3 files changed, 49 insertions, 74 deletions

diff --git a/custom/servers/apache.conf b/custom/servers/apache.confindex 7778c7f..3d65d5e 100644--- a/custom/servers/apache.conf+++ b/custom/servers/apache.conf@@ -17,16 +17,14 @@ #   cgit CGI binary   /usr/lib/cgit/cgit.cgi #   static assets     /usr/share/cgit  (cgit.css cgit.js cgit.png favicon.ico robots.txt) #   cgit config       /etc/cgitrc-#   public URL        https://git.example.org/  (cgit at the domain root)+#   public url        https://git.example.org/  (cgit at the domain root) # # cgit is one CGI executable. It learns the repository and the page from-# PATH_INFO and reads page options such as h= and id= from QUERY_STRING.-# ScriptAlias runs the binary and forwards the trailing path as PATH_INFO, so-# no extra path tuning is needed. cgit builds its own link base from-# SCRIPT_NAME. The five static assets are served straight off disk. mod_alias-# resolves Alias and ScriptAlias in order and the first match wins, so the-# static Alias lines come before the catch-all ScriptAlias to stop the two-# routes from shadowing each other.+# PATH_INFO and reads page options such as h= and id= from QUERY_STRING. The+# five static assets are served straight off disk. mod_alias resolves Alias and+# ScriptAlias in order and the first match wins, so the static Alias lines come+# before the catch-all ScriptAlias to stop the two routes from shadowing each+# other.   # ServerRoot is what every relative path below resolves against, including the@@ -138,8 +136,8 @@ AddType text/plain               .txt     Require all granted      # These assets rarely change, so let browsers cache them. Keep the-    # caching scoped to this directory. Ordinary cgit pages carry no caching-    # headers, so a server-wide ExpiresDefault would stamp freshness onto+    # caching scoped to this directory. Ordinary cgit pages carry no expiry+    # time, so a server-wide ExpiresDefault would stamp freshness onto     # them, fight the no-store cgit puts on the login page, and could let     # one visitor's page be served to another from a shared cache.     <IfModule mod_expires.c>@@ -150,7 +148,6 @@ AddType text/plain               .txt  # The cgit binary. <Directory "/usr/lib/cgit">-    # Allow CGI execution here.     Options +ExecCGI     # Run cgit.cgi as a CGI even if it is ever reached through a plain Alias     # rather than ScriptAlias.@@ -204,13 +201,8 @@ AddType text/plain               .txt     LimitRequestBody 65536      # Site-wide security headers are set here so they also cover the static-    # assets Apache serves. cgit itself sends only the headers the proxy-    # cannot supply. Those are Status, Content-Type, Content-Length and-    # Content-Disposition on downloads, Location on redirects, a Cache-Control-    # marking the login page no-store and a page behind an auth filter private,-    # the auth filter's Set-Cookie, and on raw repository bytes a nosniff of-    # its own next to the stricter policy "default-src 'none'". Everything-    # else, this policy included, is the proxy's job.+    # assets Apache serves. On raw repository bytes cgit sends a nosniff and+    # the stricter policy "default-src 'none'" of its own.     #     # The word setifempty is load bearing on the two headers cgit can also     # emit. "Header always set" replaces a same-named header even when the@@ -248,23 +240,22 @@ AddType text/plain               .txt     # once browsers have seen it.     Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains" -    # These five files are the only things served off disk. cgit.css and-    # cgit.js are the paths cgit's HTML points at by default, so if you-    # relocate the assets update both these Alias targets and the css, js,-    # logo and favicon settings in cgitrc to agree.+    # These five files are the only things served off disk. cgit's default+    # css, js, logo and favicon settings point at these paths, so if you+    # relocate the assets update both these Alias targets and those settings+    # in cgitrc to agree.     Alias /cgit.css    /usr/share/cgit/cgit.css     Alias /cgit.js     /usr/share/cgit/cgit.js     Alias /cgit.png    /usr/share/cgit/cgit.png     Alias /favicon.ico /usr/share/cgit/favicon.ico     Alias /robots.txt  /usr/share/cgit/robots.txt -    # ScriptAlias maps a URL prefix to a path, marks it executable, and-    # forwards the rest of the URL as PATH_INFO. Mapping / makes cgit the-    # handler for every URL the static Aliases above did not already claim.-    # The trailing slash on cgit.cgi/ is load bearing, telling Apache that-    # cgit.cgi is the program and the rest of the URL is PATH_INFO. cgit-    # derives its link base from SCRIPT_NAME, which at the domain root is /-    # and needs no tuning. For a sub-path install see the note below.+    # Mapping / makes cgit the handler for every url the static Aliases above+    # did not already claim. The trailing slash on cgit.cgi/ is load bearing,+    # telling Apache that cgit.cgi is the program and the rest of the url is+    # PATH_INFO. cgit derives its link base from SCRIPT_NAME, which at the+    # domain root is / and needs no tuning. For a sub-path install see the+    # note below.     ScriptAlias / /usr/lib/cgit/cgit.cgi/ </VirtualHost> 
diff --git a/custom/servers/apache.conf b/custom/servers/apache.conf
index 7778c7f..3d65d5e 100644
--- a/custom/servers/apache.conf
+++ b/custom/servers/apache.conf
@@ -17,16 +17,14 @@
 #   cgit CGI binary   /usr/lib/cgit/cgit.cgi
 #   static assets     /usr/share/cgit  (cgit.css cgit.js cgit.png favicon.ico robots.txt)
 #   cgit config       /etc/cgitrc
-#   public URL        https://git.example.org/  (cgit at the domain root)
+#   public url        https://git.example.org/  (cgit at the domain root)
 #
 # cgit is one CGI executable. It learns the repository and the page from
-# PATH_INFO and reads page options such as h= and id= from QUERY_STRING.
-# ScriptAlias runs the binary and forwards the trailing path as PATH_INFO, so
-# no extra path tuning is needed. cgit builds its own link base from
-# SCRIPT_NAME. The five static assets are served straight off disk. mod_alias
-# resolves Alias and ScriptAlias in order and the first match wins, so the
-# static Alias lines come before the catch-all ScriptAlias to stop the two
-# routes from shadowing each other.
+# PATH_INFO and reads page options such as h= and id= from QUERY_STRING. The
+# five static assets are served straight off disk. mod_alias resolves Alias and
+# ScriptAlias in order and the first match wins, so the static Alias lines come
+# before the catch-all ScriptAlias to stop the two routes from shadowing each
+# other.
 
 
 # ServerRoot is what every relative path below resolves against, including the
@@ -138,8 +136,8 @@ AddType text/plain               .txt
     Require all granted
 
     # These assets rarely change, so let browsers cache them. Keep the
-    # caching scoped to this directory. Ordinary cgit pages carry no caching
-    # headers, so a server-wide ExpiresDefault would stamp freshness onto
+    # caching scoped to this directory. Ordinary cgit pages carry no expiry
+    # time, so a server-wide ExpiresDefault would stamp freshness onto
     # them, fight the no-store cgit puts on the login page, and could let
     # one visitor's page be served to another from a shared cache.
     <IfModule mod_expires.c>
@@ -150,7 +148,6 @@ AddType text/plain               .txt
 
 # The cgit binary.
 <Directory "/usr/lib/cgit">
-    # Allow CGI execution here.
     Options +ExecCGI
     # Run cgit.cgi as a CGI even if it is ever reached through a plain Alias
     # rather than ScriptAlias.
@@ -204,13 +201,8 @@ AddType text/plain               .txt
     LimitRequestBody 65536
 
     # Site-wide security headers are set here so they also cover the static
-    # assets Apache serves. cgit itself sends only the headers the proxy
-    # cannot supply. Those are Status, Content-Type, Content-Length and
-    # Content-Disposition on downloads, Location on redirects, a Cache-Control
-    # marking the login page no-store and a page behind an auth filter private,
-    # the auth filter's Set-Cookie, and on raw repository bytes a nosniff of
-    # its own next to the stricter policy "default-src 'none'". Everything
-    # else, this policy included, is the proxy's job.
+    # assets Apache serves. On raw repository bytes cgit sends a nosniff and
+    # the stricter policy "default-src 'none'" of its own.
     #
     # The word setifempty is load bearing on the two headers cgit can also
     # emit. "Header always set" replaces a same-named header even when the
@@ -248,23 +240,22 @@ AddType text/plain               .txt
     # once browsers have seen it.
     Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
 
-    # These five files are the only things served off disk. cgit.css and
-    # cgit.js are the paths cgit's HTML points at by default, so if you
-    # relocate the assets update both these Alias targets and the css, js,
-    # logo and favicon settings in cgitrc to agree.
+    # These five files are the only things served off disk. cgit's default
+    # css, js, logo and favicon settings point at these paths, so if you
+    # relocate the assets update both these Alias targets and those settings
+    # in cgitrc to agree.
     Alias /cgit.css    /usr/share/cgit/cgit.css
     Alias /cgit.js     /usr/share/cgit/cgit.js
     Alias /cgit.png    /usr/share/cgit/cgit.png
     Alias /favicon.ico /usr/share/cgit/favicon.ico
     Alias /robots.txt  /usr/share/cgit/robots.txt
 
-    # ScriptAlias maps a URL prefix to a path, marks it executable, and
-    # forwards the rest of the URL as PATH_INFO. Mapping / makes cgit the
-    # handler for every URL the static Aliases above did not already claim.
-    # The trailing slash on cgit.cgi/ is load bearing, telling Apache that
-    # cgit.cgi is the program and the rest of the URL is PATH_INFO. cgit
-    # derives its link base from SCRIPT_NAME, which at the domain root is /
-    # and needs no tuning. For a sub-path install see the note below.
+    # Mapping / makes cgit the handler for every url the static Aliases above
+    # did not already claim. The trailing slash on cgit.cgi/ is load bearing,
+    # telling Apache that cgit.cgi is the program and the rest of the url is
+    # PATH_INFO. cgit derives its link base from SCRIPT_NAME, which at the
+    # domain root is / and needs no tuning. For a sub-path install see the
+    # note below.
     ScriptAlias / /usr/lib/cgit/cgit.cgi/
 </VirtualHost>
 
diff --git a/custom/servers/lighttpd.conf b/custom/servers/lighttpd.confindex 8fef3c4..edbf162 100644--- a/custom/servers/lighttpd.conf+++ b/custom/servers/lighttpd.conf@@ -9,19 +9,18 @@ #     lighttpd -D -f /path/to/lighttpd.conf    # run it in the foreground # # lighttpd runs the cgit.cgi binary directly through mod_cgi, so no FastCGI-# bridge is needed. This is cgit's classic reference deployment, mod_cgi with-# mod_alias and mod_setenv.+# bridge is needed. # # Paths assumed below, edit them to match your install. #   cgit CGI binary   /usr/lib/cgit/cgit.cgi #   static assets     /usr/share/cgit  (cgit.css cgit.js cgit.png favicon.ico robots.txt) #   cgit config       /etc/cgitrc-#   public URL        https://git.example.org/  (cgit at the domain root)+#   public url        https://git.example.org/  (cgit at the domain root) # # cgit is one CGI executable. It learns the repository and the page from-# PATH_INFO and reads page options such as h= and id= from QUERY_STRING. cgit-# builds its own link base from SCRIPT_NAME. The five static assets are served-# straight off disk and must never be routed through cgit.+# PATH_INFO and reads page options such as h= and id= from QUERY_STRING. The+# five static assets are served straight off disk and must never be routed+# through cgit.   # A plain assignment rather than "+=", since this config stands on its own@@ -75,13 +74,8 @@ $HTTP["host"] == "git.example.org" {     setenv.add-environment = ( "CGIT_CONFIG" => "/etc/cgitrc" )      # Site-wide security headers are set here so they also cover the static-    # assets lighttpd serves. cgit itself sends only the headers the server-    # cannot supply. Those are Status, Content-Type, Content-Length and-    # Content-Disposition on downloads, Location on redirects, a Cache-Control-    # marking the login page no-store and a page behind an auth filter private,-    # the auth filter's Set-Cookie, and on raw repository bytes a nosniff of-    # its own next to the stricter policy "default-src 'none'". Everything-    # else, this policy included, is the server's job.+    # assets lighttpd serves. On raw repository bytes cgit sends a nosniff and+    # the stricter policy "default-src 'none'" of its own.     #     # The add in add-response-header is load bearing. It appends a second     # copy next to what cgit emitted, so a raw page carries both policies and@@ -128,7 +122,7 @@ $HTTP["host"] == "git.example.org" {     # hands everything else to cgit.     #     # The trailing slash on cgit.cgi/ is load bearing. lighttpd builds the-    # physical path by stripping the matched key off the front of the URL and+    # physical path by stripping the matched key off the front of the url and     # appending the rest to the value. For the key / the remainder carries no     # leading slash, so without the trailing slash a request for     # /linux/tree/kernel/sched.c glues onto the binary name as
diff --git a/custom/servers/lighttpd.conf b/custom/servers/lighttpd.conf
index 8fef3c4..edbf162 100644
--- a/custom/servers/lighttpd.conf
+++ b/custom/servers/lighttpd.conf
@@ -9,19 +9,18 @@
 #     lighttpd -D -f /path/to/lighttpd.conf    # run it in the foreground
 #
 # lighttpd runs the cgit.cgi binary directly through mod_cgi, so no FastCGI
-# bridge is needed. This is cgit's classic reference deployment, mod_cgi with
-# mod_alias and mod_setenv.
+# bridge is needed.
 #
 # Paths assumed below, edit them to match your install.
 #   cgit CGI binary   /usr/lib/cgit/cgit.cgi
 #   static assets     /usr/share/cgit  (cgit.css cgit.js cgit.png favicon.ico robots.txt)
 #   cgit config       /etc/cgitrc
-#   public URL        https://git.example.org/  (cgit at the domain root)
+#   public url        https://git.example.org/  (cgit at the domain root)
 #
 # cgit is one CGI executable. It learns the repository and the page from
-# PATH_INFO and reads page options such as h= and id= from QUERY_STRING. cgit
-# builds its own link base from SCRIPT_NAME. The five static assets are served
-# straight off disk and must never be routed through cgit.
+# PATH_INFO and reads page options such as h= and id= from QUERY_STRING. The
+# five static assets are served straight off disk and must never be routed
+# through cgit.
 
 
 # A plain assignment rather than "+=", since this config stands on its own
@@ -75,13 +74,8 @@ $HTTP["host"] == "git.example.org" {
     setenv.add-environment = ( "CGIT_CONFIG" => "/etc/cgitrc" )
 
     # Site-wide security headers are set here so they also cover the static
-    # assets lighttpd serves. cgit itself sends only the headers the server
-    # cannot supply. Those are Status, Content-Type, Content-Length and
-    # Content-Disposition on downloads, Location on redirects, a Cache-Control
-    # marking the login page no-store and a page behind an auth filter private,
-    # the auth filter's Set-Cookie, and on raw repository bytes a nosniff of
-    # its own next to the stricter policy "default-src 'none'". Everything
-    # else, this policy included, is the server's job.
+    # assets lighttpd serves. On raw repository bytes cgit sends a nosniff and
+    # the stricter policy "default-src 'none'" of its own.
     #
     # The add in add-response-header is load bearing. It appends a second
     # copy next to what cgit emitted, so a raw page carries both policies and
@@ -128,7 +122,7 @@ $HTTP["host"] == "git.example.org" {
     # hands everything else to cgit.
     #
     # The trailing slash on cgit.cgi/ is load bearing. lighttpd builds the
-    # physical path by stripping the matched key off the front of the URL and
+    # physical path by stripping the matched key off the front of the url and
     # appending the rest to the value. For the key / the remainder carries no
     # leading slash, so without the trailing slash a request for
     # /linux/tree/kernel/sched.c glues onto the binary name as
diff --git a/custom/servers/nginx.conf b/custom/servers/nginx.confindex d18a109..7f09682 100644--- a/custom/servers/nginx.conf+++ b/custom/servers/nginx.conf@@ -12,13 +12,12 @@ #   cgit CGI binary   /usr/lib/cgit/cgit.cgi #   static assets     /usr/share/cgit  (cgit.css cgit.js cgit.png favicon.ico robots.txt) #   cgit config       /etc/cgitrc-#   public URL        https://git.example.org/  (cgit at the domain root)+#   public url        https://git.example.org/  (cgit at the domain root) # # cgit is one CGI executable. It learns the repository and the page from # PATH_INFO and reads page options such as h= and id= from QUERY_STRING, so-# nginx must pass PATH_INFO through to the binary. cgit builds its own link-# base from SCRIPT_NAME. The five static assets are served straight off disk-# and must never be routed through cgit.+# nginx must pass PATH_INFO through to the binary. The five static assets are+# served straight off disk and must never be routed through cgit. # # nginx cannot run CGI programs itself, so a small bridge called fcgiwrap runs # the cgit.cgi binary and speaks FastCGI to nginx. Nothing below works until@@ -120,7 +119,6 @@ http {             root /var/www/html;         } -        # Everything else moves to HTTPS.         location / {             return 301 https://$host$request_uri;         }@@ -152,15 +150,9 @@ http {         ssl_session_timeout 1d;         ssl_session_tickets off; -        # Site-wide security headers sit here because they must also cover the-        # static assets nginx serves directly. cgit itself sends only the-        # headers the proxy cannot supply. Those are Status, Content-Type,-        # Content-Length and Content-Disposition on downloads, Location on-        # redirects, a Cache-Control marking the login page no-store and a page-        # behind an auth filter private, the auth filter's Set-Cookie, and on-        # raw repository bytes a nosniff of its own next to the stricter policy-        # "default-src 'none'". Everything else, this policy included, is the-        # proxy's job.+        # Site-wide security headers are set here so they also cover the+        # static assets nginx serves. On raw repository bytes cgit sends a+        # nosniff and the stricter policy "default-src 'none'" of its own.         #         # add_header appends and never replaces what cgit sent, so a raw page         # carries both policies and the browser enforces the stricter one,@@ -199,9 +191,9 @@ http {         # hard to undo once browsers have seen it.         add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always; -        # The document root is the directory that holds the static assets. cgit-        # emits absolute links to /cgit.css and /cgit.png by default, so those-        # files must resolve at the root of the URL space.+        # The document root is the directory that holds the static assets.+        # cgit's default css, js, logo and favicon settings are absolute links+        # to these files, so they must resolve at the root of the url space.         root /usr/share/cgit;          # The only request body cgit ever reads is the auth-filter login form,@@ -214,18 +206,17 @@ http {          # Match the assets by their exact root-level names, never by bare         # extension. A repository can hold files ending in .css or .png, and-        # /myrepo/tree/style.css is a real cgit URL a broad match would+        # /myrepo/tree/style.css is a real cgit url a broad match would         # capture and 404. The regex anchored at ^/ matches /cgit.css but         # never /myrepo/tree/cgit.css, and a regex location beats the prefix-        # location below, so assets win their exact URLs and cgit the rest.+        # location below, so assets win their exact urls and cgit the rest.         location ~ ^/(cgit\.css|cgit\.js|cgit\.png|favicon\.ico|robots\.txt)$ {             expires    30d;             access_log off;             try_files  $uri =404;         } -        # Everything that is not a static asset above is a cgit URL, the repo-        # index, a repository, a page within a repository, a snapshot, a feed.+        # Everything else is a cgit url.         location / {             # The CGI environment, normally "include fastcgi_params", written             # out here so this config stands alone. The cookie and referer@@ -249,7 +240,7 @@ http {             # whole request path is the PATH_INFO.             fastcgi_param PATH_INFO    $uri; -            # Page options such as h=branch, id=sha and the snapshot format.+            # Page options such as h=branch and id=sha.             fastcgi_param QUERY_STRING $query_string;              # Which config cgit reads. It checks CGIT_CONFIG and falls back to@@ -257,11 +248,11 @@ http {             # explicit and lets you move cgitrc without recompiling.             fastcgi_param CGIT_CONFIG  /etc/cgitrc; -            # The browser's Host header, so cgit builds clone URLs against the+            # The browser's Host header, so cgit builds clone urls against the             # name the visitor used rather than server_name.             fastcgi_param HTTP_HOST    $http_host; -            # The real scheme, so cgit builds correct https clone URLs.+            # The real scheme, so cgit builds correct https clone urls.             fastcgi_param HTTPS        $https if_not_empty;              # The routine remainder, needed by fcgiwrap and by the login form.@@ -281,7 +272,6 @@ http {             fastcgi_param SERVER_PORT       $server_port;             fastcgi_param SERVER_NAME       $server_name; -            # Hand off to the fcgiwrap socket.             fastcgi_pass unix:/run/fcgiwrap.socket;              # Large outputs such as snapshot tarballs and blame on big files@@ -289,7 +279,7 @@ http {             fastcgi_read_timeout 300s;             fastcgi_buffering off; -            # Ordinary cgit pages carry no caching headers, so browsers+            # Ordinary cgit pages carry no expiry time, so browsers             # refetch them and cgit's internal cache keeps that cheap. Do not             # add a blanket expires or Cache-Control in this location. It             # would fight the no-store cgit puts on the login page and could@@ -300,7 +290,7 @@ http {   # To serve cgit at https://git.example.org/cgit/ instead of the root, split-# the URL so SCRIPT_NAME is the prefix and PATH_INFO is the rest. Keep every+# the url so SCRIPT_NAME is the prefix and PATH_INFO is the rest. Keep every # other fastcgi_param from the location above. # #     location /cgit/ {@@ -320,7 +310,7 @@ http { #         access_log off; #     } #-# cgit's default css=/cgit.css and logo=/cgit.png point at the domain root, so-# under a sub-path also set css=/cgit/cgit.css and logo=/cgit/cgit.png in-# cgitrc. cgit derives the /cgit prefix from SCRIPT_NAME. If links come out-# wrong, pin it in cgitrc with virtual-root=/cgit/.+# cgit's default css, js, logo and favicon settings point at the domain root,+# so under a sub-path also set them to the /cgit/ paths in cgitrc. cgit+# derives the /cgit prefix from SCRIPT_NAME. If links come out wrong, pin it+# in cgitrc with virtual-root=/cgit/.
diff --git a/custom/servers/nginx.conf b/custom/servers/nginx.conf
index d18a109..7f09682 100644
--- a/custom/servers/nginx.conf
+++ b/custom/servers/nginx.conf
@@ -12,13 +12,12 @@
 #   cgit CGI binary   /usr/lib/cgit/cgit.cgi
 #   static assets     /usr/share/cgit  (cgit.css cgit.js cgit.png favicon.ico robots.txt)
 #   cgit config       /etc/cgitrc
-#   public URL        https://git.example.org/  (cgit at the domain root)
+#   public url        https://git.example.org/  (cgit at the domain root)
 #
 # cgit is one CGI executable. It learns the repository and the page from
 # PATH_INFO and reads page options such as h= and id= from QUERY_STRING, so
-# nginx must pass PATH_INFO through to the binary. cgit builds its own link
-# base from SCRIPT_NAME. The five static assets are served straight off disk
-# and must never be routed through cgit.
+# nginx must pass PATH_INFO through to the binary. The five static assets are
+# served straight off disk and must never be routed through cgit.
 #
 # nginx cannot run CGI programs itself, so a small bridge called fcgiwrap runs
 # the cgit.cgi binary and speaks FastCGI to nginx. Nothing below works until
@@ -120,7 +119,6 @@ http {
             root /var/www/html;
         }
 
-        # Everything else moves to HTTPS.
         location / {
             return 301 https://$host$request_uri;
         }
@@ -152,15 +150,9 @@ http {
         ssl_session_timeout 1d;
         ssl_session_tickets off;
 
-        # Site-wide security headers sit here because they must also cover the
-        # static assets nginx serves directly. cgit itself sends only the
-        # headers the proxy cannot supply. Those are Status, Content-Type,
-        # Content-Length and Content-Disposition on downloads, Location on
-        # redirects, a Cache-Control marking the login page no-store and a page
-        # behind an auth filter private, the auth filter's Set-Cookie, and on
-        # raw repository bytes a nosniff of its own next to the stricter policy
-        # "default-src 'none'". Everything else, this policy included, is the
-        # proxy's job.
+        # Site-wide security headers are set here so they also cover the
+        # static assets nginx serves. On raw repository bytes cgit sends a
+        # nosniff and the stricter policy "default-src 'none'" of its own.
         #
         # add_header appends and never replaces what cgit sent, so a raw page
         # carries both policies and the browser enforces the stricter one,
@@ -199,9 +191,9 @@ http {
         # hard to undo once browsers have seen it.
         add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
 
-        # The document root is the directory that holds the static assets. cgit
-        # emits absolute links to /cgit.css and /cgit.png by default, so those
-        # files must resolve at the root of the URL space.
+        # The document root is the directory that holds the static assets.
+        # cgit's default css, js, logo and favicon settings are absolute links
+        # to these files, so they must resolve at the root of the url space.
         root /usr/share/cgit;
 
         # The only request body cgit ever reads is the auth-filter login form,
@@ -214,18 +206,17 @@ http {
 
         # Match the assets by their exact root-level names, never by bare
         # extension. A repository can hold files ending in .css or .png, and
-        # /myrepo/tree/style.css is a real cgit URL a broad match would
+        # /myrepo/tree/style.css is a real cgit url a broad match would
         # capture and 404. The regex anchored at ^/ matches /cgit.css but
         # never /myrepo/tree/cgit.css, and a regex location beats the prefix
-        # location below, so assets win their exact URLs and cgit the rest.
+        # location below, so assets win their exact urls and cgit the rest.
         location ~ ^/(cgit\.css|cgit\.js|cgit\.png|favicon\.ico|robots\.txt)$ {
             expires    30d;
             access_log off;
             try_files  $uri =404;
         }
 
-        # Everything that is not a static asset above is a cgit URL, the repo
-        # index, a repository, a page within a repository, a snapshot, a feed.
+        # Everything else is a cgit url.
         location / {
             # The CGI environment, normally "include fastcgi_params", written
             # out here so this config stands alone. The cookie and referer
@@ -249,7 +240,7 @@ http {
             # whole request path is the PATH_INFO.
             fastcgi_param PATH_INFO    $uri;
 
-            # Page options such as h=branch, id=sha and the snapshot format.
+            # Page options such as h=branch and id=sha.
             fastcgi_param QUERY_STRING $query_string;
 
             # Which config cgit reads. It checks CGIT_CONFIG and falls back to
@@ -257,11 +248,11 @@ http {
             # explicit and lets you move cgitrc without recompiling.
             fastcgi_param CGIT_CONFIG  /etc/cgitrc;
 
-            # The browser's Host header, so cgit builds clone URLs against the
+            # The browser's Host header, so cgit builds clone urls against the
             # name the visitor used rather than server_name.
             fastcgi_param HTTP_HOST    $http_host;
 
-            # The real scheme, so cgit builds correct https clone URLs.
+            # The real scheme, so cgit builds correct https clone urls.
             fastcgi_param HTTPS        $https if_not_empty;
 
             # The routine remainder, needed by fcgiwrap and by the login form.
@@ -281,7 +272,6 @@ http {
             fastcgi_param SERVER_PORT       $server_port;
             fastcgi_param SERVER_NAME       $server_name;
 
-            # Hand off to the fcgiwrap socket.
             fastcgi_pass unix:/run/fcgiwrap.socket;
 
             # Large outputs such as snapshot tarballs and blame on big files
@@ -289,7 +279,7 @@ http {
             fastcgi_read_timeout 300s;
             fastcgi_buffering off;
 
-            # Ordinary cgit pages carry no caching headers, so browsers
+            # Ordinary cgit pages carry no expiry time, so browsers
             # refetch them and cgit's internal cache keeps that cheap. Do not
             # add a blanket expires or Cache-Control in this location. It
             # would fight the no-store cgit puts on the login page and could
@@ -300,7 +290,7 @@ http {
 
 
 # To serve cgit at https://git.example.org/cgit/ instead of the root, split
-# the URL so SCRIPT_NAME is the prefix and PATH_INFO is the rest. Keep every
+# the url so SCRIPT_NAME is the prefix and PATH_INFO is the rest. Keep every
 # other fastcgi_param from the location above.
 #
 #     location /cgit/ {
@@ -320,7 +310,7 @@ http {
 #         access_log off;
 #     }
 #
-# cgit's default css=/cgit.css and logo=/cgit.png point at the domain root, so
-# under a sub-path also set css=/cgit/cgit.css and logo=/cgit/cgit.png in
-# cgitrc. cgit derives the /cgit prefix from SCRIPT_NAME. If links come out
-# wrong, pin it in cgitrc with virtual-root=/cgit/.
+# cgit's default css, js, logo and favicon settings point at the domain root,
+# so under a sub-path also set them to the /cgit/ paths in cgitrc. cgit
+# derives the /cgit prefix from SCRIPT_NAME. If links come out wrong, pin it
+# in cgitrc with virtual-root=/cgit/.