Diff options
| -rw-r--r-- | custom/servers/apache.conf | 324 |
1 file changed, 54 insertions, 270 deletions
diff --git a/custom/servers/apache.conf b/custom/servers/apache.conf index 3d65d5e..b10750e 100644 --- a/custom/servers/apache.conf +++ b/custom/servers/apache.conf @@ -1,280 +1,64 @@ -# Apache httpd configuration for cgit. +# An Apache httpd virtual host that serves cgit at the root of +# git.example.org. Include it from httpd.conf, which supplies the user, the +# MIME types and the logs. It needs mod_alias and mod_cgid, or mod_cgi under +# the prefork MPM, and the commented examples also need mod_ssl for HTTPS +# and mod_env for git-http-backend. # -# Written for the httpd 2.4 branch, at 2.4.69 when last reviewed. +# The paths are one common layout, so adjust them to your system. +# cgit.cgi /usr/lib/cgit, from make install with the two-line cgit.conf in README +# static files /usr/share/cgit, from the same install +# repositories /var/lib/git, the scan-path custom/cgitrc suggests +# git-http-backend /usr/libexec/git-core, the directory git --exec-path prints +# certificate /etc/ssl/certs/git.example.org.pem +# key /etc/ssl/private/git.example.org.key # -# This is a complete httpd.conf rather than a vhost snippet, so nothing here -# is included from elsewhere and no distro base config is assumed. Check it -# and run it with -# httpd -t -f /path/to/apache.conf # check the syntax -# httpd -f /path/to/apache.conf # run it -# To use it as an ordinary vhost file instead, drop everything above the -# virtual hosts and let your distro's httpd.conf supply it. -# -# Apache runs the cgit.cgi binary directly through mod_cgid, so no FastCGI -# bridge is needed. -# -# Paths assumed below, edit them to match your install. -# cgit CGI binary /usr/lib/cgit/cgit.cgi -# static assets /usr/share/cgit (cgit.css cgit.js cgit.png favicon.ico robots.txt) -# cgit config /etc/cgitrc -# public url https://git.example.org/ (cgit at the domain root) -# -# cgit is one CGI executable. It learns the repository and the page from -# PATH_INFO and reads page options such as h= and id= from QUERY_STRING. The -# five static assets are served straight off disk. mod_alias resolves Alias and -# ScriptAlias in order and the first match wins, so the static Alias lines come -# before the catch-all ScriptAlias to stop the two routes from shadowing each -# other. - - -# ServerRoot is what every relative path below resolves against, including the -# module paths. It is /etc/httpd on RHEL and Fedora and /etc/apache2 on Debian -# and Ubuntu, where the modules live in /usr/lib/apache2/modules and the -# LoadModule lines need that absolute path instead of the relative one. -ServerRoot /etc/httpd -PidFile /var/run/httpd.pid - -# Where Apache puts its runtime scratch, the mutexes and the SSL session -# cache. It is /var/run/httpd on RHEL and Fedora and /var/run/apache2 on -# Debian and Ubuntu. The directory has to exist and be writable before Apache -# starts, which is normally the packaging's job. -DefaultRuntimeDir /var/run/httpd - -Listen 80 -Listen 443 - -# Set globally so Apache does not have to guess a name at startup, which it -# warns about. Each vhost overrides it with its own. -ServerName git.example.org - -# Drop the version number from the Server header and from error pages. -ServerTokens Prod -ServerSignature Off - - -# mod_cgid suits the threaded MPMs that ship by default. Use mod_cgi instead -# only on the old prefork MPM. mod_alias provides Alias and ScriptAlias, -# mod_env provides SetEnv, and the rest are the core pieces a standalone -# config cannot do without. On Debian and Ubuntu run -# a2enmod cgid alias env headers expires ssl -# rather than editing these lines. The guards make double-loading harmless. -<IfModule !mpm_event_module> - LoadModule mpm_event_module modules/mod_mpm_event.so -</IfModule> -<IfModule !unixd_module> - LoadModule unixd_module modules/mod_unixd.so -</IfModule> -<IfModule !authz_core_module> - LoadModule authz_core_module modules/mod_authz_core.so -</IfModule> -<IfModule !log_config_module> - LoadModule log_config_module modules/mod_log_config.so -</IfModule> -<IfModule !mime_module> - LoadModule mime_module modules/mod_mime.so -</IfModule> -<IfModule !alias_module> - LoadModule alias_module modules/mod_alias.so -</IfModule> -<IfModule !cgid_module> - LoadModule cgid_module modules/mod_cgid.so -</IfModule> -<IfModule !env_module> - LoadModule env_module modules/mod_env.so -</IfModule> -<IfModule !headers_module> - LoadModule headers_module modules/mod_headers.so -</IfModule> -<IfModule !expires_module> - LoadModule expires_module modules/mod_expires.so -</IfModule> -# TLS. Delete these two along with the HTTPS vhost to run plain HTTP only. -# mod_socache_shmcb backs the SSL session cache and mod_ssl expects it. -<IfModule !socache_shmcb_module> - LoadModule socache_shmcb_module modules/mod_socache_shmcb.so -</IfModule> -<IfModule !ssl_module> - LoadModule ssl_module modules/mod_ssl.so -</IfModule> - - -# The user Apache drops to after binding the ports. It is apache on RHEL and -# Fedora, www-data on Debian and Ubuntu, and http on Arch. -User apache -Group apache - - -# The combined format comes from the distro config rather than from Apache -# itself, so a standalone config has to define it before any CustomLog uses it. -LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined -ErrorLog /var/log/apache2/error.log -LogLevel warn - - -# The usual "TypesConfig conf/mime.types" would pull in a second file. Exactly -# five static files are served off disk, so their types are declared here -# instead. Everything else Apache returns comes from cgit, which sets its own -# Content-Type. -AddType text/css .css -AddType text/javascript .js -AddType image/png .png -AddType image/vnd.microsoft.icon .ico -AddType text/plain .txt - - -# Deny the whole filesystem, then open only the two directories cgit needs. -# Without this a misplaced Alias could expose anything readable on the host. -<Directory /> - AllowOverride None - Require all denied -</Directory> - -# The static asset directory, read only. -<Directory "/usr/share/cgit"> - Options None - AllowOverride None - Require all granted - - # These assets rarely change, so let browsers cache them. Keep the - # caching scoped to this directory. Ordinary cgit pages carry no expiry - # time, so a server-wide ExpiresDefault would stamp freshness onto - # them, fight the no-store cgit puts on the login page, and could let - # one visitor's page be served to another from a shared cache. - <IfModule mod_expires.c> - ExpiresActive On - ExpiresDefault "access plus 30 days" - </IfModule> -</Directory> +# The commented examples add HTTPS, which the bundled auth filters need +# before they log anyone in, and smart HTTP clone and push through +# git-http-backend. -# The cgit binary. -<Directory "/usr/lib/cgit"> - Options +ExecCGI - # Run cgit.cgi as a CGI even if it is ever reached through a plain Alias - # rather than ScriptAlias. - SetHandler cgi-script - AllowOverride None - Require all granted -</Directory> - - -# This vhost only bounces plain HTTP up to HTTPS. It serves no cgit itself. -# Every cgit directive lives in the HTTPS vhost below. To run without TLS for -# now, convert the HTTPS vhost to port 80 and delete this whole block rather -# than editing it, since deleting only the Redirect line would leave a vhost -# that serves nothing. <VirtualHost *:80> ServerName git.example.org - ErrorLog /var/log/apache2/cgit_error.log - CustomLog /var/log/apache2/cgit_access.log combined - - Redirect permanent / https://git.example.org/ -</VirtualHost> - - -# The vhost that serves cgit. To run without TLS for now, change this opening -# line to port 80, delete the SSL lines, delete the Strict-Transport-Security -# line, and delete the vhost above so there is only one. Everything else stays -# as it is. -<VirtualHost *:443> - ServerName git.example.org - - ErrorLog /var/log/apache2/cgit_ssl_error.log - CustomLog /var/log/apache2/cgit_ssl_access.log combined - - # Point these at your certificate. - SSLEngine on - SSLCertificateFile /etc/ssl/certs/git.example.org.crt - SSLCertificateKeyFile /etc/ssl/private/git.example.org.key - # Subtractive rather than naming the versions to keep, since a mod_ssl - # built before TLS 1.3 rejects the +TLSv1.3 token outright and refuses to - # start. This form enables 1.3 wherever it exists. - SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 - - # Which config cgit reads. It falls back to the compiled-in /etc/cgitrc, - # the same path used here, but setting it makes the location explicit and - # lets you point at a per-vhost file later. - SetEnv CGIT_CONFIG /etc/cgitrc + # For HTTPS, change *:80 above to *:443, uncomment these three lines and + # uncomment the host at the end, which sends plain HTTP on to HTTPS. + # Apache also has to listen on 443. + #SSLEngine on + #SSLCertificateFile /etc/ssl/certs/git.example.org.pem + #SSLCertificateKeyFile /etc/ssl/private/git.example.org.key + + # The five files cgit links to at the root are served off disk. Apache + # takes the first alias that matches, so they come before the one that + # hands every other path to cgit as its PATH_INFO. + AliasMatch ^/(cgit\.css|cgit\.js|cgit\.png|favicon\.ico|robots\.txt)$ /usr/share/cgit/$1 + + # Smart HTTP clone and push at the urls cgit gives the repositories go to + # git-http-backend. It finds them under GIT_PROJECT_ROOT and, with + # GIT_HTTP_EXPORT_ALL, serves them without a git-daemon-export-ok file. + # The safe.directory setting lets it open them while another user owns + # them. Push is refused until a repository sets http.receivepack or the + # server authenticates the user. + #SetEnv GIT_PROJECT_ROOT /var/lib/git + #SetEnv GIT_HTTP_EXPORT_ALL + #SetEnv GIT_CONFIG_COUNT 1 + #SetEnv GIT_CONFIG_KEY_0 safe.directory + #SetEnv GIT_CONFIG_VALUE_0 * + #ScriptAliasMatch ^/(.+/(info/refs|git-upload-pack|git-receive-pack))$ /usr/libexec/git-core/git-http-backend/$1 - # The only request body cgit ever reads is the auth-filter login form, and - # it stops after 4096 bytes. Nothing else here accepts an upload. - LimitRequestBody 65536 - - # Site-wide security headers are set here so they also cover the static - # assets Apache serves. On raw repository bytes cgit sends a nosniff and - # the stricter policy "default-src 'none'" of its own. - # - # The word setifempty is load bearing on the two headers cgit can also - # emit. "Header always set" replaces a same-named header even when the - # CGI sent it, which would swap the strict policy on raw repository - # content for this looser site one. setifempty yields to whatever cgit - # sent. Referrer-Policy stays a plain set because cgit never emits it. - # - # form-action self covers the login form, the only form cgit renders. If - # you enable the gravatar or libravatar avatar filter, add its host to - # img-src, for example https://www.gravatar.com. A head-include or - # repo.head-content that injects a <style> block needs 'unsafe-inline' - # added to style-src. - Header always setifempty Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'self'; form-action 'self'" - Header always setifempty X-Content-Type-Options "nosniff" - Header always set Referrer-Policy "no-referrer" - - # The browser features a git viewer never asks for, camera and location - # among them, are refused outright for everything served here, repository - # files included. - Header always set Permissions-Policy "accelerometer=(), autoplay=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), usb=()" - - # Cross-origin isolation. The opener policy cuts any window.opener link - # between cgit and pages that open it, and the resource policy stops - # other origins from embedding what cgit serves, a hotlinked raw file for - # example. git clients are not browsers and ignore both, so clone and - # snapshot downloads keep working. The stricter - # Cross-Origin-Embedder-Policy is deliberately absent because it would - # break the avatar filters mentioned above. - Header always set Cross-Origin-Opener-Policy "same-origin" - Header always set Cross-Origin-Resource-Policy "same-origin" - - # Two years of forced HTTPS. This config already redirects every plain - # request to TLS, so browsers may as well stop asking. Delete this line - # if you convert the vhost to plain HTTP, and know it is hard to undo - # once browsers have seen it. - Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains" - - # These five files are the only things served off disk. cgit's default - # css, js, logo and favicon settings point at these paths, so if you - # relocate the assets update both these Alias targets and those settings - # in cgitrc to agree. - Alias /cgit.css /usr/share/cgit/cgit.css - Alias /cgit.js /usr/share/cgit/cgit.js - Alias /cgit.png /usr/share/cgit/cgit.png - Alias /favicon.ico /usr/share/cgit/favicon.ico - Alias /robots.txt /usr/share/cgit/robots.txt - - # Mapping / makes cgit the handler for every url the static Aliases above - # did not already claim. The trailing slash on cgit.cgi/ is load bearing, - # telling Apache that cgit.cgi is the program and the rest of the url is - # PATH_INFO. cgit derives its link base from SCRIPT_NAME, which at the - # domain root is / and needs no tuning. For a sub-path install see the - # note below. ScriptAlias / /usr/lib/cgit/cgit.cgi/ -</VirtualHost> - - -# The SSL session cache is a global mod_ssl setting, so it sits outside the -# vhosts. Resumption keeps a browser paging through a repository from redoing -# a full handshake on every connection. Delete along with the HTTPS vhost if -# you serve plain HTTP. -<IfModule mod_ssl.c> - # Relative, so it lands in DefaultRuntimeDir and follows it across distros. - SSLSessionCache "shmcb:ssl_scache(512000)" - SSLSessionCacheTimeout 300 -</IfModule> + # The main httpd.conf refuses every directory it has not opened itself. + <Directory /usr/share/cgit> + Require all granted + </Directory> + <Directory /usr/lib/cgit> + Require all granted + </Directory> + #<Directory /usr/libexec/git-core> + # Require all granted + #</Directory> +</VirtualHost> -# To serve cgit at https://git.example.org/cgit/ instead of the root, change -# the ScriptAlias to -# ScriptAlias /cgit/ /usr/lib/cgit/cgit.cgi/ -# and move the static assets under the same prefix, for example -# Alias /cgit/cgit.css /usr/share/cgit/cgit.css -# SCRIPT_NAME then becomes /cgit and cgit auto-detects it. If links come out -# wrong, pin the base in cgitrc with virtual-root=/cgit. +#<VirtualHost *:80> +# ServerName git.example.org +# Redirect permanent / https://git.example.org/ +#</VirtualHost> |