always;-    # Enable only once you serve HTTPS exclusively, since it is hard to undo.-    #add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;--    # The document root is the directory that holds the static assets. cgit-    # emits absolute links to /cgit.css and /cgit.png by default, so those-    # files must resolve at the root of the URL space. Pointing root at the-    # asset directory makes /cgit.css map to /usr/share/cgit/cgit.css.-    root /usr/share/cgit;--    # Upload cap for large form posts. Snapshots are generated rather than-    # uploaded, so this does not limit them.-    client_max_body_size 64m;--    access_log /var/log/nginx/cgit.access.log;-    error_log  /var/log/nginx/cgit.error.log;--    # --- Static assets, served directly --------------------------------------    # Match the assets by their exact root-level names, never by bare-    # extension. cgit routes on PATH_INFO and a repository can hold files-    # ending in .css or .png, so /myrepo/tree/style.css and /myrepo/plain/-    # logo.png are real cgit URLs. A broad extension match would capture-    # those, look for them on disk, and return 404 before cgit could render-    # them. Anchoring the regex at the start of the path matches /cgit.css but-    # not /myrepo/tree/cgit.css, so it can never shadow a repository file. An-    # nginx regex location is matched before the prefix location below, so-    # these assets win for their exact URLs and cgit wins for the rest.-    location ~ ^/(cgit\.css|cgit\.js|cgit\.png|favicon\.ico|robots\.txt)$ {-        expires    30d;-        access_log off;-        try_files  $uri =404;+http {+    # nginx's compiled-in type table knows only text/html, and the usual+    # "include mime.types" would pull in a second file. Exactly five static+    # files are served off disk, so their types are declared here instead and+    # this config keeps standing on its own. Everything else nginx returns+    # comes from cgit, which sets its own Content-Type.+    types {+        text/css                  css;+        text/javascript           js;+        image/png                 png;+        image/vnd.microsoft.icon  ico;+        text/plain                txt;     }+    default_type application/octet-stream;++    sendfile           on;+    tcp_nopush         on;+    keepalive_timeout  65; -    # --- cgit, the catch-all -------------------------------------------------    # Everything that is not a static asset above is a cgit URL, the repo-    # index, a repository, a page within a repository, a snapshot, a feed.-    location / {-        # nginx's standard FastCGI parameters, some of which are overridden-        # below. A later fastcgi_param wins, so include order does not matter.-        include fastcgi_params;--        # The program fcgiwrap runs. It must be the cgit binary itself, not-        # $document_root$fastcgi_script_name, which would try to run a repo-        # path and is the usual cause of a failed request.-        fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;--        # cgit builds its link base, the virtual root, from SCRIPT_NAME. The-        # stock parameters set SCRIPT_NAME to the whole request path, which-        # would make cgit prepend that path to every link. Served at the-        # domain root the script has no prefix, so force SCRIPT_NAME empty and-        # cgit uses / as its base. A sub-path install sets it instead, see the-        # end of this file.-        fastcgi_param SCRIPT_NAME  "";--        # How cgit learns the repository and page. At the domain root the-        # whole request path is the PATH_INFO.-        fastcgi_param PATH_INFO    $uri;--        # Page options such as h=branch, id=sha and the snapshot format.-        fastcgi_param QUERY_STRING $query_string;--        # Where the static assets live, kept consistent with root above.-        fastcgi_param DOCUMENT_ROOT $document_root;--        # The browser's Host header, so cgit builds clone URLs against the-        # name the visitor used rather than server_name.-        fastcgi_param HTTP_HOST    $http_host;--        # Which config cgit reads. It checks CGIT_CONFIG and falls back to the-        # compiled-in /etc/cgitrc. Setting it makes the location explicit and-        # lets you move cgitrc without recompiling.-        fastcgi_param CGIT_CONFIG  /etc/cgitrc;--        # The real scheme, so cgit builds correct https clone URLs.-        fastcgi_param HTTPS        $https if_not_empty;--        # Hand off to the fcgiwrap socket. See the notes for how to create it.-        # A TCP fcgiwrap would use for example 127.0.0.1:9000 here.-        fastcgi_pass unix:/run/fcgiwrap.socket;--        # Large outputs such as snapshot tarballs and blame on big files can-        # take a while, so give cgit room and stream rather than buffer.-        fastcgi_read_timeout 300s;-        fastcgi_buffering off;+    # Drop the version number from the Server header and from error pages.+    server_tokens      off;++    # cgit pages are large and highly compressible, so this is the cheapest+    # speedup available. text/html is always compressed and cannot be listed.+    # Snapshot tarballs are deliberately absent, since they arrive compressed+    # already and running them through gzip again only burns CPU.+    gzip               on;+    gzip_vary          on;+    gzip_proxied       any;+    gzip_min_length    1024;+    gzip_types         text/css text/javascript text/plain application/atom+xml;+++    # Bounce plain HTTP up to HTTPS. Delete this whole server block if you+    # serve plain HTTP only.+    server {+        listen      80;+        listen      [::]:80;+        server_name git.example.org;++        # ACME http-01 challenge files, if you use certbot in webroot mode.+        location ^~ /.well-known/acme-challenge/ {+            root /var/www/html;+        }++        # Everything else moves to HTTPS.+        location / {+            return 301 https://$host$request_uri;+        }     }-}  -# --- Notes, starting fcgiwrap ------------------------------------------------# cgit is a CGI binary and fcgiwrap is the CGI to FastCGI bridge nginx talks-# to. On Debian and Ubuntu the packaged systemd socket provides-# /run/fcgiwrap.socket, so enabling it is enough.-#     apt install fcgiwrap-#     systemctl enable --now fcgiwrap.socket-# The socket must be readable by nginx's user. The packaged unit runs fcgiwrap-# as www-data, which nginx also uses on those systems. Without systemd you can-# run-#     spawn-fcgi -s /run/fcgiwrap.socket -M 660 -- /usr/sbin/fcgiwrap-# or run fcgiwrap over TCP and point fastcgi_pass at 127.0.0.1:9000.+    # The site itself, written for TLS on 443. For a quick plain-HTTP test,+    # change the two listen lines to port 80, delete the redirect block above,+    # and delete the http2 and ssl lines below. Everything else stays as it is.+    server {+        listen      443 ssl;+        listen      [::]:443 ssl;+        # nginx 1.25.1 and newer. On older builds delete this and write the+        # listen lines as "listen 443 ssl http2;" instead.+        http2       on;+        server_name git.example.org;++        ssl_certificate     /etc/letsencrypt/live/git.example.org/fullchain.pem;+        ssl_certificate_key /etc/letsencrypt/live/git.example.org/privkey.pem;+        ssl_protocols       TLSv1.2 TLSv1.3;+        ssl_ciphers         HIGH:!aNULL:!MD5;+        # Let the client pick, which is the modern advice once the ancient+        # protocol versions are already excluded above.+        ssl_prefer_server_ciphers off;+        # Resumption, so a browser paging through a repository is not made to+        # redo a full handshake on every connection.+        ssl_session_cache   shared:SSL:10m;+        ssl_session_timeout 1d;+        ssl_session_tickets off;++        # Security headers sit here, not in cgit, because they must also cover+        # the static assets nginx serves directly. cgit loads only its own+        # /cgit.js and uses inline style on the diffstat bars, so script-src+        # stays self while style-src allows inline. always applies them to+        # error responses too. If you enable the gravatar or libravatar avatar+        # filter, add its host to img-src, for example https://www.gravatar.com+        # or https://seccdn.libravatar.org.+        add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'self'" always;+        add_header X-Content-Type-Options "nosniff" always;+        add_header Referrer-Policy "no-referrer" always;+        # Enable only once you serve HTTPS exclusively, since it is hard to undo.+        #add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;++        # The document root is the directory that holds the static assets. cgit+        # emits absolute links to /cgit.css and /cgit.png by default, so those+        # files must resolve at the root of the URL space. Pointing root at the+        # asset directory makes /cgit.css map to /usr/share/cgit/cgit.css.+        root /usr/share/cgit;++        # The only request body cgit ever reads is the auth-filter login form,+        # and it stops after 4096 bytes. Nothing else here accepts an upload,+        # so keep the cap far below the nginx default of 1m.+        client_max_body_size 64k;++        access_log /var/log/nginx/cgit.access.log combined;+        error_log  /var/log/nginx/cgit.error.log;++        # Match the assets by their exact root-level names, never by bare+        # extension. cgit routes on PATH_INFO and a repository can hold files+        # ending in .css or .png, so /myrepo/tree/style.css and /myrepo/plain/+        # logo.png are real cgit URLs. A broad extension match would capture+        # those, look for them on disk, and return 404 before cgit could render+        # them. Anchoring the regex at the start of the path matches /cgit.css+        # but not /myrepo/tree/cgit.css, so it can never shadow a repository+        # file. An nginx regex location is matched before the prefix location+        # below, so these assets win for their exact URLs and cgit wins for the+        # rest.+        location ~ ^/(cgit\.css|cgit\.js|cgit\.png|favicon\.ico|robots\.txt)$ {+            expires    30d;+            access_log off;+            try_files  $uri =404;+        }++        # Everything that is not a static asset above is a cgit URL, the repo+        # index, a repository, a page within a repository, a snapshot, a feed.+        location / {+            # The CGI environment. This is normally "include fastcgi_params",+            # which would be a second file, so the list is written out here.+            # Of all of it cgit itself reads only CGIT_CONFIG, PATH_INFO,+            # QUERY_STRING, SCRIPT_NAME, REQUEST_METHOD, CONTENT_LENGTH,+            # HTTP_HOST, HTTPS, SERVER_NAME, SERVER_PORT, HTTP_COOKIE and+            # HTTP_REFERER. The cookie and referer arrive on their own, since+            # nginx forwards request headers as HTTP_* without being asked.++            # The program fcgiwrap runs. It must be the cgit binary itself, not+            # $document_root$fastcgi_script_name, which would try to run a repo+            # path and is the usual cause of a failed request.+            fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;++            # cgit builds its link base, the virtual root, from SCRIPT_NAME.+            # The stock parameters set SCRIPT_NAME to the whole request path,+            # which would make cgit prepend that path to every link. Served at+            # the domain root the script has no prefix, so force SCRIPT_NAME+            # empty and cgit uses / as its base. A sub-path install sets it+            # instead, see the end of this file.+            fastcgi_param SCRIPT_NAME  "";++            # How cgit learns the repository and page. At the domain root the+            # whole request path is the PATH_INFO.+            fastcgi_param PATH_INFO    $uri;++            # Page options such as h=branch, id=sha and the snapshot format.+            fastcgi_param QUERY_STRING $query_string;++            # Which config cgit reads. It checks CGIT_CONFIG and falls back to+            # the compiled-in /etc/cgitrc. Setting it makes the location+            # explicit and lets you move cgitrc without recompiling.+            fastcgi_param CGIT_CONFIG  /etc/cgitrc;++            # The browser's Host header, so cgit builds clone URLs against the+            # name the visitor used rather than server_name.+            fastcgi_param HTTP_HOST    $http_host;++            # The real scheme, so cgit builds correct https clone URLs.+            fastcgi_param HTTPS        $https if_not_empty;++            # The routine remainder, needed by fcgiwrap and by the login form.+            fastcgi_param REQUEST_METHOD    $request_method;+            fastcgi_param CONTENT_TYPE      $content_type;+            fastcgi_param CONTENT_LENGTH    $content_length;+            fastcgi_param REQUEST_URI       $request_uri;+            fastcgi_param DOCUMENT_URI      $document_uri;+            fastcgi_param DOCUMENT_ROOT     $document_root;+            fastcgi_param SERVER_PROTOCOL   $server_protocol;+            fastcgi_param REQUEST_SCHEME    $scheme;+            fastcgi_param GATEWAY_INTERFACE CGI/1.1;+            fastcgi_param SERVER_SOFTWARE   nginx/$nginx_version;+            fastcgi_param REMOTE_ADDR       $remote_addr;+            fastcgi_param REMOTE_PORT       $remote_port;+            fastcgi_param SERVER_ADDR       $server_addr;+            fastcgi_param SERVER_PORT       $server_port;+            fastcgi_param SERVER_NAME       $server_name;++            # Hand off to the fcgiwrap socket. A TCP fcgiwrap would use for+            # example 127.0.0.1:9000 here.+            fastcgi_pass unix:/run/fcgiwrap.socket;++            # Large outputs such as snapshot tarballs and blame on big files+            # can take a while, so give cgit room and stream rather than buffer.+            fastcgi_read_timeout 300s;+            fastcgi_buffering off;+        }+    }+}  -# --- Alternative, serving cgit under a sub-path ----------------------------- # To serve cgit at https://git.example.org/cgit/ instead of the root, split-# the URL so SCRIPT_NAME is the prefix and PATH_INFO is the rest.+# the URL so SCRIPT_NAME is the prefix and PATH_INFO is the rest. Keep every+# other fastcgi_param from the location above. # #     location /cgit/ {-#         include fastcgi_params; #         fastcgi_split_path_info ^(/cgit)(/.*)$; #         fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi; #         fastcgi_param SCRIPT_NAME     $fastcgi_script_name; #         fastcgi_param PATH_INFO       $fastcgi_path_info;-#         fastcgi_param QUERY_STRING    $query_string;-#         fastcgi_param HTTP_HOST       $http_host;-#         fastcgi_param CGIT_CONFIG     /etc/cgitrc;-#         fastcgi_param HTTPS           $https if_not_empty;+#         ... #         fastcgi_pass  unix:/run/fcgiwrap.socket; #     } #
diff --git a/custom/servers/nginx.conf b/custom/servers/nginx.conf
index 76ac260..3b0b7ef 100644
--- a/custom/servers/nginx.conf
+++ b/custom/servers/nginx.conf
@@ -1,8 +1,10 @@
 # nginx configuration for cgit.
 #
-# nginx cannot run CGI programs itself, so a small bridge called fcgiwrap
-# runs the cgit.cgi binary and speaks FastCGI to nginx. Starting fcgiwrap is
-# covered in the notes at the end of this file.
+# This is a complete nginx.conf rather than a snippet for conf.d or
+# sites-enabled, so nothing here is included from elsewhere. Install it and
+# reload, or point nginx straight at it to try it out.
+#     nginx -t -c /path/to/nginx.conf     # check the syntax
+#     nginx -c /path/to/nginx.conf        # run it
 #
 # Paths assumed below, edit them to match your install.
 #   cgit CGI binary   /usr/lib/cgit/cgit.cgi
@@ -16,166 +18,237 @@
 # base from SCRIPT_NAME. The five static assets are served straight off disk
 # and must never be routed through cgit. Passing PATH_INFO through is the
 # single most important part of the config below.
+#
+# nginx cannot run CGI programs itself, so a small bridge called fcgiwrap runs
+# the cgit.cgi binary and speaks FastCGI to nginx. Nothing below works until
+# that socket exists. On Debian and Ubuntu the packaged systemd socket
+# provides /run/fcgiwrap.socket, so enabling it is enough.
+#     apt install fcgiwrap
+#     systemctl enable --now fcgiwrap.socket
+# The socket must be readable by nginx's user. The packaged unit runs fcgiwrap
+# as www-data, which nginx also uses on those systems. Without systemd you can
+# run
+#     spawn-fcgi -s /run/fcgiwrap.socket -M 660 -- /usr/sbin/fcgiwrap
+# or run fcgiwrap over TCP and point fastcgi_pass at 127.0.0.1:9000.
 
 
-# --- Optional HTTP to HTTPS redirect ----------------------------------------
-# Delete this whole server block if you serve plain HTTP only.
-server {
-    listen      80;
-    listen      [::]:80;
-    server_name git.example.org;
+# The user nginx drops to after binding the ports. It is www-data on Debian
+# and Ubuntu, nginx on RHEL and Fedora, and http on Arch and Alpine. It has to
+# match whatever owns the fcgiwrap socket.
+user                 www-data;
+worker_processes     auto;
+pid                  /run/nginx.pid;
 
-    # ACME http-01 challenge files, if you use certbot in webroot mode.
-    location ^~ /.well-known/acme-challenge/ {
-        root /var/www/html;
-    }
+# Startup and worker errors. Per-site request logs are set in the vhost.
+error_log            /var/log/nginx/error.log warn;
 
-    # Everything else moves to HTTPS.
-    location / {
-        return 301 https://$host$request_uri;
-    }
+events {
+    worker_connections 1024;
 }
 
 
-# --- Main site --------------------------------------------------------------
-# Written for TLS on 443. For a quick plain-HTTP test, change the two listen
-# lines to port 80, delete the redirect block above, and delete the four ssl
-# lines below. Everything else stays the same.
-server {
-    listen      443 ssl;
-    listen      [::]:443 ssl;
-    http2       on;
-    server_name git.example.org;
-
-    ssl_certificate     /etc/letsencrypt/live/git.example.org/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/git.example.org/privkey.pem;
-    ssl_protocols       TLSv1.2 TLSv1.3;
-    ssl_ciphers         HIGH:!aNULL:!MD5;
-
-    # --- Security headers ---------------------------------------------------
-    # These sit here, not in cgit, because they must also cover the static
-    # assets nginx serves directly. cgit loads only its own /cgit.js and uses
-    # inline style on the diffstat bars, so script-src stays self while
-    # style-src allows inline. always applies them to error responses too. If
-    # you enable the gravatar or libravatar avatar filter, add its host to
-    # img-src, for example https://www.gravatar.com or https://seccdn.libravatar.org.
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'self'" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header Referrer-Policy "no-referrer" always;
-    # Enable only once you serve HTTPS exclusively, since it is hard to undo.
-    #add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
-
-    # The document root is the directory that holds the static assets. cgit
-    # emits absolute links to /cgit.css and /cgit.png by default, so those
-    # files must resolve at the root of the URL space. Pointing root at the
-    # asset directory makes /cgit.css map to /usr/share/cgit/cgit.css.
-    root /usr/share/cgit;
-
-    # Upload cap for large form posts. Snapshots are generated rather than
-    # uploaded, so this does not limit them.
-    client_max_body_size 64m;
-
-    access_log /var/log/nginx/cgit.access.log;
-    error_log  /var/log/nginx/cgit.error.log;
-
-    # --- Static assets, served directly -------------------------------------
-    # Match the assets by their exact root-level names, never by bare
-    # extension. cgit routes on PATH_INFO and a repository can hold files
-    # ending in .css or .png, so /myrepo/tree/style.css and /myrepo/plain/
-    # logo.png are real cgit URLs. A broad extension match would capture
-    # those, look for them on disk, and return 404 before cgit could render
-    # them. Anchoring the regex at the start of the path matches /cgit.css but
-    # not /myrepo/tree/cgit.css, so it can never shadow a repository file. An
-    # nginx regex location is matched before the prefix location below, so
-    # these assets win for their exact URLs and cgit wins for the rest.
-    location ~ ^/(cgit\.css|cgit\.js|cgit\.png|favicon\.ico|robots\.txt)$ {
-        expires    30d;
-        access_log off;
-        try_files  $uri =404;
+http {
+    # nginx's compiled-in type table knows only text/html, and the usual
+    # "include mime.types" would pull in a second file. Exactly five static
+    # files are served off disk, so their types are declared here instead and
+    # this config keeps standing on its own. Everything else nginx returns
+    # comes from cgit, which sets its own Content-Type.
+    types {
+        text/css                  css;
+        text/javascript           js;
+        image/png                 png;
+        image/vnd.microsoft.icon  ico;
+        text/plain                txt;
     }
+    default_type application/octet-stream;
+
+    sendfile           on;
+    tcp_nopush         on;
+    keepalive_timeout  65;
 
-    # --- cgit, the catch-all ------------------------------------------------
-    # Everything that is not a static asset above is a cgit URL, the repo
-    # index, a repository, a page within a repository, a snapshot, a feed.
-    location / {
-        # nginx's standard FastCGI parameters, some of which are overridden
-        # below. A later fastcgi_param wins, so include order does not matter.
-        include fastcgi_params;
-
-        # The program fcgiwrap runs. It must be the cgit binary itself, not
-        # $document_root$fastcgi_script_name, which would try to run a repo
-        # path and is the usual cause of a failed request.
-        fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;
-
-        # cgit builds its link base, the virtual root, from SCRIPT_NAME. The
-        # stock parameters set SCRIPT_NAME to the whole request path, which
-        # would make cgit prepend that path to every link. Served at the
-        # domain root the script has no prefix, so force SCRIPT_NAME empty and
-        # cgit uses / as its base. A sub-path install sets it instead, see the
-        # end of this file.
-        fastcgi_param SCRIPT_NAME  "";
-
-        # How cgit learns the repository and page. At the domain root the
-        # whole request path is the PATH_INFO.
-        fastcgi_param PATH_INFO    $uri;
-
-        # Page options such as h=branch, id=sha and the snapshot format.
-        fastcgi_param QUERY_STRING $query_string;
-
-        # Where the static assets live, kept consistent with root above.
-        fastcgi_param DOCUMENT_ROOT $document_root;
-
-        # The browser's Host header, so cgit builds clone URLs against the
-        # name the visitor used rather than server_name.
-        fastcgi_param HTTP_HOST    $http_host;
-
-        # Which config cgit reads. It checks CGIT_CONFIG and falls back to the
-        # compiled-in /etc/cgitrc. Setting it makes the location explicit and
-        # lets you move cgitrc without recompiling.
-        fastcgi_param CGIT_CONFIG  /etc/cgitrc;
-
-        # The real scheme, so cgit builds correct https clone URLs.
-        fastcgi_param HTTPS        $https if_not_empty;
-
-        # Hand off to the fcgiwrap socket. See the notes for how to create it.
-        # A TCP fcgiwrap would use for example 127.0.0.1:9000 here.
-        fastcgi_pass unix:/run/fcgiwrap.socket;
-
-        # Large outputs such as snapshot tarballs and blame on big files can
-        # take a while, so give cgit room and stream rather than buffer.
-        fastcgi_read_timeout 300s;
-        fastcgi_buffering off;
+    # Drop the version number from the Server header and from error pages.
+    server_tokens      off;
+
+    # cgit pages are large and highly compressible, so this is the cheapest
+    # speedup available. text/html is always compressed and cannot be listed.
+    # Snapshot tarballs are deliberately absent, since they arrive compressed
+    # already and running them through gzip again only burns CPU.
+    gzip               on;
+    gzip_vary          on;
+    gzip_proxied       any;
+    gzip_min_length    1024;
+    gzip_types         text/css text/javascript text/plain application/atom+xml;
+
+
+    # Bounce plain HTTP up to HTTPS. Delete this whole server block if you
+    # serve plain HTTP only.
+    server {
+        listen      80;
+        listen      [::]:80;
+        server_name git.example.org;
+
+        # ACME http-01 challenge files, if you use certbot in webroot mode.
+        location ^~ /.well-known/acme-challenge/ {
+            root /var/www/html;
+        }
+
+        # Everything else moves to HTTPS.
+        location / {
+            return 301 https://$host$request_uri;
+        }
     }
-}
 
 
-# --- Notes, starting fcgiwrap -----------------------------------------------
-# cgit is a CGI binary and fcgiwrap is the CGI to FastCGI bridge nginx talks
-# to. On Debian and Ubuntu the packaged systemd socket provides
-# /run/fcgiwrap.socket, so enabling it is enough.
-#     apt install fcgiwrap
-#     systemctl enable --now fcgiwrap.socket
-# The socket must be readable by nginx's user. The packaged unit runs fcgiwrap
-# as www-data, which nginx also uses on those systems. Without systemd you can
-# run
-#     spawn-fcgi -s /run/fcgiwrap.socket -M 660 -- /usr/sbin/fcgiwrap
-# or run fcgiwrap over TCP and point fastcgi_pass at 127.0.0.1:9000.
+    # The site itself, written for TLS on 443. For a quick plain-HTTP test,
+    # change the two listen lines to port 80, delete the redirect block above,
+    # and delete the http2 and ssl lines below. Everything else stays as it is.
+    server {
+        listen      443 ssl;
+        listen      [::]:443 ssl;
+        # nginx 1.25.1 and newer. On older builds delete this and write the
+        # listen lines as "listen 443 ssl http2;" instead.
+        http2       on;
+        server_name git.example.org;
+
+        ssl_certificate     /etc/letsencrypt/live/git.example.org/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/git.example.org/privkey.pem;
+        ssl_protocols       TLSv1.2 TLSv1.3;
+        ssl_ciphers         HIGH:!aNULL:!MD5;
+        # Let the client pick, which is the modern advice once the ancient
+        # protocol versions are already excluded above.
+        ssl_prefer_server_ciphers off;
+        # Resumption, so a browser paging through a repository is not made to
+        # redo a full handshake on every connection.
+        ssl_session_cache   shared:SSL:10m;
+        ssl_session_timeout 1d;
+        ssl_session_tickets off;
+
+        # Security headers sit here, not in cgit, because they must also cover
+        # the static assets nginx serves directly. cgit loads only its own
+        # /cgit.js and uses inline style on the diffstat bars, so script-src
+        # stays self while style-src allows inline. always applies them to
+        # error responses too. If you enable the gravatar or libravatar avatar
+        # filter, add its host to img-src, for example https://www.gravatar.com
+        # or https://seccdn.libravatar.org.
+        add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'self'" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-referrer" always;
+        # Enable only once you serve HTTPS exclusively, since it is hard to undo.
+        #add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
+
+        # The document root is the directory that holds the static assets. cgit
+        # emits absolute links to /cgit.css and /cgit.png by default, so those
+        # files must resolve at the root of the URL space. Pointing root at the
+        # asset directory makes /cgit.css map to /usr/share/cgit/cgit.css.
+        root /usr/share/cgit;
+
+        # The only request body cgit ever reads is the auth-filter login form,
+        # and it stops after 4096 bytes. Nothing else here accepts an upload,
+        # so keep the cap far below the nginx default of 1m.
+        client_max_body_size 64k;
+
+        access_log /var/log/nginx/cgit.access.log combined;
+        error_log  /var/log/nginx/cgit.error.log;
+
+        # Match the assets by their exact root-level names, never by bare
+        # extension. cgit routes on PATH_INFO and a repository can hold files
+        # ending in .css or .png, so /myrepo/tree/style.css and /myrepo/plain/
+        # logo.png are real cgit URLs. A broad extension match would capture
+        # those, look for them on disk, and return 404 before cgit could render
+        # them. Anchoring the regex at the start of the path matches /cgit.css
+        # but not /myrepo/tree/cgit.css, so it can never shadow a repository
+        # file. An nginx regex location is matched before the prefix location
+        # below, so these assets win for their exact URLs and cgit wins for the
+        # rest.
+        location ~ ^/(cgit\.css|cgit\.js|cgit\.png|favicon\.ico|robots\.txt)$ {
+            expires    30d;
+            access_log off;
+            try_files  $uri =404;
+        }
+
+        # Everything that is not a static asset above is a cgit URL, the repo
+        # index, a repository, a page within a repository, a snapshot, a feed.
+        location / {
+            # The CGI environment. This is normally "include fastcgi_params",
+            # which would be a second file, so the list is written out here.
+            # Of all of it cgit itself reads only CGIT_CONFIG, PATH_INFO,
+            # QUERY_STRING, SCRIPT_NAME, REQUEST_METHOD, CONTENT_LENGTH,
+            # HTTP_HOST, HTTPS, SERVER_NAME, SERVER_PORT, HTTP_COOKIE and
+            # HTTP_REFERER. The cookie and referer arrive on their own, since
+            # nginx forwards request headers as HTTP_* without being asked.
+
+            # The program fcgiwrap runs. It must be the cgit binary itself, not
+            # $document_root$fastcgi_script_name, which would try to run a repo
+            # path and is the usual cause of a failed request.
+            fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;
+
+            # cgit builds its link base, the virtual root, from SCRIPT_NAME.
+            # The stock parameters set SCRIPT_NAME to the whole request path,
+            # which would make cgit prepend that path to every link. Served at
+            # the domain root the script has no prefix, so force SCRIPT_NAME
+            # empty and cgit uses / as its base. A sub-path install sets it
+            # instead, see the end of this file.
+            fastcgi_param SCRIPT_NAME  "";
+
+            # How cgit learns the repository and page. At the domain root the
+            # whole request path is the PATH_INFO.
+            fastcgi_param PATH_INFO    $uri;
+
+            # Page options such as h=branch, id=sha and the snapshot format.
+            fastcgi_param QUERY_STRING $query_string;
+
+            # Which config cgit reads. It checks CGIT_CONFIG and falls back to
+            # the compiled-in /etc/cgitrc. Setting it makes the location
+            # explicit and lets you move cgitrc without recompiling.
+            fastcgi_param CGIT_CONFIG  /etc/cgitrc;
+
+            # The browser's Host header, so cgit builds clone URLs against the
+            # name the visitor used rather than server_name.
+            fastcgi_param HTTP_HOST    $http_host;
+
+            # The real scheme, so cgit builds correct https clone URLs.
+            fastcgi_param HTTPS        $https if_not_empty;
+
+            # The routine remainder, needed by fcgiwrap and by the login form.
+            fastcgi_param REQUEST_METHOD    $request_method;
+            fastcgi_param CONTENT_TYPE      $content_type;
+            fastcgi_param CONTENT_LENGTH    $content_length;
+            fastcgi_param REQUEST_URI       $request_uri;
+            fastcgi_param DOCUMENT_URI      $document_uri;
+            fastcgi_param DOCUMENT_ROOT     $document_root;
+            fastcgi_param SERVER_PROTOCOL   $server_protocol;
+            fastcgi_param REQUEST_SCHEME    $scheme;
+            fastcgi_param GATEWAY_INTERFACE CGI/1.1;
+            fastcgi_param SERVER_SOFTWARE   nginx/$nginx_version;
+            fastcgi_param REMOTE_ADDR       $remote_addr;
+            fastcgi_param REMOTE_PORT       $remote_port;
+            fastcgi_param SERVER_ADDR       $server_addr;
+            fastcgi_param SERVER_PORT       $server_port;
+            fastcgi_param SERVER_NAME       $server_name;
+
+            # Hand off to the fcgiwrap socket. A TCP fcgiwrap would use for
+            # example 127.0.0.1:9000 here.
+            fastcgi_pass unix:/run/fcgiwrap.socket;
+
+            # Large outputs such as snapshot tarballs and blame on big files
+            # can take a while, so give cgit room and stream rather than buffer.
+            fastcgi_read_timeout 300s;
+            fastcgi_buffering off;
+        }
+    }
+}
 
 
-# --- Alternative, serving cgit under a sub-path -----------------------------
 # To serve cgit at https://git.example.org/cgit/ instead of the root, split
-# the URL so SCRIPT_NAME is the prefix and PATH_INFO is the rest.
+# the URL so SCRIPT_NAME is the prefix and PATH_INFO is the rest. Keep every
+# other fastcgi_param from the location above.
 #
 #     location /cgit/ {
-#         include fastcgi_params;
 #         fastcgi_split_path_info ^(/cgit)(/.*)$;
 #         fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;
 #         fastcgi_param SCRIPT_NAME     $fastcgi_script_name;
 #         fastcgi_param PATH_INFO       $fastcgi_path_info;
-#         fastcgi_param QUERY_STRING    $query_string;
-#         fastcgi_param HTTP_HOST       $http_host;
-#         fastcgi_param CGIT_CONFIG     /etc/cgitrc;
-#         fastcgi_param HTTPS           $https if_not_empty;
+#         ...
 #         fastcgi_pass  unix:/run/fcgiwrap.socket;
 #     }
 #