Age	Commit message (Collapse)	Author	Lines
38 hours	Cut the lighttpd config down to a generic drop-in	Bryce Kwon	-155/+61
	The old file was a complete lighttpd.conf with its own user, modules and MIME table. As a snippet it takes those from the distribution and loads only the three modules it uses, which lighttpd skips when the main config loads them already. It takes the nginx config's header and commented examples. The host block matches on every socket, so HTTPS needs only the socket, and the redirect is a condition on the scheme inside it. The stock lighttpd.conf on Debian, Alpine and Fedora refuses urls ending in ~ or .inc, so a repository's config.inc answered 403 until the host block cleared the list. git-http-backend's cgi.assign sits outside the url condition because lighttpd checks it after splitting the path, when that condition no longer matches, and inside it the program itself was served as a file.
38 hours	Cut the Apache config down to a generic drop-in	Bryce Kwon	-270/+54
	The old file was a complete httpd.conf that named RHEL's paths and user and loaded its own modules, so on Debian it had to be rewritten before Apache would start. As a virtual host it leaves all of that to the distribution, and it takes the nginx config's header and commented examples. For HTTPS the one virtual host moves to port 443 rather than a second host repeating its routing, and a small host on port 80 sends plain HTTP on to it.
39 hours	Cut the nginx config down to a generic drop-in	Bryce Kwon	-310/+68
	The old file was a complete nginx.conf with TLS, compression, catch-all hosts and security headers, and it had to be taken apart before it ran beside a distribution's own nginx.conf. A server block included from the http block leaves the user, the MIME types and the logs to the distribution. Its header gives one default path per thing, adjusted where a system differs, which leaves packagers a plain base to adapt rather than a table for each distribution. HTTPS and git-http-backend are commented examples, so the file serves plain HTTP as shipped. The backend takes only the three smart HTTP paths at cgit's own repository urls, so every page still reaches cgit. git refuses a repository another user owns, which failed every clone until safe.directory was set for the backend, and a 3 MB push got 413 until the location lifted nginx's body limit. The split empties SCRIPT_NAME because a second SCRIPT_NAME after the include reaches fcgiwrap as well, and cgit reads the first one, which put every link under the request path. cgit sends nosniff and a locked policy on raw output itself, so the configs no longer carry one. The t0004 check that all three agree goes here, with the first of them to drop it.
8 days	Say cgit pages carry no expiry, not no headers	Bryce Kwon	-3/+3
	Behind an auth filter every page carries Cache-Control: private and the login page no-store, so only the missing expiry holds on every site.
8 days	Spell url the way the tree mostly does	Bryce Kwon	-13/+13
	Names keep their own spelling, so the URL trailer and CGIT_REPO_URL stay in capitals.
10 days	Drop config comments that restate their line	Bryce Kwon	-7/+2
10 days	Say each routing fact once in the server configs	Bryce Kwon	-20/+16
10 days	Trim the header notes in the server configs	Bryce Kwon	-23/+7
	Each config listed every header cgit sends, where only its own nosniff and strict policy on raw bytes bear on the headers set there. The list also missed Vary, and the Apache one called Apache a proxy.
10 days	Drop the snapshot format from the query comment	Bryce Kwon	-1/+1
	A snapshot's format comes from the suffix of its filename in the path, not from the query string.
10 days	Name every default asset link in the configs	Bryce Kwon	-11/+11
	The nginx sub-path recipe moved only the stylesheet and the logo, and left the script and the icon pointing at the domain root.
11 days	Pin the server configs to the releases they suit	Bryce Kwon	-1/+7
	Each release named is the one its project's own site listed as current on 2026-10-29.
2026-09-25	Mark a page behind an auth filter private	Bryce Kwon	-14/+15
	Only the login page carried a Cache-Control, so a page an auth filter had let a visitor see could be kept by a cache shared with the next visitor. The page also varies on the cookie that got them in.
2026-09-15	Unify the docs, samples and extensions	Bryce Kwon	-15/+12
2026-09-07	Refresh the server configs and drop unsafe-inline	Bryce Kwon	-94/+71
	style-src allowed inline styles only for the diffstat bars, which take their width from colspan instead. t0004 now checks that the three configs pin the same policy.
2026-08-19	Refuse unknown and spoofed hostnames in nginx.conf	Bryce Kwon	-0/+31
2026-08-18	Rework the response headers in the server configs	Bryce Kwon	-30/+132
2026-08-17	Drop the Last-Modified, Expires and ETag headers	Bryce Kwon	-1/+11
2026-08-01	Make the server configs complete standalone files	Bryce Kwon	-219/+410
2026-07-31	Reorganise the tree into vendor/ and custom/	Bryce Kwon	-0/+477