Age	Commit message (Collapse)	Author	Lines
9 days	Mark a page behind an auth filter private	Bryce Kwon	-4/+5
	Only the login page carried a Cache-Control, so a page an auth filter had let a visitor see could be kept by a cache shared with the next visitor. The page also varies on the cookie that got them in.
2026-09-21	Unify the docs, samples and extensions	Bryce Kwon	-5/+4
2026-09-06	Refresh the server configs and drop `unsafe-inline`	Bryce Kwon	-43/+30
	The inline handlers and the auto-submitting selects are gone, so `script-src` no longer needs it, and t0004 now checks that the three configs pin the same policy.
2026-08-23	Refuse unknown and spoofed hostnames in nginx.conf	Bryce Kwon	-0/+31
2026-08-18	Rework the response headers in the server configs	Bryce Kwon	-11/+45
2026-08-14	Drop the Last-Modified, Expires and ETag headers	Bryce Kwon	-0/+6
2026-08-01	Make the server configs complete standalone files	Bryce Kwon	-127/+200
2026-07-25	Reorganize the tree into vendor/ and custom/	Bryce Kwon	-0/+0
2026-07-16	Add example web server configurations	Bryce Kwon	-0/+193
	The wiring has real pitfalls around PATH_INFO and the link base, so these ship as working commented configs. nginx needs the fcgiwrap bridge while apache and lighttpd run the CGI directly. The security headers live here rather than in cgit because they must also cover the static assets the server serves itself.