Diff options
Diffstat (limited to 'custom')
| -rw-r--r-- | custom/servers/lighttpd.conf | 216 |
1 file changed, 61 insertions, 155 deletions
diff --git a/custom/servers/lighttpd.conf b/custom/servers/lighttpd.conf index edbf162..5b6010c 100644 --- a/custom/servers/lighttpd.conf +++ b/custom/servers/lighttpd.conf @@ -1,134 +1,43 @@ -# lighttpd configuration for cgit. +# A lighttpd snippet that serves cgit at the root of git.example.org. +# Include it from lighttpd.conf, which supplies the user, the port, the MIME +# types and the logs. The first line below loads the modules it needs, and +# the next two those of the commented examples. A module the main config +# loads already is loaded only once. # -# Written for the lighttpd 1.4 branch, at 1.4.85 when last reviewed. +# The paths are one common layout, so adjust them to your system. +# cgit.cgi /usr/lib/cgit, from make install with the two-line cgit.conf in README +# static files /usr/share/cgit, from the same install +# repositories /var/lib/git, the scan-path custom/cgitrc suggests +# git-http-backend /usr/libexec/git-core, the directory git --exec-path prints +# certificate /etc/ssl/certs/git.example.org.pem +# key /etc/ssl/private/git.example.org.key # -# This is a complete lighttpd.conf rather than a snippet for conf-enabled, so -# nothing here is included from elsewhere and no distro base config is -# assumed. Check it and run it with -# lighttpd -tt -f /path/to/lighttpd.conf # check the syntax and modules -# lighttpd -D -f /path/to/lighttpd.conf # run it in the foreground -# -# lighttpd runs the cgit.cgi binary directly through mod_cgi, so no FastCGI -# bridge is needed. -# -# Paths assumed below, edit them to match your install. -# cgit CGI binary /usr/lib/cgit/cgit.cgi -# static assets /usr/share/cgit (cgit.css cgit.js cgit.png favicon.ico robots.txt) -# cgit config /etc/cgitrc -# public url https://git.example.org/ (cgit at the domain root) -# -# cgit is one CGI executable. It learns the repository and the page from -# PATH_INFO and reads page options such as h= and id= from QUERY_STRING. The -# five static assets are served straight off disk and must never be routed -# through cgit. - - -# A plain assignment rather than "+=", since this config stands on its own -# and there is no distro base list to append to. Adding mod_accesslog here -# is what the access log below needs. -server.modules = ( - "mod_alias", - "mod_setenv", - "mod_cgi", - "mod_accesslog", -) - +# The commented examples add HTTPS, which the bundled auth filters need +# before they log anyone in, and smart HTTP clone and push through +# git-http-backend. -server.port = 80 -server.username = "http" # Debian and Ubuntu use www-data -server.groupname = "http" -server.document-root = "/usr/share/cgit" # a valid docroot must exist. The - # alias rules below do the routing. -server.pid-file = "/run/lighttpd.pid" -server.errorlog = "/var/log/lighttpd/error.log" -accesslog.filename = "/var/log/lighttpd/access.log" - -# Drop the version number from the Server header and from error pages. -server.tag = "lighttpd" - -# The only request body cgit ever reads is the auth-filter login form, and it -# stops after 4096 bytes. Nothing else here accepts an upload. The value is in -# kilobytes and the default of 0 means unlimited. -server.max-request-size = 64 - - -# mod_alias serves the assets off disk, so lighttpd must know their content -# types. Without this the stylesheet is sent as application/octet-stream and -# the browser ignores it. Only these five files are served off disk, so this -# short table is the whole of it and no external mime file is needed. -mimetype.assign = ( - ".css" => "text/css", - ".js" => "text/javascript", - ".png" => "image/png", - ".ico" => "image/vnd.microsoft.icon", - ".txt" => "text/plain", -) +server.modules += ( "mod_access", "mod_alias", "mod_cgi" ) +#server.modules += ( "mod_openssl", "mod_redirect" ) +#server.modules += ( "mod_setenv" ) +# HTTPS on 443 beside plain HTTP. The host block below answers on both. +#$SERVER["socket"] == ":443" { +# ssl.engine = "enable" +# ssl.pemfile = "/etc/ssl/certs/git.example.org.pem" +# ssl.privkey = "/etc/ssl/private/git.example.org.key" +#} -# The vhost, as a top-level conditional so it matches on both the port 80 -# socket and the optional TLS socket at the end of this file. $HTTP["host"] == "git.example.org" { - - # Which config cgit reads. It falls back to the compiled-in /etc/cgitrc, - # the same path used here, but setting it makes the location explicit. - setenv.add-environment = ( "CGIT_CONFIG" => "/etc/cgitrc" ) - - # Site-wide security headers are set here so they also cover the static - # assets lighttpd serves. On raw repository bytes cgit sends a nosniff and - # the stricter policy "default-src 'none'" of its own. - # - # The add in add-response-header is load bearing. It appends a second - # copy next to what cgit emitted, so a raw page carries both policies and - # the browser enforces the stricter one, while the doubled nosniff line - # is harmless. The set-response-header directive would instead replace - # what cgit sent, swapping the strict policy on raw repository content - # for this looser site one. Never switch add to set. - # - # form-action self covers the login form, the only form cgit renders. If - # you enable the gravatar or libravatar avatar filter, add its host to - # img-src. A head-include or repo.head-content that injects a <style> - # block needs 'unsafe-inline' added to style-src. - # - # Permissions-Policy refuses the browser features a git viewer never asks - # for, camera and location among them, for everything served here, - # repository files included. The opener policy cuts any window.opener - # link between cgit and pages that open it, and the resource policy stops - # other origins from embedding what cgit serves, a hotlinked raw file for - # example. git clients are not browsers and ignore both, so clone and - # snapshot downloads keep working. The stricter - # Cross-Origin-Embedder-Policy is deliberately absent because it would - # break the avatar filters mentioned above. - setenv.add-response-header = ( - "Content-Security-Policy" => "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'self'; form-action 'self'", - "X-Content-Type-Options" => "nosniff", - "Referrer-Policy" => "no-referrer", - "Permissions-Policy" => "accelerometer=(), autoplay=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), usb=()", - "Cross-Origin-Opener-Policy" => "same-origin", - "Cross-Origin-Resource-Policy" => "same-origin" - ) - # Two years of forced HTTPS. Enable this together with the TLS socket at - # the end of this file and only once you serve HTTPS exclusively, since - # it is hard to undo once browsers have seen it. - #setenv.add-response-header += ( "Strict-Transport-Security" => "max-age=63072000; includeSubDomains" ) - - # Register the cgit binary as a CGI program. The empty value means the - # file is itself the program rather than input to an interpreter. - cgi.assign = ( "cgit.cgi" => "" ) - - # Routing. lighttpd's alias.url is first-match in declaration order, not - # longest prefix, so the five static entries must come before the / entry. - # If / came first it would swallow every request and recent lighttpd - # refuses to start. The static entries are served off disk and the / entry - # hands everything else to cgit. - # - # The trailing slash on cgit.cgi/ is load bearing. lighttpd builds the - # physical path by stripping the matched key off the front of the url and - # appending the rest to the value. For the key / the remainder carries no - # leading slash, so without the trailing slash a request for - # /linux/tree/kernel/sched.c glues onto the binary name as - # /usr/lib/cgit/cgit.cgilinux/tree/... and 404s. The trailing slash - # restores the separator, giving cgit SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi - # and PATH_INFO /linux/tree/kernel/sched.c. + # Sends plain HTTP on to HTTPS. + #$HTTP["scheme"] == "http" { + # url.redirect = ( "" => "https://${url.authority}${url.path}${qsa}" ) + #} + + # The five files cgit links to at the root are served off disk. lighttpd + # takes the first alias that matches, so they come before the one that + # hands every other path to cgit. That match takes the leading slash off + # the path and the slash after cgit.cgi puts it back, so cgit gets the + # whole path as its PATH_INFO. alias.url = ( "/cgit.css" => "/usr/share/cgit/cgit.css", "/cgit.js" => "/usr/share/cgit/cgit.js", @@ -138,34 +47,31 @@ $HTTP["host"] == "git.example.org" { "/" => "/usr/lib/cgit/cgit.cgi/", ) - # Served at / the SCRIPT_NAME is empty and cgit derives its link base - # correctly. For a sub-path install use a key without a trailing slash - # mapped to the binary without a trailing slash, for example - # "/git" => "/usr/lib/cgit/cgit.cgi" - # so /git/linux/tree resolves to /usr/lib/cgit/cgit.cgi/linux/tree, giving - # SCRIPT_NAME /git and PATH_INFO /linux/tree. cgit auto-detects the prefix. - # If links come out wrong, pin it in cgitrc with virtual-root=/git. + # The empty value runs cgit.cgi as a program rather than through an + # interpreter. + cgi.assign = ( "/cgit.cgi" => "" ) + + # Smart HTTP clone and push at the urls cgit gives the repositories go to + # git-http-backend. It finds them under GIT_PROJECT_ROOT and, with + # GIT_HTTP_EXPORT_ALL, serves them without a git-daemon-export-ok file. + # The safe.directory setting lets it open them while another user owns + # them. Push is refused until a repository sets http.receivepack or the + # server authenticates the user. The program is assigned outside the url + # condition, which no longer matches once lighttpd has split the path + # into the program and its PATH_INFO. + #cgi.assign += ( "/git-http-backend" => "" ) + #$HTTP["url"] =~ "^/.+/(info/refs|git-upload-pack|git-receive-pack)$" { + # alias.url = ( "/" => "/usr/libexec/git-core/git-http-backend/" ) + # setenv.add-environment = ( + # "GIT_PROJECT_ROOT" => "/var/lib/git", + # "GIT_HTTP_EXPORT_ALL" => "", + # "GIT_CONFIG_COUNT" => "1", + # "GIT_CONFIG_KEY_0" => "safe.directory", + # "GIT_CONFIG_VALUE_0" => "*", + # ) + #} + + # The stock lighttpd.conf refuses paths ending in ~ or .inc, which here + # are files in a repository, so cgit's host clears the list. + url.access-deny = () } - - -# Uncomment this whole block to enable TLS on 443. The host block above is -# socket independent, so it serves cgit over this socket too once the crypto -# is set. -#server.modules += ( "mod_openssl" ) -# -#$SERVER["socket"] == ":443" { -# ssl.engine = "enable" -# ssl.pemfile = "/etc/lighttpd/certs/git.example.org.crt" -# ssl.privkey = "/etc/lighttpd/certs/git.example.org.key" -# ssl.ca-file = "/etc/lighttpd/certs/git.example.org.chain.pem" -# ssl.openssl.ssl-conf-cmd = ( "MinProtocol" => "TLSv1.2" ) -#} -# -# Redirect plain HTTP to HTTPS, scoped to the port 80 socket. Needs -# mod_redirect. -#server.modules += ( "mod_redirect" ) -#$SERVER["socket"] == ":80" { -# $HTTP["host"] == "git.example.org" { -# url.redirect = ( "^/(.*)" => "https://git.example.org/$1" ) -# } -#} |