1 file changed, 21 insertions, 31 deletions
diff --git a/custom/servers/nginx.conf b/custom/servers/nginx.conf
index d18a109..7f09682 100644
--- a/custom/servers/nginx.conf
+++ b/custom/servers/nginx.conf
@@ -12,13 +12,12 @@
 #   cgit CGI binary   /usr/lib/cgit/cgit.cgi
 #   static assets     /usr/share/cgit  (cgit.css cgit.js cgit.png favicon.ico robots.txt)
 #   cgit config       /etc/cgitrc
-#   public URL        https://git.example.org/  (cgit at the domain root)
+#   public url        https://git.example.org/  (cgit at the domain root)
 #
 # cgit is one CGI executable. It learns the repository and the page from
 # PATH_INFO and reads page options such as h= and id= from QUERY_STRING, so
-# nginx must pass PATH_INFO through to the binary. cgit builds its own link
-# base from SCRIPT_NAME. The five static assets are served straight off disk
-# and must never be routed through cgit.
+# nginx must pass PATH_INFO through to the binary. The five static assets are
+# served straight off disk and must never be routed through cgit.
 #
 # nginx cannot run CGI programs itself, so a small bridge called fcgiwrap runs
 # the cgit.cgi binary and speaks FastCGI to nginx. Nothing below works until
@@ -120,7 +119,6 @@ http {
             root /var/www/html;
         }
 
-        # Everything else moves to HTTPS.
         location / {
             return 301 https://$host$request_uri;
         }
@@ -152,15 +150,9 @@ http {
         ssl_session_timeout 1d;
         ssl_session_tickets off;
 
-        # Site-wide security headers sit here because they must also cover the
-        # static assets nginx serves directly. cgit itself sends only the
-        # headers the proxy cannot supply. Those are Status, Content-Type,
-        # Content-Length and Content-Disposition on downloads, Location on
-        # redirects, a Cache-Control marking the login page no-store and a page
-        # behind an auth filter private, the auth filter's Set-Cookie, and on
-        # raw repository bytes a nosniff of its own next to the stricter policy
-        # "default-src 'none'". Everything else, this policy included, is the
-        # proxy's job.
+        # Site-wide security headers are set here so they also cover the
+        # static assets nginx serves. On raw repository bytes cgit sends a
+        # nosniff and the stricter policy "default-src 'none'" of its own.
         #
         # add_header appends and never replaces what cgit sent, so a raw page
         # carries both policies and the browser enforces the stricter one,
@@ -199,9 +191,9 @@ http {
         # hard to undo once browsers have seen it.
         add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
 
-        # The document root is the directory that holds the static assets. cgit
-        # emits absolute links to /cgit.css and /cgit.png by default, so those
-        # files must resolve at the root of the URL space.
+        # The document root is the directory that holds the static assets.
+        # cgit's default css, js, logo and favicon settings are absolute links
+        # to these files, so they must resolve at the root of the url space.
         root /usr/share/cgit;
 
         # The only request body cgit ever reads is the auth-filter login form,
@@ -214,18 +206,17 @@ http {
 
         # Match the assets by their exact root-level names, never by bare
         # extension. A repository can hold files ending in .css or .png, and
-        # /myrepo/tree/style.css is a real cgit URL a broad match would
+        # /myrepo/tree/style.css is a real cgit url a broad match would
         # capture and 404. The regex anchored at ^/ matches /cgit.css but
         # never /myrepo/tree/cgit.css, and a regex location beats the prefix
-        # location below, so assets win their exact URLs and cgit the rest.
+        # location below, so assets win their exact urls and cgit the rest.
         location ~ ^/(cgit\.css|cgit\.js|cgit\.png|favicon\.ico|robots\.txt)$ {
             expires    30d;
             access_log off;
             try_files  $uri =404;
         }
 
-        # Everything that is not a static asset above is a cgit URL, the repo
-        # index, a repository, a page within a repository, a snapshot, a feed.
+        # Everything else is a cgit url.
         location / {
             # The CGI environment, normally "include fastcgi_params", written
             # out here so this config stands alone. The cookie and referer
@@ -249,7 +240,7 @@ http {
             # whole request path is the PATH_INFO.
             fastcgi_param PATH_INFO    $uri;
 
-            # Page options such as h=branch, id=sha and the snapshot format.
+            # Page options such as h=branch and id=sha.
             fastcgi_param QUERY_STRING $query_string;
 
             # Which config cgit reads. It checks CGIT_CONFIG and falls back to
@@ -257,11 +248,11 @@ http {
             # explicit and lets you move cgitrc without recompiling.
             fastcgi_param CGIT_CONFIG  /etc/cgitrc;
 
-            # The browser's Host header, so cgit builds clone URLs against the
+            # The browser's Host header, so cgit builds clone urls against the
             # name the visitor used rather than server_name.
             fastcgi_param HTTP_HOST    $http_host;
 
-            # The real scheme, so cgit builds correct https clone URLs.
+            # The real scheme, so cgit builds correct https clone urls.
             fastcgi_param HTTPS        $https if_not_empty;
 
             # The routine remainder, needed by fcgiwrap and by the login form.
@@ -281,7 +272,6 @@ http {
             fastcgi_param SERVER_PORT       $server_port;
             fastcgi_param SERVER_NAME       $server_name;
 
-            # Hand off to the fcgiwrap socket.
             fastcgi_pass unix:/run/fcgiwrap.socket;
 
             # Large outputs such as snapshot tarballs and blame on big files
@@ -289,7 +279,7 @@ http {
             fastcgi_read_timeout 300s;
             fastcgi_buffering off;
 
-            # Ordinary cgit pages carry no caching headers, so browsers
+            # Ordinary cgit pages carry no expiry time, so browsers
             # refetch them and cgit's internal cache keeps that cheap. Do not
             # add a blanket expires or Cache-Control in this location. It
             # would fight the no-store cgit puts on the login page and could
@@ -300,7 +290,7 @@ http {
 
 
 # To serve cgit at https://git.example.org/cgit/ instead of the root, split
-# the URL so SCRIPT_NAME is the prefix and PATH_INFO is the rest. Keep every
+# the url so SCRIPT_NAME is the prefix and PATH_INFO is the rest. Keep every
 # other fastcgi_param from the location above.
 #
 #     location /cgit/ {
@@ -320,7 +310,7 @@ http {
 #         access_log off;
 #     }
 #
-# cgit's default css=/cgit.css and logo=/cgit.png point at the domain root, so
-# under a sub-path also set css=/cgit/cgit.css and logo=/cgit/cgit.png in
-# cgitrc. cgit derives the /cgit prefix from SCRIPT_NAME. If links come out
-# wrong, pin it in cgitrc with virtual-root=/cgit/.
+# cgit's default css, js, logo and favicon settings point at the domain root,
+# so under a sub-path also set them to the /cgit/ paths in cgitrc. cgit
+# derives the /cgit prefix from SCRIPT_NAME. If links come out wrong, pin it
+# in cgitrc with virtual-root=/cgit/.