From b5988111398bf3b5a1cc58c374c1ef1cb58fe0ea Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 25 Jul 2026 22:36:52 -1000
Subject: Reorganize the tree into vendor/ and custom/

---
 .gitmodules                                   |   2 +-
 Makefile                                      |   8 +-
 README.txt                                    |  25 +-
 cgitrc.5.txt                                  |   6 +-
 custom/cgitrc                                 | 566 ++++++++++++++++++++++++
 custom/extensions/about-render.lua            | 592 ++++++++++++++++++++++++++
 custom/extensions/auth-file.lua               | 556 ++++++++++++++++++++++++
 custom/extensions/auth-inline.lua             | 528 +++++++++++++++++++++++
 custom/extensions/email-gravatar.lua          | 115 +++++
 custom/extensions/email-libravatar.lua        | 114 +++++
 custom/extensions/link-commits.lua            | 153 +++++++
 custom/extensions/syntax-highlight.lua        | 278 ++++++++++++
 custom/hooks/post-receive.agefile             |  19 +
 custom/hooks/post-update.update-server-info   |  18 +
 custom/servers/apache.conf                    | 152 +++++++
 custom/servers/lighttpd.conf                  | 132 ++++++
 custom/servers/nginx.conf                     | 193 +++++++++
 examples/cgitrc                               | 566 ------------------------
 examples/hooks/post-receive.agefile           |  19 -
 examples/hooks/post-update.update-server-info |  18 -
 examples/servers/apache.conf                  | 152 -------
 examples/servers/lighttpd.conf                | 132 ------
 examples/servers/nginx.conf                   | 193 ---------
 extensions/about-render.lua                   | 592 --------------------------
 extensions/auth-file.lua                      | 556 ------------------------
 extensions/auth-inline.lua                    | 528 -----------------------
 extensions/email-gravatar.lua                 | 115 -----
 extensions/email-libravatar.lua               | 114 -----
 extensions/link-commits.lua                   | 153 -------
 extensions/syntax-highlight.lua               | 278 ------------
 libraries/git                                 |   1 -
 source/cgit.mk                                |   6 +-
 source/ui-tree.c                              |   2 +-
 tests/Makefile                                |   2 +-
 tests/setup.sh                                |   2 +-
 tests/t0001-validate-git-versions.sh          |  10 +-
 tests/t0201-limits.sh                         |   2 +-
 vendor/git                                    |   1 +
 38 files changed, 3443 insertions(+), 3456 deletions(-)
 create mode 100644 custom/cgitrc
 create mode 100644 custom/extensions/about-render.lua
 create mode 100644 custom/extensions/auth-file.lua
 create mode 100644 custom/extensions/auth-inline.lua
 create mode 100644 custom/extensions/email-gravatar.lua
 create mode 100644 custom/extensions/email-libravatar.lua
 create mode 100644 custom/extensions/link-commits.lua
 create mode 100644 custom/extensions/syntax-highlight.lua
 create mode 100755 custom/hooks/post-receive.agefile
 create mode 100755 custom/hooks/post-update.update-server-info
 create mode 100644 custom/servers/apache.conf
 create mode 100644 custom/servers/lighttpd.conf
 create mode 100644 custom/servers/nginx.conf
 delete mode 100644 examples/cgitrc
 delete mode 100755 examples/hooks/post-receive.agefile
 delete mode 100755 examples/hooks/post-update.update-server-info
 delete mode 100644 examples/servers/apache.conf
 delete mode 100644 examples/servers/lighttpd.conf
 delete mode 100644 examples/servers/nginx.conf
 delete mode 100644 extensions/about-render.lua
 delete mode 100644 extensions/auth-file.lua
 delete mode 100644 extensions/auth-inline.lua
 delete mode 100644 extensions/email-gravatar.lua
 delete mode 100644 extensions/email-libravatar.lua
 delete mode 100644 extensions/link-commits.lua
 delete mode 100644 extensions/syntax-highlight.lua
 delete mode 160000 libraries/git
 create mode 160000 vendor/git

diff --git a/.gitmodules b/.gitmodules
index a7ed44a..15d7ed5 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,3 +1,3 @@
 [submodule "git"]
 	url = https://git.kernel.org/pub/scm/git/git.git
-	path = libraries/git
+	path = vendor/git
diff --git a/Makefile b/Makefile
index 4906686..6029c77 100644
--- a/Makefile
+++ b/Makefile
@@ -6,12 +6,12 @@
 .SUFFIXES:
 
 # Project layout. Sources live in source/, web assets in assets/, Lua filters
-# in extensions/, the bundled Git tree in libraries/git, and every generated
+# in custom/extensions/, the bundled Git tree in vendor/git, and every generated
 # file lands in build/. CGIT_ROOT reaches from the Git tree back to the root.
 SRCDIR   = source
 ASSETDIR = assets
-EXTDIR   = extensions
-GITDIR   = libraries/git
+EXTDIR   = custom/extensions
+GITDIR   = vendor/git
 BUILDDIR = build
 CGIT_ROOT = ../..
 
@@ -46,7 +46,7 @@ FILTER_FILES = $(notdir $(wildcard $(EXTDIR)/*.lua))
 # Extra files and whole trees the dist target bundles into the release tarball,
 # alongside the binary and the assets above.
 DIST_DOCS  = cgitrc.5.txt README.txt LICENSE.txt AUTHORS
-DIST_TREES = $(EXTDIR) examples
+DIST_TREES = custom
 DIST_NAME  = cgit-$(CGIT_VERSION)
 DIST_DIR   = $(BUILDDIR)/$(DIST_NAME)
 
diff --git a/README.txt b/README.txt
index d385d31..b1ff14a 100644
--- a/README.txt
+++ b/README.txt
@@ -5,19 +5,6 @@ This is an attempt to create a fast web interface for the Git SCM, using a
 built-in cache to decrease server I/O pressure.
 
 
-Repository layout
------------------
-
-    source/      the C sources, the build fragment and the version script
-    libraries/   the bundled Git tree, tracked as a submodule
-    assets/      cgit.css, cgit.js and the images cgit serves
-    extensions/  optional runtime filter scripts
-    examples/    a commented cgitrc, git hooks and web server configs
-    tools/       developer tooling (preview server and release build)
-    tests/       the test suite
-    build/       everything the build generates, and not tracked in git
-
-
 Installation
 ------------
 
@@ -47,7 +34,7 @@ configure this location (and a few other things) by providing a `cgit.conf` file
 (see the Makefile for details).
 
 Lua is optional and only powers the lua: filter extensions (authentication,
-email and commit-message filters in extensions/). A plain build auto-detects a
+email and commit-message filters in custom/extensions/). A plain build auto-detects a
 Lua through pkg-config, preferring LuaJIT, and falls back to a Lua-less binary
 when none is found. Acceptable values are generally "luajit", "lua", "lua5.4",
 "lua5.3", "lua5.2" and "lua5.1".
@@ -87,7 +74,7 @@ needed.
 Filter extensions
 -----------------
 
-The optional Lua filters in `extensions/` need extra Lua modules. Each script's
+The optional Lua filters in `custom/extensions/` need extra Lua modules. Each script's
 header lists the exact install commands for its own dependencies.
 
 * The auth filters (`auth-file.lua`, `auth-inline.lua`) need `luaossl` and
@@ -108,7 +95,7 @@ Web server configuration
 ------------------------
 
 cgit is a CGI program. Complete, commented configurations for nginx, Apache and
-lighttpd live in `examples/servers/`, each explaining how that server routes
+lighttpd live in `custom/servers/`, each explaining how that server routes
 requests to the binary and serves the static assets off disk.
 
 
@@ -118,7 +105,7 @@ Runtime configuration
 The file `/etc/cgitrc` is read by cgit before handling a request. In addition to
 runtime parameters, this file may also contain a list of repositories displayed
 by cgit (see `cgitrc.5.txt` for further details). A fully commented starting
-point with every option at its default is in `examples/cgitrc`.
+point with every option at its default is in `custom/cgitrc`.
 
 
 Securing an instance
@@ -131,11 +118,11 @@ documented in `cgitrc.5.txt`.
   marker filename so only repositories that contain it are published.
 
 * Gate the whole instance behind a login with `auth-filter`. Two example filters
-  ship in `extensions/`, `auth-inline.lua` and `auth-file.lua`.
+  ship in `custom/extensions/`, `auth-inline.lua` and `auth-file.lua`.
 
 * Terminate TLS at the web server in front of cgit.
 
-* The example configs in `examples/servers/` set a Content-Security-Policy and
+* The example configs in `custom/servers/` set a Content-Security-Policy and
   related headers at the web server, where they also cover the static assets.
 
 * `max-blob-size` bounds how much a single request reads into memory, and
diff --git a/cgitrc.5.txt b/cgitrc.5.txt
index e8e006a..ed11563 100644
--- a/cgitrc.5.txt
+++ b/cgitrc.5.txt
@@ -473,7 +473,7 @@ source-filter::
 	this can be used to implement e.g. syntax highlighting. When no
 	source-filter is configured, cgit serves the text plain. A ready
 	syntax highlighter using the Scintillua lexer collection ships as
-	extensions/syntax-highlight.lua, see the comments in that file for
+	custom/extensions/syntax-highlight.lua, see the comments in that file for
 	its dependencies. Default value: none. See also: "FILTER API".
 
 summary-branches::
@@ -754,8 +754,8 @@ auth filter::
 	with a 302 redirect, and write to output one or more "Set-Cookie"
 	HTTP headers, each followed by a newline.
 
-	See `extensions/auth-inline.lua` for a ready to modify example that
-	keeps its user list inline, or `extensions/auth-file.lua` for the
+	See `custom/extensions/auth-inline.lua` for a ready to modify example that
+	keeps its user list inline, or `custom/extensions/auth-file.lua` for the
 	same filter reading its users from files on disk.
 
 commit filter::
diff --git a/custom/cgitrc b/custom/cgitrc
new file mode 100644
index 0000000..85929d4
--- /dev/null
+++ b/custom/cgitrc
@@ -0,0 +1,566 @@
+# cgitrc reference configuration
+#
+# This file lists every cgit configuration option set to its default value.
+# Options with a real default are left uncommented at that default. Options
+# that are site-specific are commented out with a realistic example and their
+# default noted in the comment. Copied as-is, cgit behaves as if no option
+# were set.
+#
+# Quick start. The one thing you must set to see any repositories is where
+# they live. Uncomment scan-path further down and point it at your git
+# directory, or list repositories by hand in the per-repository section at
+# the end of this file.
+#
+# About pages (markdown, man and plain-text readmes) render through the
+# bundled about-render.lua about-filter, see the filter section below. Source
+# syntax highlighting is optional and ships as a source-filter there too.
+#
+# One key=value pair per line. Lines starting with # are comments.
+
+
+##
+## Cache
+##
+
+# Maximum number of entries in the cgit output cache. A value of 0 disables
+# caching. Value is an integer. Default is 0.
+cache-size=0
+
+# Directory used to store cgit cache entries. Value is a filesystem path that
+# may use macros. Default is /var/cache/cgit.
+#cache-root=/var/cache/cgit
+
+# Minutes to cache the repository index page. Value is an integer number of
+# minutes. Default is 5.
+cache-root-ttl=5
+
+# Minutes to cache the repository summary page. Value is an integer number of
+# minutes. Default is 5.
+cache-repo-ttl=5
+
+# Minutes to cache the result of scanning a path for repositories. Value is an
+# integer number of minutes. Default is 15.
+cache-scanrc-ttl=15
+
+# Minutes to cache repo pages requested with a fixed SHA1. A negative value
+# never expires. Value is an integer number of minutes. Default is -1.
+cache-static-ttl=-1
+
+# Minutes to cache repo pages requested without a fixed SHA1. Value is an
+# integer number of minutes. Default is 5.
+cache-dynamic-ttl=5
+
+# Minutes to cache the repository about page. Value is an integer number of
+# minutes. Default is 15.
+cache-about-ttl=15
+
+# Minutes to cache snapshots. Value is an integer number of minutes.
+# Default is 5.
+cache-snapshot-ttl=5
+
+# Expose the ls_cache page, which lists cache paths and the urls other
+# visitors requested. Values are 0 or 1. Default is 0.
+enable-cache-list=0
+
+
+##
+## Site appearance
+##
+
+# Heading text on the repository index page. Value is any text.
+# Default is Git repository browser.
+#root-title=Git repository browser
+
+# Subheading text below the index page heading. Value is any text.
+# Default is a fast webinterface for the git dscm.
+#root-desc=a fast webinterface for the git dscm
+
+# File included verbatim below the about link on the index page. Value is a
+# filesystem path. Default is none.
+#root-readme=/var/www/htdocs/about.html
+
+# Default value or values for repo.readme. The first existing file wins. Value
+# is one or more [ref]path entries. Default is none.
+#readme=:README.md
+
+# CSS document urls added to the head of every page. Value is one or more urls.
+# Default is /cgit.css.
+#css=/cgit.css
+
+# JavaScript document urls included on every page. An empty value disables it.
+# Value is one or more urls. Default is /cgit.js.
+#js=/cgit.js
+
+# Shortcut icon url for all pages. Value is a url. Default is /favicon.ico.
+#favicon=/favicon.ico
+
+# Image url used as the logo on all pages. Value is a url. Default is /cgit.png.
+#logo=/cgit.png
+
+# Url loaded when clicking the logo. Value is a url. Default is the index url.
+#logo-link=/
+
+# File included verbatim at the top of all pages. Value is a filesystem path.
+# Default is none.
+#header=/var/www/htdocs/cgit-header.html
+
+# File included verbatim at the bottom of all pages, replacing the generated-by
+# line. Value is a filesystem path. Default is none.
+#footer=/var/www/htdocs/cgit-footer.html
+
+# File included verbatim in the HTML head of all pages. Value is a filesystem
+# path. Default is none.
+#head-include=/var/www/htdocs/cgit-head.html
+
+# Content of the robots meta tag. Value is robots meta content.
+# Default is index, nofollow.
+robots=index, nofollow
+
+# Omit the standard page header when set. Values are 0 or 1. Default is 0.
+noheader=0
+
+# Generate an HTML fragment suitable for embedding in other pages. Values are
+# 0 or 1. Default is 0.
+embedded=0
+
+# Root url for all cgit links, enabling virtual urls. Value is a url path.
+# Default is none.
+#virtual-root=/
+
+# Link format string for submodules in directory listings. Value is a printf
+# format string taking path and sha1. Default is none.
+#module-link=/%s/commit/?id=%s
+
+
+##
+## Repository discovery
+##
+
+# Directory scanned for git repositories at parse time. Value is a filesystem
+# path that may use macros. Default is none.
+#scan-path=/var/lib/git
+
+# When scanning, recurse into dot-directories. Must precede scan-path.
+# Values are 0 or 1. Default is 0.
+scan-hidden-path=0
+
+# Derive default section names from N leading path elements. Must precede
+# scan-path. Value is an integer that may be negative. Default is 0.
+section-from-path=0
+
+# Strip the .git suffix from scanned repo url and name. Must precede scan-path.
+# Values are 0 or 1. Default is 0.
+remove-suffix=0
+
+# File listing subdirs of scan-path to load. Must precede scan-path. Value is a
+# filesystem path that may use macros. Default is none.
+#project-list=/var/lib/git/projects.list
+
+# Serve a repo only if this file exists inside it. Emulates gitweb EXPORT_OK.
+# Must precede scan-path. Value is a filename. Default is none.
+#strict-export=git-daemon-export-ok
+
+# Section heading that subsequently-defined repos inherit. Value is any section
+# heading text. Default is none.
+#section=main
+
+# Sort sections and repos within them by name rather than file order. Values
+# are 0 or 1. Default is 0.
+section-sort=0
+
+# How repositories within a section are sorted. Values are name or age.
+# Default is name.
+repository-sort=name
+
+# Let scanned repos set cgit settings via git config using gitweb.* or cgit.*
+# keys. Values are 0 or 1. Default is 0.
+enable-git-config=0
+
+# Include another config file before continuing to parse this one. Value is a
+# filesystem path that may use macros. Default is none.
+#include=/etc/cgitrc.d/extra
+
+
+##
+## Features
+##
+
+# Provide a blame page for files and links to it. Values are 0 or 1.
+# Default is 0.
+enable-blame=0
+
+# Print an ASCII-art commit history graph in the log page. Values are 0 or 1.
+# Default is 0.
+enable-commit-graph=0
+
+# Allow following a file across renames in the log view. Values are 0 or 1.
+# Default is 0.
+enable-follow-links=0
+
+# Add a help tab to the index page with a built-in guide to the interface.
+# Values are 0 or 1. Default is 1.
+enable-help=1
+
+# Generate extra summary, commit and tree links per repo on the index. Values
+# are 0 or 1. Default is 0.
+enable-index-links=0
+
+# Show the owner of each repo on the index page. Values are 0 or 1.
+# Default is 1.
+enable-index-owner=1
+
+# Show the number of modified files per commit in the log. Values are 0 or 1.
+# Default is 0.
+enable-log-filecount=0
+
+# Show added and removed line counts per commit in the log. Values are 0 or 1.
+# Default is 0.
+enable-log-linecount=0
+
+# Display remote branches in summary and refs views. Values are 0 or 1.
+# Default is 0.
+enable-remote-branches=0
+
+# Use the parent commit subject as link text for parent links. Values are
+# 0 or 1. Default is 0.
+enable-subject-links=0
+
+# Allow /plain to serve HTML mimetypes instead of downgrading to text/plain.
+# Values are 0 or 1. Default is 0.
+enable-html-serving=0
+
+# Generate line-number links for plaintext blobs in the tree view. Values are
+# 0 or 1. Default is 1.
+enable-tree-linenumbers=1
+
+# List directories first, then files, in the tree view. Values are 0 or 1.
+# Default is 0.
+enable-tree-group-dirs=0
+
+# Default maximum statistics period. Leaving this unset disables statistics.
+# Values are week, month, quarter or year. Default is unset.
+#max-stats=week
+
+# Enable the statistics page, with the repository overview, activity
+# timeline, commit rhythm, language breakdown and commits per author.
+# Values are 0 or 1. Default is 0.
+enable-stats=0
+
+
+##
+## Snapshots and cloning
+##
+
+# Default set of snapshot archive formats to offer. Value is a space list of
+# tar tar.gz tar.bz2 tar.lz tar.xz tar.zst zip, or the word all.
+# Default is none.
+#snapshots=tar.gz tar.xz zip
+
+# Act as a dumb HTTP endpoint for git clones. Values are 0 or 1. Default is 1.
+enable-http-clone=1
+
+# Prefixes combined with the repo url to build clone urls. Used only when
+# repo.clone-url is unset. Value is space-separated url prefixes.
+# Default is none.
+#clone-prefix=https://example.com/git git://example.com
+
+# Clone-url templates used when repo.clone-url is unset. Value is
+# space-separated url templates that may use macros. Default is none.
+#clone-url=https://example.com/$CGIT_REPO_URL git://example.com/$CGIT_REPO_URL
+
+
+##
+## Filters
+##
+#
+# A filter is an external command cgit runs to transform a piece of content.
+# Prefix the command with lua: to run it through the built-in Lua interpreter,
+# which avoids a fork per call, or with exec: to run a normal program. The
+# commands below that point at /usr/share/cgit/extensions/ use scripts this
+# repository ships under custom/extensions/. The ones written as /path/to/your-command
+# mark where your own command goes.
+
+# Allow filter settings to be overridden in per-repo cgitrc files. Values are
+# 0 or 1. Default is 0.
+enable-filter-overrides=0
+
+# Filter command used to format about-page content. The bundled about-render.lua
+# renders markdown, man pages and plain text. Value is a command optionally
+# prefixed with exec or lua. Default is none.
+#about-filter=lua:/usr/share/cgit/extensions/about-render.lua
+
+# Filter command used to format commit messages, for example to turn object
+# names and issue numbers into links. Value is a command optionally prefixed
+# with exec or lua. Default is none.
+#commit-filter=lua:/usr/share/cgit/extensions/link-commits.lua
+
+# Filter command used to format author and committer emails, for example to
+# add avatar images. Value is a command optionally prefixed with exec or lua.
+# Default is none.
+#email-filter=lua:/usr/share/cgit/extensions/email-gravatar.lua
+
+# Filter command used to format plaintext blobs in the tree view. Without it
+# cgit serves the text plain. For syntax highlighting, the shipped filter
+# below uses the Scintillua lexers and needs the lpeg module installed too,
+# on Debian that is "apt install lua-lpeg". Missing either dependency means
+# plain uncolored text, not an error. See the comments in that file. Value
+# is a command optionally prefixed with exec or lua. Default is none.
+#source-filter=lua:/usr/share/cgit/extensions/syntax-highlight.lua
+
+# Filter command invoked to authenticate access, gating repositories behind a
+# login. See custom/extensions/auth-inline.lua and custom/extensions/auth-file.lua. Value
+# is a command optionally prefixed with exec or lua. Default is none.
+#auth-filter=lua:/usr/share/cgit/extensions/auth-inline.lua
+
+
+##
+## Limits and safety
+##
+
+# Number of items to display in atom feeds. Value is an integer. Default is 10.
+max-atom-items=10
+
+# Max commit message characters shown in the log view. Value is an integer.
+# Default is 80.
+max-message-length=80
+
+# Max repo description characters shown on the index page. Value is an integer.
+# Default is 80.
+max-repodesc-length=80
+
+# Max blob size in KBytes read into memory for html, plain and blob output.
+# A value of 0 disables the limit. Value is an integer. Default is 10240.
+max-blob-size=10240
+
+# Number of repos listed per page on the index. A value of 0 or negative shows
+# all repos. Value is an integer. Default is 50.
+max-repo-count=50
+
+# Number of log entries listed per page in the log view. Value is an integer.
+# Default is 50.
+max-commit-count=50
+
+# Maximum number of commits the patch view emits as a series for an explicit
+# revision range. A single commit is unaffected. A value of 0 removes the
+# limit. Value is an integer. Default is 50.
+max-patch-count=50
+
+# Commits changing more files than this render as a diffstat, where each file
+# links to its own diff page. A value of 0 always renders everything inline.
+# Value is an integer. Default is 200.
+max-diff-files=200
+
+# A file whose diff spans more lines than this is replaced by a link to its
+# own diff page in whole-commit views. A value of 0 always renders it inline.
+# Value is an integer. Default is 1000.
+max-diff-lines=1000
+
+# Branches and tags listed per section on the refs page, and per page on the
+# dedicated branch and tag pages. A value of 0 lists everything on one page.
+# Value is an integer. Default is 200.
+max-ref-count=200
+
+# Max files considered when detecting renames. A value of -1 uses the git
+# compile-time value. Value is an integer. Default is -1.
+renamelimit=-1
+
+
+##
+## Presentation
+##
+
+# Number of log entries shown in the summary view. Value is an integer.
+# Default is 10.
+summary-log=10
+
+# Number of branches shown in the summary view. Value is an integer.
+# Default is 10.
+summary-branches=10
+
+# Number of tags shown in the summary view. Value is an integer. Default is 10.
+summary-tags=10
+
+# Show side-by-side diffs instead of unidiffs by default. Values are 0 or 1.
+# Default is 0.
+side-by-side-diffs=0
+
+# Print commit and tag times in the server timezone. Values are 0 or 1.
+# Default is 0.
+local-time=0
+
+# Ordering of commits in the log view. Leaving this unset uses the git log
+# default. Values are date or topo. Default is unset.
+#commit-sort=date
+
+# Ordering of the branch ref list. Values are name or age. Default is name.
+branch-sort=name
+
+# Sort items in the repo list case-sensitively. Values are 0 or 1. Default is 1.
+case-sensitive-sort=1
+
+# Hide full author email addresses when set. Values are 0 or 1. Default is 0.
+noplainemail=0
+
+# File giving the timestamp of the youngest commit. Value is a path relative to
+# the repo. Default is info/web/last-modified.
+#agefile=info/web/last-modified
+
+# Fallback mimetype lookup file for plain output. Value is a filesystem path.
+# Default is none.
+#mimetype-file=/etc/mime.types
+
+# Mimetype for a given filename extension, used by plain output. Value is a
+# mimetype string keyed by extension. Default is none.
+#mimetype.gif=image/gif
+#mimetype.html=text/html
+#mimetype.jpg=image/jpeg
+#mimetype.pdf=application/pdf
+#mimetype.png=image/png
+#mimetype.svg=image/svg+xml
+
+
+##
+## Per-repository overrides
+##
+#
+# Each repository is introduced by a repo.url line, which must be the first
+# setting of the block. All following repo.* settings apply to that repo until
+# the next repo.url line. When repos are discovered via scan-path the repo.
+# prefix is dropped inside each repo cgitrc and repo.url and repo.path are not
+# allowed there.
+
+# Relative url for a repo. Must be the first setting of each repo block. Value
+# is a relative url path. Default is none.
+#repo.url=example
+
+# Absolute path to the repository. For a non-bare repo this is the .git dir.
+# Value is an absolute filesystem path. Default is none.
+#repo.path=/var/lib/git/example.git
+
+# Display name of the repository. Value is any text. Default is the repo url.
+#repo.name=example
+
+# Repository description. Value is any text. Default is none.
+#repo.desc=An example repository
+
+# Repository owner identifier. Value is any text. Default is none.
+#repo.owner=Jane Doe
+
+# Repository homepage value. Value is a url or text. Default is none.
+#repo.homepage=https://example.com/
+
+# Urls used to clone this repo. Value is space-separated urls that may use
+# macros. Default is none.
+#repo.clone-url=https://example.com/example.git git://example.com/example.git
+
+# Default branch for the repo. Falls back to the first sorted branch. Value is
+# a branch name. Default is the HEAD branch, or master.
+#repo.defbranch=master
+
+# Override the current section name for this repo. Value is a section name.
+# Default is none.
+#repo.section=main
+
+# Prefix for snapshot filenames instead of the repo basename. Value is a prefix
+# string. Default is none.
+#repo.snapshot-prefix=example
+
+# Extra content added verbatim to the head of each page for this repo. Value is
+# an HTML fragment. Default is none.
+#repo.extra-head-content=<meta name="example" content="value">
+
+# File included verbatim as the repo About page. A colon-prefixed value uses
+# the head or defbranch. Value is a [ref]path entry. Default is the global
+# readme value.
+#repo.readme=:README.md
+
+# Per-repo logo image url. Value is a url. Default is the global logo value.
+#repo.logo=/cgit.png
+
+# Per-repo logo link target url. Value is a url. Default is the global
+# logo-link value.
+#repo.logo-link=/
+
+# Per-repo submodule link format string. Value is a printf format string taking
+# path and sha1. Default is the global module-link value.
+#repo.module-link=/%s/commit/?id=%s
+
+# Submodule link format for a specific submodule path. Value is a printf format
+# string taking sha1. Default is none.
+#repo.module-link.path/to/sub=https://example.com/sub/commit/?id=%s
+
+# Snapshot formats offered for this repo, restricted by the global mask. A
+# value of 0 disables snapshots. Value is snapshot formats. Default is the
+# global snapshots value.
+#repo.snapshots=tar.gz zip
+
+# Hide the repo from the index but still allow direct access. Values are
+# 0 or 1. Default is 0.
+#repo.hide=0
+
+# Ignore the repo entirely so it is not indexed and not directly accessible.
+# Values are 0 or 1. Default is 0.
+#repo.ignore=0
+
+# Per-repo override of enable-blame. Values are 0 or 1. Default is the global
+# enable-blame value.
+#repo.enable-blame=0
+
+# Per-repo override of enable-commit-graph. Values are 0 or 1. Default is the
+# global enable-commit-graph value.
+#repo.enable-commit-graph=0
+
+# Per-repo override of enable-follow-links. Values are 0 or 1. Default is the
+# global enable-follow-links value.
+#repo.enable-follow-links=0
+
+# Per-repo override of enable-log-filecount. Values are 0 or 1. Default is the
+# global enable-log-filecount value.
+#repo.enable-log-filecount=0
+
+# Per-repo override of enable-log-linecount. Values are 0 or 1. Default is the
+# global enable-log-linecount value.
+#repo.enable-log-linecount=0
+
+# Per-repo override of enable-remote-branches. Values are 0 or 1. Default is
+# the global enable-remote-branches value.
+#repo.enable-remote-branches=0
+
+# Per-repo override of enable-subject-links. Values are 0 or 1. Default is the
+# global enable-subject-links value.
+#repo.enable-subject-links=0
+
+# Per-repo override of enable-html-serving. Values are 0 or 1. Default is the
+# global enable-html-serving value.
+#repo.enable-html-serving=0
+
+# Per-repo branch ref list ordering. Values are name or age. Default is name.
+#repo.branch-sort=name
+
+# Per-repo commit log ordering. Leaving this unset uses the git log default.
+# Values are date or topo. Default is unset.
+#repo.commit-sort=date
+
+# Per-repo maximum statistics period. Values are week, month, quarter or year.
+# Default is the global max-stats value.
+#repo.max-stats=week
+
+# Per-repo override of the about-filter. Allowed in a repo cgitrc only when
+# enable-filter-overrides is 1. Value is a command. Default is the global
+# about-filter value.
+#repo.about-filter=exec:/path/to/your-command
+
+# Per-repo override of the commit-filter. Allowed in a repo cgitrc only when
+# enable-filter-overrides is 1. Value is a command. Default is the global
+# commit-filter value.
+#repo.commit-filter=lua:/usr/share/cgit/extensions/link-commits.lua
+
+# Per-repo override of the source-filter. Allowed in a repo cgitrc only when
+# enable-filter-overrides is 1. Value is a command. Default is the global
+# source-filter value.
+#repo.source-filter=exec:/path/to/your-command
+
+# Per-repo override of the email-filter. Allowed in a repo cgitrc only when
+# enable-filter-overrides is 1. Value is a command. Default is the global
+# email-filter value.
+#repo.email-filter=lua:/usr/share/cgit/extensions/email-gravatar.lua
diff --git a/custom/extensions/about-render.lua b/custom/extensions/about-render.lua
new file mode 100644
index 0000000..073b531
--- /dev/null
+++ b/custom/extensions/about-render.lua
@@ -0,0 +1,592 @@
+-- Server-side about-page rendering for cgit, used with the about-filter setting
+-- in cgitrc and the lua: prefix so it runs in cgit's embedded interpreter with
+-- no per-request process.
+--
+--     about-filter=lua:/usr/lib/cgit/filters/about-render.lua
+--
+-- One filter renders the three baseline about formats, chosen by the readme's
+-- file extension.
+--
+--     markdown   .md .markdown .mkd .mdown
+--     man page   .1 through .9 and .man
+--     plain text everything else, and the fallback for anything that fails
+--
+-- Add a format by giving it a render function and a row in the handler table
+-- near the foot of this file. Nothing else needs to change.
+--
+-- SUPPORTED LUA
+--
+-- Lua 5.1 through 5.4 and LuaJIT.
+--
+-- REQUIREMENTS
+--
+-- lpeg, the parsing module, for the Lua cgit is linked against. Markdown and
+-- man pages are parsed with lpeg grammars, so without lpeg both fall back to
+-- escaped plain text. It ships with cgit's syntax highlighter too, so a cgit
+-- that colours source already has it.
+--
+--     # Debian and Ubuntu
+--     sudo apt install lua-lpeg
+--     # Fedora
+--     sudo dnf install lua-lpeg
+--     # Alpine
+--     sudo apk add lua5.1-lpeg
+--     # or with LuaRocks, matched to your Lua version
+--     sudo luarocks --lua-version 5.1 install lpeg
+--
+-- Plain text needs only Lua itself.
+--
+-- SECURITY
+--
+-- The about page renders untrusted repository content, so the safety rule is
+-- that every run of text reaches the page through cgit's own html_txt, every
+-- attribute value through html_attr, and every link or image target through
+-- the safe_url scheme allowlist below before html_attr. Only http, https,
+-- mailto and relative targets survive, so a hostile readme cannot inject markup
+-- or a javascript: url. Because all output is routed through those sinks by
+-- construction, a bug in the parser can only mis-render, never inject.
+--
+-- LIMITATIONS
+--
+-- Markdown is a deliberate subset, not CommonMark. Headings, thematic breaks,
+-- fenced and inline code, blockquotes, pipe tables, single-level lists, links,
+-- images and emphasis. No reference links, no raw HTML passthrough, no nested
+-- lists, no setext headings. Emphasis does not span a hard line break inside a
+-- paragraph. Man rendering covers the common macros (section headings, filled
+-- and no-fill paragraphs, bold and italic, font escapes) and drops the rest.
+-- cgit sends filter output through a C string sink that stops at the first NUL
+-- byte, so content past a NUL is truncated.
+--
+-- OUTPUT
+--
+-- Markdown is wrapped in <div class='markdown'>, man pages in
+-- <div class='markdown manpage'>, plain text in <pre class='plaintext'>, all
+-- styled by assets/cgit.css.
+
+local ok_lpeg, lpeg = pcall(require, "lpeg")
+
+
+-- ===== configuration ===================================================
+
+-- Readmes larger than this are served as escaped plain text rather than parsed.
+local max_bytes = 512 * 1024
+
+-- Ceiling on blockquote and emphasis nesting, so a hostile readme of stacked
+-- markers cannot drive the recursive parser into a stack overflow.
+local max_depth = 24
+
+local filename, chunks = "", {}
+
+
+-- ===== helpers =========================================================
+
+local function trim(s)
+	return (s:gsub("^%s+", ""):gsub("%s+$", ""))
+end
+
+-- Split on newlines after normalising CRLF and CR, returning the lines without
+-- their terminators. A trailing newline yields a final empty line, which every
+-- caller treats as blank.
+local function split_lines(s)
+	s = s:gsub("\r\n?", "\n")
+	local lines, start = {}, 1
+	while true do
+		local nl = s:find("\n", start, true)
+		if not nl then
+			lines[#lines + 1] = s:sub(start)
+			return lines
+		end
+		lines[#lines + 1] = s:sub(start, nl - 1)
+		start = nl + 1
+	end
+end
+
+-- Split a table row into trimmed cells, dropping one optional leading and
+-- trailing pipe.
+local function split_cells(row)
+	row = trim(row):gsub("^|", ""):gsub("|$", "")
+	local cells = {}
+	for c in (row .. "|"):gmatch("(.-)|") do
+		cells[#cells + 1] = trim(c)
+	end
+	return cells
+end
+
+-- Return the url if its scheme is safe, else nil. Control and whitespace bytes
+-- are stripped anywhere first because a browser ignores them when resolving the
+-- scheme, so "java\nscript:" must still be caught as javascript. The class is
+-- %c%s rather than a literal 0x00 range so it is safe on Lua 5.1, where an
+-- embedded zero byte ends a pattern.
+local function safe_url(url)
+	url = url:gsub("[%c%s]", "")
+	-- A leading "//" or "/\" is scheme-relative, which a browser resolves to
+	-- another origin, so it is not the local target the parser meant to allow.
+	if url:sub(1, 2) == "//" or url:sub(1, 2) == "/\\" then
+		return nil
+	end
+	local scheme = url:match("^(%a[%w%+%.%-]*):")
+	if scheme then
+		scheme = scheme:lower()
+		if scheme ~= "http" and scheme ~= "https" and scheme ~= "mailto" then
+			return nil
+		end
+	end
+	return url
+end
+
+
+-- ===== emit ============================================================
+-- html, html_txt and html_attr are injected by cgit's lua filter host. Tag
+-- scaffolding is a literal argument to html; every value that came from the
+-- repository goes through html_txt, html_attr or safe_url.
+
+local emit_inline
+
+emit_inline = function(list)
+	for _, nd in ipairs(list) do
+		local t = nd.t
+		if t == "text" then
+			html_txt(nd.v)
+		elseif t == "code" then
+			html("<code>"); html_txt(nd.v); html("</code>")
+		elseif t == "strong" then
+			html("<strong>"); emit_inline(nd.kids); html("</strong>")
+		elseif t == "em" then
+			html("<em>"); emit_inline(nd.kids); html("</em>")
+		elseif t == "link" then
+			local u = safe_url(nd.url)
+			if u then
+				html("<a href='"); html_attr(u); html("'>")
+				emit_inline(nd.kids)
+				html("</a>")
+			else
+				emit_inline(nd.kids)
+			end
+		elseif t == "image" then
+			local u = safe_url(nd.url)
+			if u then
+				html("<img src='"); html_attr(u)
+				html("' alt='"); html_attr(nd.alt); html("'/>")
+			else
+				html_txt("![" .. nd.alt .. "]")
+			end
+		end
+	end
+end
+
+local emit_blocks
+
+emit_blocks = function(blocks)
+	for _, b in ipairs(blocks) do
+		local t = b.t
+		if t == "heading" then
+			html("<h" .. b.level .. ">")
+			emit_inline(b.kids)
+			html("</h" .. b.level .. ">")
+		elseif t == "hr" then
+			html("<hr/>")
+		elseif t == "code" then
+			html("<pre><code")
+			if b.lang and b.lang ~= "" then
+				html(" data-lang='"); html_attr(b.lang); html("'")
+			end
+			html(">"); html_txt(b.text); html("</code></pre>")
+		elseif t == "blockquote" then
+			html("<blockquote>"); emit_blocks(b.blocks); html("</blockquote>")
+		elseif t == "table" then
+			html("<table><thead><tr>")
+			for _, c in ipairs(b.head) do
+				html("<th>"); emit_inline(c); html("</th>")
+			end
+			html("</tr></thead><tbody>")
+			for _, row in ipairs(b.rows) do
+				html("<tr>")
+				for _, c in ipairs(row) do
+					html("<td>"); emit_inline(c); html("</td>")
+				end
+				html("</tr>")
+			end
+			html("</tbody></table>")
+		elseif t == "list" then
+			local tag = b.ordered and "ol" or "ul"
+			html("<" .. tag .. ">")
+			for _, item in ipairs(b.items) do
+				html("<li>"); emit_inline(item); html("</li>")
+			end
+			html("</" .. tag .. ">")
+		elseif t == "para" then
+			html("<p>")
+			for k, line in ipairs(b.lines) do
+				if k > 1 then html("<br/>") end
+				emit_inline(line)
+			end
+			html("</p>")
+		end
+	end
+end
+
+
+-- ===== plain text ======================================================
+
+local function render_plaintext(text)
+	html("<pre class='plaintext'>")
+	html_txt(text)
+	html("</pre>")
+end
+
+
+-- ===== markdown and man ================================================
+-- Both are parsed with lpeg into the block/inline node trees emit_blocks and
+-- emit_inline above consume. Parsing is pure and builds a tree; emit is the
+-- only step that writes output, so a parse failure falls back to plain text
+-- without leaving half a page behind.
+
+local render_markdown, render_man
+
+if ok_lpeg then
+	local P, R, S, C, Ct = lpeg.P, lpeg.R, lpeg.S, lpeg.C, lpeg.Ct
+
+	local sp = S(" \t")
+	local ws = S(" \t\r\n\f\v")
+	local eol = P(-1)
+
+	-- ----- markdown inline -----
+	local marker = S("`![*_")
+	local urlchar = 1 - S(")") - ws
+	-- Bound the link and image inner scans. Without a cap a readme of unclosed
+	-- brackets ("[[[[...") makes each position scan to end of line for a "]"
+	-- that never comes, which is quadratic. Real link text and urls sit far
+	-- under this, and anything longer simply renders as plain text.
+	local CAP = 512
+
+	local parse_inline
+	local inline_depth = 0
+
+	local function node_text(s) return { t = "text", v = s } end
+	local function node_code(s) return { t = "code", v = s } end
+	local function node_strong(s) return { t = "strong", kids = parse_inline(s) } end
+	local function node_em(s) return { t = "em", kids = parse_inline(s) } end
+	local function node_link(text, url) return { t = "link", kids = parse_inline(text), url = url } end
+	local function node_image(alt, url) return { t = "image", alt = alt, url = url } end
+
+	local inline_grammar = Ct((
+		  (P("`") * C((1 - P("`")) ^ 1) * P("`")) / node_code
+		+ (P("![") * C((1 - P("]")) ^ (-CAP)) * P("]") * P("(") * sp ^ 0
+			* C(urlchar * urlchar ^ (-CAP)) * (1 - P(")")) ^ (-CAP) * P(")")) / node_image
+		+ (P("[") * C((1 - P("]")) ^ (-CAP)) * P("]") * P("(") * sp ^ 0
+			* C(urlchar * urlchar ^ (-CAP)) * (1 - P(")")) ^ (-CAP) * P(")")) / node_link
+		+ (P("**") * C((1 - P("**")) ^ 1) * P("**")) / node_strong
+		+ (P("__") * C((1 - P("__")) ^ 1) * P("__")) / node_strong
+		+ (P("*") * C((1 - ws) * (1 - P("*")) ^ 0) * P("*")) / node_em
+		+ (P("_") * C((1 - ws) * (1 - P("_")) ^ 0) * P("_")) / node_em
+		+ C((1 - marker) ^ 1) / node_text
+		+ C(P(1)) / node_text
+	) ^ 0)
+
+	parse_inline = function(s)
+		if inline_depth >= max_depth then
+			return { node_text(s) }
+		end
+		inline_depth = inline_depth + 1
+		local nodes = inline_grammar:match(s) or { node_text(s) }
+		inline_depth = inline_depth - 1
+		return nodes
+	end
+
+	-- ----- markdown blocks -----
+	-- Line matchers. Each is anchored at the start of a single line and returns
+	-- its captures, or nil when the line is not of that kind.
+	local langchar = R("az", "AZ", "09") + S("_.+#-")
+	local m_heading = C(P("#") * P("#") ^ -5) * sp ^ 1 * C(P(1) ^ 0)
+	local function rule(c) return sp ^ 0 * P(c) * (sp ^ 0 * P(c)) ^ 2 * sp ^ 0 * eol end
+	local m_hr = rule("-") + rule("*") + rule("_")
+	local m_fence = sp ^ 0 * (C(P("`") ^ 3) + C(P("~") ^ 3)) * sp ^ 0 * C(langchar ^ 0)
+	local m_close_bt = sp ^ 0 * P("`") ^ 3 * sp ^ 0 * eol
+	local m_close_ti = sp ^ 0 * P("~") ^ 3 * sp ^ 0 * eol
+	local m_bq = sp ^ 0 * P(">")
+	local bullet = S("-*+")
+	local number = R("09") ^ 1 * S(".)")
+	local m_item = sp ^ 0 * C(bullet + number) * sp ^ 1 * C(P(1) ^ 0)
+	local dcell = sp ^ 0 * P(":") ^ -1 * P("-") ^ 1 * P(":") ^ -1 * sp ^ 0
+	-- A delimiter row is dash-cells joined by pipes. Require at least one pipe,
+	-- a leading one or one between cells, so a bare rule of dashes stays a
+	-- thematic break and an ordinary paragraph line is never taken for a table.
+	local pipe = P("|")
+	local m_tdelim = sp ^ 0 * (
+		  pipe * dcell * (pipe * dcell) ^ 0 * pipe ^ -1
+		+ dcell * (pipe * dcell) ^ 1 * pipe ^ -1
+	) * sp ^ 0 * eol
+	local m_blockstart = sp ^ 0 * ((P("#") * P("#") ^ -5 * sp) + P(">")
+		+ P("`") ^ 3 + P("~") ^ 3 + ((bullet + number) * sp))
+
+	local function ordered(mark) return mark:match("%d") ~= nil end
+
+	local parse_blocks
+
+	parse_blocks = function(lines, depth)
+		local blocks, i, n = {}, 1, #lines
+		while i <= n do
+			local line = lines[i]
+			local fence, lang = m_fence:match(line)
+			local hashes, htext = m_heading:match(line)
+			local mark = m_item:match(line)
+			if line:match("^%s*$") then
+				i = i + 1
+			elseif fence then
+				local close = (fence:sub(1, 1) == "`") and m_close_bt or m_close_ti
+				local code = {}
+				i = i + 1
+				while i <= n and not close:match(lines[i]) do
+					code[#code + 1] = lines[i]; i = i + 1
+				end
+				i = i + 1
+				local body = table.concat(code, "\n")
+				if #code > 0 then body = body .. "\n" end
+				blocks[#blocks + 1] = { t = "code", lang = lang, text = body }
+			elseif hashes then
+				blocks[#blocks + 1] = {
+					t = "heading",
+					level = #hashes,
+					kids = parse_inline((htext:gsub("%s*#*%s*$", ""))),
+				}
+				i = i + 1
+			elseif m_hr:match(line) then
+				blocks[#blocks + 1] = { t = "hr" }
+				i = i + 1
+			elseif m_bq:match(line) then
+				local inner = {}
+				while i <= n and m_bq:match(lines[i]) do
+					inner[#inner + 1] = (lines[i]:gsub("^%s*>%s?", ""))
+					i = i + 1
+				end
+				if depth < max_depth then
+					blocks[#blocks + 1] = { t = "blockquote", blocks = parse_blocks(inner, depth + 1) }
+				else
+					local para = {}
+					for _, l in ipairs(inner) do para[#para + 1] = parse_inline(l) end
+					blocks[#blocks + 1] = { t = "para", lines = para }
+				end
+			elseif i + 1 <= n and line:find("|", 1, true) and m_tdelim:match(lines[i + 1]) then
+				local head = {}
+				for _, c in ipairs(split_cells(line)) do head[#head + 1] = parse_inline(c) end
+				local rows = {}
+				i = i + 2
+				while i <= n and lines[i]:find("|", 1, true) and not lines[i]:match("^%s*$") do
+					local row = {}
+					for _, c in ipairs(split_cells(lines[i])) do row[#row + 1] = parse_inline(c) end
+					rows[#rows + 1] = row
+					i = i + 1
+				end
+				blocks[#blocks + 1] = { t = "table", head = head, rows = rows }
+			elseif mark then
+				local is_ol = ordered(mark)
+				local items = {}
+				while i <= n do
+					local mk, ct = m_item:match(lines[i])
+					if not mk or ordered(mk) ~= is_ol then break end
+					items[#items + 1] = parse_inline(ct)
+					i = i + 1
+				end
+				blocks[#blocks + 1] = { t = "list", ordered = is_ol, items = items }
+			else
+				local para = { parse_inline(line) }
+				i = i + 1
+				while i <= n and not lines[i]:match("^%s*$") and not m_blockstart:match(lines[i]) do
+					para[#para + 1] = parse_inline(lines[i]); i = i + 1
+				end
+				blocks[#blocks + 1] = { t = "para", lines = para }
+			end
+		end
+		return blocks
+	end
+
+	render_markdown = function(text)
+		if #text > max_bytes then
+			return render_plaintext(text)
+		end
+		local ok, blocks = pcall(parse_blocks, split_lines(text), 0)
+		if not ok then
+			return render_plaintext(text)
+		end
+		html("<div class='markdown'>")
+		-- Emit is wrapped so a parser bug can at worst truncate the page, never
+		-- error out and let the outer fallback duplicate what was already sent.
+		pcall(emit_blocks, blocks)
+		html("</div>")
+	end
+
+	-- ----- man pages -----
+	-- Macro lines are matched with lpeg, and the roff inline font and character
+	-- escapes are an lpeg grammar producing a flat token list that a fold turns
+	-- into the same inline nodes markdown emits. Bold and italic are the current
+	-- font, which carries across a run, so the inline pass tokenises and folds
+	-- rather than nesting the way markdown does.
+	local m_macro = S(".'") * sp ^ 0 * C((1 - sp) ^ 1) * sp ^ 0 * C(P(1) ^ 0)
+
+	local one_font = { B = "B", I = "I" }
+	local two_font = { CB = "B", BI = "B", CI = "I" }
+	local man_chars = {
+		aq = "'", cq = "'", oq = "'", dq = '"', lq = '"', rq = '"',
+		hy = "-", en = "-", em = "-",
+	}
+	local esc = P("\\")
+	local function font_tok(f) return { k = "font", f = f } end
+	local function text_tok(v) return { k = "text", v = v } end
+	local skip_tok = { k = "skip" }
+
+	local man_inline_grammar = Ct((
+		  (esc * P("f") * P("(") * C(P(1) * P(1))) / function(nm) return font_tok(two_font[nm] or "R") end
+		+ (esc * P("f") * P("[") * C((1 - P("]")) ^ 0) * P("]")) / function(nm) return font_tok(one_font[nm] or "R") end
+		+ (esc * P("f") * C(P(1))) / function(f) return font_tok(one_font[f] or "R") end
+		+ (esc * P("-")) / function() return text_tok("-") end
+		+ (esc * P("e")) / function() return text_tok("\\") end
+		+ (esc * P(" ")) / function() return text_tok(" ") end
+		+ (esc * S("&|^")) / function() return skip_tok end
+		+ (esc * P("(") * C(P(1) * P(1))) / function(nm) return text_tok(man_chars[nm] or "") end
+		+ (esc * P("*") * (P("(") * P(1) * P(1) + P(1))) / function() return skip_tok end
+		+ (esc * C(P(1))) / text_tok
+		+ esc / function() return skip_tok end
+		+ C((1 - esc) ^ 1) / text_tok
+	) ^ 0)
+
+	local function man_inline(s)
+		local toks = man_inline_grammar:match(s) or {}
+		local nodes, buf, font = {}, {}, "R"
+		local function flush()
+			if #buf == 0 then return end
+			local txt = table.concat(buf); buf = {}
+			if txt == "" then return end
+			if font == "B" then
+				nodes[#nodes + 1] = { t = "strong", kids = { { t = "text", v = txt } } }
+			elseif font == "I" then
+				nodes[#nodes + 1] = { t = "em", kids = { { t = "text", v = txt } } }
+			else
+				nodes[#nodes + 1] = { t = "text", v = txt }
+			end
+		end
+		for _, tk in ipairs(toks) do
+			if tk.k == "text" then
+				buf[#buf + 1] = tk.v
+			elseif tk.k == "font" then
+				flush(); font = tk.f
+			end
+		end
+		flush()
+		return nodes
+	end
+
+	local function parse_man(text)
+		local lines = split_lines(text)
+		local blocks = {}
+		local para, pre, nofill = nil, nil, false
+		local function flush_para()
+			if para and #para > 0 then
+				blocks[#blocks + 1] = { t = "para", lines = para }
+			end
+			para = nil
+		end
+		local function flush_pre()
+			if pre then
+				local body = table.concat(pre, "\n")
+				if #pre > 0 then body = body .. "\n" end
+				blocks[#blocks + 1] = { t = "code", text = body }
+				pre = nil
+			end
+		end
+		local function add_line(nodes)
+			para = para or {}
+			para[#para + 1] = nodes
+		end
+		for _, line in ipairs(lines) do
+			local macro, rest = m_macro:match(line)
+			if rest then rest = (rest:gsub('^"(.*)"$', "%1")) end
+			if nofill then
+				if macro == "fi" then
+					nofill = false; flush_pre()
+				else
+					pre[#pre + 1] = line
+				end
+			elseif line:match("^%s*$") then
+				flush_para()
+			elseif macro and macro:sub(1, 1) == "\\" then
+				-- roff comment, dropped
+			elseif macro == "SH" or macro == "SS" then
+				flush_para()
+				blocks[#blocks + 1] = {
+					t = "heading",
+					level = (macro == "SH") and 2 or 3,
+					kids = man_inline(rest),
+				}
+			elseif macro == "nf" then
+				flush_para(); nofill = true; pre = {}
+			elseif macro == "fi" then
+				flush_pre()
+			elseif macro == "B" or macro == "BR" or macro == "RB"
+			    or macro == "BI" or macro == "IB" then
+				add_line({ { t = "strong", kids = man_inline(rest) } })
+			elseif macro == "I" or macro == "IR" or macro == "RI" then
+				add_line({ { t = "em", kids = man_inline(rest) } })
+			elseif macro == "TH" or macro == "PP" or macro == "LP"
+			    or macro == "P" or macro == "TP" or macro == "IP"
+			    or macro == "HP" or macro == "RS" or macro == "RE"
+			    or macro == "sp" or macro == "br" then
+				flush_para()
+			elseif macro then
+				if rest ~= "" then add_line(man_inline(rest)) end
+			else
+				add_line(man_inline(line))
+			end
+		end
+		flush_para(); flush_pre()
+		return blocks
+	end
+
+	render_man = function(text)
+		if #text > max_bytes then
+			return render_plaintext(text)
+		end
+		local ok, blocks = pcall(parse_man, text)
+		if not ok then
+			return render_plaintext(text)
+		end
+		html("<div class='markdown manpage'>")
+		pcall(emit_blocks, blocks)
+		html("</div>")
+	end
+else
+	-- No lpeg, so markdown and man readmes read as escaped source, not nothing.
+	render_markdown = render_plaintext
+	render_man = render_plaintext
+end
+
+
+-- ===== dispatch ========================================================
+
+local handlers = {}
+for _, ext in ipairs({ "md", "markdown", "mkd", "mdown" }) do
+	handlers[ext] = render_markdown
+end
+for _, ext in ipairs({ "1", "2", "3", "4", "5", "6", "7", "8", "9", "man" }) do
+	handlers[ext] = render_man
+end
+
+function filter_open(name)
+	filename = name or ""
+	chunks = {}
+end
+
+function filter_write(str)
+	chunks[#chunks + 1] = str
+end
+
+function filter_close()
+	local text = table.concat(chunks)
+	chunks = {}
+	local ext = (filename:match("%.([^.]+)$") or ""):lower()
+	local render = handlers[ext] or render_plaintext
+	local ok = pcall(render, text)
+	if not ok then
+		render_plaintext(text)
+	end
+	return 0
+end
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
new file mode 100644
index 0000000..5415ca7
--- /dev/null
+++ b/custom/extensions/auth-file.lua
@@ -0,0 +1,556 @@
+-- cgit auth-filter that gates repositories behind a login form and a signed
+-- session cookie.
+--
+-- This is the FILE-BACKED variant. The user accounts, the groups, and the
+-- per-repository access lists are read from files on disk, whose paths are set
+-- in the CONFIGURATION block below. Edit those files without touching this
+-- script. This suits larger or externally managed user sets.
+--
+-- The companion auth-inline.lua behaves identically but keeps its accounts and
+-- access lists inline in the script itself, which suits a small fixed set of
+-- users.
+--
+-- Enable it in cgitrc with
+--     auth-filter=lua:/path/to/auth-file.lua
+--
+-- SUPPORTED LUA
+--
+-- Lua 5.1, 5.2, 5.3, 5.4 and LuaJIT. Lua 5.5 is not supported, because luaossl
+-- has no 5.5 build. Match the runtime to the Lua that cgit is built against.
+--
+-- HTTPS IS RECOMMENDED
+--
+-- Serve cgit over HTTPS. Terminate TLS at the web server in front of cgit. The
+-- session cookie is marked Secure by default, so a browser only sends it back
+-- over HTTPS. If you genuinely run cgit over plain HTTP with no TLS anywhere,
+-- set cookie_insecure below, otherwise the cookie is never returned and login
+-- appears to loop.
+--
+-- DEPENDENCIES
+--
+--     luaossl    OpenSSL binding, provides openssl.rand and openssl.hmac
+--                <https://github.com/wahern/luaossl>
+--     luaposix   POSIX binding, provides posix.sys.stat and posix.unistd
+--                <https://github.com/luaposix/luaposix>
+--
+-- The reliable cross-platform install is LuaRocks, matched to your Lua
+-- version. luaossl also needs the OpenSSL development headers present.
+--
+--     # Debian and Ubuntu
+--     sudo apt install luarocks libssl-dev
+--     sudo luarocks --lua-version 5.1 install luaossl
+--     sudo luarocks --lua-version 5.1 install luaposix
+--
+--     # Fedora
+--     sudo dnf install luarocks openssl-devel
+--     sudo luarocks --lua-version 5.1 install luaossl luaposix
+--
+--     # Alpine
+--     sudo apk add luarocks openssl-dev
+--     sudo luarocks-5.1 install luaossl luaposix
+--
+--     # macOS with Homebrew
+--     brew install luarocks openssl
+--     luarocks install luaossl OPENSSL_DIR="$(brew --prefix openssl)"
+--     luarocks install luaposix
+--
+-- Some distributions also package these, for example lua-luaossl and lua-posix
+-- on Debian. If you use a distribution package, make sure it is built for the
+-- same Lua version as cgit.
+--
+-- SECURITY NOTES
+--
+-- The cookie carries only a username with no server-side session store, so
+-- deleting an account does not revoke a cookie already issued until it
+-- expires, and instances that share a secret file accept each other's cookies.
+-- The login form carries no CSRF token. Both are acceptable for gating read
+-- access to a git browser. Weigh them before guarding anything more sensitive.
+
+local sysstat = require("posix.sys.stat")
+local unistd = require("posix.unistd")
+local rand = require("openssl.rand")
+local hmac = require("openssl.hmac")
+
+--
+-- ========================= CONFIGURATION =========================
+-- Edit the values in this block. Nothing below it needs changing for
+-- ordinary use.
+--
+
+-- Accounts, one per line, as username:hash. Generate a hash with
+--     mkpasswd -m sha-512 -R 300000
+-- This file should not be world-readable.
+local users_filename = "/etc/cgit-auth/users"
+
+-- Group membership, one per line, as groupname:user1,user2,user3,...
+local groups_filename = "/etc/cgit-auth/groups"
+
+-- Per-repository access, one per line, as reponame:group1,group2,...
+-- A repository listed here is protected. One not listed is public.
+local repos_filename = "/etc/cgit-auth/repos"
+
+-- Where the cookie-signing secret is stored. It is created on first use. It
+-- must be persistent and writable by cgit. Prefer a path OUTSIDE the cache
+-- root, because pruning the cache would delete a secret kept inside it and
+-- invalidate every live session. This file should not be world-readable.
+local secret_filename = "/var/cache/cgit/auth-secret"
+
+-- How long a login stays valid, in seconds. Default one week.
+local session_seconds = 7 * 24 * 60 * 60
+
+-- Name of the session cookie.
+local cookie_name = "cgitauth"
+
+-- Path the cookie is scoped to. "/" covers the whole host. Set it to the cgit
+-- root to scope the cookie more tightly.
+local cookie_path = "/"
+
+-- Leave false so the cookie is marked Secure and only travels over HTTPS. Set
+-- it true ONLY if cgit is served over plain HTTP with no TLS anywhere, see the
+-- HTTPS note in the header.
+local cookie_insecure = false
+
+--
+-- =================================================================
+--
+
+-- A throwaway hash of the documented shape, used only to spend the same work
+-- on a missing account as on a present one, so a failed login does not reveal
+-- by timing whether the username exists.
+local dummy_hash = "$6$rounds=300000$0000000000000000$"
+
+-- Module state shared across the open, write and close calls of one request.
+local action, http, cgit, post
+
+--
+--
+-- Account and access-list storage. This is the ONLY part that differs from
+-- auth-inline.lua. Swap these two functions to change where accounts live.
+--
+--
+
+local function trim(s)
+	return (string.gsub(s, "^%s*(.-)%s*$", "%1"))
+end
+
+-- Return the stored password hash for a user, or nil. Reads the users file
+-- fresh each call. A missing or unreadable file, and any unparsable line, are
+-- skipped rather than fatal.
+function account_hash(user)
+	if user == nil then
+		return nil
+	end
+	local wanted = user:lower()
+	local f = io.open(users_filename, "r")
+	if f == nil then
+		return nil
+	end
+	for line in f:lines() do
+		local u, h = string.match(line, "(.-):(.+)")
+		if u ~= nil and trim(u):lower() == wanted then
+			f:close()
+			return h
+		end
+	end
+	f:close()
+	return nil
+end
+
+-- Return the set of users allowed to access a repository, keyed by lowercased
+-- username, or nil if the repository is not protected. A protected repository
+-- whose groups resolve to no users returns an EMPTY table, which denies
+-- everyone rather than falling through to public.
+function repo_userset(repo)
+	if repo == nil then
+		return nil
+	end
+	local groups = nil
+	local f = io.open(repos_filename, "r")
+	if f ~= nil then
+		for line in f:lines() do
+			local r, g = string.match(line, "(.-):(.+)")
+			if r ~= nil and trim(r) == repo then
+				groups = {}
+				for group in string.gmatch(g, "([^,]+)") do
+					groups[trim(group):lower()] = true
+				end
+				break
+			end
+		end
+		f:close()
+	end
+	if groups == nil then
+		return nil
+	end
+	local users = {}
+	local gf = io.open(groups_filename, "r")
+	if gf ~= nil then
+		for line in gf:lines() do
+			local g, u = string.match(line, "(.-):(.+)")
+			if g ~= nil and groups[trim(g):lower()] then
+				for user in string.gmatch(u, "([^,]+)") do
+					users[trim(user):lower()] = true
+				end
+			end
+		end
+		gf:close()
+	end
+	return users
+end
+
+--
+--
+-- Utility functions based on keplerproject/wsapi.
+--
+--
+
+function url_decode(str)
+	if not str then
+		return ""
+	end
+	str = string.gsub(str, "+", " ")
+	str = string.gsub(str, "%%(%x%x)", function(h) return string.char(tonumber(h, 16)) end)
+	str = string.gsub(str, "\r\n", "\n")
+	return str
+end
+
+function url_encode(str)
+	if not str then
+		return ""
+	end
+	str = string.gsub(str, "\n", "\r\n")
+	str = string.gsub(str, "([^%w ])", function(c) return string.format("%%%02X", string.byte(c)) end)
+	str = string.gsub(str, " ", "+")
+	return str
+end
+
+-- Parse an application/x-www-form-urlencoded body. A value may itself contain
+-- '=', for example a base64 password, so the value runs to the next '&'.
+function parse_qs(qs)
+	local tab = {}
+	for key, val in string.gmatch(qs or "", "([^&=]+)=([^&]*)") do
+		tab[url_decode(key)] = url_decode(val)
+	end
+	return tab
+end
+
+-- Return the value of the named cookie, or nil. The stored token was already
+-- url-encoded by secure_value, so it is returned verbatim, which keeps the
+-- write path (set_cookie) and the read path symmetric. Decoding it here would
+-- break the signature check for any value carrying a percent escape.
+function get_cookie(cookies, name)
+	cookies = string.gsub(";" .. (cookies or "") .. ";", "%s*;%s*", ";")
+	return string.match(cookies, ";" .. name .. "=(.-);")
+end
+
+function tohex(b)
+	local x = ""
+	for i = 1, #b do
+		x = x .. string.format("%.2x", string.byte(b, i))
+	end
+	return x
+end
+
+--
+--
+-- Cookie construction and validation helpers.
+--
+--
+
+local secret = nil
+
+-- Load the cookie-signing secret, creating it on first use. Failures raise,
+-- which cgit turns into a request error, so a broken secret denies rather than
+-- signs with nothing.
+function get_secret()
+	if secret ~= nil then
+		return secret
+	end
+	local secret_file = io.open(secret_filename, "r")
+	if secret_file == nil then
+		local old_umask = sysstat.umask(63)
+		local temporary_filename = secret_filename .. ".tmp." .. tohex(rand.bytes(16))
+		local temporary_file = io.open(temporary_filename, "w")
+		if temporary_file == nil then
+			sysstat.umask(old_umask)
+			error("cgit auth: cannot create secret file " .. secret_filename)
+		end
+		local wrote = temporary_file:write(tohex(rand.bytes(32)))
+		local closed = temporary_file:close()
+		if not wrote or not closed then
+			os.remove(temporary_filename)
+			sysstat.umask(old_umask)
+			error("cgit auth: failed writing secret file " .. secret_filename)
+		end
+		unistd.link(temporary_filename, secret_filename) -- Intentionally fails if another worker won the race.
+		unistd.unlink(temporary_filename)
+		sysstat.umask(old_umask)
+		secret_file = io.open(secret_filename, "r")
+	end
+	if secret_file == nil then
+		error("cgit auth: cannot read secret file " .. secret_filename)
+	end
+	secret = secret_file:read("*l")
+	secret_file:close()
+	if secret == nil or secret:len() ~= 64 then
+		secret = nil
+		error("cgit auth: secret file " .. secret_filename .. " is malformed, expected 64 hex characters")
+	end
+	return secret
+end
+
+-- A redirect target is unsafe if a browser would read it as another origin.
+-- The only such form cgit can be tricked into signing is a scheme-relative
+-- "//host" or "/\host". Everything else stays on this host.
+function is_safe_redirect(url)
+	if type(url) ~= "string" then
+		return false
+	end
+	local head = url:sub(1, 2)
+	if head == "//" or head == "/\\" then
+		return false
+	end
+	return true
+end
+
+-- Return the value carried by a signed cookie, or nil if it does not verify.
+function validate_value(expected_field, cookie)
+	local i = 0
+	local value = ""
+	local field = ""
+	local expiration = 0
+	local salt = ""
+	local chmac = ""
+
+	if cookie == nil or cookie:len() < 3 or cookie:sub(1, 1) == "|" then
+		return nil
+	end
+
+	for component in string.gmatch(cookie, "[^|]+") do
+		if i == 0 then
+			field = component
+		elseif i == 1 then
+			value = component
+		elseif i == 2 then
+			-- The expiration must be a plain integer. Rejecting other forms
+			-- keeps the signed bytes canonical, since tonumber and tostring of
+			-- "1e9" or "100.0" differ across Lua versions.
+			if not string.match(component, "^%d+$") then
+				return nil
+			end
+			expiration = tonumber(component)
+		elseif i == 3 then
+			salt = component
+		elseif i == 4 then
+			chmac = component
+		else
+			break
+		end
+		i = i + 1
+	end
+
+	if chmac == nil or chmac:len() == 0 then
+		return nil
+	end
+
+	-- Compare the HMAC without short-circuiting on the first mismatch.
+	if not constant_equals(chmac, tohex(hmac.new(get_secret(), "sha256"):final(field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt))) then
+		return nil
+	end
+
+	-- An expiration of 0 never expires and is used for the redirect token.
+	if expiration ~= 0 and expiration <= os.time() then
+		return nil
+	end
+
+	if url_decode(field) ~= expected_field then
+		return nil
+	end
+
+	local decoded = url_decode(value)
+	-- Reject values carrying control characters so a signed value cannot
+	-- smuggle CR or LF into a response header.
+	if decoded:find("%c") then
+		return nil
+	end
+	return decoded
+end
+
+function secure_value(field, value, expiration)
+	if value == nil or value:len() <= 0 then
+		return ""
+	end
+
+	local salt = tohex(rand.bytes(16))
+	value = url_encode(value)
+	field = url_encode(field)
+	local authstr = field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt
+	authstr = authstr .. "|" .. tohex(hmac.new(get_secret(), "sha256"):final(authstr))
+	return authstr
+end
+
+-- Strip control characters that could split an HTTP response header.
+function strip_ctl(s)
+	return (string.gsub(s or "", "%c", ""))
+end
+
+-- Compare two strings in time that does not depend on how many leading bytes
+-- match, so a mismatch position is not revealed by timing.
+function constant_equals(a, b)
+	if type(a) ~= "string" or type(b) ~= "string" or #a ~= #b then
+		return false
+	end
+	local diff = 0
+	for i = 1, #a do
+		local d = a:byte(i) - b:byte(i)
+		diff = diff + d * d
+	end
+	return diff == 0
+end
+
+function set_cookie(cookie, value)
+	local attrs = "; HttpOnly; SameSite=Lax; Path=" .. cookie_path
+	if not cookie_insecure then
+		attrs = attrs .. "; Secure"
+	end
+	if value == "" then
+		attrs = attrs .. "; Max-Age=0"
+	elseif session_seconds > 0 then
+		attrs = attrs .. "; Max-Age=" .. tostring(session_seconds)
+	end
+	html("Set-Cookie: " .. cookie .. "=" .. strip_ctl(value) .. attrs .. "\n")
+end
+
+function redirect_to(url)
+	html("Status: 302 Redirect\n")
+	html("Cache-Control: no-cache, no-store\n")
+	html("Location: " .. strip_ctl(url) .. "\n")
+end
+
+function not_found()
+	html("Status: 404 Not Found\n")
+	html("Cache-Control: no-cache, no-store\n\n")
+end
+
+--
+--
+-- Authentication actions. Identical to auth-inline.lua from here down.
+--
+--
+
+-- Sets HTTP cookie headers based on post and sets up redirection.
+function authenticate_post()
+	local redirect = validate_value("redirect", post["redirect"])
+
+	if redirect == nil or not is_safe_redirect(redirect) then
+		not_found()
+		return 0
+	end
+
+	redirect_to(redirect)
+
+	local username = post["username"]
+	local password = post["password"]
+	local ok = false
+	if username ~= nil and password ~= nil then
+		local hash = account_hash(username)
+		if hash == nil then
+			-- Spend the work anyway, see dummy_hash.
+			unistd.crypt(password, dummy_hash)
+		elseif constant_equals(hash, unistd.crypt(password, hash)) then
+			ok = true
+		end
+	end
+
+	if ok then
+		set_cookie(cookie_name, secure_value("username", username, os.time() + session_seconds))
+	else
+		set_cookie(cookie_name, "")
+	end
+
+	html("\n")
+	return 0
+end
+
+-- Returns 1 if the cookie is valid and 0 if it is not.
+function authenticate_cookie()
+	local accepted_users = repo_userset(cgit["repo"])
+	if accepted_users == nil then
+		-- The repository is not protected.
+		return 1
+	end
+
+	local username = validate_value("username", get_cookie(http["cookie"], cookie_name))
+	if username == nil or not accepted_users[username:lower()] then
+		return 0
+	end
+	return 1
+end
+
+-- Prints the html for the login form.
+function body()
+	local target = cgit["url"]
+	if not is_safe_redirect(target) then
+		target = cgit["login"]
+	end
+
+	html("<h2>Authentication Required</h2>")
+	html("<form method='post' action='")
+	html_attr(cgit["login"])
+	html("'>")
+	html("<input type='hidden' name='redirect' value='")
+	html_attr(secure_value("redirect", target, 0))
+	html("' />")
+	html("<table>")
+	html("<tr><td><label for='username'>Username:</label></td><td><input id='username' name='username' autofocus /></td></tr>")
+	html("<tr><td><label for='password'>Password:</label></td><td><input id='password' name='password' type='password' /></td></tr>")
+	html("<tr><td colspan='2'><input value='Login' type='submit' /></td></tr>")
+	html("</table></form>")
+
+	return 0
+end
+
+--
+--
+-- Wrapper around the filter API, exposing the http, cgit and post tables to
+-- the functions above.
+--
+--
+
+local actions = {}
+actions["authenticate-post"] = authenticate_post
+actions["authenticate-cookie"] = authenticate_cookie
+actions["body"] = body
+
+function filter_open(...)
+	action = actions[select(1, ...)]
+
+	post = {}
+
+	http = {}
+	http["cookie"] = select(2, ...)
+	http["method"] = select(3, ...)
+	http["query"] = select(4, ...)
+	http["referer"] = select(5, ...)
+	http["path"] = select(6, ...)
+	http["host"] = select(7, ...)
+	http["https"] = select(8, ...)
+
+	cgit = {}
+	cgit["repo"] = select(9, ...)
+	cgit["page"] = select(10, ...)
+	cgit["url"] = select(11, ...)
+	cgit["login"] = select(12, ...)
+end
+
+function filter_close()
+	if action == nil then
+		-- Unknown action, deny rather than raise.
+		return 0
+	end
+	return action()
+end
+
+function filter_write(str)
+	post = parse_qs(str)
+end
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
new file mode 100644
index 0000000..168a444
--- /dev/null
+++ b/custom/extensions/auth-inline.lua
@@ -0,0 +1,528 @@
+-- cgit auth-filter that gates repositories behind a login form and a signed
+-- session cookie.
+--
+-- This is the INLINE variant. The user accounts and the per-repository access
+-- lists are written directly in this script, in the two tables in the
+-- CONFIGURATION block below. Edit them here and reload. This suits a small
+-- fixed set of users that rarely changes.
+--
+-- The companion auth-file.lua behaves identically but reads its accounts and
+-- access lists from files on disk instead, which suits larger or externally
+-- managed user sets.
+--
+-- Enable it in cgitrc with
+--     auth-filter=lua:/path/to/auth-inline.lua
+--
+-- SUPPORTED LUA
+--
+-- Lua 5.1, 5.2, 5.3, 5.4 and LuaJIT. Lua 5.5 is not supported, because luaossl
+-- has no 5.5 build. Match the runtime to the Lua that cgit is built against.
+--
+-- HTTPS IS RECOMMENDED
+--
+-- Serve cgit over HTTPS. Terminate TLS at the web server in front of cgit. The
+-- session cookie is marked Secure by default, so a browser only sends it back
+-- over HTTPS. If you genuinely run cgit over plain HTTP with no TLS anywhere,
+-- set cookie_insecure below, otherwise the cookie is never returned and login
+-- appears to loop.
+--
+-- DEPENDENCIES
+--
+--     luaossl    OpenSSL binding, provides openssl.rand and openssl.hmac
+--                <https://github.com/wahern/luaossl>
+--     luaposix   POSIX binding, provides posix.sys.stat and posix.unistd
+--                <https://github.com/luaposix/luaposix>
+--
+-- The reliable cross-platform install is LuaRocks, matched to your Lua
+-- version. luaossl also needs the OpenSSL development headers present.
+--
+--     # Debian and Ubuntu
+--     sudo apt install luarocks libssl-dev
+--     sudo luarocks --lua-version 5.1 install luaossl
+--     sudo luarocks --lua-version 5.1 install luaposix
+--
+--     # Fedora
+--     sudo dnf install luarocks openssl-devel
+--     sudo luarocks --lua-version 5.1 install luaossl luaposix
+--
+--     # Alpine
+--     sudo apk add luarocks openssl-dev
+--     sudo luarocks-5.1 install luaossl luaposix
+--
+--     # macOS with Homebrew
+--     brew install luarocks openssl
+--     luarocks install luaossl OPENSSL_DIR="$(brew --prefix openssl)"
+--     luarocks install luaposix
+--
+-- Some distributions also package these, for example lua-luaossl and lua-posix
+-- on Debian. If you use a distribution package, make sure it is built for the
+-- same Lua version as cgit.
+--
+-- SECURITY NOTES
+--
+-- The cookie carries only a username with no server-side session store, so
+-- deleting an account does not revoke a cookie already issued until it
+-- expires, and instances that share a secret file accept each other's cookies.
+-- The login form carries no CSRF token. Both are acceptable for gating read
+-- access to a git browser. Weigh them before guarding anything more sensitive.
+
+local sysstat = require("posix.sys.stat")
+local unistd = require("posix.unistd")
+local rand = require("openssl.rand")
+local hmac = require("openssl.hmac")
+
+--
+-- ========================= CONFIGURATION =========================
+-- Edit the values in this block. Nothing below it needs changing for
+-- ordinary use.
+--
+
+-- Protected repositories and the users allowed into each. A repository listed
+-- here is protected. One not listed is public. Keys and user names are matched
+-- case-insensitively. REPLACE THE EXAMPLES BELOW, they are commented out so an
+-- unedited copy protects nothing and grants no accounts.
+local protected_repos = {
+	-- ["secret-repo"] = { alice = true, bob = true },
+	-- ["another"]     = { alice = true },
+}
+
+-- Accounts as name = hash. Generate a hash with
+--     mkpasswd -m sha-512 -R 300000
+-- REPLACE THE EXAMPLES BELOW. The commented lines are not real credentials and
+-- must not be deployed as-is.
+local users = {
+	-- alice = "$6$rounds=300000$REPLACE_THIS_SALT$REPLACE_THIS_HASH",
+	-- bob   = "$6$rounds=300000$REPLACE_THIS_SALT$REPLACE_THIS_HASH",
+}
+
+-- Where the cookie-signing secret is stored. It is created on first use. It
+-- must be persistent and writable by cgit. Prefer a path OUTSIDE the cache
+-- root, because pruning the cache would delete a secret kept inside it and
+-- invalidate every live session. This file should not be world-readable.
+local secret_filename = "/var/cache/cgit/auth-secret"
+
+-- How long a login stays valid, in seconds. Default one week.
+local session_seconds = 7 * 24 * 60 * 60
+
+-- Name of the session cookie.
+local cookie_name = "cgitauth"
+
+-- Path the cookie is scoped to. "/" covers the whole host. Set it to the cgit
+-- root to scope the cookie more tightly.
+local cookie_path = "/"
+
+-- Leave false so the cookie is marked Secure and only travels over HTTPS. Set
+-- it true ONLY if cgit is served over plain HTTP with no TLS anywhere, see the
+-- HTTPS note in the header.
+local cookie_insecure = false
+
+--
+-- =================================================================
+--
+
+-- A throwaway hash of the documented shape, used only to spend the same work
+-- on a missing account as on a present one, so a failed login does not reveal
+-- by timing whether the username exists.
+local dummy_hash = "$6$rounds=300000$0000000000000000$"
+
+-- Module state shared across the open, write and close calls of one request.
+local action, http, cgit, post
+
+--
+--
+-- Account and access-list storage. This is the ONLY part that differs from
+-- auth-file.lua. Swap these two functions to change where accounts live.
+--
+--
+
+-- Fold the configured tables to lowercased user names once, so lookups match
+-- case-insensitively the same way auth-file.lua does. Repository names keep
+-- their case.
+do
+	local folded = {}
+	for name, hash in pairs(users) do
+		folded[tostring(name):lower()] = hash
+	end
+	users = folded
+	for repo, set in pairs(protected_repos) do
+		local fs = {}
+		for name, allowed in pairs(set) do
+			fs[tostring(name):lower()] = allowed
+		end
+		protected_repos[repo] = fs
+	end
+end
+
+-- Return the stored password hash for a user, or nil.
+function account_hash(user)
+	if user == nil then
+		return nil
+	end
+	return users[user:lower()]
+end
+
+-- Return the set of users allowed to access a repository, keyed by lowercased
+-- user name, or nil if the repository is not protected.
+function repo_userset(repo)
+	if repo == nil then
+		return nil
+	end
+	return protected_repos[repo]
+end
+
+--
+--
+-- Utility functions based on keplerproject/wsapi.
+--
+--
+
+function url_decode(str)
+	if not str then
+		return ""
+	end
+	str = string.gsub(str, "+", " ")
+	str = string.gsub(str, "%%(%x%x)", function(h) return string.char(tonumber(h, 16)) end)
+	str = string.gsub(str, "\r\n", "\n")
+	return str
+end
+
+function url_encode(str)
+	if not str then
+		return ""
+	end
+	str = string.gsub(str, "\n", "\r\n")
+	str = string.gsub(str, "([^%w ])", function(c) return string.format("%%%02X", string.byte(c)) end)
+	str = string.gsub(str, " ", "+")
+	return str
+end
+
+-- Parse an application/x-www-form-urlencoded body. A value may itself contain
+-- '=', for example a base64 password, so the value runs to the next '&'.
+function parse_qs(qs)
+	local tab = {}
+	for key, val in string.gmatch(qs or "", "([^&=]+)=([^&]*)") do
+		tab[url_decode(key)] = url_decode(val)
+	end
+	return tab
+end
+
+-- Return the value of the named cookie, or nil. The stored token was already
+-- url-encoded by secure_value, so it is returned verbatim, which keeps the
+-- write path (set_cookie) and the read path symmetric. Decoding it here would
+-- break the signature check for any value carrying a percent escape.
+function get_cookie(cookies, name)
+	cookies = string.gsub(";" .. (cookies or "") .. ";", "%s*;%s*", ";")
+	return string.match(cookies, ";" .. name .. "=(.-);")
+end
+
+function tohex(b)
+	local x = ""
+	for i = 1, #b do
+		x = x .. string.format("%.2x", string.byte(b, i))
+	end
+	return x
+end
+
+--
+--
+-- Cookie construction and validation helpers.
+--
+--
+
+local secret = nil
+
+-- Load the cookie-signing secret, creating it on first use. Failures raise,
+-- which cgit turns into a request error, so a broken secret denies rather than
+-- signs with nothing.
+function get_secret()
+	if secret ~= nil then
+		return secret
+	end
+	local secret_file = io.open(secret_filename, "r")
+	if secret_file == nil then
+		local old_umask = sysstat.umask(63)
+		local temporary_filename = secret_filename .. ".tmp." .. tohex(rand.bytes(16))
+		local temporary_file = io.open(temporary_filename, "w")
+		if temporary_file == nil then
+			sysstat.umask(old_umask)
+			error("cgit auth: cannot create secret file " .. secret_filename)
+		end
+		local wrote = temporary_file:write(tohex(rand.bytes(32)))
+		local closed = temporary_file:close()
+		if not wrote or not closed then
+			os.remove(temporary_filename)
+			sysstat.umask(old_umask)
+			error("cgit auth: failed writing secret file " .. secret_filename)
+		end
+		unistd.link(temporary_filename, secret_filename) -- Intentionally fails if another worker won the race.
+		unistd.unlink(temporary_filename)
+		sysstat.umask(old_umask)
+		secret_file = io.open(secret_filename, "r")
+	end
+	if secret_file == nil then
+		error("cgit auth: cannot read secret file " .. secret_filename)
+	end
+	secret = secret_file:read("*l")
+	secret_file:close()
+	if secret == nil or secret:len() ~= 64 then
+		secret = nil
+		error("cgit auth: secret file " .. secret_filename .. " is malformed, expected 64 hex characters")
+	end
+	return secret
+end
+
+-- A redirect target is unsafe if a browser would read it as another origin.
+-- The only such form cgit can be tricked into signing is a scheme-relative
+-- "//host" or "/\host". Everything else stays on this host.
+function is_safe_redirect(url)
+	if type(url) ~= "string" then
+		return false
+	end
+	local head = url:sub(1, 2)
+	if head == "//" or head == "/\\" then
+		return false
+	end
+	return true
+end
+
+-- Return the value carried by a signed cookie, or nil if it does not verify.
+function validate_value(expected_field, cookie)
+	local i = 0
+	local value = ""
+	local field = ""
+	local expiration = 0
+	local salt = ""
+	local chmac = ""
+
+	if cookie == nil or cookie:len() < 3 or cookie:sub(1, 1) == "|" then
+		return nil
+	end
+
+	for component in string.gmatch(cookie, "[^|]+") do
+		if i == 0 then
+			field = component
+		elseif i == 1 then
+			value = component
+		elseif i == 2 then
+			-- The expiration must be a plain integer. Rejecting other forms
+			-- keeps the signed bytes canonical, since tonumber and tostring of
+			-- "1e9" or "100.0" differ across Lua versions.
+			if not string.match(component, "^%d+$") then
+				return nil
+			end
+			expiration = tonumber(component)
+		elseif i == 3 then
+			salt = component
+		elseif i == 4 then
+			chmac = component
+		else
+			break
+		end
+		i = i + 1
+	end
+
+	if chmac == nil or chmac:len() == 0 then
+		return nil
+	end
+
+	-- Compare the HMAC without short-circuiting on the first mismatch.
+	if not constant_equals(chmac, tohex(hmac.new(get_secret(), "sha256"):final(field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt))) then
+		return nil
+	end
+
+	-- An expiration of 0 never expires and is used for the redirect token.
+	if expiration ~= 0 and expiration <= os.time() then
+		return nil
+	end
+
+	if url_decode(field) ~= expected_field then
+		return nil
+	end
+
+	local decoded = url_decode(value)
+	-- Reject values carrying control characters so a signed value cannot
+	-- smuggle CR or LF into a response header.
+	if decoded:find("%c") then
+		return nil
+	end
+	return decoded
+end
+
+function secure_value(field, value, expiration)
+	if value == nil or value:len() <= 0 then
+		return ""
+	end
+
+	local salt = tohex(rand.bytes(16))
+	value = url_encode(value)
+	field = url_encode(field)
+	local authstr = field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt
+	authstr = authstr .. "|" .. tohex(hmac.new(get_secret(), "sha256"):final(authstr))
+	return authstr
+end
+
+-- Strip control characters that could split an HTTP response header.
+function strip_ctl(s)
+	return (string.gsub(s or "", "%c", ""))
+end
+
+-- Compare two strings in time that does not depend on how many leading bytes
+-- match, so a mismatch position is not revealed by timing.
+function constant_equals(a, b)
+	if type(a) ~= "string" or type(b) ~= "string" or #a ~= #b then
+		return false
+	end
+	local diff = 0
+	for i = 1, #a do
+		local d = a:byte(i) - b:byte(i)
+		diff = diff + d * d
+	end
+	return diff == 0
+end
+
+function set_cookie(cookie, value)
+	local attrs = "; HttpOnly; SameSite=Lax; Path=" .. cookie_path
+	if not cookie_insecure then
+		attrs = attrs .. "; Secure"
+	end
+	if value == "" then
+		attrs = attrs .. "; Max-Age=0"
+	elseif session_seconds > 0 then
+		attrs = attrs .. "; Max-Age=" .. tostring(session_seconds)
+	end
+	html("Set-Cookie: " .. cookie .. "=" .. strip_ctl(value) .. attrs .. "\n")
+end
+
+function redirect_to(url)
+	html("Status: 302 Redirect\n")
+	html("Cache-Control: no-cache, no-store\n")
+	html("Location: " .. strip_ctl(url) .. "\n")
+end
+
+function not_found()
+	html("Status: 404 Not Found\n")
+	html("Cache-Control: no-cache, no-store\n\n")
+end
+
+--
+--
+-- Authentication actions. Identical to auth-inline.lua from here down.
+--
+--
+
+-- Sets HTTP cookie headers based on post and sets up redirection.
+function authenticate_post()
+	local redirect = validate_value("redirect", post["redirect"])
+
+	if redirect == nil or not is_safe_redirect(redirect) then
+		not_found()
+		return 0
+	end
+
+	redirect_to(redirect)
+
+	local username = post["username"]
+	local password = post["password"]
+	local ok = false
+	if username ~= nil and password ~= nil then
+		local hash = account_hash(username)
+		if hash == nil then
+			-- Spend the work anyway, see dummy_hash.
+			unistd.crypt(password, dummy_hash)
+		elseif constant_equals(hash, unistd.crypt(password, hash)) then
+			ok = true
+		end
+	end
+
+	if ok then
+		set_cookie(cookie_name, secure_value("username", username, os.time() + session_seconds))
+	else
+		set_cookie(cookie_name, "")
+	end
+
+	html("\n")
+	return 0
+end
+
+-- Returns 1 if the cookie is valid and 0 if it is not.
+function authenticate_cookie()
+	local accepted_users = repo_userset(cgit["repo"])
+	if accepted_users == nil then
+		-- The repository is not protected.
+		return 1
+	end
+
+	local username = validate_value("username", get_cookie(http["cookie"], cookie_name))
+	if username == nil or not accepted_users[username:lower()] then
+		return 0
+	end
+	return 1
+end
+
+-- Prints the html for the login form.
+function body()
+	local target = cgit["url"]
+	if not is_safe_redirect(target) then
+		target = cgit["login"]
+	end
+
+	html("<h2>Authentication Required</h2>")
+	html("<form method='post' action='")
+	html_attr(cgit["login"])
+	html("'>")
+	html("<input type='hidden' name='redirect' value='")
+	html_attr(secure_value("redirect", target, 0))
+	html("' />")
+	html("<table>")
+	html("<tr><td><label for='username'>Username:</label></td><td><input id='username' name='username' autofocus /></td></tr>")
+	html("<tr><td><label for='password'>Password:</label></td><td><input id='password' name='password' type='password' /></td></tr>")
+	html("<tr><td colspan='2'><input value='Login' type='submit' /></td></tr>")
+	html("</table></form>")
+
+	return 0
+end
+
+--
+--
+-- Wrapper around the filter API, exposing the http, cgit and post tables to
+-- the functions above.
+--
+--
+
+local actions = {}
+actions["authenticate-post"] = authenticate_post
+actions["authenticate-cookie"] = authenticate_cookie
+actions["body"] = body
+
+function filter_open(...)
+	action = actions[select(1, ...)]
+
+	post = {}
+
+	http = {}
+	http["cookie"] = select(2, ...)
+	http["method"] = select(3, ...)
+	http["query"] = select(4, ...)
+	http["referer"] = select(5, ...)
+	http["path"] = select(6, ...)
+	http["host"] = select(7, ...)
+	http["https"] = select(8, ...)
+
+	cgit = {}
+	cgit["repo"] = select(9, ...)
+	cgit["page"] = select(10, ...)
+	cgit["url"] = select(11, ...)
+	cgit["login"] = select(12, ...)
+end
+
+function filter_close()
+	if action == nil then
+		-- Unknown action, deny rather than raise.
+		return 0
+	end
+	return action()
+end
+
+function filter_write(str)
+	post = parse_qs(str)
+end
diff --git a/custom/extensions/email-gravatar.lua b/custom/extensions/email-gravatar.lua
new file mode 100644
index 0000000..47c359e
--- /dev/null
+++ b/custom/extensions/email-gravatar.lua
@@ -0,0 +1,115 @@
+-- cgit email-filter that shows a Gravatar icon next to author names. Use it
+-- with the email-filter or repo.email-filter setting and the lua: prefix.
+--
+--     email-filter=lua:/path/to/email-gravatar.lua
+--
+-- SUPPORTED LUA
+--
+-- Lua 5.1, 5.2, 5.3, 5.4 and LuaJIT. Lua 5.5 is not supported, because luaossl
+-- has no 5.5 build.
+--
+-- DEPENDENCY
+--
+--     luaossl    OpenSSL binding, provides openssl.digest
+--                <https://github.com/wahern/luaossl>
+--
+--     # Debian and Ubuntu
+--     sudo apt install luarocks libssl-dev
+--     sudo luarocks --lua-version 5.1 install luaossl
+--
+--     # Fedora
+--     sudo dnf install luarocks openssl-devel
+--     sudo luarocks --lua-version 5.1 install luaossl
+--
+--     # macOS with Homebrew
+--     brew install luarocks openssl
+--     luarocks install luaossl OPENSSL_DIR="$(brew --prefix openssl)"
+--
+-- PRIVACY
+--
+-- Every page view sends the visitor's IP address and a hash of each
+-- committer's email to a third-party service. Leave this filter off if that is
+-- not acceptable for your instance.
+--
+-- Addresses are hashed with MD5, which Gravatar still accepts. Gravatar also
+-- supports SHA-256 now, change the digest in hash_hex if you prefer it.
+
+local digest = require("openssl.digest")
+
+--
+-- ===== CONFIGURATION =====
+--
+
+-- Pixel size of the avatar.
+local avatar_size = 13
+
+-- Fallback style for an address with no avatar. See the Gravatar docs for the
+-- choices, for example retro, identicon, monsterid or mp.
+local default_image = "retro"
+
+-- Avatar endpoint. Kept https so the image is not blocked as mixed content on
+-- an https page.
+local base_url = "https://www.gravatar.com/avatar/"
+
+-- Text for the image alt attribute.
+local alt_text = "Gravatar"
+
+--
+-- =========================
+--
+
+-- State shared across the open, write and close calls of one invocation.
+local buffer = ""
+local avatar = nil
+
+local function hash_hex(input)
+	local b = digest.new("md5"):final(input)
+	local x = ""
+	for i = 1, #b do
+		x = x .. string.format("%.2x", string.byte(b, i))
+	end
+	return x
+end
+
+-- Take the address, strip the angle brackets if present, then trim and
+-- lowercase as the avatar services expect. Returns nil for a missing or empty
+-- address.
+local function normalize_email(email)
+	if email == nil then
+		return nil
+	end
+	local inner = email:match("<(.*)>")
+	if inner ~= nil then
+		email = inner
+	end
+	email = (email:gsub("^%s*(.-)%s*$", "%1")):lower()
+	if email == "" then
+		return nil
+	end
+	return email
+end
+
+function filter_open(email, page)
+	buffer = ""
+	local addr = normalize_email(email)
+	if addr == nil then
+		avatar = nil
+	else
+		avatar = hash_hex(addr)
+	end
+end
+
+function filter_close()
+	if avatar == nil then
+		-- No usable address, render the name without an icon.
+		html(buffer)
+	else
+		html("<img src='" .. base_url .. avatar .. "?s=" .. avatar_size .. "&amp;d=" .. default_image ..
+			"' width='" .. avatar_size .. "' height='" .. avatar_size .. "' alt='" .. alt_text .. "' /> " .. buffer)
+	end
+	return 0
+end
+
+function filter_write(str)
+	buffer = buffer .. str
+end
diff --git a/custom/extensions/email-libravatar.lua b/custom/extensions/email-libravatar.lua
new file mode 100644
index 0000000..812bef5
--- /dev/null
+++ b/custom/extensions/email-libravatar.lua
@@ -0,0 +1,114 @@
+-- cgit email-filter that shows a Libravatar icon next to author names. Use it
+-- with the email-filter or repo.email-filter setting and the lua: prefix.
+--
+--     email-filter=lua:/path/to/email-libravatar.lua
+--
+-- SUPPORTED LUA
+--
+-- Lua 5.1, 5.2, 5.3, 5.4 and LuaJIT. Lua 5.5 is not supported, because luaossl
+-- has no 5.5 build.
+--
+-- DEPENDENCY
+--
+--     luaossl    OpenSSL binding, provides openssl.digest
+--                <https://github.com/wahern/luaossl>
+--
+--     # Debian and Ubuntu
+--     sudo apt install luarocks libssl-dev
+--     sudo luarocks --lua-version 5.1 install luaossl
+--
+--     # Fedora
+--     sudo dnf install luarocks openssl-devel
+--     sudo luarocks --lua-version 5.1 install luaossl
+--
+--     # macOS with Homebrew
+--     brew install luarocks openssl
+--     luarocks install luaossl OPENSSL_DIR="$(brew --prefix openssl)"
+--
+-- PRIVACY
+--
+-- Every page view sends the visitor's IP address and a hash of each
+-- committer's email to a third-party service. Leave this filter off if that is
+-- not acceptable for your instance.
+--
+-- The secure CDN is always used, so the icon loads over https and is never
+-- blocked as mixed content. Addresses are hashed with MD5.
+
+local digest = require("openssl.digest")
+
+--
+-- ===== CONFIGURATION =====
+--
+
+-- Pixel size of the avatar.
+local avatar_size = 13
+
+-- Fallback style for an address with no avatar. See the Libravatar docs for
+-- the choices, for example retro, identicon, monsterid or mm.
+local default_image = "retro"
+
+-- Avatar endpoint. The secure CDN is used so the image loads over https.
+local base_url = "https://seccdn.libravatar.org/avatar/"
+
+-- Text for the image alt attribute.
+local alt_text = "Libravatar"
+
+--
+-- =========================
+--
+
+-- State shared across the open, write and close calls of one invocation.
+local buffer = ""
+local avatar = nil
+
+local function hash_hex(input)
+	local b = digest.new("md5"):final(input)
+	local x = ""
+	for i = 1, #b do
+		x = x .. string.format("%.2x", string.byte(b, i))
+	end
+	return x
+end
+
+-- Take the address, strip the angle brackets if present, then trim and
+-- lowercase as the avatar services expect. Returns nil for a missing or empty
+-- address.
+local function normalize_email(email)
+	if email == nil then
+		return nil
+	end
+	local inner = email:match("<(.*)>")
+	if inner ~= nil then
+		email = inner
+	end
+	email = (email:gsub("^%s*(.-)%s*$", "%1")):lower()
+	if email == "" then
+		return nil
+	end
+	return email
+end
+
+function filter_open(email, page)
+	buffer = ""
+	local addr = normalize_email(email)
+	if addr == nil then
+		avatar = nil
+	else
+		avatar = hash_hex(addr)
+	end
+end
+
+function filter_close()
+	if avatar == nil then
+		-- No usable address, render the name without an icon.
+		html(buffer)
+	else
+		html("<img src='" .. base_url .. avatar .. "?s=" .. avatar_size .. "&amp;d=" .. default_image ..
+			"' width='" .. avatar_size .. "' height='" .. avatar_size .. "' alt='" .. alt_text .. "' /> " .. buffer)
+	end
+	return 0
+end
+
+function filter_write(str)
+	buffer = buffer .. str
+end
diff --git a/custom/extensions/link-commits.lua b/custom/extensions/link-commits.lua
new file mode 100644
index 0000000..e7b17cc
--- /dev/null
+++ b/custom/extensions/link-commits.lua
@@ -0,0 +1,153 @@
+-- cgit commit-filter that turns git object names and configurable text
+-- references in commit messages into links. Use it with the commit-filter or
+-- repo.commit-filter setting and the lua: prefix.
+--
+--     commit-filter=lua:/path/to/link-commits.lua
+--
+-- cgit hands the filter the message already HTML-escaped, so this only wraps
+-- matches in anchors. No external dependencies. Runs on Lua 5.1 through 5.4
+-- and LuaJIT.
+--
+-- Two kinds of thing are linked, object names (runs of hex that look like git
+-- hashes) and any number of text-reference rules you define, each a pattern
+-- and a URL. Both are configured in the block below. All matches are resolved
+-- in a single left-to-right pass, so nothing is ever linked twice.
+
+--
+-- ===== CONFIGURATION =====
+--
+
+-- Object names (git hashes). Handled specially, because the length rule cannot
+-- be written as a plain Lua pattern.
+--
+-- Recognition is by shape, since a commit-filter cannot ask the repository
+-- whether a hash is real. Any hex run within the length bounds is linked,
+-- whatever mix of digits and letters it has, so abbreviated and all-digit
+-- hashes are both caught. The cost is that a long hex-looking number can now
+-- and then link to an object that does not exist, which cgit renders as a
+-- harmless "bad object name" page. Shape matching is inherently approximate,
+-- the length bounds are the only filter.
+local objects = {
+	-- Set false to stop linking bare hashes.
+	enabled = true,
+	-- A hex run within these lengths is linked. Git abbreviations run about 7
+	-- to 12 characters, full names are 40 (sha1) or 64 (sha256).
+	min_length = 7,
+	max_length = 64,
+	-- Link target, %s is replaced with the matched hash. "./?id=%s" is relative
+	-- to the current page and works for the common virtual-root layout.
+	url = "./?id=%s",
+}
+
+-- Text-reference rules. Each rule is a Lua pattern with ONE capture and a URL
+-- where %s is replaced by that capture, percent-encoded. The whole match is
+-- shown, the capture is what goes in the URL. Rules are tried in order and the
+-- leftmost match on the line wins, so put more specific patterns first. Leave
+-- the list empty to link only object names.
+--
+-- Lua patterns are not regular expressions. There is no alternation and no
+-- {n,m} repetition. %d is a digit, %a a letter, %w a letter or digit, %x a hex
+-- digit, and a literal magic character is escaped with %, so a literal '-' is
+-- '%-'. Reference: https://www.lua.org/manual/5.1/manual.html#5.4.1
+local rules = {
+	{ pattern = "#(%d+)", url = "https://bugs.example.com/?bug=%s" },
+	-- { pattern = "CVE%-(%d%d%d%d%-%d+)", url = "https://www.cve.org/CVERecord?id=CVE-%s" },
+	-- { pattern = "!(%d+)",               url = "https://gitlab.example.com/group/repo/-/merge_requests/%s" },
+	-- { pattern = "RFC%s?(%d+)",          url = "https://www.rfc-editor.org/rfc/rfc%s" },
+}
+
+--
+-- =========================
+--
+
+local chunks = {}
+
+-- Percent-encode everything but the URL-unreserved characters, so a captured
+-- value cannot break out of the href attribute or the URL.
+local function url_encode(s)
+	return (string.gsub(s, "[^%w._~-]", function(c)
+		return string.format("%%%02X", string.byte(c))
+	end))
+end
+
+-- Build one anchor. url_template has %s where the encoded capture goes, display
+-- is the text shown. A function replacement is used so a '%' in the encoded
+-- value is not treated as a gsub reference.
+local function make_link(url_template, capture, display)
+	local encoded = url_encode(capture)
+	local href = string.gsub(url_template, "%%s", function() return encoded end)
+	return '<a href="' .. href .. '">' .. display .. '</a>'
+end
+
+-- Collect every candidate match as {s, e, pri, link}. A lower pri wins a tie on
+-- the same start position.
+local function collect(text)
+	local cands = {}
+	for pri, rule in ipairs(rules) do
+		-- A malformed pattern is an operator error, skip that rule rather than
+		-- failing the whole page.
+		pcall(function()
+			local init = 1
+			while init <= #text do
+				local s, e, cap = string.find(text, rule.pattern, init)
+				if not s then break end
+				if cap == nil then
+					cap = string.sub(text, s, e)
+				end
+				cands[#cands + 1] = {
+					s = s, e = e, pri = pri,
+					link = make_link(rule.url, cap, string.sub(text, s, e)),
+				}
+				init = (e >= s) and e + 1 or s + 1
+			end
+		end)
+	end
+	if objects.enabled then
+		local objpri = #rules + 1
+		local init = 1
+		while init <= #text do
+			local s, e, run = string.find(text, "%f[%w](%x+)%f[%W]", init)
+			if not s then break end
+			if #run >= objects.min_length and #run <= objects.max_length then
+				cands[#cands + 1] = {
+					s = s, e = e, pri = objpri,
+					link = make_link(objects.url, run, run),
+				}
+			end
+			init = e + 1
+		end
+	end
+	return cands
+end
+
+function filter_open(...)
+	chunks = {}
+end
+
+function filter_write(str)
+	chunks[#chunks + 1] = str
+end
+
+function filter_close()
+	local text = table.concat(chunks)
+	local cands = collect(text)
+	table.sort(cands, function(a, b)
+		if a.s ~= b.s then
+			return a.s < b.s
+		end
+		return a.pri < b.pri
+	end)
+	local out = {}
+	local i = 1
+	for _, c in ipairs(cands) do
+		-- Skip a candidate that overlaps one already emitted.
+		if c.s >= i then
+			out[#out + 1] = string.sub(text, i, c.s - 1)
+			out[#out + 1] = c.link
+			i = c.e + 1
+		end
+	end
+	out[#out + 1] = string.sub(text, i)
+	html(table.concat(out))
+	return 0
+end
diff --git a/custom/extensions/syntax-highlight.lua b/custom/extensions/syntax-highlight.lua
new file mode 100644
index 0000000..8310504
--- /dev/null
+++ b/custom/extensions/syntax-highlight.lua
@@ -0,0 +1,278 @@
+-- Server-side syntax highlighting for the tree and blob views, used with the
+-- source-filter setting in cgitrc and the lua: prefix so it runs in cgit's
+-- embedded interpreter with no per-request process.
+--
+--     source-filter=lua:/usr/lib/cgit/extensions/syntax-highlight.lua
+--
+-- Highlighting is deliberately not built into cgit itself. Without this filter
+-- cgit serves plain escaped text, and any other program can take its place.
+--
+-- SUPPORTED LUA
+--
+-- Lua 5.1 through 5.4 and LuaJIT. The Scintillua version matters too. Recent
+-- Scintillua (6.x) needs Lua 5.3 or newer to load its lexers, older Scintillua
+-- releases still load under 5.1 and 5.2. Pick a Scintillua release that matches
+-- the Lua cgit is built against.
+--
+-- REQUIREMENTS
+--
+-- Two pieces, and BOTH must be installed. When either is missing the filter
+-- serves plain escaped text by design, so uncolored code means a missing
+-- dependency, not an error.
+--
+-- 1. lpeg, the parsing module, for the Lua cgit is linked against. Scintillua
+--    does NOT bundle it, it must come from the system, and forgetting it is the
+--    usual reason nothing happens.
+--
+--        # Debian and Ubuntu
+--        sudo apt install lua-lpeg
+--        # Fedora
+--        sudo dnf install lua-lpeg
+--        # Alpine
+--        sudo apk add lua5.1-lpeg
+--        # or with LuaRocks, matched to your Lua version
+--        sudo luarocks --lua-version 5.1 install lpeg
+--
+-- 2. Scintillua, the lexer collection from the Textadept editor. Roughly 120
+--    languages as plain .lua files, nothing to compile. Download a release and
+--    unpack it anywhere.
+--
+--        https://orbitalquark.github.io/scintillua/
+--
+-- The lexers are found by probing, in order
+--
+--     $CGIT_SCINTILLUA_PATH        (used alone when set, no fallback)
+--     <dir of $CGIT_CONFIG>/scintillua/lexers
+--     the scintillua_dirs list in the CONFIGURATION block below
+--
+-- so either set the variable in the web server environment, or place (or
+-- symlink) the scintillua directory next to your cgitrc.
+--
+-- SECURITY
+--
+-- Every probed directory is placed on package.path and its Lua is executed in
+-- cgit's process. Make sure none of them is writable by other users, or someone
+-- who can write there gains code execution as the web server. On macOS in
+-- particular, /opt/homebrew/share is group-writable by default.
+--
+-- LIMITATIONS
+--
+-- cgit sends the filter output through a C string sink that stops at the first
+-- NUL byte, so a blob containing a NUL is truncated there. This affects binary
+-- files that slip past cgit's text detection, not ordinary source.
+--
+-- OUTPUT
+--
+-- Tokens are wrapped in <span> elements carrying the hl- classes that
+-- assets/cgit.css styles. Every input byte up to the first NUL is preserved, so
+-- the line number gutter stays aligned.
+
+--
+-- ===== CONFIGURATION =====
+--
+
+-- Files larger than this many bytes are served escaped but unhighlighted, so a
+-- huge blob does not cost a lexing pass. Kept well below cgit's max-blob-size.
+local max_bytes = 512 * 1024
+
+-- Environment variable that, when set, points straight at the Scintillua
+-- lexers directory and is used alone.
+local scintillua_env = "CGIT_SCINTILLUA_PATH"
+
+-- Directories probed for the lexers when that variable is not set. The
+-- directory of $CGIT_CONFIG, when set, is tried ahead of these. Keep every one
+-- of these unwritable by others, see the SECURITY note above.
+local scintillua_dirs = {
+	"/usr/local/share/scintillua/lexers",
+	"/usr/share/scintillua/lexers",
+	"/opt/homebrew/share/scintillua/lexers",
+}
+
+-- Scintillua tag name (its first dotted component) to a cgit css class. Only
+-- the six classes below exist in assets/cgit.css. Add a class there and a row
+-- here to style more token kinds. Tokens with no row render as plain text,
+-- which is what most themes want for operators and identifiers.
+local css = {
+	comment      = "hl-comment",
+	string       = "hl-string",
+	regex        = "hl-string",
+	number       = "hl-number",
+	constant     = "hl-number",
+	keyword      = "hl-keyword",
+	preprocessor = "hl-keyword",
+	tag          = "hl-keyword",
+	label        = "hl-keyword",
+	annotation   = "hl-keyword",
+	type         = "hl-type",
+	class        = "hl-type",
+	attribute    = "hl-type",
+	["function"] = "hl-func",
+}
+
+-- Extension to lexer-name fixes for the fallback path, used only when this
+-- Scintillua has no detect(). Most extensions already equal their lexer name,
+-- these are the frequent exceptions. A wrong guess just falls back to plain
+-- text, so there is no harm in listing best-effort entries.
+local ext_lexer = {
+	py = "python", js = "javascript", ts = "typescript",
+	rb = "ruby", pl = "perl", pm = "perl", sh = "bash",
+	md = "markdown", htm = "html", yml = "yaml",
+	rs = "rust", c = "ansi_c", h = "ansi_c",
+}
+
+--
+-- =========================
+--
+
+local lexer_mod = nil
+local filename = ""
+local chunks = {}
+
+local escape_map = { ["&"] = "&amp;", ["<"] = "&lt;", [">"] = "&gt;" }
+
+-- Escape the three HTML metacharacters in a single pass.
+local function escape(s)
+	return (string.gsub(s, "[&<>]", escape_map))
+end
+
+local function scintillua_path()
+	local env = os.getenv(scintillua_env)
+	if env then
+		return env
+	end
+	local candidates = {}
+	local config = os.getenv("CGIT_CONFIG")
+	if config then
+		local dir = string.match(config, "^(.*)/[^/]+$")
+		if dir then
+			candidates[#candidates + 1] = dir .. "/scintillua/lexers"
+		end
+	end
+	for _, d in ipairs(scintillua_dirs) do
+		candidates[#candidates + 1] = d
+	end
+	for _, dir in ipairs(candidates) do
+		local f = io.open(dir .. "/lexer.lua", "r")
+		if f then
+			f:close()
+			return dir
+		end
+	end
+	return nil
+end
+
+local function load_scintillua()
+	local dir = scintillua_path()
+	if not dir then
+		return nil
+	end
+	if not string.find(package.path, dir, 1, true) then
+		package.path = dir .. "/?.lua;" .. package.path
+	end
+	local ok, mod = pcall(require, "lexer")
+	-- A real Scintillua exposes load(). Anything else on the path that happens
+	-- to be called lexer is not usable.
+	if ok and type(mod) == "table" and type(mod.load) == "function" then
+		return mod
+	end
+	return nil
+end
+
+local function load_lexer_name(name)
+	if name == nil then
+		return nil
+	end
+	local ok, lex = pcall(lexer_mod.load, name)
+	if ok and lex then
+		return lex
+	end
+	return nil
+end
+
+-- Resolve a lexer for the file, preferring Scintillua's own filename detection
+-- when this version provides it, then an extension map, then the raw extension.
+local function lexer_for(name)
+	if type(lexer_mod.detect) == "function" then
+		local ok, lang = pcall(lexer_mod.detect, name)
+		if ok and lang then
+			local lex = load_lexer_name(lang)
+			if lex then
+				return lex
+			end
+		end
+	end
+	local ext = string.match(name, "%.([^.]+)$")
+	if not ext then
+		return nil
+	end
+	ext = string.lower(ext)
+	return load_lexer_name(ext_lexer[ext]) or load_lexer_name(ext)
+end
+
+local function highlight(text)
+	local lex = lexer_for(filename)
+	if not lex then
+		return nil
+	end
+	local ok, tokens = pcall(lex.lex, lex, text)
+	if not ok or type(tokens) ~= "table" then
+		return nil
+	end
+	local out = {}
+	local pos = 1
+	for i = 1, #tokens, 2 do
+		local tag = tokens[i]
+		local fin = tokens[i + 1]
+		local part = escape(string.sub(text, pos, fin - 1))
+		local class = css[string.match(tag, "^[%w_]+")]
+		if class and part ~= "" then
+			part = "<span class='" .. class .. "'>" .. part .. "</span>"
+		end
+		out[#out + 1] = part
+		pos = fin
+	end
+	-- Anything the lexer left unconsumed is kept, escaped.
+	if pos <= #text then
+		out[#out + 1] = escape(string.sub(text, pos))
+	end
+	return table.concat(out)
+end
+
+function filter_open(name)
+	filename = name or ""
+	chunks = {}
+end
+
+function filter_write(str)
+	chunks[#chunks + 1] = str
+end
+
+function filter_close()
+	local text = table.concat(chunks)
+	chunks = {}
+	if #text <= max_bytes then
+		if lexer_mod == nil then
+			lexer_mod = load_scintillua() or false
+		end
+		if lexer_mod then
+			local ok, marked = pcall(highlight, text)
+			if ok and marked then
+				html(marked)
+				return 0
+			end
+		end
+	end
+	-- Fallback, escaped plain text emitted in slices so a large blob does not
+	-- cost a full-size second copy all at once.
+	local n = #text
+	if n == 0 then
+		html("")
+		return 0
+	end
+	local pos = 1
+	while pos <= n do
+		html(escape(string.sub(text, pos, pos + 65535)))
+		pos = pos + 65536
+	end
+	return 0
+end
diff --git a/custom/hooks/post-receive.agefile b/custom/hooks/post-receive.agefile
new file mode 100755
index 0000000..2f72ae9
--- /dev/null
+++ b/custom/hooks/post-receive.agefile
@@ -0,0 +1,19 @@
+#!/bin/sh
+#
+# An example hook to update the "agefile" for CGit's idle time calculation.
+#
+# This hook assumes that you are using the default agefile location of
+# "info/web/last-modified".  If you change the value in your cgitrc then you
+# must also change it here.
+#
+# To install the hook, copy (or link) it to the file "hooks/post-receive" in
+# each of your repositories.
+#
+
+agefile="$(git rev-parse --git-dir)"/info/web/last-modified
+
+mkdir -p "$(dirname "$agefile")" &&
+git for-each-ref \
+	--sort=-authordate --count=1 \
+	--format='%(authordate:iso8601)' \
+	>"$agefile"
diff --git a/custom/hooks/post-update.update-server-info b/custom/hooks/post-update.update-server-info
new file mode 100755
index 0000000..d499ce5
--- /dev/null
+++ b/custom/hooks/post-update.update-server-info
@@ -0,0 +1,18 @@
+#!/bin/sh
+#
+# Example hook that keeps cgit's dumb HTTP clone data current.
+#
+# cgit can serve "git clone" over HTTP by itself using the dumb protocol,
+# which is on by default through enable-http-clone. The dumb protocol
+# reads a few static files that git refreshes only when you run
+# "git update-server-info", so without this hook a fresh push can leave a
+# clone unable to see the new refs and objects.
+#
+# You do not need this when you clone through git-http-backend (the smart
+# protocol) or over ssh or git://. It matters only when cgit itself is the
+# clone endpoint.
+#
+# To install it, copy or link this file to "hooks/post-update" in each
+# repository and make sure it is executable.
+#
+exec git update-server-info
diff --git a/custom/servers/apache.conf b/custom/servers/apache.conf
new file mode 100644
index 0000000..d042dd9
--- /dev/null
+++ b/custom/servers/apache.conf
@@ -0,0 +1,152 @@
+# Apache httpd 2.4 configuration for cgit.
+#
+# Apache runs the cgit.cgi binary directly through mod_cgid, so no FastCGI
+# bridge is needed. Drop this file in your vhost directory, for example
+# /etc/apache2/sites-available/cgit.conf on Debian and Ubuntu or
+# /etc/httpd/conf.d/cgit.conf on RHEL and Fedora, then enable it and reload.
+#
+# Paths assumed below, edit them to match your install.
+#   cgit CGI binary   /usr/lib/cgit/cgit.cgi
+#   static assets     /usr/share/cgit  (cgit.css cgit.js cgit.png favicon.ico robots.txt)
+#   cgit config       /etc/cgitrc
+#   public URL        https://git.example.org/  (cgit at the domain root)
+#
+# cgit is one CGI executable. It learns the repository and the page from
+# PATH_INFO and reads page options such as h= and id= from QUERY_STRING.
+# ScriptAlias runs the binary and forwards the trailing path as PATH_INFO, so
+# no extra path tuning is needed. cgit builds its own link base from
+# SCRIPT_NAME. The five static assets are served straight off disk. mod_alias
+# resolves Alias and ScriptAlias in order and the first match wins, so the
+# static Alias lines come before the catch-all ScriptAlias to stop the two
+# routes from shadowing each other.
+
+
+# --- Required modules -------------------------------------------------------
+# mod_cgid suits the threaded MPMs that ship by default. Use mod_cgi instead
+# only on the old prefork MPM. mod_alias provides Alias and ScriptAlias and
+# mod_env provides SetEnv. On Debian and Ubuntu run a2enmod cgid alias env
+# rather than editing these lines. The guards make double-loading harmless.
+<IfModule !mod_cgid.c>
+    LoadModule cgid_module  modules/mod_cgid.so
+</IfModule>
+<IfModule !mod_alias.c>
+    LoadModule alias_module modules/mod_alias.so
+</IfModule>
+<IfModule !mod_env.c>
+    LoadModule env_module   modules/mod_env.so
+</IfModule>
+<IfModule !mod_headers.c>
+    LoadModule headers_module modules/mod_headers.so
+</IfModule>
+
+
+# --- Plain HTTP virtual host ------------------------------------------------
+# This vhost only bounces plain HTTP up to HTTPS. It serves no cgit itself,
+# every cgit directive lives in the HTTPS vhost below. To run without TLS for
+# now, convert the HTTPS vhost to port 80 and delete this whole block rather
+# than editing it, since deleting only the Redirect line would leave a vhost
+# that serves nothing.
+<VirtualHost *:80>
+    ServerName git.example.org
+
+    ErrorLog  /var/log/apache2/cgit_error.log
+    CustomLog /var/log/apache2/cgit_access.log combined
+
+    Redirect permanent / https://git.example.org/
+</VirtualHost>
+
+
+# --- HTTPS virtual host, this one serves cgit -------------------------------
+# To run without TLS for now, change this opening line to <VirtualHost *:80>,
+# delete the three SSL lines, and delete the port 80 vhost above so there is
+# only one vhost. Everything else stays the same.
+<VirtualHost *:443>
+    ServerName git.example.org
+
+    ErrorLog  /var/log/apache2/cgit_ssl_error.log
+    CustomLog /var/log/apache2/cgit_ssl_access.log combined
+
+    # TLS needs mod_ssl (a2enmod ssl). Point these at your certificate.
+    SSLEngine on
+    SSLCertificateFile    /etc/ssl/certs/git.example.org.crt
+    SSLCertificateKeyFile /etc/ssl/private/git.example.org.key
+
+    # Which config cgit reads. It falls back to the compiled-in /etc/cgitrc,
+    # the same path used here, but setting it makes the location explicit and
+    # lets you point at a per-vhost file later.
+    SetEnv CGIT_CONFIG /etc/cgitrc
+
+    # --- Security headers (needs mod_headers, a2enmod headers) --------------
+    # Set here, not in cgit, so they also cover the static assets Apache
+    # serves. script-src stays self because cgit loads only its own cgit.js,
+    # and style-src allows inline for the diffstat bars. If you enable the
+    # gravatar or libravatar avatar filter, add its host to img-src, for
+    # example https://www.gravatar.com.
+    Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'self'"
+    Header always set X-Content-Type-Options "nosniff"
+    Header always set Referrer-Policy "no-referrer"
+    # Enable only once you serve HTTPS exclusively, since it is hard to undo.
+    #Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
+
+    # --- Static assets, served directly by Apache ---------------------------
+    # These five files are the only things served off disk. Each Alias maps
+    # one URL to one file. Because they come before the ScriptAlias below, a
+    # request for /cgit.css is answered from disk and never reaches cgit.
+    # cgit.css and cgit.js are the paths cgit's HTML points at by default, so
+    # if you relocate the assets update both these Alias targets and the css,
+    # js, logo and favicon settings in cgitrc to agree.
+    Alias /cgit.css    /usr/share/cgit/cgit.css
+    Alias /cgit.js     /usr/share/cgit/cgit.js
+    Alias /cgit.png    /usr/share/cgit/cgit.png
+    Alias /favicon.ico /usr/share/cgit/favicon.ico
+    Alias /robots.txt  /usr/share/cgit/robots.txt
+
+    # Apache 2.4 denies filesystem access by default, so open the asset
+    # directory for reading.
+    <Directory "/usr/share/cgit">
+        Options None
+        AllowOverride None
+        Require all granted
+
+        # Optional. These assets rarely change, so let browsers cache them.
+        # Needs mod_expires (a2enmod expires). Safe to delete this block.
+        <IfModule mod_expires.c>
+            ExpiresActive On
+            ExpiresDefault "access plus 30 days"
+        </IfModule>
+    </Directory>
+
+    # --- cgit, the catch-all ------------------------------------------------
+    # ScriptAlias maps a URL prefix to a path, marks it executable, and
+    # forwards the rest of the URL as PATH_INFO. Mapping / makes cgit the
+    # handler for every URL the static Aliases above did not already claim.
+    #
+    # The trailing slash on cgit.cgi/ is load bearing. It tells Apache that
+    # cgit.cgi is the program and the rest of the URL is PATH_INFO. So a
+    # request for /torvalds/linux/tree/kernel?h=next runs the binary with
+    # PATH_INFO set to /torvalds/linux/tree/kernel and QUERY_STRING set to
+    # h=next. cgit derives its link base from SCRIPT_NAME, which at the domain
+    # root is / and needs no tuning. For a sub-path install see the note below.
+    ScriptAlias / /usr/lib/cgit/cgit.cgi/
+
+    <Directory "/usr/lib/cgit">
+        # Allow CGI execution here. ScriptAlias implies it, stating it makes
+        # the intent clear.
+        Options +ExecCGI
+        # Run cgit.cgi as a CGI even if it is ever reached through a plain
+        # Alias rather than ScriptAlias.
+        SetHandler cgi-script
+        AllowOverride None
+        Require all granted
+    </Directory>
+</VirtualHost>
+
+
+# --- Sub-path install, only if cgit is not at the domain root ---------------
+# To serve cgit at https://git.example.org/cgit/ instead of the root, change
+# the ScriptAlias to
+#     ScriptAlias /cgit/ /usr/lib/cgit/cgit.cgi/
+# and move the static assets under the same prefix, for example
+#     Alias /cgit/cgit.css /usr/share/cgit/cgit.css
+# SCRIPT_NAME then becomes /cgit and cgit auto-detects it. If links come out
+# wrong, pin the base in cgitrc with virtual-root=/cgit.
diff --git a/custom/servers/lighttpd.conf b/custom/servers/lighttpd.conf
new file mode 100644
index 0000000..3111ed0
--- /dev/null
+++ b/custom/servers/lighttpd.conf
@@ -0,0 +1,132 @@
+# lighttpd configuration for cgit.
+#
+# lighttpd runs the cgit.cgi binary directly through mod_cgi, so no FastCGI
+# bridge is needed. This is cgit's classic reference deployment, mod_cgi with
+# mod_alias and mod_setenv.
+#
+# Paths assumed below, edit them to match your install.
+#   cgit CGI binary   /usr/lib/cgit/cgit.cgi
+#   static assets     /usr/share/cgit  (cgit.css cgit.js cgit.png favicon.ico robots.txt)
+#   cgit config       /etc/cgitrc
+#   public URL        https://git.example.org/  (cgit at the domain root)
+#
+# cgit is one CGI executable. It learns the repository and the page from
+# PATH_INFO and reads page options such as h= and id= from QUERY_STRING. cgit
+# builds its own link base from SCRIPT_NAME. The five static assets are served
+# straight off disk and must never be routed through cgit.
+
+
+# --- Modules ----------------------------------------------------------------
+# Append the three modules cgit needs so the distro's base config is kept.
+# mod_alias maps URL paths onto files, mod_setenv injects CGIT_CONFIG, and
+# mod_cgi runs cgit.cgi.
+server.modules += ( "mod_alias", "mod_setenv", "mod_cgi" )
+
+
+# --- Server basics ----------------------------------------------------------
+server.port          = 80
+server.username      = "http"             # Debian and Ubuntu use www-data
+server.groupname     = "http"
+server.document-root = "/usr/share/cgit"  # a valid docroot must exist, the
+                                          # alias rules below do the routing
+server.errorlog      = "/var/log/lighttpd/error.log"
+# Access logging needs mod_accesslog. Load it and uncomment to enable.
+#server.modules     += ( "mod_accesslog" )
+#accesslog.filename  = "/var/log/lighttpd/access.log"
+
+
+# --- MIME types for the static assets ---------------------------------------
+# mod_alias serves the assets off disk, so lighttpd must know their content
+# types. Without this the stylesheet is sent as application/octet-stream and
+# the browser ignores it.
+mimetype.assign = (
+    ".css" => "text/css",
+    ".js"  => "text/javascript",
+    ".png" => "image/png",
+    ".ico" => "image/vnd.microsoft.icon",
+    ".txt" => "text/plain",
+)
+
+
+# --- Virtual host, git.example.org ------------------------------------------
+# A top-level conditional, so it matches on both the port 80 socket and the
+# optional TLS socket at the end of this file.
+$HTTP["host"] == "git.example.org" {
+
+    # Which config cgit reads. It falls back to the compiled-in /etc/cgitrc,
+    # the same path used here, but setting it makes the location explicit.
+    setenv.add-environment = ( "CGIT_CONFIG" => "/etc/cgitrc" )
+
+    # --- Security headers ---------------------------------------------------
+    # Set here, not in cgit, so they also cover the static assets lighttpd
+    # serves. script-src stays self because cgit loads only its own cgit.js,
+    # and style-src allows inline for the diffstat bars. If you enable the
+    # gravatar or libravatar avatar filter, add its host to img-src.
+    setenv.add-response-header = (
+        "Content-Security-Policy" => "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'self'",
+        "X-Content-Type-Options" => "nosniff",
+        "Referrer-Policy" => "no-referrer"
+    )
+    # Enable only once you serve HTTPS exclusively, since it is hard to undo.
+    #setenv.add-response-header += ( "Strict-Transport-Security" => "max-age=63072000; includeSubDomains" )
+
+    # Register the cgit binary as a CGI program. The key cgit.cgi matches the
+    # binary's name and the empty value means the file is itself the program,
+    # with no interpreter in front of it. This is what makes lighttpd split
+    # the trailing path off as PATH_INFO, so never drop it.
+    cgi.assign = ( "cgit.cgi" => "" )
+
+    # Routing. lighttpd's alias.url is first-match in declaration order, not
+    # longest prefix, so the five static entries must come before the / entry.
+    # If / came first it would swallow every request and recent lighttpd
+    # refuses to start. The static entries are served off disk and the / entry
+    # hands everything else to cgit.
+    #
+    # The trailing slash on cgit.cgi/ is load bearing. lighttpd builds the
+    # physical path by stripping the matched key off the front of the URL and
+    # appending the rest to the value. For the key / the remainder carries no
+    # leading slash, so without the trailing slash a request for
+    # /linux/tree/kernel/sched.c glues onto the binary name as
+    # /usr/lib/cgit/cgit.cgilinux/tree/... and 404s. The trailing slash
+    # restores the separator, giving cgit SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi
+    # and PATH_INFO /linux/tree/kernel/sched.c.
+    alias.url = (
+        "/cgit.css"    => "/usr/share/cgit/cgit.css",
+        "/cgit.js"     => "/usr/share/cgit/cgit.js",
+        "/cgit.png"    => "/usr/share/cgit/cgit.png",
+        "/favicon.ico" => "/usr/share/cgit/favicon.ico",
+        "/robots.txt"  => "/usr/share/cgit/robots.txt",
+        "/"            => "/usr/lib/cgit/cgit.cgi/",
+    )
+
+    # Served at / the SCRIPT_NAME is empty and cgit derives its link base
+    # correctly. For a sub-path install use a key without a trailing slash
+    # mapped to the binary without a trailing slash, for example
+    #     "/git" => "/usr/lib/cgit/cgit.cgi"
+    # so /git/linux/tree resolves to /usr/lib/cgit/cgit.cgi/linux/tree, giving
+    # SCRIPT_NAME /git and PATH_INFO /linux/tree. cgit auto-detects the prefix.
+    # If links come out wrong, pin it in cgitrc with virtual-root=/git.
+}
+
+
+# --- Optional HTTPS on 443 --------------------------------------------------
+# Uncomment this whole block to enable TLS. The host block above is socket
+# independent, so it serves cgit over this socket too once the crypto is set.
+#server.modules += ( "mod_openssl" )
+#
+#$SERVER["socket"] == ":443" {
+#    ssl.engine  = "enable"
+#    ssl.pemfile = "/etc/lighttpd/certs/git.example.org.crt"
+#    ssl.privkey = "/etc/lighttpd/certs/git.example.org.key"
+#    ssl.ca-file = "/etc/lighttpd/certs/git.example.org.chain.pem"
+#    ssl.openssl.ssl-conf-cmd = ( "MinProtocol" => "TLSv1.2" )
+#}
+#
+# Redirect plain HTTP to HTTPS, scoped to the port 80 socket. Needs
+# mod_redirect.
+#server.modules += ( "mod_redirect" )
+#$SERVER["socket"] == ":80" {
+#    $HTTP["host"] == "git.example.org" {
+#        url.redirect = ( "^/(.*)" => "https://git.example.org/$1" )
+#    }
+#}
diff --git a/custom/servers/nginx.conf b/custom/servers/nginx.conf
new file mode 100644
index 0000000..76ac260
--- /dev/null
+++ b/custom/servers/nginx.conf
@@ -0,0 +1,193 @@
+# nginx configuration for cgit.
+#
+# nginx cannot run CGI programs itself, so a small bridge called fcgiwrap
+# runs the cgit.cgi binary and speaks FastCGI to nginx. Starting fcgiwrap is
+# covered in the notes at the end of this file.
+#
+# Paths assumed below, edit them to match your install.
+#   cgit CGI binary   /usr/lib/cgit/cgit.cgi
+#   static assets     /usr/share/cgit  (cgit.css cgit.js cgit.png favicon.ico robots.txt)
+#   cgit config       /etc/cgitrc
+#   public URL        https://git.example.org/  (cgit at the domain root)
+#
+# cgit is one CGI executable. It learns the repository and the page from
+# PATH_INFO and reads page options such as h= and id= from QUERY_STRING, so
+# nginx must pass PATH_INFO through to the binary. cgit builds its own link
+# base from SCRIPT_NAME. The five static assets are served straight off disk
+# and must never be routed through cgit. Passing PATH_INFO through is the
+# single most important part of the config below.
+
+
+# --- Optional HTTP to HTTPS redirect ----------------------------------------
+# Delete this whole server block if you serve plain HTTP only.
+server {
+    listen      80;
+    listen      [::]:80;
+    server_name git.example.org;
+
+    # ACME http-01 challenge files, if you use certbot in webroot mode.
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/html;
+    }
+
+    # Everything else moves to HTTPS.
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+
+# --- Main site --------------------------------------------------------------
+# Written for TLS on 443. For a quick plain-HTTP test, change the two listen
+# lines to port 80, delete the redirect block above, and delete the four ssl
+# lines below. Everything else stays the same.
+server {
+    listen      443 ssl;
+    listen      [::]:443 ssl;
+    http2       on;
+    server_name git.example.org;
+
+    ssl_certificate     /etc/letsencrypt/live/git.example.org/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/git.example.org/privkey.pem;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_ciphers         HIGH:!aNULL:!MD5;
+
+    # --- Security headers ---------------------------------------------------
+    # These sit here, not in cgit, because they must also cover the static
+    # assets nginx serves directly. cgit loads only its own /cgit.js and uses
+    # inline style on the diffstat bars, so script-src stays self while
+    # style-src allows inline. always applies them to error responses too. If
+    # you enable the gravatar or libravatar avatar filter, add its host to
+    # img-src, for example https://www.gravatar.com or https://seccdn.libravatar.org.
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'self'" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "no-referrer" always;
+    # Enable only once you serve HTTPS exclusively, since it is hard to undo.
+    #add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
+
+    # The document root is the directory that holds the static assets. cgit
+    # emits absolute links to /cgit.css and /cgit.png by default, so those
+    # files must resolve at the root of the URL space. Pointing root at the
+    # asset directory makes /cgit.css map to /usr/share/cgit/cgit.css.
+    root /usr/share/cgit;
+
+    # Upload cap for large form posts. Snapshots are generated rather than
+    # uploaded, so this does not limit them.
+    client_max_body_size 64m;
+
+    access_log /var/log/nginx/cgit.access.log;
+    error_log  /var/log/nginx/cgit.error.log;
+
+    # --- Static assets, served directly -------------------------------------
+    # Match the assets by their exact root-level names, never by bare
+    # extension. cgit routes on PATH_INFO and a repository can hold files
+    # ending in .css or .png, so /myrepo/tree/style.css and /myrepo/plain/
+    # logo.png are real cgit URLs. A broad extension match would capture
+    # those, look for them on disk, and return 404 before cgit could render
+    # them. Anchoring the regex at the start of the path matches /cgit.css but
+    # not /myrepo/tree/cgit.css, so it can never shadow a repository file. An
+    # nginx regex location is matched before the prefix location below, so
+    # these assets win for their exact URLs and cgit wins for the rest.
+    location ~ ^/(cgit\.css|cgit\.js|cgit\.png|favicon\.ico|robots\.txt)$ {
+        expires    30d;
+        access_log off;
+        try_files  $uri =404;
+    }
+
+    # --- cgit, the catch-all ------------------------------------------------
+    # Everything that is not a static asset above is a cgit URL, the repo
+    # index, a repository, a page within a repository, a snapshot, a feed.
+    location / {
+        # nginx's standard FastCGI parameters, some of which are overridden
+        # below. A later fastcgi_param wins, so include order does not matter.
+        include fastcgi_params;
+
+        # The program fcgiwrap runs. It must be the cgit binary itself, not
+        # $document_root$fastcgi_script_name, which would try to run a repo
+        # path and is the usual cause of a failed request.
+        fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;
+
+        # cgit builds its link base, the virtual root, from SCRIPT_NAME. The
+        # stock parameters set SCRIPT_NAME to the whole request path, which
+        # would make cgit prepend that path to every link. Served at the
+        # domain root the script has no prefix, so force SCRIPT_NAME empty and
+        # cgit uses / as its base. A sub-path install sets it instead, see the
+        # end of this file.
+        fastcgi_param SCRIPT_NAME  "";
+
+        # How cgit learns the repository and page. At the domain root the
+        # whole request path is the PATH_INFO.
+        fastcgi_param PATH_INFO    $uri;
+
+        # Page options such as h=branch, id=sha and the snapshot format.
+        fastcgi_param QUERY_STRING $query_string;
+
+        # Where the static assets live, kept consistent with root above.
+        fastcgi_param DOCUMENT_ROOT $document_root;
+
+        # The browser's Host header, so cgit builds clone URLs against the
+        # name the visitor used rather than server_name.
+        fastcgi_param HTTP_HOST    $http_host;
+
+        # Which config cgit reads. It checks CGIT_CONFIG and falls back to the
+        # compiled-in /etc/cgitrc. Setting it makes the location explicit and
+        # lets you move cgitrc without recompiling.
+        fastcgi_param CGIT_CONFIG  /etc/cgitrc;
+
+        # The real scheme, so cgit builds correct https clone URLs.
+        fastcgi_param HTTPS        $https if_not_empty;
+
+        # Hand off to the fcgiwrap socket. See the notes for how to create it.
+        # A TCP fcgiwrap would use for example 127.0.0.1:9000 here.
+        fastcgi_pass unix:/run/fcgiwrap.socket;
+
+        # Large outputs such as snapshot tarballs and blame on big files can
+        # take a while, so give cgit room and stream rather than buffer.
+        fastcgi_read_timeout 300s;
+        fastcgi_buffering off;
+    }
+}
+
+
+# --- Notes, starting fcgiwrap -----------------------------------------------
+# cgit is a CGI binary and fcgiwrap is the CGI to FastCGI bridge nginx talks
+# to. On Debian and Ubuntu the packaged systemd socket provides
+# /run/fcgiwrap.socket, so enabling it is enough.
+#     apt install fcgiwrap
+#     systemctl enable --now fcgiwrap.socket
+# The socket must be readable by nginx's user. The packaged unit runs fcgiwrap
+# as www-data, which nginx also uses on those systems. Without systemd you can
+# run
+#     spawn-fcgi -s /run/fcgiwrap.socket -M 660 -- /usr/sbin/fcgiwrap
+# or run fcgiwrap over TCP and point fastcgi_pass at 127.0.0.1:9000.
+
+
+# --- Alternative, serving cgit under a sub-path -----------------------------
+# To serve cgit at https://git.example.org/cgit/ instead of the root, split
+# the URL so SCRIPT_NAME is the prefix and PATH_INFO is the rest.
+#
+#     location /cgit/ {
+#         include fastcgi_params;
+#         fastcgi_split_path_info ^(/cgit)(/.*)$;
+#         fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;
+#         fastcgi_param SCRIPT_NAME     $fastcgi_script_name;
+#         fastcgi_param PATH_INFO       $fastcgi_path_info;
+#         fastcgi_param QUERY_STRING    $query_string;
+#         fastcgi_param HTTP_HOST       $http_host;
+#         fastcgi_param CGIT_CONFIG     /etc/cgitrc;
+#         fastcgi_param HTTPS           $https if_not_empty;
+#         fastcgi_pass  unix:/run/fcgiwrap.socket;
+#     }
+#
+# Serve the assets from the sub-path too, again anchored to the exact names.
+#
+#     location ~ ^/cgit/(cgit\.css|cgit\.js|cgit\.png|favicon\.ico|robots\.txt)$ {
+#         alias /usr/share/cgit/$1;
+#         expires 30d;
+#         access_log off;
+#     }
+#
+# cgit's default css=/cgit.css and logo=/cgit.png point at the domain root, so
+# under a sub-path also set css=/cgit/cgit.css and logo=/cgit/cgit.png in
+# cgitrc. cgit derives the /cgit prefix from SCRIPT_NAME. If links come out
+# wrong, pin it in cgitrc with virtual-root=/cgit/.
diff --git a/examples/cgitrc b/examples/cgitrc
deleted file mode 100644
index 4a36149..0000000
--- a/examples/cgitrc
+++ /dev/null
@@ -1,566 +0,0 @@
-# cgitrc reference configuration
-#
-# This file lists every cgit configuration option set to its default value.
-# Options with a real default are left uncommented at that default. Options
-# that are site-specific are commented out with a realistic example and their
-# default noted in the comment. Copied as-is, cgit behaves as if no option
-# were set.
-#
-# Quick start. The one thing you must set to see any repositories is where
-# they live. Uncomment scan-path further down and point it at your git
-# directory, or list repositories by hand in the per-repository section at
-# the end of this file.
-#
-# About pages (markdown, man and plain-text readmes) render through the
-# bundled about-render.lua about-filter, see the filter section below. Source
-# syntax highlighting is optional and ships as a source-filter there too.
-#
-# One key=value pair per line. Lines starting with # are comments.
-
-
-##
-## Cache
-##
-
-# Maximum number of entries in the cgit output cache. A value of 0 disables
-# caching. Value is an integer. Default is 0.
-cache-size=0
-
-# Directory used to store cgit cache entries. Value is a filesystem path that
-# may use macros. Default is /var/cache/cgit.
-#cache-root=/var/cache/cgit
-
-# Minutes to cache the repository index page. Value is an integer number of
-# minutes. Default is 5.
-cache-root-ttl=5
-
-# Minutes to cache the repository summary page. Value is an integer number of
-# minutes. Default is 5.
-cache-repo-ttl=5
-
-# Minutes to cache the result of scanning a path for repositories. Value is an
-# integer number of minutes. Default is 15.
-cache-scanrc-ttl=15
-
-# Minutes to cache repo pages requested with a fixed SHA1. A negative value
-# never expires. Value is an integer number of minutes. Default is -1.
-cache-static-ttl=-1
-
-# Minutes to cache repo pages requested without a fixed SHA1. Value is an
-# integer number of minutes. Default is 5.
-cache-dynamic-ttl=5
-
-# Minutes to cache the repository about page. Value is an integer number of
-# minutes. Default is 15.
-cache-about-ttl=15
-
-# Minutes to cache snapshots. Value is an integer number of minutes.
-# Default is 5.
-cache-snapshot-ttl=5
-
-# Expose the ls_cache page, which lists cache paths and the urls other
-# visitors requested. Values are 0 or 1. Default is 0.
-enable-cache-list=0
-
-
-##
-## Site appearance
-##
-
-# Heading text on the repository index page. Value is any text.
-# Default is Git repository browser.
-#root-title=Git repository browser
-
-# Subheading text below the index page heading. Value is any text.
-# Default is a fast webinterface for the git dscm.
-#root-desc=a fast webinterface for the git dscm
-
-# File included verbatim below the about link on the index page. Value is a
-# filesystem path. Default is none.
-#root-readme=/var/www/htdocs/about.html
-
-# Default value or values for repo.readme. The first existing file wins. Value
-# is one or more [ref]path entries. Default is none.
-#readme=:README.md
-
-# CSS document urls added to the head of every page. Value is one or more urls.
-# Default is /cgit.css.
-#css=/cgit.css
-
-# JavaScript document urls included on every page. An empty value disables it.
-# Value is one or more urls. Default is /cgit.js.
-#js=/cgit.js
-
-# Shortcut icon url for all pages. Value is a url. Default is /favicon.ico.
-#favicon=/favicon.ico
-
-# Image url used as the logo on all pages. Value is a url. Default is /cgit.png.
-#logo=/cgit.png
-
-# Url loaded when clicking the logo. Value is a url. Default is the index url.
-#logo-link=/
-
-# File included verbatim at the top of all pages. Value is a filesystem path.
-# Default is none.
-#header=/var/www/htdocs/cgit-header.html
-
-# File included verbatim at the bottom of all pages, replacing the generated-by
-# line. Value is a filesystem path. Default is none.
-#footer=/var/www/htdocs/cgit-footer.html
-
-# File included verbatim in the HTML head of all pages. Value is a filesystem
-# path. Default is none.
-#head-include=/var/www/htdocs/cgit-head.html
-
-# Content of the robots meta tag. Value is robots meta content.
-# Default is index, nofollow.
-robots=index, nofollow
-
-# Omit the standard page header when set. Values are 0 or 1. Default is 0.
-noheader=0
-
-# Generate an HTML fragment suitable for embedding in other pages. Values are
-# 0 or 1. Default is 0.
-embedded=0
-
-# Root url for all cgit links, enabling virtual urls. Value is a url path.
-# Default is none.
-#virtual-root=/
-
-# Link format string for submodules in directory listings. Value is a printf
-# format string taking path and sha1. Default is none.
-#module-link=/%s/commit/?id=%s
-
-
-##
-## Repository discovery
-##
-
-# Directory scanned for git repositories at parse time. Value is a filesystem
-# path that may use macros. Default is none.
-#scan-path=/var/lib/git
-
-# When scanning, recurse into dot-directories. Must precede scan-path.
-# Values are 0 or 1. Default is 0.
-scan-hidden-path=0
-
-# Derive default section names from N leading path elements. Must precede
-# scan-path. Value is an integer that may be negative. Default is 0.
-section-from-path=0
-
-# Strip the .git suffix from scanned repo url and name. Must precede scan-path.
-# Values are 0 or 1. Default is 0.
-remove-suffix=0
-
-# File listing subdirs of scan-path to load. Must precede scan-path. Value is a
-# filesystem path that may use macros. Default is none.
-#project-list=/var/lib/git/projects.list
-
-# Serve a repo only if this file exists inside it. Emulates gitweb EXPORT_OK.
-# Must precede scan-path. Value is a filename. Default is none.
-#strict-export=git-daemon-export-ok
-
-# Section heading that subsequently-defined repos inherit. Value is any section
-# heading text. Default is none.
-#section=main
-
-# Sort sections and repos within them by name rather than file order. Values
-# are 0 or 1. Default is 0.
-section-sort=0
-
-# How repositories within a section are sorted. Values are name or age.
-# Default is name.
-repository-sort=name
-
-# Let scanned repos set cgit settings via git config using gitweb.* or cgit.*
-# keys. Values are 0 or 1. Default is 0.
-enable-git-config=0
-
-# Include another config file before continuing to parse this one. Value is a
-# filesystem path that may use macros. Default is none.
-#include=/etc/cgitrc.d/extra
-
-
-##
-## Features
-##
-
-# Provide a blame page for files and links to it. Values are 0 or 1.
-# Default is 0.
-enable-blame=0
-
-# Print an ASCII-art commit history graph in the log page. Values are 0 or 1.
-# Default is 0.
-enable-commit-graph=0
-
-# Allow following a file across renames in the log view. Values are 0 or 1.
-# Default is 0.
-enable-follow-links=0
-
-# Add a help tab to the index page with a built-in guide to the interface.
-# Values are 0 or 1. Default is 1.
-enable-help=1
-
-# Generate extra summary, commit and tree links per repo on the index. Values
-# are 0 or 1. Default is 0.
-enable-index-links=0
-
-# Show the owner of each repo on the index page. Values are 0 or 1.
-# Default is 1.
-enable-index-owner=1
-
-# Show the number of modified files per commit in the log. Values are 0 or 1.
-# Default is 0.
-enable-log-filecount=0
-
-# Show added and removed line counts per commit in the log. Values are 0 or 1.
-# Default is 0.
-enable-log-linecount=0
-
-# Display remote branches in summary and refs views. Values are 0 or 1.
-# Default is 0.
-enable-remote-branches=0
-
-# Use the parent commit subject as link text for parent links. Values are
-# 0 or 1. Default is 0.
-enable-subject-links=0
-
-# Allow /plain to serve HTML mimetypes instead of downgrading to text/plain.
-# Values are 0 or 1. Default is 0.
-enable-html-serving=0
-
-# Generate line-number links for plaintext blobs in the tree view. Values are
-# 0 or 1. Default is 1.
-enable-tree-linenumbers=1
-
-# List directories first, then files, in the tree view. Values are 0 or 1.
-# Default is 0.
-enable-tree-group-dirs=0
-
-# Default maximum statistics period. Leaving this unset disables statistics.
-# Values are week, month, quarter or year. Default is unset.
-#max-stats=week
-
-# Enable the statistics page, with the repository overview, activity
-# timeline, commit rhythm, language breakdown and commits per author.
-# Values are 0 or 1. Default is 0.
-enable-stats=0
-
-
-##
-## Snapshots and cloning
-##
-
-# Default set of snapshot archive formats to offer. Value is a space list of
-# tar tar.gz tar.bz2 tar.lz tar.xz tar.zst zip, or the word all.
-# Default is none.
-#snapshots=tar.gz tar.xz zip
-
-# Act as a dumb HTTP endpoint for git clones. Values are 0 or 1. Default is 1.
-enable-http-clone=1
-
-# Prefixes combined with the repo url to build clone urls. Used only when
-# repo.clone-url is unset. Value is space-separated url prefixes.
-# Default is none.
-#clone-prefix=https://example.com/git git://example.com
-
-# Clone-url templates used when repo.clone-url is unset. Value is
-# space-separated url templates that may use macros. Default is none.
-#clone-url=https://example.com/$CGIT_REPO_URL git://example.com/$CGIT_REPO_URL
-
-
-##
-## Filters
-##
-#
-# A filter is an external command cgit runs to transform a piece of content.
-# Prefix the command with lua: to run it through the built-in Lua interpreter,
-# which avoids a fork per call, or with exec: to run a normal program. The
-# commands below that point at /usr/share/cgit/extensions/ use scripts this
-# repository ships under extensions/. The ones written as /path/to/your-command
-# mark where your own command goes.
-
-# Allow filter settings to be overridden in per-repo cgitrc files. Values are
-# 0 or 1. Default is 0.
-enable-filter-overrides=0
-
-# Filter command used to format about-page content. The bundled about-render.lua
-# renders markdown, man pages and plain text. Value is a command optionally
-# prefixed with exec or lua. Default is none.
-#about-filter=lua:/usr/share/cgit/extensions/about-render.lua
-
-# Filter command used to format commit messages, for example to turn object
-# names and issue numbers into links. Value is a command optionally prefixed
-# with exec or lua. Default is none.
-#commit-filter=lua:/usr/share/cgit/extensions/link-commits.lua
-
-# Filter command used to format author and committer emails, for example to
-# add avatar images. Value is a command optionally prefixed with exec or lua.
-# Default is none.
-#email-filter=lua:/usr/share/cgit/extensions/email-gravatar.lua
-
-# Filter command used to format plaintext blobs in the tree view. Without it
-# cgit serves the text plain. For syntax highlighting, the shipped filter
-# below uses the Scintillua lexers and needs the lpeg module installed too,
-# on Debian that is "apt install lua-lpeg". Missing either dependency means
-# plain uncolored text, not an error. See the comments in that file. Value
-# is a command optionally prefixed with exec or lua. Default is none.
-#source-filter=lua:/usr/share/cgit/extensions/syntax-highlight.lua
-
-# Filter command invoked to authenticate access, gating repositories behind a
-# login. See extensions/auth-inline.lua and extensions/auth-file.lua. Value
-# is a command optionally prefixed with exec or lua. Default is none.
-#auth-filter=lua:/usr/share/cgit/extensions/auth-inline.lua
-
-
-##
-## Limits and safety
-##
-
-# Number of items to display in atom feeds. Value is an integer. Default is 10.
-max-atom-items=10
-
-# Max commit message characters shown in the log view. Value is an integer.
-# Default is 80.
-max-message-length=80
-
-# Max repo description characters shown on the index page. Value is an integer.
-# Default is 80.
-max-repodesc-length=80
-
-# Max blob size in KBytes read into memory for html, plain and blob output.
-# A value of 0 disables the limit. Value is an integer. Default is 10240.
-max-blob-size=10240
-
-# Number of repos listed per page on the index. A value of 0 or negative shows
-# all repos. Value is an integer. Default is 50.
-max-repo-count=50
-
-# Number of log entries listed per page in the log view. Value is an integer.
-# Default is 50.
-max-commit-count=50
-
-# Maximum number of commits the patch view emits as a series for an explicit
-# revision range. A single commit is unaffected. A value of 0 removes the
-# limit. Value is an integer. Default is 50.
-max-patch-count=50
-
-# Commits changing more files than this render as a diffstat, where each file
-# links to its own diff page. A value of 0 always renders everything inline.
-# Value is an integer. Default is 200.
-max-diff-files=200
-
-# A file whose diff spans more lines than this is replaced by a link to its
-# own diff page in whole-commit views. A value of 0 always renders it inline.
-# Value is an integer. Default is 1000.
-max-diff-lines=1000
-
-# Branches and tags listed per section on the refs page, and per page on the
-# dedicated branch and tag pages. A value of 0 lists everything on one page.
-# Value is an integer. Default is 200.
-max-ref-count=200
-
-# Max files considered when detecting renames. A value of -1 uses the git
-# compile-time value. Value is an integer. Default is -1.
-renamelimit=-1
-
-
-##
-## Presentation
-##
-
-# Number of log entries shown in the summary view. Value is an integer.
-# Default is 10.
-summary-log=10
-
-# Number of branches shown in the summary view. Value is an integer.
-# Default is 10.
-summary-branches=10
-
-# Number of tags shown in the summary view. Value is an integer. Default is 10.
-summary-tags=10
-
-# Show side-by-side diffs instead of unidiffs by default. Values are 0 or 1.
-# Default is 0.
-side-by-side-diffs=0
-
-# Print commit and tag times in the server timezone. Values are 0 or 1.
-# Default is 0.
-local-time=0
-
-# Ordering of commits in the log view. Leaving this unset uses the git log
-# default. Values are date or topo. Default is unset.
-#commit-sort=date
-
-# Ordering of the branch ref list. Values are name or age. Default is name.
-branch-sort=name
-
-# Sort items in the repo list case-sensitively. Values are 0 or 1. Default is 1.
-case-sensitive-sort=1
-
-# Hide full author email addresses when set. Values are 0 or 1. Default is 0.
-noplainemail=0
-
-# File giving the timestamp of the youngest commit. Value is a path relative to
-# the repo. Default is info/web/last-modified.
-#agefile=info/web/last-modified
-
-# Fallback mimetype lookup file for plain output. Value is a filesystem path.
-# Default is none.
-#mimetype-file=/etc/mime.types
-
-# Mimetype for a given filename extension, used by plain output. Value is a
-# mimetype string keyed by extension. Default is none.
-#mimetype.gif=image/gif
-#mimetype.html=text/html
-#mimetype.jpg=image/jpeg
-#mimetype.pdf=application/pdf
-#mimetype.png=image/png
-#mimetype.svg=image/svg+xml
-
-
-##
-## Per-repository overrides
-##
-#
-# Each repository is introduced by a repo.url line, which must be the first
-# setting of the block. All following repo.* settings apply to that repo until
-# the next repo.url line. When repos are discovered via scan-path the repo.
-# prefix is dropped inside each repo cgitrc and repo.url and repo.path are not
-# allowed there.
-
-# Relative url for a repo. Must be the first setting of each repo block. Value
-# is a relative url path. Default is none.
-#repo.url=example
-
-# Absolute path to the repository. For a non-bare repo this is the .git dir.
-# Value is an absolute filesystem path. Default is none.
-#repo.path=/var/lib/git/example.git
-
-# Display name of the repository. Value is any text. Default is the repo url.
-#repo.name=example
-
-# Repository description. Value is any text. Default is none.
-#repo.desc=An example repository
-
-# Repository owner identifier. Value is any text. Default is none.
-#repo.owner=Jane Doe
-
-# Repository homepage value. Value is a url or text. Default is none.
-#repo.homepage=https://example.com/
-
-# Urls used to clone this repo. Value is space-separated urls that may use
-# macros. Default is none.
-#repo.clone-url=https://example.com/example.git git://example.com/example.git
-
-# Default branch for the repo. Falls back to the first sorted branch. Value is
-# a branch name. Default is the HEAD branch, or master.
-#repo.defbranch=master
-
-# Override the current section name for this repo. Value is a section name.
-# Default is none.
-#repo.section=main
-
-# Prefix for snapshot filenames instead of the repo basename. Value is a prefix
-# string. Default is none.
-#repo.snapshot-prefix=example
-
-# Extra content added verbatim to the head of each page for this repo. Value is
-# an HTML fragment. Default is none.
-#repo.extra-head-content=<meta name="example" content="value">
-
-# File included verbatim as the repo About page. A colon-prefixed value uses
-# the head or defbranch. Value is a [ref]path entry. Default is the global
-# readme value.
-#repo.readme=:README.md
-
-# Per-repo logo image url. Value is a url. Default is the global logo value.
-#repo.logo=/cgit.png
-
-# Per-repo logo link target url. Value is a url. Default is the global
-# logo-link value.
-#repo.logo-link=/
-
-# Per-repo submodule link format string. Value is a printf format string taking
-# path and sha1. Default is the global module-link value.
-#repo.module-link=/%s/commit/?id=%s
-
-# Submodule link format for a specific submodule path. Value is a printf format
-# string taking sha1. Default is none.
-#repo.module-link.path/to/sub=https://example.com/sub/commit/?id=%s
-
-# Snapshot formats offered for this repo, restricted by the global mask. A
-# value of 0 disables snapshots. Value is snapshot formats. Default is the
-# global snapshots value.
-#repo.snapshots=tar.gz zip
-
-# Hide the repo from the index but still allow direct access. Values are
-# 0 or 1. Default is 0.
-#repo.hide=0
-
-# Ignore the repo entirely so it is not indexed and not directly accessible.
-# Values are 0 or 1. Default is 0.
-#repo.ignore=0
-
-# Per-repo override of enable-blame. Values are 0 or 1. Default is the global
-# enable-blame value.
-#repo.enable-blame=0
-
-# Per-repo override of enable-commit-graph. Values are 0 or 1. Default is the
-# global enable-commit-graph value.
-#repo.enable-commit-graph=0
-
-# Per-repo override of enable-follow-links. Values are 0 or 1. Default is the
-# global enable-follow-links value.
-#repo.enable-follow-links=0
-
-# Per-repo override of enable-log-filecount. Values are 0 or 1. Default is the
-# global enable-log-filecount value.
-#repo.enable-log-filecount=0
-
-# Per-repo override of enable-log-linecount. Values are 0 or 1. Default is the
-# global enable-log-linecount value.
-#repo.enable-log-linecount=0
-
-# Per-repo override of enable-remote-branches. Values are 0 or 1. Default is
-# the global enable-remote-branches value.
-#repo.enable-remote-branches=0
-
-# Per-repo override of enable-subject-links. Values are 0 or 1. Default is the
-# global enable-subject-links value.
-#repo.enable-subject-links=0
-
-# Per-repo override of enable-html-serving. Values are 0 or 1. Default is the
-# global enable-html-serving value.
-#repo.enable-html-serving=0
-
-# Per-repo branch ref list ordering. Values are name or age. Default is name.
-#repo.branch-sort=name
-
-# Per-repo commit log ordering. Leaving this unset uses the git log default.
-# Values are date or topo. Default is unset.
-#repo.commit-sort=date
-
-# Per-repo maximum statistics period. Values are week, month, quarter or year.
-# Default is the global max-stats value.
-#repo.max-stats=week
-
-# Per-repo override of the about-filter. Allowed in a repo cgitrc only when
-# enable-filter-overrides is 1. Value is a command. Default is the global
-# about-filter value.
-#repo.about-filter=exec:/path/to/your-command
-
-# Per-repo override of the commit-filter. Allowed in a repo cgitrc only when
-# enable-filter-overrides is 1. Value is a command. Default is the global
-# commit-filter value.
-#repo.commit-filter=lua:/usr/share/cgit/extensions/link-commits.lua
-
-# Per-repo override of the source-filter. Allowed in a repo cgitrc only when
-# enable-filter-overrides is 1. Value is a command. Default is the global
-# source-filter value.
-#repo.source-filter=exec:/path/to/your-command
-
-# Per-repo override of the email-filter. Allowed in a repo cgitrc only when
-# enable-filter-overrides is 1. Value is a command. Default is the global
-# email-filter value.
-#repo.email-filter=lua:/usr/share/cgit/extensions/email-gravatar.lua
diff --git a/examples/hooks/post-receive.agefile b/examples/hooks/post-receive.agefile
deleted file mode 100755
index 2f72ae9..0000000
--- a/examples/hooks/post-receive.agefile
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/bin/sh
-#
-# An example hook to update the "agefile" for CGit's idle time calculation.
-#
-# This hook assumes that you are using the default agefile location of
-# "info/web/last-modified".  If you change the value in your cgitrc then you
-# must also change it here.
-#
-# To install the hook, copy (or link) it to the file "hooks/post-receive" in
-# each of your repositories.
-#
-
-agefile="$(git rev-parse --git-dir)"/info/web/last-modified
-
-mkdir -p "$(dirname "$agefile")" &&
-git for-each-ref \
-	--sort=-authordate --count=1 \
-	--format='%(authordate:iso8601)' \
-	>"$agefile"
diff --git a/examples/hooks/post-update.update-server-info b/examples/hooks/post-update.update-server-info
deleted file mode 100755
index d499ce5..0000000
--- a/examples/hooks/post-update.update-server-info
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/sh
-#
-# Example hook that keeps cgit's dumb HTTP clone data current.
-#
-# cgit can serve "git clone" over HTTP by itself using the dumb protocol,
-# which is on by default through enable-http-clone. The dumb protocol
-# reads a few static files that git refreshes only when you run
-# "git update-server-info", so without this hook a fresh push can leave a
-# clone unable to see the new refs and objects.
-#
-# You do not need this when you clone through git-http-backend (the smart
-# protocol) or over ssh or git://. It matters only when cgit itself is the
-# clone endpoint.
-#
-# To install it, copy or link this file to "hooks/post-update" in each
-# repository and make sure it is executable.
-#
-exec git update-server-info
diff --git a/examples/servers/apache.conf b/examples/servers/apache.conf
deleted file mode 100644
index d042dd9..0000000
--- a/examples/servers/apache.conf
+++ /dev/null
@@ -1,152 +0,0 @@
-# Apache httpd 2.4 configuration for cgit.
-#
-# Apache runs the cgit.cgi binary directly through mod_cgid, so no FastCGI
-# bridge is needed. Drop this file in your vhost directory, for example
-# /etc/apache2/sites-available/cgit.conf on Debian and Ubuntu or
-# /etc/httpd/conf.d/cgit.conf on RHEL and Fedora, then enable it and reload.
-#
-# Paths assumed below, edit them to match your install.
-#   cgit CGI binary   /usr/lib/cgit/cgit.cgi
-#   static assets     /usr/share/cgit  (cgit.css cgit.js cgit.png favicon.ico robots.txt)
-#   cgit config       /etc/cgitrc
-#   public URL        https://git.example.org/  (cgit at the domain root)
-#
-# cgit is one CGI executable. It learns the repository and the page from
-# PATH_INFO and reads page options such as h= and id= from QUERY_STRING.
-# ScriptAlias runs the binary and forwards the trailing path as PATH_INFO, so
-# no extra path tuning is needed. cgit builds its own link base from
-# SCRIPT_NAME. The five static assets are served straight off disk. mod_alias
-# resolves Alias and ScriptAlias in order and the first match wins, so the
-# static Alias lines come before the catch-all ScriptAlias to stop the two
-# routes from shadowing each other.
-
-
-# --- Required modules -------------------------------------------------------
-# mod_cgid suits the threaded MPMs that ship by default. Use mod_cgi instead
-# only on the old prefork MPM. mod_alias provides Alias and ScriptAlias and
-# mod_env provides SetEnv. On Debian and Ubuntu run a2enmod cgid alias env
-# rather than editing these lines. The guards make double-loading harmless.
-<IfModule !mod_cgid.c>
-    LoadModule cgid_module  modules/mod_cgid.so
-</IfModule>
-<IfModule !mod_alias.c>
-    LoadModule alias_module modules/mod_alias.so
-</IfModule>
-<IfModule !mod_env.c>
-    LoadModule env_module   modules/mod_env.so
-</IfModule>
-<IfModule !mod_headers.c>
-    LoadModule headers_module modules/mod_headers.so
-</IfModule>
-
-
-# --- Plain HTTP virtual host ------------------------------------------------
-# This vhost only bounces plain HTTP up to HTTPS. It serves no cgit itself,
-# every cgit directive lives in the HTTPS vhost below. To run without TLS for
-# now, convert the HTTPS vhost to port 80 and delete this whole block rather
-# than editing it, since deleting only the Redirect line would leave a vhost
-# that serves nothing.
-<VirtualHost *:80>
-    ServerName git.example.org
-
-    ErrorLog  /var/log/apache2/cgit_error.log
-    CustomLog /var/log/apache2/cgit_access.log combined
-
-    Redirect permanent / https://git.example.org/
-</VirtualHost>
-
-
-# --- HTTPS virtual host, this one serves cgit -------------------------------
-# To run without TLS for now, change this opening line to <VirtualHost *:80>,
-# delete the three SSL lines, and delete the port 80 vhost above so there is
-# only one vhost. Everything else stays the same.
-<VirtualHost *:443>
-    ServerName git.example.org
-
-    ErrorLog  /var/log/apache2/cgit_ssl_error.log
-    CustomLog /var/log/apache2/cgit_ssl_access.log combined
-
-    # TLS needs mod_ssl (a2enmod ssl). Point these at your certificate.
-    SSLEngine on
-    SSLCertificateFile    /etc/ssl/certs/git.example.org.crt
-    SSLCertificateKeyFile /etc/ssl/private/git.example.org.key
-
-    # Which config cgit reads. It falls back to the compiled-in /etc/cgitrc,
-    # the same path used here, but setting it makes the location explicit and
-    # lets you point at a per-vhost file later.
-    SetEnv CGIT_CONFIG /etc/cgitrc
-
-    # --- Security headers (needs mod_headers, a2enmod headers) --------------
-    # Set here, not in cgit, so they also cover the static assets Apache
-    # serves. script-src stays self because cgit loads only its own cgit.js,
-    # and style-src allows inline for the diffstat bars. If you enable the
-    # gravatar or libravatar avatar filter, add its host to img-src, for
-    # example https://www.gravatar.com.
-    Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'self'"
-    Header always set X-Content-Type-Options "nosniff"
-    Header always set Referrer-Policy "no-referrer"
-    # Enable only once you serve HTTPS exclusively, since it is hard to undo.
-    #Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
-
-    # --- Static assets, served directly by Apache ---------------------------
-    # These five files are the only things served off disk. Each Alias maps
-    # one URL to one file. Because they come before the ScriptAlias below, a
-    # request for /cgit.css is answered from disk and never reaches cgit.
-    # cgit.css and cgit.js are the paths cgit's HTML points at by default, so
-    # if you relocate the assets update both these Alias targets and the css,
-    # js, logo and favicon settings in cgitrc to agree.
-    Alias /cgit.css    /usr/share/cgit/cgit.css
-    Alias /cgit.js     /usr/share/cgit/cgit.js
-    Alias /cgit.png    /usr/share/cgit/cgit.png
-    Alias /favicon.ico /usr/share/cgit/favicon.ico
-    Alias /robots.txt  /usr/share/cgit/robots.txt
-
-    # Apache 2.4 denies filesystem access by default, so open the asset
-    # directory for reading.
-    <Directory "/usr/share/cgit">
-        Options None
-        AllowOverride None
-        Require all granted
-
-        # Optional. These assets rarely change, so let browsers cache them.
-        # Needs mod_expires (a2enmod expires). Safe to delete this block.
-        <IfModule mod_expires.c>
-            ExpiresActive On
-            ExpiresDefault "access plus 30 days"
-        </IfModule>
-    </Directory>
-
-    # --- cgit, the catch-all ------------------------------------------------
-    # ScriptAlias maps a URL prefix to a path, marks it executable, and
-    # forwards the rest of the URL as PATH_INFO. Mapping / makes cgit the
-    # handler for every URL the static Aliases above did not already claim.
-    #
-    # The trailing slash on cgit.cgi/ is load bearing. It tells Apache that
-    # cgit.cgi is the program and the rest of the URL is PATH_INFO. So a
-    # request for /torvalds/linux/tree/kernel?h=next runs the binary with
-    # PATH_INFO set to /torvalds/linux/tree/kernel and QUERY_STRING set to
-    # h=next. cgit derives its link base from SCRIPT_NAME, which at the domain
-    # root is / and needs no tuning. For a sub-path install see the note below.
-    ScriptAlias / /usr/lib/cgit/cgit.cgi/
-
-    <Directory "/usr/lib/cgit">
-        # Allow CGI execution here. ScriptAlias implies it, stating it makes
-        # the intent clear.
-        Options +ExecCGI
-        # Run cgit.cgi as a CGI even if it is ever reached through a plain
-        # Alias rather than ScriptAlias.
-        SetHandler cgi-script
-        AllowOverride None
-        Require all granted
-    </Directory>
-</VirtualHost>
-
-
-# --- Sub-path install, only if cgit is not at the domain root ---------------
-# To serve cgit at https://git.example.org/cgit/ instead of the root, change
-# the ScriptAlias to
-#     ScriptAlias /cgit/ /usr/lib/cgit/cgit.cgi/
-# and move the static assets under the same prefix, for example
-#     Alias /cgit/cgit.css /usr/share/cgit/cgit.css
-# SCRIPT_NAME then becomes /cgit and cgit auto-detects it. If links come out
-# wrong, pin the base in cgitrc with virtual-root=/cgit.
diff --git a/examples/servers/lighttpd.conf b/examples/servers/lighttpd.conf
deleted file mode 100644
index 3111ed0..0000000
--- a/examples/servers/lighttpd.conf
+++ /dev/null
@@ -1,132 +0,0 @@
-# lighttpd configuration for cgit.
-#
-# lighttpd runs the cgit.cgi binary directly through mod_cgi, so no FastCGI
-# bridge is needed. This is cgit's classic reference deployment, mod_cgi with
-# mod_alias and mod_setenv.
-#
-# Paths assumed below, edit them to match your install.
-#   cgit CGI binary   /usr/lib/cgit/cgit.cgi
-#   static assets     /usr/share/cgit  (cgit.css cgit.js cgit.png favicon.ico robots.txt)
-#   cgit config       /etc/cgitrc
-#   public URL        https://git.example.org/  (cgit at the domain root)
-#
-# cgit is one CGI executable. It learns the repository and the page from
-# PATH_INFO and reads page options such as h= and id= from QUERY_STRING. cgit
-# builds its own link base from SCRIPT_NAME. The five static assets are served
-# straight off disk and must never be routed through cgit.
-
-
-# --- Modules ----------------------------------------------------------------
-# Append the three modules cgit needs so the distro's base config is kept.
-# mod_alias maps URL paths onto files, mod_setenv injects CGIT_CONFIG, and
-# mod_cgi runs cgit.cgi.
-server.modules += ( "mod_alias", "mod_setenv", "mod_cgi" )
-
-
-# --- Server basics ----------------------------------------------------------
-server.port          = 80
-server.username      = "http"             # Debian and Ubuntu use www-data
-server.groupname     = "http"
-server.document-root = "/usr/share/cgit"  # a valid docroot must exist, the
-                                          # alias rules below do the routing
-server.errorlog      = "/var/log/lighttpd/error.log"
-# Access logging needs mod_accesslog. Load it and uncomment to enable.
-#server.modules     += ( "mod_accesslog" )
-#accesslog.filename  = "/var/log/lighttpd/access.log"
-
-
-# --- MIME types for the static assets ---------------------------------------
-# mod_alias serves the assets off disk, so lighttpd must know their content
-# types. Without this the stylesheet is sent as application/octet-stream and
-# the browser ignores it.
-mimetype.assign = (
-    ".css" => "text/css",
-    ".js"  => "text/javascript",
-    ".png" => "image/png",
-    ".ico" => "image/vnd.microsoft.icon",
-    ".txt" => "text/plain",
-)
-
-
-# --- Virtual host, git.example.org ------------------------------------------
-# A top-level conditional, so it matches on both the port 80 socket and the
-# optional TLS socket at the end of this file.
-$HTTP["host"] == "git.example.org" {
-
-    # Which config cgit reads. It falls back to the compiled-in /etc/cgitrc,
-    # the same path used here, but setting it makes the location explicit.
-    setenv.add-environment = ( "CGIT_CONFIG" => "/etc/cgitrc" )
-
-    # --- Security headers ---------------------------------------------------
-    # Set here, not in cgit, so they also cover the static assets lighttpd
-    # serves. script-src stays self because cgit loads only its own cgit.js,
-    # and style-src allows inline for the diffstat bars. If you enable the
-    # gravatar or libravatar avatar filter, add its host to img-src.
-    setenv.add-response-header = (
-        "Content-Security-Policy" => "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'self'",
-        "X-Content-Type-Options" => "nosniff",
-        "Referrer-Policy" => "no-referrer"
-    )
-    # Enable only once you serve HTTPS exclusively, since it is hard to undo.
-    #setenv.add-response-header += ( "Strict-Transport-Security" => "max-age=63072000; includeSubDomains" )
-
-    # Register the cgit binary as a CGI program. The key cgit.cgi matches the
-    # binary's name and the empty value means the file is itself the program,
-    # with no interpreter in front of it. This is what makes lighttpd split
-    # the trailing path off as PATH_INFO, so never drop it.
-    cgi.assign = ( "cgit.cgi" => "" )
-
-    # Routing. lighttpd's alias.url is first-match in declaration order, not
-    # longest prefix, so the five static entries must come before the / entry.
-    # If / came first it would swallow every request and recent lighttpd
-    # refuses to start. The static entries are served off disk and the / entry
-    # hands everything else to cgit.
-    #
-    # The trailing slash on cgit.cgi/ is load bearing. lighttpd builds the
-    # physical path by stripping the matched key off the front of the URL and
-    # appending the rest to the value. For the key / the remainder carries no
-    # leading slash, so without the trailing slash a request for
-    # /linux/tree/kernel/sched.c glues onto the binary name as
-    # /usr/lib/cgit/cgit.cgilinux/tree/... and 404s. The trailing slash
-    # restores the separator, giving cgit SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi
-    # and PATH_INFO /linux/tree/kernel/sched.c.
-    alias.url = (
-        "/cgit.css"    => "/usr/share/cgit/cgit.css",
-        "/cgit.js"     => "/usr/share/cgit/cgit.js",
-        "/cgit.png"    => "/usr/share/cgit/cgit.png",
-        "/favicon.ico" => "/usr/share/cgit/favicon.ico",
-        "/robots.txt"  => "/usr/share/cgit/robots.txt",
-        "/"            => "/usr/lib/cgit/cgit.cgi/",
-    )
-
-    # Served at / the SCRIPT_NAME is empty and cgit derives its link base
-    # correctly. For a sub-path install use a key without a trailing slash
-    # mapped to the binary without a trailing slash, for example
-    #     "/git" => "/usr/lib/cgit/cgit.cgi"
-    # so /git/linux/tree resolves to /usr/lib/cgit/cgit.cgi/linux/tree, giving
-    # SCRIPT_NAME /git and PATH_INFO /linux/tree. cgit auto-detects the prefix.
-    # If links come out wrong, pin it in cgitrc with virtual-root=/git.
-}
-
-
-# --- Optional HTTPS on 443 --------------------------------------------------
-# Uncomment this whole block to enable TLS. The host block above is socket
-# independent, so it serves cgit over this socket too once the crypto is set.
-#server.modules += ( "mod_openssl" )
-#
-#$SERVER["socket"] == ":443" {
-#    ssl.engine  = "enable"
-#    ssl.pemfile = "/etc/lighttpd/certs/git.example.org.crt"
-#    ssl.privkey = "/etc/lighttpd/certs/git.example.org.key"
-#    ssl.ca-file = "/etc/lighttpd/certs/git.example.org.chain.pem"
-#    ssl.openssl.ssl-conf-cmd = ( "MinProtocol" => "TLSv1.2" )
-#}
-#
-# Redirect plain HTTP to HTTPS, scoped to the port 80 socket. Needs
-# mod_redirect.
-#server.modules += ( "mod_redirect" )
-#$SERVER["socket"] == ":80" {
-#    $HTTP["host"] == "git.example.org" {
-#        url.redirect = ( "^/(.*)" => "https://git.example.org/$1" )
-#    }
-#}
diff --git a/examples/servers/nginx.conf b/examples/servers/nginx.conf
deleted file mode 100644
index 76ac260..0000000
--- a/examples/servers/nginx.conf
+++ /dev/null
@@ -1,193 +0,0 @@
-# nginx configuration for cgit.
-#
-# nginx cannot run CGI programs itself, so a small bridge called fcgiwrap
-# runs the cgit.cgi binary and speaks FastCGI to nginx. Starting fcgiwrap is
-# covered in the notes at the end of this file.
-#
-# Paths assumed below, edit them to match your install.
-#   cgit CGI binary   /usr/lib/cgit/cgit.cgi
-#   static assets     /usr/share/cgit  (cgit.css cgit.js cgit.png favicon.ico robots.txt)
-#   cgit config       /etc/cgitrc
-#   public URL        https://git.example.org/  (cgit at the domain root)
-#
-# cgit is one CGI executable. It learns the repository and the page from
-# PATH_INFO and reads page options such as h= and id= from QUERY_STRING, so
-# nginx must pass PATH_INFO through to the binary. cgit builds its own link
-# base from SCRIPT_NAME. The five static assets are served straight off disk
-# and must never be routed through cgit. Passing PATH_INFO through is the
-# single most important part of the config below.
-
-
-# --- Optional HTTP to HTTPS redirect ----------------------------------------
-# Delete this whole server block if you serve plain HTTP only.
-server {
-    listen      80;
-    listen      [::]:80;
-    server_name git.example.org;
-
-    # ACME http-01 challenge files, if you use certbot in webroot mode.
-    location ^~ /.well-known/acme-challenge/ {
-        root /var/www/html;
-    }
-
-    # Everything else moves to HTTPS.
-    location / {
-        return 301 https://$host$request_uri;
-    }
-}
-
-
-# --- Main site --------------------------------------------------------------
-# Written for TLS on 443. For a quick plain-HTTP test, change the two listen
-# lines to port 80, delete the redirect block above, and delete the four ssl
-# lines below. Everything else stays the same.
-server {
-    listen      443 ssl;
-    listen      [::]:443 ssl;
-    http2       on;
-    server_name git.example.org;
-
-    ssl_certificate     /etc/letsencrypt/live/git.example.org/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/git.example.org/privkey.pem;
-    ssl_protocols       TLSv1.2 TLSv1.3;
-    ssl_ciphers         HIGH:!aNULL:!MD5;
-
-    # --- Security headers ---------------------------------------------------
-    # These sit here, not in cgit, because they must also cover the static
-    # assets nginx serves directly. cgit loads only its own /cgit.js and uses
-    # inline style on the diffstat bars, so script-src stays self while
-    # style-src allows inline. always applies them to error responses too. If
-    # you enable the gravatar or libravatar avatar filter, add its host to
-    # img-src, for example https://www.gravatar.com or https://seccdn.libravatar.org.
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; base-uri 'none'; frame-ancestors 'self'" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header Referrer-Policy "no-referrer" always;
-    # Enable only once you serve HTTPS exclusively, since it is hard to undo.
-    #add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
-
-    # The document root is the directory that holds the static assets. cgit
-    # emits absolute links to /cgit.css and /cgit.png by default, so those
-    # files must resolve at the root of the URL space. Pointing root at the
-    # asset directory makes /cgit.css map to /usr/share/cgit/cgit.css.
-    root /usr/share/cgit;
-
-    # Upload cap for large form posts. Snapshots are generated rather than
-    # uploaded, so this does not limit them.
-    client_max_body_size 64m;
-
-    access_log /var/log/nginx/cgit.access.log;
-    error_log  /var/log/nginx/cgit.error.log;
-
-    # --- Static assets, served directly -------------------------------------
-    # Match the assets by their exact root-level names, never by bare
-    # extension. cgit routes on PATH_INFO and a repository can hold files
-    # ending in .css or .png, so /myrepo/tree/style.css and /myrepo/plain/
-    # logo.png are real cgit URLs. A broad extension match would capture
-    # those, look for them on disk, and return 404 before cgit could render
-    # them. Anchoring the regex at the start of the path matches /cgit.css but
-    # not /myrepo/tree/cgit.css, so it can never shadow a repository file. An
-    # nginx regex location is matched before the prefix location below, so
-    # these assets win for their exact URLs and cgit wins for the rest.
-    location ~ ^/(cgit\.css|cgit\.js|cgit\.png|favicon\.ico|robots\.txt)$ {
-        expires    30d;
-        access_log off;
-        try_files  $uri =404;
-    }
-
-    # --- cgit, the catch-all ------------------------------------------------
-    # Everything that is not a static asset above is a cgit URL, the repo
-    # index, a repository, a page within a repository, a snapshot, a feed.
-    location / {
-        # nginx's standard FastCGI parameters, some of which are overridden
-        # below. A later fastcgi_param wins, so include order does not matter.
-        include fastcgi_params;
-
-        # The program fcgiwrap runs. It must be the cgit binary itself, not
-        # $document_root$fastcgi_script_name, which would try to run a repo
-        # path and is the usual cause of a failed request.
-        fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;
-
-        # cgit builds its link base, the virtual root, from SCRIPT_NAME. The
-        # stock parameters set SCRIPT_NAME to the whole request path, which
-        # would make cgit prepend that path to every link. Served at the
-        # domain root the script has no prefix, so force SCRIPT_NAME empty and
-        # cgit uses / as its base. A sub-path install sets it instead, see the
-        # end of this file.
-        fastcgi_param SCRIPT_NAME  "";
-
-        # How cgit learns the repository and page. At the domain root the
-        # whole request path is the PATH_INFO.
-        fastcgi_param PATH_INFO    $uri;
-
-        # Page options such as h=branch, id=sha and the snapshot format.
-        fastcgi_param QUERY_STRING $query_string;
-
-        # Where the static assets live, kept consistent with root above.
-        fastcgi_param DOCUMENT_ROOT $document_root;
-
-        # The browser's Host header, so cgit builds clone URLs against the
-        # name the visitor used rather than server_name.
-        fastcgi_param HTTP_HOST    $http_host;
-
-        # Which config cgit reads. It checks CGIT_CONFIG and falls back to the
-        # compiled-in /etc/cgitrc. Setting it makes the location explicit and
-        # lets you move cgitrc without recompiling.
-        fastcgi_param CGIT_CONFIG  /etc/cgitrc;
-
-        # The real scheme, so cgit builds correct https clone URLs.
-        fastcgi_param HTTPS        $https if_not_empty;
-
-        # Hand off to the fcgiwrap socket. See the notes for how to create it.
-        # A TCP fcgiwrap would use for example 127.0.0.1:9000 here.
-        fastcgi_pass unix:/run/fcgiwrap.socket;
-
-        # Large outputs such as snapshot tarballs and blame on big files can
-        # take a while, so give cgit room and stream rather than buffer.
-        fastcgi_read_timeout 300s;
-        fastcgi_buffering off;
-    }
-}
-
-
-# --- Notes, starting fcgiwrap -----------------------------------------------
-# cgit is a CGI binary and fcgiwrap is the CGI to FastCGI bridge nginx talks
-# to. On Debian and Ubuntu the packaged systemd socket provides
-# /run/fcgiwrap.socket, so enabling it is enough.
-#     apt install fcgiwrap
-#     systemctl enable --now fcgiwrap.socket
-# The socket must be readable by nginx's user. The packaged unit runs fcgiwrap
-# as www-data, which nginx also uses on those systems. Without systemd you can
-# run
-#     spawn-fcgi -s /run/fcgiwrap.socket -M 660 -- /usr/sbin/fcgiwrap
-# or run fcgiwrap over TCP and point fastcgi_pass at 127.0.0.1:9000.
-
-
-# --- Alternative, serving cgit under a sub-path -----------------------------
-# To serve cgit at https://git.example.org/cgit/ instead of the root, split
-# the URL so SCRIPT_NAME is the prefix and PATH_INFO is the rest.
-#
-#     location /cgit/ {
-#         include fastcgi_params;
-#         fastcgi_split_path_info ^(/cgit)(/.*)$;
-#         fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;
-#         fastcgi_param SCRIPT_NAME     $fastcgi_script_name;
-#         fastcgi_param PATH_INFO       $fastcgi_path_info;
-#         fastcgi_param QUERY_STRING    $query_string;
-#         fastcgi_param HTTP_HOST       $http_host;
-#         fastcgi_param CGIT_CONFIG     /etc/cgitrc;
-#         fastcgi_param HTTPS           $https if_not_empty;
-#         fastcgi_pass  unix:/run/fcgiwrap.socket;
-#     }
-#
-# Serve the assets from the sub-path too, again anchored to the exact names.
-#
-#     location ~ ^/cgit/(cgit\.css|cgit\.js|cgit\.png|favicon\.ico|robots\.txt)$ {
-#         alias /usr/share/cgit/$1;
-#         expires 30d;
-#         access_log off;
-#     }
-#
-# cgit's default css=/cgit.css and logo=/cgit.png point at the domain root, so
-# under a sub-path also set css=/cgit/cgit.css and logo=/cgit/cgit.png in
-# cgitrc. cgit derives the /cgit prefix from SCRIPT_NAME. If links come out
-# wrong, pin it in cgitrc with virtual-root=/cgit/.
diff --git a/extensions/about-render.lua b/extensions/about-render.lua
deleted file mode 100644
index 073b531..0000000
--- a/extensions/about-render.lua
+++ /dev/null
@@ -1,592 +0,0 @@
--- Server-side about-page rendering for cgit, used with the about-filter setting
--- in cgitrc and the lua: prefix so it runs in cgit's embedded interpreter with
--- no per-request process.
---
---     about-filter=lua:/usr/lib/cgit/filters/about-render.lua
---
--- One filter renders the three baseline about formats, chosen by the readme's
--- file extension.
---
---     markdown   .md .markdown .mkd .mdown
---     man page   .1 through .9 and .man
---     plain text everything else, and the fallback for anything that fails
---
--- Add a format by giving it a render function and a row in the handler table
--- near the foot of this file. Nothing else needs to change.
---
--- SUPPORTED LUA
---
--- Lua 5.1 through 5.4 and LuaJIT.
---
--- REQUIREMENTS
---
--- lpeg, the parsing module, for the Lua cgit is linked against. Markdown and
--- man pages are parsed with lpeg grammars, so without lpeg both fall back to
--- escaped plain text. It ships with cgit's syntax highlighter too, so a cgit
--- that colours source already has it.
---
---     # Debian and Ubuntu
---     sudo apt install lua-lpeg
---     # Fedora
---     sudo dnf install lua-lpeg
---     # Alpine
---     sudo apk add lua5.1-lpeg
---     # or with LuaRocks, matched to your Lua version
---     sudo luarocks --lua-version 5.1 install lpeg
---
--- Plain text needs only Lua itself.
---
--- SECURITY
---
--- The about page renders untrusted repository content, so the safety rule is
--- that every run of text reaches the page through cgit's own html_txt, every
--- attribute value through html_attr, and every link or image target through
--- the safe_url scheme allowlist below before html_attr. Only http, https,
--- mailto and relative targets survive, so a hostile readme cannot inject markup
--- or a javascript: url. Because all output is routed through those sinks by
--- construction, a bug in the parser can only mis-render, never inject.
---
--- LIMITATIONS
---
--- Markdown is a deliberate subset, not CommonMark. Headings, thematic breaks,
--- fenced and inline code, blockquotes, pipe tables, single-level lists, links,
--- images and emphasis. No reference links, no raw HTML passthrough, no nested
--- lists, no setext headings. Emphasis does not span a hard line break inside a
--- paragraph. Man rendering covers the common macros (section headings, filled
--- and no-fill paragraphs, bold and italic, font escapes) and drops the rest.
--- cgit sends filter output through a C string sink that stops at the first NUL
--- byte, so content past a NUL is truncated.
---
--- OUTPUT
---
--- Markdown is wrapped in <div class='markdown'>, man pages in
--- <div class='markdown manpage'>, plain text in <pre class='plaintext'>, all
--- styled by assets/cgit.css.
-
-local ok_lpeg, lpeg = pcall(require, "lpeg")
-
-
--- ===== configuration ===================================================
-
--- Readmes larger than this are served as escaped plain text rather than parsed.
-local max_bytes = 512 * 1024
-
--- Ceiling on blockquote and emphasis nesting, so a hostile readme of stacked
--- markers cannot drive the recursive parser into a stack overflow.
-local max_depth = 24
-
-local filename, chunks = "", {}
-
-
--- ===== helpers =========================================================
-
-local function trim(s)
-	return (s:gsub("^%s+", ""):gsub("%s+$", ""))
-end
-
--- Split on newlines after normalising CRLF and CR, returning the lines without
--- their terminators. A trailing newline yields a final empty line, which every
--- caller treats as blank.
-local function split_lines(s)
-	s = s:gsub("\r\n?", "\n")
-	local lines, start = {}, 1
-	while true do
-		local nl = s:find("\n", start, true)
-		if not nl then
-			lines[#lines + 1] = s:sub(start)
-			return lines
-		end
-		lines[#lines + 1] = s:sub(start, nl - 1)
-		start = nl + 1
-	end
-end
-
--- Split a table row into trimmed cells, dropping one optional leading and
--- trailing pipe.
-local function split_cells(row)
-	row = trim(row):gsub("^|", ""):gsub("|$", "")
-	local cells = {}
-	for c in (row .. "|"):gmatch("(.-)|") do
-		cells[#cells + 1] = trim(c)
-	end
-	return cells
-end
-
--- Return the url if its scheme is safe, else nil. Control and whitespace bytes
--- are stripped anywhere first because a browser ignores them when resolving the
--- scheme, so "java\nscript:" must still be caught as javascript. The class is
--- %c%s rather than a literal 0x00 range so it is safe on Lua 5.1, where an
--- embedded zero byte ends a pattern.
-local function safe_url(url)
-	url = url:gsub("[%c%s]", "")
-	-- A leading "//" or "/\" is scheme-relative, which a browser resolves to
-	-- another origin, so it is not the local target the parser meant to allow.
-	if url:sub(1, 2) == "//" or url:sub(1, 2) == "/\\" then
-		return nil
-	end
-	local scheme = url:match("^(%a[%w%+%.%-]*):")
-	if scheme then
-		scheme = scheme:lower()
-		if scheme ~= "http" and scheme ~= "https" and scheme ~= "mailto" then
-			return nil
-		end
-	end
-	return url
-end
-
-
--- ===== emit ============================================================
--- html, html_txt and html_attr are injected by cgit's lua filter host. Tag
--- scaffolding is a literal argument to html; every value that came from the
--- repository goes through html_txt, html_attr or safe_url.
-
-local emit_inline
-
-emit_inline = function(list)
-	for _, nd in ipairs(list) do
-		local t = nd.t
-		if t == "text" then
-			html_txt(nd.v)
-		elseif t == "code" then
-			html("<code>"); html_txt(nd.v); html("</code>")
-		elseif t == "strong" then
-			html("<strong>"); emit_inline(nd.kids); html("</strong>")
-		elseif t == "em" then
-			html("<em>"); emit_inline(nd.kids); html("</em>")
-		elseif t == "link" then
-			local u = safe_url(nd.url)
-			if u then
-				html("<a href='"); html_attr(u); html("'>")
-				emit_inline(nd.kids)
-				html("</a>")
-			else
-				emit_inline(nd.kids)
-			end
-		elseif t == "image" then
-			local u = safe_url(nd.url)
-			if u then
-				html("<img src='"); html_attr(u)
-				html("' alt='"); html_attr(nd.alt); html("'/>")
-			else
-				html_txt("![" .. nd.alt .. "]")
-			end
-		end
-	end
-end
-
-local emit_blocks
-
-emit_blocks = function(blocks)
-	for _, b in ipairs(blocks) do
-		local t = b.t
-		if t == "heading" then
-			html("<h" .. b.level .. ">")
-			emit_inline(b.kids)
-			html("</h" .. b.level .. ">")
-		elseif t == "hr" then
-			html("<hr/>")
-		elseif t == "code" then
-			html("<pre><code")
-			if b.lang and b.lang ~= "" then
-				html(" data-lang='"); html_attr(b.lang); html("'")
-			end
-			html(">"); html_txt(b.text); html("</code></pre>")
-		elseif t == "blockquote" then
-			html("<blockquote>"); emit_blocks(b.blocks); html("</blockquote>")
-		elseif t == "table" then
-			html("<table><thead><tr>")
-			for _, c in ipairs(b.head) do
-				html("<th>"); emit_inline(c); html("</th>")
-			end
-			html("</tr></thead><tbody>")
-			for _, row in ipairs(b.rows) do
-				html("<tr>")
-				for _, c in ipairs(row) do
-					html("<td>"); emit_inline(c); html("</td>")
-				end
-				html("</tr>")
-			end
-			html("</tbody></table>")
-		elseif t == "list" then
-			local tag = b.ordered and "ol" or "ul"
-			html("<" .. tag .. ">")
-			for _, item in ipairs(b.items) do
-				html("<li>"); emit_inline(item); html("</li>")
-			end
-			html("</" .. tag .. ">")
-		elseif t == "para" then
-			html("<p>")
-			for k, line in ipairs(b.lines) do
-				if k > 1 then html("<br/>") end
-				emit_inline(line)
-			end
-			html("</p>")
-		end
-	end
-end
-
-
--- ===== plain text ======================================================
-
-local function render_plaintext(text)
-	html("<pre class='plaintext'>")
-	html_txt(text)
-	html("</pre>")
-end
-
-
--- ===== markdown and man ================================================
--- Both are parsed with lpeg into the block/inline node trees emit_blocks and
--- emit_inline above consume. Parsing is pure and builds a tree; emit is the
--- only step that writes output, so a parse failure falls back to plain text
--- without leaving half a page behind.
-
-local render_markdown, render_man
-
-if ok_lpeg then
-	local P, R, S, C, Ct = lpeg.P, lpeg.R, lpeg.S, lpeg.C, lpeg.Ct
-
-	local sp = S(" \t")
-	local ws = S(" \t\r\n\f\v")
-	local eol = P(-1)
-
-	-- ----- markdown inline -----
-	local marker = S("`![*_")
-	local urlchar = 1 - S(")") - ws
-	-- Bound the link and image inner scans. Without a cap a readme of unclosed
-	-- brackets ("[[[[...") makes each position scan to end of line for a "]"
-	-- that never comes, which is quadratic. Real link text and urls sit far
-	-- under this, and anything longer simply renders as plain text.
-	local CAP = 512
-
-	local parse_inline
-	local inline_depth = 0
-
-	local function node_text(s) return { t = "text", v = s } end
-	local function node_code(s) return { t = "code", v = s } end
-	local function node_strong(s) return { t = "strong", kids = parse_inline(s) } end
-	local function node_em(s) return { t = "em", kids = parse_inline(s) } end
-	local function node_link(text, url) return { t = "link", kids = parse_inline(text), url = url } end
-	local function node_image(alt, url) return { t = "image", alt = alt, url = url } end
-
-	local inline_grammar = Ct((
-		  (P("`") * C((1 - P("`")) ^ 1) * P("`")) / node_code
-		+ (P("![") * C((1 - P("]")) ^ (-CAP)) * P("]") * P("(") * sp ^ 0
-			* C(urlchar * urlchar ^ (-CAP)) * (1 - P(")")) ^ (-CAP) * P(")")) / node_image
-		+ (P("[") * C((1 - P("]")) ^ (-CAP)) * P("]") * P("(") * sp ^ 0
-			* C(urlchar * urlchar ^ (-CAP)) * (1 - P(")")) ^ (-CAP) * P(")")) / node_link
-		+ (P("**") * C((1 - P("**")) ^ 1) * P("**")) / node_strong
-		+ (P("__") * C((1 - P("__")) ^ 1) * P("__")) / node_strong
-		+ (P("*") * C((1 - ws) * (1 - P("*")) ^ 0) * P("*")) / node_em
-		+ (P("_") * C((1 - ws) * (1 - P("_")) ^ 0) * P("_")) / node_em
-		+ C((1 - marker) ^ 1) / node_text
-		+ C(P(1)) / node_text
-	) ^ 0)
-
-	parse_inline = function(s)
-		if inline_depth >= max_depth then
-			return { node_text(s) }
-		end
-		inline_depth = inline_depth + 1
-		local nodes = inline_grammar:match(s) or { node_text(s) }
-		inline_depth = inline_depth - 1
-		return nodes
-	end
-
-	-- ----- markdown blocks -----
-	-- Line matchers. Each is anchored at the start of a single line and returns
-	-- its captures, or nil when the line is not of that kind.
-	local langchar = R("az", "AZ", "09") + S("_.+#-")
-	local m_heading = C(P("#") * P("#") ^ -5) * sp ^ 1 * C(P(1) ^ 0)
-	local function rule(c) return sp ^ 0 * P(c) * (sp ^ 0 * P(c)) ^ 2 * sp ^ 0 * eol end
-	local m_hr = rule("-") + rule("*") + rule("_")
-	local m_fence = sp ^ 0 * (C(P("`") ^ 3) + C(P("~") ^ 3)) * sp ^ 0 * C(langchar ^ 0)
-	local m_close_bt = sp ^ 0 * P("`") ^ 3 * sp ^ 0 * eol
-	local m_close_ti = sp ^ 0 * P("~") ^ 3 * sp ^ 0 * eol
-	local m_bq = sp ^ 0 * P(">")
-	local bullet = S("-*+")
-	local number = R("09") ^ 1 * S(".)")
-	local m_item = sp ^ 0 * C(bullet + number) * sp ^ 1 * C(P(1) ^ 0)
-	local dcell = sp ^ 0 * P(":") ^ -1 * P("-") ^ 1 * P(":") ^ -1 * sp ^ 0
-	-- A delimiter row is dash-cells joined by pipes. Require at least one pipe,
-	-- a leading one or one between cells, so a bare rule of dashes stays a
-	-- thematic break and an ordinary paragraph line is never taken for a table.
-	local pipe = P("|")
-	local m_tdelim = sp ^ 0 * (
-		  pipe * dcell * (pipe * dcell) ^ 0 * pipe ^ -1
-		+ dcell * (pipe * dcell) ^ 1 * pipe ^ -1
-	) * sp ^ 0 * eol
-	local m_blockstart = sp ^ 0 * ((P("#") * P("#") ^ -5 * sp) + P(">")
-		+ P("`") ^ 3 + P("~") ^ 3 + ((bullet + number) * sp))
-
-	local function ordered(mark) return mark:match("%d") ~= nil end
-
-	local parse_blocks
-
-	parse_blocks = function(lines, depth)
-		local blocks, i, n = {}, 1, #lines
-		while i <= n do
-			local line = lines[i]
-			local fence, lang = m_fence:match(line)
-			local hashes, htext = m_heading:match(line)
-			local mark = m_item:match(line)
-			if line:match("^%s*$") then
-				i = i + 1
-			elseif fence then
-				local close = (fence:sub(1, 1) == "`") and m_close_bt or m_close_ti
-				local code = {}
-				i = i + 1
-				while i <= n and not close:match(lines[i]) do
-					code[#code + 1] = lines[i]; i = i + 1
-				end
-				i = i + 1
-				local body = table.concat(code, "\n")
-				if #code > 0 then body = body .. "\n" end
-				blocks[#blocks + 1] = { t = "code", lang = lang, text = body }
-			elseif hashes then
-				blocks[#blocks + 1] = {
-					t = "heading",
-					level = #hashes,
-					kids = parse_inline((htext:gsub("%s*#*%s*$", ""))),
-				}
-				i = i + 1
-			elseif m_hr:match(line) then
-				blocks[#blocks + 1] = { t = "hr" }
-				i = i + 1
-			elseif m_bq:match(line) then
-				local inner = {}
-				while i <= n and m_bq:match(lines[i]) do
-					inner[#inner + 1] = (lines[i]:gsub("^%s*>%s?", ""))
-					i = i + 1
-				end
-				if depth < max_depth then
-					blocks[#blocks + 1] = { t = "blockquote", blocks = parse_blocks(inner, depth + 1) }
-				else
-					local para = {}
-					for _, l in ipairs(inner) do para[#para + 1] = parse_inline(l) end
-					blocks[#blocks + 1] = { t = "para", lines = para }
-				end
-			elseif i + 1 <= n and line:find("|", 1, true) and m_tdelim:match(lines[i + 1]) then
-				local head = {}
-				for _, c in ipairs(split_cells(line)) do head[#head + 1] = parse_inline(c) end
-				local rows = {}
-				i = i + 2
-				while i <= n and lines[i]:find("|", 1, true) and not lines[i]:match("^%s*$") do
-					local row = {}
-					for _, c in ipairs(split_cells(lines[i])) do row[#row + 1] = parse_inline(c) end
-					rows[#rows + 1] = row
-					i = i + 1
-				end
-				blocks[#blocks + 1] = { t = "table", head = head, rows = rows }
-			elseif mark then
-				local is_ol = ordered(mark)
-				local items = {}
-				while i <= n do
-					local mk, ct = m_item:match(lines[i])
-					if not mk or ordered(mk) ~= is_ol then break end
-					items[#items + 1] = parse_inline(ct)
-					i = i + 1
-				end
-				blocks[#blocks + 1] = { t = "list", ordered = is_ol, items = items }
-			else
-				local para = { parse_inline(line) }
-				i = i + 1
-				while i <= n and not lines[i]:match("^%s*$") and not m_blockstart:match(lines[i]) do
-					para[#para + 1] = parse_inline(lines[i]); i = i + 1
-				end
-				blocks[#blocks + 1] = { t = "para", lines = para }
-			end
-		end
-		return blocks
-	end
-
-	render_markdown = function(text)
-		if #text > max_bytes then
-			return render_plaintext(text)
-		end
-		local ok, blocks = pcall(parse_blocks, split_lines(text), 0)
-		if not ok then
-			return render_plaintext(text)
-		end
-		html("<div class='markdown'>")
-		-- Emit is wrapped so a parser bug can at worst truncate the page, never
-		-- error out and let the outer fallback duplicate what was already sent.
-		pcall(emit_blocks, blocks)
-		html("</div>")
-	end
-
-	-- ----- man pages -----
-	-- Macro lines are matched with lpeg, and the roff inline font and character
-	-- escapes are an lpeg grammar producing a flat token list that a fold turns
-	-- into the same inline nodes markdown emits. Bold and italic are the current
-	-- font, which carries across a run, so the inline pass tokenises and folds
-	-- rather than nesting the way markdown does.
-	local m_macro = S(".'") * sp ^ 0 * C((1 - sp) ^ 1) * sp ^ 0 * C(P(1) ^ 0)
-
-	local one_font = { B = "B", I = "I" }
-	local two_font = { CB = "B", BI = "B", CI = "I" }
-	local man_chars = {
-		aq = "'", cq = "'", oq = "'", dq = '"', lq = '"', rq = '"',
-		hy = "-", en = "-", em = "-",
-	}
-	local esc = P("\\")
-	local function font_tok(f) return { k = "font", f = f } end
-	local function text_tok(v) return { k = "text", v = v } end
-	local skip_tok = { k = "skip" }
-
-	local man_inline_grammar = Ct((
-		  (esc * P("f") * P("(") * C(P(1) * P(1))) / function(nm) return font_tok(two_font[nm] or "R") end
-		+ (esc * P("f") * P("[") * C((1 - P("]")) ^ 0) * P("]")) / function(nm) return font_tok(one_font[nm] or "R") end
-		+ (esc * P("f") * C(P(1))) / function(f) return font_tok(one_font[f] or "R") end
-		+ (esc * P("-")) / function() return text_tok("-") end
-		+ (esc * P("e")) / function() return text_tok("\\") end
-		+ (esc * P(" ")) / function() return text_tok(" ") end
-		+ (esc * S("&|^")) / function() return skip_tok end
-		+ (esc * P("(") * C(P(1) * P(1))) / function(nm) return text_tok(man_chars[nm] or "") end
-		+ (esc * P("*") * (P("(") * P(1) * P(1) + P(1))) / function() return skip_tok end
-		+ (esc * C(P(1))) / text_tok
-		+ esc / function() return skip_tok end
-		+ C((1 - esc) ^ 1) / text_tok
-	) ^ 0)
-
-	local function man_inline(s)
-		local toks = man_inline_grammar:match(s) or {}
-		local nodes, buf, font = {}, {}, "R"
-		local function flush()
-			if #buf == 0 then return end
-			local txt = table.concat(buf); buf = {}
-			if txt == "" then return end
-			if font == "B" then
-				nodes[#nodes + 1] = { t = "strong", kids = { { t = "text", v = txt } } }
-			elseif font == "I" then
-				nodes[#nodes + 1] = { t = "em", kids = { { t = "text", v = txt } } }
-			else
-				nodes[#nodes + 1] = { t = "text", v = txt }
-			end
-		end
-		for _, tk in ipairs(toks) do
-			if tk.k == "text" then
-				buf[#buf + 1] = tk.v
-			elseif tk.k == "font" then
-				flush(); font = tk.f
-			end
-		end
-		flush()
-		return nodes
-	end
-
-	local function parse_man(text)
-		local lines = split_lines(text)
-		local blocks = {}
-		local para, pre, nofill = nil, nil, false
-		local function flush_para()
-			if para and #para > 0 then
-				blocks[#blocks + 1] = { t = "para", lines = para }
-			end
-			para = nil
-		end
-		local function flush_pre()
-			if pre then
-				local body = table.concat(pre, "\n")
-				if #pre > 0 then body = body .. "\n" end
-				blocks[#blocks + 1] = { t = "code", text = body }
-				pre = nil
-			end
-		end
-		local function add_line(nodes)
-			para = para or {}
-			para[#para + 1] = nodes
-		end
-		for _, line in ipairs(lines) do
-			local macro, rest = m_macro:match(line)
-			if rest then rest = (rest:gsub('^"(.*)"$', "%1")) end
-			if nofill then
-				if macro == "fi" then
-					nofill = false; flush_pre()
-				else
-					pre[#pre + 1] = line
-				end
-			elseif line:match("^%s*$") then
-				flush_para()
-			elseif macro and macro:sub(1, 1) == "\\" then
-				-- roff comment, dropped
-			elseif macro == "SH" or macro == "SS" then
-				flush_para()
-				blocks[#blocks + 1] = {
-					t = "heading",
-					level = (macro == "SH") and 2 or 3,
-					kids = man_inline(rest),
-				}
-			elseif macro == "nf" then
-				flush_para(); nofill = true; pre = {}
-			elseif macro == "fi" then
-				flush_pre()
-			elseif macro == "B" or macro == "BR" or macro == "RB"
-			    or macro == "BI" or macro == "IB" then
-				add_line({ { t = "strong", kids = man_inline(rest) } })
-			elseif macro == "I" or macro == "IR" or macro == "RI" then
-				add_line({ { t = "em", kids = man_inline(rest) } })
-			elseif macro == "TH" or macro == "PP" or macro == "LP"
-			    or macro == "P" or macro == "TP" or macro == "IP"
-			    or macro == "HP" or macro == "RS" or macro == "RE"
-			    or macro == "sp" or macro == "br" then
-				flush_para()
-			elseif macro then
-				if rest ~= "" then add_line(man_inline(rest)) end
-			else
-				add_line(man_inline(line))
-			end
-		end
-		flush_para(); flush_pre()
-		return blocks
-	end
-
-	render_man = function(text)
-		if #text > max_bytes then
-			return render_plaintext(text)
-		end
-		local ok, blocks = pcall(parse_man, text)
-		if not ok then
-			return render_plaintext(text)
-		end
-		html("<div class='markdown manpage'>")
-		pcall(emit_blocks, blocks)
-		html("</div>")
-	end
-else
-	-- No lpeg, so markdown and man readmes read as escaped source, not nothing.
-	render_markdown = render_plaintext
-	render_man = render_plaintext
-end
-
-
--- ===== dispatch ========================================================
-
-local handlers = {}
-for _, ext in ipairs({ "md", "markdown", "mkd", "mdown" }) do
-	handlers[ext] = render_markdown
-end
-for _, ext in ipairs({ "1", "2", "3", "4", "5", "6", "7", "8", "9", "man" }) do
-	handlers[ext] = render_man
-end
-
-function filter_open(name)
-	filename = name or ""
-	chunks = {}
-end
-
-function filter_write(str)
-	chunks[#chunks + 1] = str
-end
-
-function filter_close()
-	local text = table.concat(chunks)
-	chunks = {}
-	local ext = (filename:match("%.([^.]+)$") or ""):lower()
-	local render = handlers[ext] or render_plaintext
-	local ok = pcall(render, text)
-	if not ok then
-		render_plaintext(text)
-	end
-	return 0
-end
diff --git a/extensions/auth-file.lua b/extensions/auth-file.lua
deleted file mode 100644
index 5415ca7..0000000
--- a/extensions/auth-file.lua
+++ /dev/null
@@ -1,556 +0,0 @@
--- cgit auth-filter that gates repositories behind a login form and a signed
--- session cookie.
---
--- This is the FILE-BACKED variant. The user accounts, the groups, and the
--- per-repository access lists are read from files on disk, whose paths are set
--- in the CONFIGURATION block below. Edit those files without touching this
--- script. This suits larger or externally managed user sets.
---
--- The companion auth-inline.lua behaves identically but keeps its accounts and
--- access lists inline in the script itself, which suits a small fixed set of
--- users.
---
--- Enable it in cgitrc with
---     auth-filter=lua:/path/to/auth-file.lua
---
--- SUPPORTED LUA
---
--- Lua 5.1, 5.2, 5.3, 5.4 and LuaJIT. Lua 5.5 is not supported, because luaossl
--- has no 5.5 build. Match the runtime to the Lua that cgit is built against.
---
--- HTTPS IS RECOMMENDED
---
--- Serve cgit over HTTPS. Terminate TLS at the web server in front of cgit. The
--- session cookie is marked Secure by default, so a browser only sends it back
--- over HTTPS. If you genuinely run cgit over plain HTTP with no TLS anywhere,
--- set cookie_insecure below, otherwise the cookie is never returned and login
--- appears to loop.
---
--- DEPENDENCIES
---
---     luaossl    OpenSSL binding, provides openssl.rand and openssl.hmac
---                <https://github.com/wahern/luaossl>
---     luaposix   POSIX binding, provides posix.sys.stat and posix.unistd
---                <https://github.com/luaposix/luaposix>
---
--- The reliable cross-platform install is LuaRocks, matched to your Lua
--- version. luaossl also needs the OpenSSL development headers present.
---
---     # Debian and Ubuntu
---     sudo apt install luarocks libssl-dev
---     sudo luarocks --lua-version 5.1 install luaossl
---     sudo luarocks --lua-version 5.1 install luaposix
---
---     # Fedora
---     sudo dnf install luarocks openssl-devel
---     sudo luarocks --lua-version 5.1 install luaossl luaposix
---
---     # Alpine
---     sudo apk add luarocks openssl-dev
---     sudo luarocks-5.1 install luaossl luaposix
---
---     # macOS with Homebrew
---     brew install luarocks openssl
---     luarocks install luaossl OPENSSL_DIR="$(brew --prefix openssl)"
---     luarocks install luaposix
---
--- Some distributions also package these, for example lua-luaossl and lua-posix
--- on Debian. If you use a distribution package, make sure it is built for the
--- same Lua version as cgit.
---
--- SECURITY NOTES
---
--- The cookie carries only a username with no server-side session store, so
--- deleting an account does not revoke a cookie already issued until it
--- expires, and instances that share a secret file accept each other's cookies.
--- The login form carries no CSRF token. Both are acceptable for gating read
--- access to a git browser. Weigh them before guarding anything more sensitive.
-
-local sysstat = require("posix.sys.stat")
-local unistd = require("posix.unistd")
-local rand = require("openssl.rand")
-local hmac = require("openssl.hmac")
-
---
--- ========================= CONFIGURATION =========================
--- Edit the values in this block. Nothing below it needs changing for
--- ordinary use.
---
-
--- Accounts, one per line, as username:hash. Generate a hash with
---     mkpasswd -m sha-512 -R 300000
--- This file should not be world-readable.
-local users_filename = "/etc/cgit-auth/users"
-
--- Group membership, one per line, as groupname:user1,user2,user3,...
-local groups_filename = "/etc/cgit-auth/groups"
-
--- Per-repository access, one per line, as reponame:group1,group2,...
--- A repository listed here is protected. One not listed is public.
-local repos_filename = "/etc/cgit-auth/repos"
-
--- Where the cookie-signing secret is stored. It is created on first use. It
--- must be persistent and writable by cgit. Prefer a path OUTSIDE the cache
--- root, because pruning the cache would delete a secret kept inside it and
--- invalidate every live session. This file should not be world-readable.
-local secret_filename = "/var/cache/cgit/auth-secret"
-
--- How long a login stays valid, in seconds. Default one week.
-local session_seconds = 7 * 24 * 60 * 60
-
--- Name of the session cookie.
-local cookie_name = "cgitauth"
-
--- Path the cookie is scoped to. "/" covers the whole host. Set it to the cgit
--- root to scope the cookie more tightly.
-local cookie_path = "/"
-
--- Leave false so the cookie is marked Secure and only travels over HTTPS. Set
--- it true ONLY if cgit is served over plain HTTP with no TLS anywhere, see the
--- HTTPS note in the header.
-local cookie_insecure = false
-
---
--- =================================================================
---
-
--- A throwaway hash of the documented shape, used only to spend the same work
--- on a missing account as on a present one, so a failed login does not reveal
--- by timing whether the username exists.
-local dummy_hash = "$6$rounds=300000$0000000000000000$"
-
--- Module state shared across the open, write and close calls of one request.
-local action, http, cgit, post
-
---
---
--- Account and access-list storage. This is the ONLY part that differs from
--- auth-inline.lua. Swap these two functions to change where accounts live.
---
---
-
-local function trim(s)
-	return (string.gsub(s, "^%s*(.-)%s*$", "%1"))
-end
-
--- Return the stored password hash for a user, or nil. Reads the users file
--- fresh each call. A missing or unreadable file, and any unparsable line, are
--- skipped rather than fatal.
-function account_hash(user)
-	if user == nil then
-		return nil
-	end
-	local wanted = user:lower()
-	local f = io.open(users_filename, "r")
-	if f == nil then
-		return nil
-	end
-	for line in f:lines() do
-		local u, h = string.match(line, "(.-):(.+)")
-		if u ~= nil and trim(u):lower() == wanted then
-			f:close()
-			return h
-		end
-	end
-	f:close()
-	return nil
-end
-
--- Return the set of users allowed to access a repository, keyed by lowercased
--- username, or nil if the repository is not protected. A protected repository
--- whose groups resolve to no users returns an EMPTY table, which denies
--- everyone rather than falling through to public.
-function repo_userset(repo)
-	if repo == nil then
-		return nil
-	end
-	local groups = nil
-	local f = io.open(repos_filename, "r")
-	if f ~= nil then
-		for line in f:lines() do
-			local r, g = string.match(line, "(.-):(.+)")
-			if r ~= nil and trim(r) == repo then
-				groups = {}
-				for group in string.gmatch(g, "([^,]+)") do
-					groups[trim(group):lower()] = true
-				end
-				break
-			end
-		end
-		f:close()
-	end
-	if groups == nil then
-		return nil
-	end
-	local users = {}
-	local gf = io.open(groups_filename, "r")
-	if gf ~= nil then
-		for line in gf:lines() do
-			local g, u = string.match(line, "(.-):(.+)")
-			if g ~= nil and groups[trim(g):lower()] then
-				for user in string.gmatch(u, "([^,]+)") do
-					users[trim(user):lower()] = true
-				end
-			end
-		end
-		gf:close()
-	end
-	return users
-end
-
---
---
--- Utility functions based on keplerproject/wsapi.
---
---
-
-function url_decode(str)
-	if not str then
-		return ""
-	end
-	str = string.gsub(str, "+", " ")
-	str = string.gsub(str, "%%(%x%x)", function(h) return string.char(tonumber(h, 16)) end)
-	str = string.gsub(str, "\r\n", "\n")
-	return str
-end
-
-function url_encode(str)
-	if not str then
-		return ""
-	end
-	str = string.gsub(str, "\n", "\r\n")
-	str = string.gsub(str, "([^%w ])", function(c) return string.format("%%%02X", string.byte(c)) end)
-	str = string.gsub(str, " ", "+")
-	return str
-end
-
--- Parse an application/x-www-form-urlencoded body. A value may itself contain
--- '=', for example a base64 password, so the value runs to the next '&'.
-function parse_qs(qs)
-	local tab = {}
-	for key, val in string.gmatch(qs or "", "([^&=]+)=([^&]*)") do
-		tab[url_decode(key)] = url_decode(val)
-	end
-	return tab
-end
-
--- Return the value of the named cookie, or nil. The stored token was already
--- url-encoded by secure_value, so it is returned verbatim, which keeps the
--- write path (set_cookie) and the read path symmetric. Decoding it here would
--- break the signature check for any value carrying a percent escape.
-function get_cookie(cookies, name)
-	cookies = string.gsub(";" .. (cookies or "") .. ";", "%s*;%s*", ";")
-	return string.match(cookies, ";" .. name .. "=(.-);")
-end
-
-function tohex(b)
-	local x = ""
-	for i = 1, #b do
-		x = x .. string.format("%.2x", string.byte(b, i))
-	end
-	return x
-end
-
---
---
--- Cookie construction and validation helpers.
---
---
-
-local secret = nil
-
--- Load the cookie-signing secret, creating it on first use. Failures raise,
--- which cgit turns into a request error, so a broken secret denies rather than
--- signs with nothing.
-function get_secret()
-	if secret ~= nil then
-		return secret
-	end
-	local secret_file = io.open(secret_filename, "r")
-	if secret_file == nil then
-		local old_umask = sysstat.umask(63)
-		local temporary_filename = secret_filename .. ".tmp." .. tohex(rand.bytes(16))
-		local temporary_file = io.open(temporary_filename, "w")
-		if temporary_file == nil then
-			sysstat.umask(old_umask)
-			error("cgit auth: cannot create secret file " .. secret_filename)
-		end
-		local wrote = temporary_file:write(tohex(rand.bytes(32)))
-		local closed = temporary_file:close()
-		if not wrote or not closed then
-			os.remove(temporary_filename)
-			sysstat.umask(old_umask)
-			error("cgit auth: failed writing secret file " .. secret_filename)
-		end
-		unistd.link(temporary_filename, secret_filename) -- Intentionally fails if another worker won the race.
-		unistd.unlink(temporary_filename)
-		sysstat.umask(old_umask)
-		secret_file = io.open(secret_filename, "r")
-	end
-	if secret_file == nil then
-		error("cgit auth: cannot read secret file " .. secret_filename)
-	end
-	secret = secret_file:read("*l")
-	secret_file:close()
-	if secret == nil or secret:len() ~= 64 then
-		secret = nil
-		error("cgit auth: secret file " .. secret_filename .. " is malformed, expected 64 hex characters")
-	end
-	return secret
-end
-
--- A redirect target is unsafe if a browser would read it as another origin.
--- The only such form cgit can be tricked into signing is a scheme-relative
--- "//host" or "/\host". Everything else stays on this host.
-function is_safe_redirect(url)
-	if type(url) ~= "string" then
-		return false
-	end
-	local head = url:sub(1, 2)
-	if head == "//" or head == "/\\" then
-		return false
-	end
-	return true
-end
-
--- Return the value carried by a signed cookie, or nil if it does not verify.
-function validate_value(expected_field, cookie)
-	local i = 0
-	local value = ""
-	local field = ""
-	local expiration = 0
-	local salt = ""
-	local chmac = ""
-
-	if cookie == nil or cookie:len() < 3 or cookie:sub(1, 1) == "|" then
-		return nil
-	end
-
-	for component in string.gmatch(cookie, "[^|]+") do
-		if i == 0 then
-			field = component
-		elseif i == 1 then
-			value = component
-		elseif i == 2 then
-			-- The expiration must be a plain integer. Rejecting other forms
-			-- keeps the signed bytes canonical, since tonumber and tostring of
-			-- "1e9" or "100.0" differ across Lua versions.
-			if not string.match(component, "^%d+$") then
-				return nil
-			end
-			expiration = tonumber(component)
-		elseif i == 3 then
-			salt = component
-		elseif i == 4 then
-			chmac = component
-		else
-			break
-		end
-		i = i + 1
-	end
-
-	if chmac == nil or chmac:len() == 0 then
-		return nil
-	end
-
-	-- Compare the HMAC without short-circuiting on the first mismatch.
-	if not constant_equals(chmac, tohex(hmac.new(get_secret(), "sha256"):final(field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt))) then
-		return nil
-	end
-
-	-- An expiration of 0 never expires and is used for the redirect token.
-	if expiration ~= 0 and expiration <= os.time() then
-		return nil
-	end
-
-	if url_decode(field) ~= expected_field then
-		return nil
-	end
-
-	local decoded = url_decode(value)
-	-- Reject values carrying control characters so a signed value cannot
-	-- smuggle CR or LF into a response header.
-	if decoded:find("%c") then
-		return nil
-	end
-	return decoded
-end
-
-function secure_value(field, value, expiration)
-	if value == nil or value:len() <= 0 then
-		return ""
-	end
-
-	local salt = tohex(rand.bytes(16))
-	value = url_encode(value)
-	field = url_encode(field)
-	local authstr = field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt
-	authstr = authstr .. "|" .. tohex(hmac.new(get_secret(), "sha256"):final(authstr))
-	return authstr
-end
-
--- Strip control characters that could split an HTTP response header.
-function strip_ctl(s)
-	return (string.gsub(s or "", "%c", ""))
-end
-
--- Compare two strings in time that does not depend on how many leading bytes
--- match, so a mismatch position is not revealed by timing.
-function constant_equals(a, b)
-	if type(a) ~= "string" or type(b) ~= "string" or #a ~= #b then
-		return false
-	end
-	local diff = 0
-	for i = 1, #a do
-		local d = a:byte(i) - b:byte(i)
-		diff = diff + d * d
-	end
-	return diff == 0
-end
-
-function set_cookie(cookie, value)
-	local attrs = "; HttpOnly; SameSite=Lax; Path=" .. cookie_path
-	if not cookie_insecure then
-		attrs = attrs .. "; Secure"
-	end
-	if value == "" then
-		attrs = attrs .. "; Max-Age=0"
-	elseif session_seconds > 0 then
-		attrs = attrs .. "; Max-Age=" .. tostring(session_seconds)
-	end
-	html("Set-Cookie: " .. cookie .. "=" .. strip_ctl(value) .. attrs .. "\n")
-end
-
-function redirect_to(url)
-	html("Status: 302 Redirect\n")
-	html("Cache-Control: no-cache, no-store\n")
-	html("Location: " .. strip_ctl(url) .. "\n")
-end
-
-function not_found()
-	html("Status: 404 Not Found\n")
-	html("Cache-Control: no-cache, no-store\n\n")
-end
-
---
---
--- Authentication actions. Identical to auth-inline.lua from here down.
---
---
-
--- Sets HTTP cookie headers based on post and sets up redirection.
-function authenticate_post()
-	local redirect = validate_value("redirect", post["redirect"])
-
-	if redirect == nil or not is_safe_redirect(redirect) then
-		not_found()
-		return 0
-	end
-
-	redirect_to(redirect)
-
-	local username = post["username"]
-	local password = post["password"]
-	local ok = false
-	if username ~= nil and password ~= nil then
-		local hash = account_hash(username)
-		if hash == nil then
-			-- Spend the work anyway, see dummy_hash.
-			unistd.crypt(password, dummy_hash)
-		elseif constant_equals(hash, unistd.crypt(password, hash)) then
-			ok = true
-		end
-	end
-
-	if ok then
-		set_cookie(cookie_name, secure_value("username", username, os.time() + session_seconds))
-	else
-		set_cookie(cookie_name, "")
-	end
-
-	html("\n")
-	return 0
-end
-
--- Returns 1 if the cookie is valid and 0 if it is not.
-function authenticate_cookie()
-	local accepted_users = repo_userset(cgit["repo"])
-	if accepted_users == nil then
-		-- The repository is not protected.
-		return 1
-	end
-
-	local username = validate_value("username", get_cookie(http["cookie"], cookie_name))
-	if username == nil or not accepted_users[username:lower()] then
-		return 0
-	end
-	return 1
-end
-
--- Prints the html for the login form.
-function body()
-	local target = cgit["url"]
-	if not is_safe_redirect(target) then
-		target = cgit["login"]
-	end
-
-	html("<h2>Authentication Required</h2>")
-	html("<form method='post' action='")
-	html_attr(cgit["login"])
-	html("'>")
-	html("<input type='hidden' name='redirect' value='")
-	html_attr(secure_value("redirect", target, 0))
-	html("' />")
-	html("<table>")
-	html("<tr><td><label for='username'>Username:</label></td><td><input id='username' name='username' autofocus /></td></tr>")
-	html("<tr><td><label for='password'>Password:</label></td><td><input id='password' name='password' type='password' /></td></tr>")
-	html("<tr><td colspan='2'><input value='Login' type='submit' /></td></tr>")
-	html("</table></form>")
-
-	return 0
-end
-
---
---
--- Wrapper around the filter API, exposing the http, cgit and post tables to
--- the functions above.
---
---
-
-local actions = {}
-actions["authenticate-post"] = authenticate_post
-actions["authenticate-cookie"] = authenticate_cookie
-actions["body"] = body
-
-function filter_open(...)
-	action = actions[select(1, ...)]
-
-	post = {}
-
-	http = {}
-	http["cookie"] = select(2, ...)
-	http["method"] = select(3, ...)
-	http["query"] = select(4, ...)
-	http["referer"] = select(5, ...)
-	http["path"] = select(6, ...)
-	http["host"] = select(7, ...)
-	http["https"] = select(8, ...)
-
-	cgit = {}
-	cgit["repo"] = select(9, ...)
-	cgit["page"] = select(10, ...)
-	cgit["url"] = select(11, ...)
-	cgit["login"] = select(12, ...)
-end
-
-function filter_close()
-	if action == nil then
-		-- Unknown action, deny rather than raise.
-		return 0
-	end
-	return action()
-end
-
-function filter_write(str)
-	post = parse_qs(str)
-end
diff --git a/extensions/auth-inline.lua b/extensions/auth-inline.lua
deleted file mode 100644
index 168a444..0000000
--- a/extensions/auth-inline.lua
+++ /dev/null
@@ -1,528 +0,0 @@
--- cgit auth-filter that gates repositories behind a login form and a signed
--- session cookie.
---
--- This is the INLINE variant. The user accounts and the per-repository access
--- lists are written directly in this script, in the two tables in the
--- CONFIGURATION block below. Edit them here and reload. This suits a small
--- fixed set of users that rarely changes.
---
--- The companion auth-file.lua behaves identically but reads its accounts and
--- access lists from files on disk instead, which suits larger or externally
--- managed user sets.
---
--- Enable it in cgitrc with
---     auth-filter=lua:/path/to/auth-inline.lua
---
--- SUPPORTED LUA
---
--- Lua 5.1, 5.2, 5.3, 5.4 and LuaJIT. Lua 5.5 is not supported, because luaossl
--- has no 5.5 build. Match the runtime to the Lua that cgit is built against.
---
--- HTTPS IS RECOMMENDED
---
--- Serve cgit over HTTPS. Terminate TLS at the web server in front of cgit. The
--- session cookie is marked Secure by default, so a browser only sends it back
--- over HTTPS. If you genuinely run cgit over plain HTTP with no TLS anywhere,
--- set cookie_insecure below, otherwise the cookie is never returned and login
--- appears to loop.
---
--- DEPENDENCIES
---
---     luaossl    OpenSSL binding, provides openssl.rand and openssl.hmac
---                <https://github.com/wahern/luaossl>
---     luaposix   POSIX binding, provides posix.sys.stat and posix.unistd
---                <https://github.com/luaposix/luaposix>
---
--- The reliable cross-platform install is LuaRocks, matched to your Lua
--- version. luaossl also needs the OpenSSL development headers present.
---
---     # Debian and Ubuntu
---     sudo apt install luarocks libssl-dev
---     sudo luarocks --lua-version 5.1 install luaossl
---     sudo luarocks --lua-version 5.1 install luaposix
---
---     # Fedora
---     sudo dnf install luarocks openssl-devel
---     sudo luarocks --lua-version 5.1 install luaossl luaposix
---
---     # Alpine
---     sudo apk add luarocks openssl-dev
---     sudo luarocks-5.1 install luaossl luaposix
---
---     # macOS with Homebrew
---     brew install luarocks openssl
---     luarocks install luaossl OPENSSL_DIR="$(brew --prefix openssl)"
---     luarocks install luaposix
---
--- Some distributions also package these, for example lua-luaossl and lua-posix
--- on Debian. If you use a distribution package, make sure it is built for the
--- same Lua version as cgit.
---
--- SECURITY NOTES
---
--- The cookie carries only a username with no server-side session store, so
--- deleting an account does not revoke a cookie already issued until it
--- expires, and instances that share a secret file accept each other's cookies.
--- The login form carries no CSRF token. Both are acceptable for gating read
--- access to a git browser. Weigh them before guarding anything more sensitive.
-
-local sysstat = require("posix.sys.stat")
-local unistd = require("posix.unistd")
-local rand = require("openssl.rand")
-local hmac = require("openssl.hmac")
-
---
--- ========================= CONFIGURATION =========================
--- Edit the values in this block. Nothing below it needs changing for
--- ordinary use.
---
-
--- Protected repositories and the users allowed into each. A repository listed
--- here is protected. One not listed is public. Keys and user names are matched
--- case-insensitively. REPLACE THE EXAMPLES BELOW, they are commented out so an
--- unedited copy protects nothing and grants no accounts.
-local protected_repos = {
-	-- ["secret-repo"] = { alice = true, bob = true },
-	-- ["another"]     = { alice = true },
-}
-
--- Accounts as name = hash. Generate a hash with
---     mkpasswd -m sha-512 -R 300000
--- REPLACE THE EXAMPLES BELOW. The commented lines are not real credentials and
--- must not be deployed as-is.
-local users = {
-	-- alice = "$6$rounds=300000$REPLACE_THIS_SALT$REPLACE_THIS_HASH",
-	-- bob   = "$6$rounds=300000$REPLACE_THIS_SALT$REPLACE_THIS_HASH",
-}
-
--- Where the cookie-signing secret is stored. It is created on first use. It
--- must be persistent and writable by cgit. Prefer a path OUTSIDE the cache
--- root, because pruning the cache would delete a secret kept inside it and
--- invalidate every live session. This file should not be world-readable.
-local secret_filename = "/var/cache/cgit/auth-secret"
-
--- How long a login stays valid, in seconds. Default one week.
-local session_seconds = 7 * 24 * 60 * 60
-
--- Name of the session cookie.
-local cookie_name = "cgitauth"
-
--- Path the cookie is scoped to. "/" covers the whole host. Set it to the cgit
--- root to scope the cookie more tightly.
-local cookie_path = "/"
-
--- Leave false so the cookie is marked Secure and only travels over HTTPS. Set
--- it true ONLY if cgit is served over plain HTTP with no TLS anywhere, see the
--- HTTPS note in the header.
-local cookie_insecure = false
-
---
--- =================================================================
---
-
--- A throwaway hash of the documented shape, used only to spend the same work
--- on a missing account as on a present one, so a failed login does not reveal
--- by timing whether the username exists.
-local dummy_hash = "$6$rounds=300000$0000000000000000$"
-
--- Module state shared across the open, write and close calls of one request.
-local action, http, cgit, post
-
---
---
--- Account and access-list storage. This is the ONLY part that differs from
--- auth-file.lua. Swap these two functions to change where accounts live.
---
---
-
--- Fold the configured tables to lowercased user names once, so lookups match
--- case-insensitively the same way auth-file.lua does. Repository names keep
--- their case.
-do
-	local folded = {}
-	for name, hash in pairs(users) do
-		folded[tostring(name):lower()] = hash
-	end
-	users = folded
-	for repo, set in pairs(protected_repos) do
-		local fs = {}
-		for name, allowed in pairs(set) do
-			fs[tostring(name):lower()] = allowed
-		end
-		protected_repos[repo] = fs
-	end
-end
-
--- Return the stored password hash for a user, or nil.
-function account_hash(user)
-	if user == nil then
-		return nil
-	end
-	return users[user:lower()]
-end
-
--- Return the set of users allowed to access a repository, keyed by lowercased
--- user name, or nil if the repository is not protected.
-function repo_userset(repo)
-	if repo == nil then
-		return nil
-	end
-	return protected_repos[repo]
-end
-
---
---
--- Utility functions based on keplerproject/wsapi.
---
---
-
-function url_decode(str)
-	if not str then
-		return ""
-	end
-	str = string.gsub(str, "+", " ")
-	str = string.gsub(str, "%%(%x%x)", function(h) return string.char(tonumber(h, 16)) end)
-	str = string.gsub(str, "\r\n", "\n")
-	return str
-end
-
-function url_encode(str)
-	if not str then
-		return ""
-	end
-	str = string.gsub(str, "\n", "\r\n")
-	str = string.gsub(str, "([^%w ])", function(c) return string.format("%%%02X", string.byte(c)) end)
-	str = string.gsub(str, " ", "+")
-	return str
-end
-
--- Parse an application/x-www-form-urlencoded body. A value may itself contain
--- '=', for example a base64 password, so the value runs to the next '&'.
-function parse_qs(qs)
-	local tab = {}
-	for key, val in string.gmatch(qs or "", "([^&=]+)=([^&]*)") do
-		tab[url_decode(key)] = url_decode(val)
-	end
-	return tab
-end
-
--- Return the value of the named cookie, or nil. The stored token was already
--- url-encoded by secure_value, so it is returned verbatim, which keeps the
--- write path (set_cookie) and the read path symmetric. Decoding it here would
--- break the signature check for any value carrying a percent escape.
-function get_cookie(cookies, name)
-	cookies = string.gsub(";" .. (cookies or "") .. ";", "%s*;%s*", ";")
-	return string.match(cookies, ";" .. name .. "=(.-);")
-end
-
-function tohex(b)
-	local x = ""
-	for i = 1, #b do
-		x = x .. string.format("%.2x", string.byte(b, i))
-	end
-	return x
-end
-
---
---
--- Cookie construction and validation helpers.
---
---
-
-local secret = nil
-
--- Load the cookie-signing secret, creating it on first use. Failures raise,
--- which cgit turns into a request error, so a broken secret denies rather than
--- signs with nothing.
-function get_secret()
-	if secret ~= nil then
-		return secret
-	end
-	local secret_file = io.open(secret_filename, "r")
-	if secret_file == nil then
-		local old_umask = sysstat.umask(63)
-		local temporary_filename = secret_filename .. ".tmp." .. tohex(rand.bytes(16))
-		local temporary_file = io.open(temporary_filename, "w")
-		if temporary_file == nil then
-			sysstat.umask(old_umask)
-			error("cgit auth: cannot create secret file " .. secret_filename)
-		end
-		local wrote = temporary_file:write(tohex(rand.bytes(32)))
-		local closed = temporary_file:close()
-		if not wrote or not closed then
-			os.remove(temporary_filename)
-			sysstat.umask(old_umask)
-			error("cgit auth: failed writing secret file " .. secret_filename)
-		end
-		unistd.link(temporary_filename, secret_filename) -- Intentionally fails if another worker won the race.
-		unistd.unlink(temporary_filename)
-		sysstat.umask(old_umask)
-		secret_file = io.open(secret_filename, "r")
-	end
-	if secret_file == nil then
-		error("cgit auth: cannot read secret file " .. secret_filename)
-	end
-	secret = secret_file:read("*l")
-	secret_file:close()
-	if secret == nil or secret:len() ~= 64 then
-		secret = nil
-		error("cgit auth: secret file " .. secret_filename .. " is malformed, expected 64 hex characters")
-	end
-	return secret
-end
-
--- A redirect target is unsafe if a browser would read it as another origin.
--- The only such form cgit can be tricked into signing is a scheme-relative
--- "//host" or "/\host". Everything else stays on this host.
-function is_safe_redirect(url)
-	if type(url) ~= "string" then
-		return false
-	end
-	local head = url:sub(1, 2)
-	if head == "//" or head == "/\\" then
-		return false
-	end
-	return true
-end
-
--- Return the value carried by a signed cookie, or nil if it does not verify.
-function validate_value(expected_field, cookie)
-	local i = 0
-	local value = ""
-	local field = ""
-	local expiration = 0
-	local salt = ""
-	local chmac = ""
-
-	if cookie == nil or cookie:len() < 3 or cookie:sub(1, 1) == "|" then
-		return nil
-	end
-
-	for component in string.gmatch(cookie, "[^|]+") do
-		if i == 0 then
-			field = component
-		elseif i == 1 then
-			value = component
-		elseif i == 2 then
-			-- The expiration must be a plain integer. Rejecting other forms
-			-- keeps the signed bytes canonical, since tonumber and tostring of
-			-- "1e9" or "100.0" differ across Lua versions.
-			if not string.match(component, "^%d+$") then
-				return nil
-			end
-			expiration = tonumber(component)
-		elseif i == 3 then
-			salt = component
-		elseif i == 4 then
-			chmac = component
-		else
-			break
-		end
-		i = i + 1
-	end
-
-	if chmac == nil or chmac:len() == 0 then
-		return nil
-	end
-
-	-- Compare the HMAC without short-circuiting on the first mismatch.
-	if not constant_equals(chmac, tohex(hmac.new(get_secret(), "sha256"):final(field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt))) then
-		return nil
-	end
-
-	-- An expiration of 0 never expires and is used for the redirect token.
-	if expiration ~= 0 and expiration <= os.time() then
-		return nil
-	end
-
-	if url_decode(field) ~= expected_field then
-		return nil
-	end
-
-	local decoded = url_decode(value)
-	-- Reject values carrying control characters so a signed value cannot
-	-- smuggle CR or LF into a response header.
-	if decoded:find("%c") then
-		return nil
-	end
-	return decoded
-end
-
-function secure_value(field, value, expiration)
-	if value == nil or value:len() <= 0 then
-		return ""
-	end
-
-	local salt = tohex(rand.bytes(16))
-	value = url_encode(value)
-	field = url_encode(field)
-	local authstr = field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt
-	authstr = authstr .. "|" .. tohex(hmac.new(get_secret(), "sha256"):final(authstr))
-	return authstr
-end
-
--- Strip control characters that could split an HTTP response header.
-function strip_ctl(s)
-	return (string.gsub(s or "", "%c", ""))
-end
-
--- Compare two strings in time that does not depend on how many leading bytes
--- match, so a mismatch position is not revealed by timing.
-function constant_equals(a, b)
-	if type(a) ~= "string" or type(b) ~= "string" or #a ~= #b then
-		return false
-	end
-	local diff = 0
-	for i = 1, #a do
-		local d = a:byte(i) - b:byte(i)
-		diff = diff + d * d
-	end
-	return diff == 0
-end
-
-function set_cookie(cookie, value)
-	local attrs = "; HttpOnly; SameSite=Lax; Path=" .. cookie_path
-	if not cookie_insecure then
-		attrs = attrs .. "; Secure"
-	end
-	if value == "" then
-		attrs = attrs .. "; Max-Age=0"
-	elseif session_seconds > 0 then
-		attrs = attrs .. "; Max-Age=" .. tostring(session_seconds)
-	end
-	html("Set-Cookie: " .. cookie .. "=" .. strip_ctl(value) .. attrs .. "\n")
-end
-
-function redirect_to(url)
-	html("Status: 302 Redirect\n")
-	html("Cache-Control: no-cache, no-store\n")
-	html("Location: " .. strip_ctl(url) .. "\n")
-end
-
-function not_found()
-	html("Status: 404 Not Found\n")
-	html("Cache-Control: no-cache, no-store\n\n")
-end
-
---
---
--- Authentication actions. Identical to auth-inline.lua from here down.
---
---
-
--- Sets HTTP cookie headers based on post and sets up redirection.
-function authenticate_post()
-	local redirect = validate_value("redirect", post["redirect"])
-
-	if redirect == nil or not is_safe_redirect(redirect) then
-		not_found()
-		return 0
-	end
-
-	redirect_to(redirect)
-
-	local username = post["username"]
-	local password = post["password"]
-	local ok = false
-	if username ~= nil and password ~= nil then
-		local hash = account_hash(username)
-		if hash == nil then
-			-- Spend the work anyway, see dummy_hash.
-			unistd.crypt(password, dummy_hash)
-		elseif constant_equals(hash, unistd.crypt(password, hash)) then
-			ok = true
-		end
-	end
-
-	if ok then
-		set_cookie(cookie_name, secure_value("username", username, os.time() + session_seconds))
-	else
-		set_cookie(cookie_name, "")
-	end
-
-	html("\n")
-	return 0
-end
-
--- Returns 1 if the cookie is valid and 0 if it is not.
-function authenticate_cookie()
-	local accepted_users = repo_userset(cgit["repo"])
-	if accepted_users == nil then
-		-- The repository is not protected.
-		return 1
-	end
-
-	local username = validate_value("username", get_cookie(http["cookie"], cookie_name))
-	if username == nil or not accepted_users[username:lower()] then
-		return 0
-	end
-	return 1
-end
-
--- Prints the html for the login form.
-function body()
-	local target = cgit["url"]
-	if not is_safe_redirect(target) then
-		target = cgit["login"]
-	end
-
-	html("<h2>Authentication Required</h2>")
-	html("<form method='post' action='")
-	html_attr(cgit["login"])
-	html("'>")
-	html("<input type='hidden' name='redirect' value='")
-	html_attr(secure_value("redirect", target, 0))
-	html("' />")
-	html("<table>")
-	html("<tr><td><label for='username'>Username:</label></td><td><input id='username' name='username' autofocus /></td></tr>")
-	html("<tr><td><label for='password'>Password:</label></td><td><input id='password' name='password' type='password' /></td></tr>")
-	html("<tr><td colspan='2'><input value='Login' type='submit' /></td></tr>")
-	html("</table></form>")
-
-	return 0
-end
-
---
---
--- Wrapper around the filter API, exposing the http, cgit and post tables to
--- the functions above.
---
---
-
-local actions = {}
-actions["authenticate-post"] = authenticate_post
-actions["authenticate-cookie"] = authenticate_cookie
-actions["body"] = body
-
-function filter_open(...)
-	action = actions[select(1, ...)]
-
-	post = {}
-
-	http = {}
-	http["cookie"] = select(2, ...)
-	http["method"] = select(3, ...)
-	http["query"] = select(4, ...)
-	http["referer"] = select(5, ...)
-	http["path"] = select(6, ...)
-	http["host"] = select(7, ...)
-	http["https"] = select(8, ...)
-
-	cgit = {}
-	cgit["repo"] = select(9, ...)
-	cgit["page"] = select(10, ...)
-	cgit["url"] = select(11, ...)
-	cgit["login"] = select(12, ...)
-end
-
-function filter_close()
-	if action == nil then
-		-- Unknown action, deny rather than raise.
-		return 0
-	end
-	return action()
-end
-
-function filter_write(str)
-	post = parse_qs(str)
-end
diff --git a/extensions/email-gravatar.lua b/extensions/email-gravatar.lua
deleted file mode 100644
index 47c359e..0000000
--- a/extensions/email-gravatar.lua
+++ /dev/null
@@ -1,115 +0,0 @@
--- cgit email-filter that shows a Gravatar icon next to author names. Use it
--- with the email-filter or repo.email-filter setting and the lua: prefix.
---
---     email-filter=lua:/path/to/email-gravatar.lua
---
--- SUPPORTED LUA
---
--- Lua 5.1, 5.2, 5.3, 5.4 and LuaJIT. Lua 5.5 is not supported, because luaossl
--- has no 5.5 build.
---
--- DEPENDENCY
---
---     luaossl    OpenSSL binding, provides openssl.digest
---                <https://github.com/wahern/luaossl>
---
---     # Debian and Ubuntu
---     sudo apt install luarocks libssl-dev
---     sudo luarocks --lua-version 5.1 install luaossl
---
---     # Fedora
---     sudo dnf install luarocks openssl-devel
---     sudo luarocks --lua-version 5.1 install luaossl
---
---     # macOS with Homebrew
---     brew install luarocks openssl
---     luarocks install luaossl OPENSSL_DIR="$(brew --prefix openssl)"
---
--- PRIVACY
---
--- Every page view sends the visitor's IP address and a hash of each
--- committer's email to a third-party service. Leave this filter off if that is
--- not acceptable for your instance.
---
--- Addresses are hashed with MD5, which Gravatar still accepts. Gravatar also
--- supports SHA-256 now, change the digest in hash_hex if you prefer it.
-
-local digest = require("openssl.digest")
-
---
--- ===== CONFIGURATION =====
---
-
--- Pixel size of the avatar.
-local avatar_size = 13
-
--- Fallback style for an address with no avatar. See the Gravatar docs for the
--- choices, for example retro, identicon, monsterid or mp.
-local default_image = "retro"
-
--- Avatar endpoint. Kept https so the image is not blocked as mixed content on
--- an https page.
-local base_url = "https://www.gravatar.com/avatar/"
-
--- Text for the image alt attribute.
-local alt_text = "Gravatar"
-
---
--- =========================
---
-
--- State shared across the open, write and close calls of one invocation.
-local buffer = ""
-local avatar = nil
-
-local function hash_hex(input)
-	local b = digest.new("md5"):final(input)
-	local x = ""
-	for i = 1, #b do
-		x = x .. string.format("%.2x", string.byte(b, i))
-	end
-	return x
-end
-
--- Take the address, strip the angle brackets if present, then trim and
--- lowercase as the avatar services expect. Returns nil for a missing or empty
--- address.
-local function normalize_email(email)
-	if email == nil then
-		return nil
-	end
-	local inner = email:match("<(.*)>")
-	if inner ~= nil then
-		email = inner
-	end
-	email = (email:gsub("^%s*(.-)%s*$", "%1")):lower()
-	if email == "" then
-		return nil
-	end
-	return email
-end
-
-function filter_open(email, page)
-	buffer = ""
-	local addr = normalize_email(email)
-	if addr == nil then
-		avatar = nil
-	else
-		avatar = hash_hex(addr)
-	end
-end
-
-function filter_close()
-	if avatar == nil then
-		-- No usable address, render the name without an icon.
-		html(buffer)
-	else
-		html("<img src='" .. base_url .. avatar .. "?s=" .. avatar_size .. "&amp;d=" .. default_image ..
-			"' width='" .. avatar_size .. "' height='" .. avatar_size .. "' alt='" .. alt_text .. "' /> " .. buffer)
-	end
-	return 0
-end
-
-function filter_write(str)
-	buffer = buffer .. str
-end
diff --git a/extensions/email-libravatar.lua b/extensions/email-libravatar.lua
deleted file mode 100644
index 812bef5..0000000
--- a/extensions/email-libravatar.lua
+++ /dev/null
@@ -1,114 +0,0 @@
--- cgit email-filter that shows a Libravatar icon next to author names. Use it
--- with the email-filter or repo.email-filter setting and the lua: prefix.
---
---     email-filter=lua:/path/to/email-libravatar.lua
---
--- SUPPORTED LUA
---
--- Lua 5.1, 5.2, 5.3, 5.4 and LuaJIT. Lua 5.5 is not supported, because luaossl
--- has no 5.5 build.
---
--- DEPENDENCY
---
---     luaossl    OpenSSL binding, provides openssl.digest
---                <https://github.com/wahern/luaossl>
---
---     # Debian and Ubuntu
---     sudo apt install luarocks libssl-dev
---     sudo luarocks --lua-version 5.1 install luaossl
---
---     # Fedora
---     sudo dnf install luarocks openssl-devel
---     sudo luarocks --lua-version 5.1 install luaossl
---
---     # macOS with Homebrew
---     brew install luarocks openssl
---     luarocks install luaossl OPENSSL_DIR="$(brew --prefix openssl)"
---
--- PRIVACY
---
--- Every page view sends the visitor's IP address and a hash of each
--- committer's email to a third-party service. Leave this filter off if that is
--- not acceptable for your instance.
---
--- The secure CDN is always used, so the icon loads over https and is never
--- blocked as mixed content. Addresses are hashed with MD5.
-
-local digest = require("openssl.digest")
-
---
--- ===== CONFIGURATION =====
---
-
--- Pixel size of the avatar.
-local avatar_size = 13
-
--- Fallback style for an address with no avatar. See the Libravatar docs for
--- the choices, for example retro, identicon, monsterid or mm.
-local default_image = "retro"
-
--- Avatar endpoint. The secure CDN is used so the image loads over https.
-local base_url = "https://seccdn.libravatar.org/avatar/"
-
--- Text for the image alt attribute.
-local alt_text = "Libravatar"
-
---
--- =========================
---
-
--- State shared across the open, write and close calls of one invocation.
-local buffer = ""
-local avatar = nil
-
-local function hash_hex(input)
-	local b = digest.new("md5"):final(input)
-	local x = ""
-	for i = 1, #b do
-		x = x .. string.format("%.2x", string.byte(b, i))
-	end
-	return x
-end
-
--- Take the address, strip the angle brackets if present, then trim and
--- lowercase as the avatar services expect. Returns nil for a missing or empty
--- address.
-local function normalize_email(email)
-	if email == nil then
-		return nil
-	end
-	local inner = email:match("<(.*)>")
-	if inner ~= nil then
-		email = inner
-	end
-	email = (email:gsub("^%s*(.-)%s*$", "%1")):lower()
-	if email == "" then
-		return nil
-	end
-	return email
-end
-
-function filter_open(email, page)
-	buffer = ""
-	local addr = normalize_email(email)
-	if addr == nil then
-		avatar = nil
-	else
-		avatar = hash_hex(addr)
-	end
-end
-
-function filter_close()
-	if avatar == nil then
-		-- No usable address, render the name without an icon.
-		html(buffer)
-	else
-		html("<img src='" .. base_url .. avatar .. "?s=" .. avatar_size .. "&amp;d=" .. default_image ..
-			"' width='" .. avatar_size .. "' height='" .. avatar_size .. "' alt='" .. alt_text .. "' /> " .. buffer)
-	end
-	return 0
-end
-
-function filter_write(str)
-	buffer = buffer .. str
-end
diff --git a/extensions/link-commits.lua b/extensions/link-commits.lua
deleted file mode 100644
index e7b17cc..0000000
--- a/extensions/link-commits.lua
+++ /dev/null
@@ -1,153 +0,0 @@
--- cgit commit-filter that turns git object names and configurable text
--- references in commit messages into links. Use it with the commit-filter or
--- repo.commit-filter setting and the lua: prefix.
---
---     commit-filter=lua:/path/to/link-commits.lua
---
--- cgit hands the filter the message already HTML-escaped, so this only wraps
--- matches in anchors. No external dependencies. Runs on Lua 5.1 through 5.4
--- and LuaJIT.
---
--- Two kinds of thing are linked, object names (runs of hex that look like git
--- hashes) and any number of text-reference rules you define, each a pattern
--- and a URL. Both are configured in the block below. All matches are resolved
--- in a single left-to-right pass, so nothing is ever linked twice.
-
---
--- ===== CONFIGURATION =====
---
-
--- Object names (git hashes). Handled specially, because the length rule cannot
--- be written as a plain Lua pattern.
---
--- Recognition is by shape, since a commit-filter cannot ask the repository
--- whether a hash is real. Any hex run within the length bounds is linked,
--- whatever mix of digits and letters it has, so abbreviated and all-digit
--- hashes are both caught. The cost is that a long hex-looking number can now
--- and then link to an object that does not exist, which cgit renders as a
--- harmless "bad object name" page. Shape matching is inherently approximate,
--- the length bounds are the only filter.
-local objects = {
-	-- Set false to stop linking bare hashes.
-	enabled = true,
-	-- A hex run within these lengths is linked. Git abbreviations run about 7
-	-- to 12 characters, full names are 40 (sha1) or 64 (sha256).
-	min_length = 7,
-	max_length = 64,
-	-- Link target, %s is replaced with the matched hash. "./?id=%s" is relative
-	-- to the current page and works for the common virtual-root layout.
-	url = "./?id=%s",
-}
-
--- Text-reference rules. Each rule is a Lua pattern with ONE capture and a URL
--- where %s is replaced by that capture, percent-encoded. The whole match is
--- shown, the capture is what goes in the URL. Rules are tried in order and the
--- leftmost match on the line wins, so put more specific patterns first. Leave
--- the list empty to link only object names.
---
--- Lua patterns are not regular expressions. There is no alternation and no
--- {n,m} repetition. %d is a digit, %a a letter, %w a letter or digit, %x a hex
--- digit, and a literal magic character is escaped with %, so a literal '-' is
--- '%-'. Reference: https://www.lua.org/manual/5.1/manual.html#5.4.1
-local rules = {
-	{ pattern = "#(%d+)", url = "https://bugs.example.com/?bug=%s" },
-	-- { pattern = "CVE%-(%d%d%d%d%-%d+)", url = "https://www.cve.org/CVERecord?id=CVE-%s" },
-	-- { pattern = "!(%d+)",               url = "https://gitlab.example.com/group/repo/-/merge_requests/%s" },
-	-- { pattern = "RFC%s?(%d+)",          url = "https://www.rfc-editor.org/rfc/rfc%s" },
-}
-
---
--- =========================
---
-
-local chunks = {}
-
--- Percent-encode everything but the URL-unreserved characters, so a captured
--- value cannot break out of the href attribute or the URL.
-local function url_encode(s)
-	return (string.gsub(s, "[^%w._~-]", function(c)
-		return string.format("%%%02X", string.byte(c))
-	end))
-end
-
--- Build one anchor. url_template has %s where the encoded capture goes, display
--- is the text shown. A function replacement is used so a '%' in the encoded
--- value is not treated as a gsub reference.
-local function make_link(url_template, capture, display)
-	local encoded = url_encode(capture)
-	local href = string.gsub(url_template, "%%s", function() return encoded end)
-	return '<a href="' .. href .. '">' .. display .. '</a>'
-end
-
--- Collect every candidate match as {s, e, pri, link}. A lower pri wins a tie on
--- the same start position.
-local function collect(text)
-	local cands = {}
-	for pri, rule in ipairs(rules) do
-		-- A malformed pattern is an operator error, skip that rule rather than
-		-- failing the whole page.
-		pcall(function()
-			local init = 1
-			while init <= #text do
-				local s, e, cap = string.find(text, rule.pattern, init)
-				if not s then break end
-				if cap == nil then
-					cap = string.sub(text, s, e)
-				end
-				cands[#cands + 1] = {
-					s = s, e = e, pri = pri,
-					link = make_link(rule.url, cap, string.sub(text, s, e)),
-				}
-				init = (e >= s) and e + 1 or s + 1
-			end
-		end)
-	end
-	if objects.enabled then
-		local objpri = #rules + 1
-		local init = 1
-		while init <= #text do
-			local s, e, run = string.find(text, "%f[%w](%x+)%f[%W]", init)
-			if not s then break end
-			if #run >= objects.min_length and #run <= objects.max_length then
-				cands[#cands + 1] = {
-					s = s, e = e, pri = objpri,
-					link = make_link(objects.url, run, run),
-				}
-			end
-			init = e + 1
-		end
-	end
-	return cands
-end
-
-function filter_open(...)
-	chunks = {}
-end
-
-function filter_write(str)
-	chunks[#chunks + 1] = str
-end
-
-function filter_close()
-	local text = table.concat(chunks)
-	local cands = collect(text)
-	table.sort(cands, function(a, b)
-		if a.s ~= b.s then
-			return a.s < b.s
-		end
-		return a.pri < b.pri
-	end)
-	local out = {}
-	local i = 1
-	for _, c in ipairs(cands) do
-		-- Skip a candidate that overlaps one already emitted.
-		if c.s >= i then
-			out[#out + 1] = string.sub(text, i, c.s - 1)
-			out[#out + 1] = c.link
-			i = c.e + 1
-		end
-	end
-	out[#out + 1] = string.sub(text, i)
-	html(table.concat(out))
-	return 0
-end
diff --git a/extensions/syntax-highlight.lua b/extensions/syntax-highlight.lua
deleted file mode 100644
index 8310504..0000000
--- a/extensions/syntax-highlight.lua
+++ /dev/null
@@ -1,278 +0,0 @@
--- Server-side syntax highlighting for the tree and blob views, used with the
--- source-filter setting in cgitrc and the lua: prefix so it runs in cgit's
--- embedded interpreter with no per-request process.
---
---     source-filter=lua:/usr/lib/cgit/extensions/syntax-highlight.lua
---
--- Highlighting is deliberately not built into cgit itself. Without this filter
--- cgit serves plain escaped text, and any other program can take its place.
---
--- SUPPORTED LUA
---
--- Lua 5.1 through 5.4 and LuaJIT. The Scintillua version matters too. Recent
--- Scintillua (6.x) needs Lua 5.3 or newer to load its lexers, older Scintillua
--- releases still load under 5.1 and 5.2. Pick a Scintillua release that matches
--- the Lua cgit is built against.
---
--- REQUIREMENTS
---
--- Two pieces, and BOTH must be installed. When either is missing the filter
--- serves plain escaped text by design, so uncolored code means a missing
--- dependency, not an error.
---
--- 1. lpeg, the parsing module, for the Lua cgit is linked against. Scintillua
---    does NOT bundle it, it must come from the system, and forgetting it is the
---    usual reason nothing happens.
---
---        # Debian and Ubuntu
---        sudo apt install lua-lpeg
---        # Fedora
---        sudo dnf install lua-lpeg
---        # Alpine
---        sudo apk add lua5.1-lpeg
---        # or with LuaRocks, matched to your Lua version
---        sudo luarocks --lua-version 5.1 install lpeg
---
--- 2. Scintillua, the lexer collection from the Textadept editor. Roughly 120
---    languages as plain .lua files, nothing to compile. Download a release and
---    unpack it anywhere.
---
---        https://orbitalquark.github.io/scintillua/
---
--- The lexers are found by probing, in order
---
---     $CGIT_SCINTILLUA_PATH        (used alone when set, no fallback)
---     <dir of $CGIT_CONFIG>/scintillua/lexers
---     the scintillua_dirs list in the CONFIGURATION block below
---
--- so either set the variable in the web server environment, or place (or
--- symlink) the scintillua directory next to your cgitrc.
---
--- SECURITY
---
--- Every probed directory is placed on package.path and its Lua is executed in
--- cgit's process. Make sure none of them is writable by other users, or someone
--- who can write there gains code execution as the web server. On macOS in
--- particular, /opt/homebrew/share is group-writable by default.
---
--- LIMITATIONS
---
--- cgit sends the filter output through a C string sink that stops at the first
--- NUL byte, so a blob containing a NUL is truncated there. This affects binary
--- files that slip past cgit's text detection, not ordinary source.
---
--- OUTPUT
---
--- Tokens are wrapped in <span> elements carrying the hl- classes that
--- assets/cgit.css styles. Every input byte up to the first NUL is preserved, so
--- the line number gutter stays aligned.
-
---
--- ===== CONFIGURATION =====
---
-
--- Files larger than this many bytes are served escaped but unhighlighted, so a
--- huge blob does not cost a lexing pass. Kept well below cgit's max-blob-size.
-local max_bytes = 512 * 1024
-
--- Environment variable that, when set, points straight at the Scintillua
--- lexers directory and is used alone.
-local scintillua_env = "CGIT_SCINTILLUA_PATH"
-
--- Directories probed for the lexers when that variable is not set. The
--- directory of $CGIT_CONFIG, when set, is tried ahead of these. Keep every one
--- of these unwritable by others, see the SECURITY note above.
-local scintillua_dirs = {
-	"/usr/local/share/scintillua/lexers",
-	"/usr/share/scintillua/lexers",
-	"/opt/homebrew/share/scintillua/lexers",
-}
-
--- Scintillua tag name (its first dotted component) to a cgit css class. Only
--- the six classes below exist in assets/cgit.css. Add a class there and a row
--- here to style more token kinds. Tokens with no row render as plain text,
--- which is what most themes want for operators and identifiers.
-local css = {
-	comment      = "hl-comment",
-	string       = "hl-string",
-	regex        = "hl-string",
-	number       = "hl-number",
-	constant     = "hl-number",
-	keyword      = "hl-keyword",
-	preprocessor = "hl-keyword",
-	tag          = "hl-keyword",
-	label        = "hl-keyword",
-	annotation   = "hl-keyword",
-	type         = "hl-type",
-	class        = "hl-type",
-	attribute    = "hl-type",
-	["function"] = "hl-func",
-}
-
--- Extension to lexer-name fixes for the fallback path, used only when this
--- Scintillua has no detect(). Most extensions already equal their lexer name,
--- these are the frequent exceptions. A wrong guess just falls back to plain
--- text, so there is no harm in listing best-effort entries.
-local ext_lexer = {
-	py = "python", js = "javascript", ts = "typescript",
-	rb = "ruby", pl = "perl", pm = "perl", sh = "bash",
-	md = "markdown", htm = "html", yml = "yaml",
-	rs = "rust", c = "ansi_c", h = "ansi_c",
-}
-
---
--- =========================
---
-
-local lexer_mod = nil
-local filename = ""
-local chunks = {}
-
-local escape_map = { ["&"] = "&amp;", ["<"] = "&lt;", [">"] = "&gt;" }
-
--- Escape the three HTML metacharacters in a single pass.
-local function escape(s)
-	return (string.gsub(s, "[&<>]", escape_map))
-end
-
-local function scintillua_path()
-	local env = os.getenv(scintillua_env)
-	if env then
-		return env
-	end
-	local candidates = {}
-	local config = os.getenv("CGIT_CONFIG")
-	if config then
-		local dir = string.match(config, "^(.*)/[^/]+$")
-		if dir then
-			candidates[#candidates + 1] = dir .. "/scintillua/lexers"
-		end
-	end
-	for _, d in ipairs(scintillua_dirs) do
-		candidates[#candidates + 1] = d
-	end
-	for _, dir in ipairs(candidates) do
-		local f = io.open(dir .. "/lexer.lua", "r")
-		if f then
-			f:close()
-			return dir
-		end
-	end
-	return nil
-end
-
-local function load_scintillua()
-	local dir = scintillua_path()
-	if not dir then
-		return nil
-	end
-	if not string.find(package.path, dir, 1, true) then
-		package.path = dir .. "/?.lua;" .. package.path
-	end
-	local ok, mod = pcall(require, "lexer")
-	-- A real Scintillua exposes load(). Anything else on the path that happens
-	-- to be called lexer is not usable.
-	if ok and type(mod) == "table" and type(mod.load) == "function" then
-		return mod
-	end
-	return nil
-end
-
-local function load_lexer_name(name)
-	if name == nil then
-		return nil
-	end
-	local ok, lex = pcall(lexer_mod.load, name)
-	if ok and lex then
-		return lex
-	end
-	return nil
-end
-
--- Resolve a lexer for the file, preferring Scintillua's own filename detection
--- when this version provides it, then an extension map, then the raw extension.
-local function lexer_for(name)
-	if type(lexer_mod.detect) == "function" then
-		local ok, lang = pcall(lexer_mod.detect, name)
-		if ok and lang then
-			local lex = load_lexer_name(lang)
-			if lex then
-				return lex
-			end
-		end
-	end
-	local ext = string.match(name, "%.([^.]+)$")
-	if not ext then
-		return nil
-	end
-	ext = string.lower(ext)
-	return load_lexer_name(ext_lexer[ext]) or load_lexer_name(ext)
-end
-
-local function highlight(text)
-	local lex = lexer_for(filename)
-	if not lex then
-		return nil
-	end
-	local ok, tokens = pcall(lex.lex, lex, text)
-	if not ok or type(tokens) ~= "table" then
-		return nil
-	end
-	local out = {}
-	local pos = 1
-	for i = 1, #tokens, 2 do
-		local tag = tokens[i]
-		local fin = tokens[i + 1]
-		local part = escape(string.sub(text, pos, fin - 1))
-		local class = css[string.match(tag, "^[%w_]+")]
-		if class and part ~= "" then
-			part = "<span class='" .. class .. "'>" .. part .. "</span>"
-		end
-		out[#out + 1] = part
-		pos = fin
-	end
-	-- Anything the lexer left unconsumed is kept, escaped.
-	if pos <= #text then
-		out[#out + 1] = escape(string.sub(text, pos))
-	end
-	return table.concat(out)
-end
-
-function filter_open(name)
-	filename = name or ""
-	chunks = {}
-end
-
-function filter_write(str)
-	chunks[#chunks + 1] = str
-end
-
-function filter_close()
-	local text = table.concat(chunks)
-	chunks = {}
-	if #text <= max_bytes then
-		if lexer_mod == nil then
-			lexer_mod = load_scintillua() or false
-		end
-		if lexer_mod then
-			local ok, marked = pcall(highlight, text)
-			if ok and marked then
-				html(marked)
-				return 0
-			end
-		end
-	end
-	-- Fallback, escaped plain text emitted in slices so a large blob does not
-	-- cost a full-size second copy all at once.
-	local n = #text
-	if n == 0 then
-		html("")
-		return 0
-	end
-	local pos = 1
-	while pos <= n do
-		html(escape(string.sub(text, pos, pos + 65535)))
-		pos = pos + 65536
-	end
-	return 0
-end
diff --git a/libraries/git b/libraries/git
deleted file mode 160000
index 94f0577..0000000
--- a/libraries/git
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 94f057755b7941b321fd11fec1b2e3ca5313a4e0
diff --git a/source/cgit.mk b/source/cgit.mk
index f864ecb..7852b99 100644
--- a/source/cgit.mk
+++ b/source/cgit.mk
@@ -1,14 +1,14 @@
-# This Makefile runs inside the bundled Git tree (libraries/git) so that it
+# This Makefile runs inside the bundled Git tree (vendor/git) so that it
 # can reuse Git's build variables and platform detection. The top-level
 # Makefile invokes it as:
 #
-#     make -C libraries/git -f ../../source/cgit.mk ../../build/cgit
+#     make -C vendor/git -f ../../source/cgit.mk ../../build/cgit
 #
 # so every path back into the project reaches through CGIT_ROOT ("../.."):
 # sources come from ../../source and all build output goes to ../../build.
 include Makefile
 
-# Locations relative to libraries/git, where this file is run. SRCDIR and
+# Locations relative to vendor/git, where this file is run. SRCDIR and
 # BUILDDIR name the root-relative subdirs (matching the top-level Makefile and
 # used by the version recipe, which cds to the root); CGIT_SRC and CGIT_BUILD
 # are their full paths from here.
diff --git a/source/ui-tree.c b/source/ui-tree.c
index 6507881..870ace2 100644
--- a/source/ui-tree.c
+++ b/source/ui-tree.c
@@ -65,7 +65,7 @@ static void print_text_buffer(const char *name, char *buf, unsigned long size)
 	}
 
 	/* No source filter is configured, so serve the text plain. Syntax
-	 * highlighting ships as an optional source filter in extensions/,
+	 * highlighting ships as an optional source filter in custom/extensions/,
 	 * keeping language knowledge out of the core. */
 	html("<td class='lines'><pre><code>");
 	html_txt(buf);
diff --git a/tests/Makefile b/tests/Makefile
index a11aa74..e159487 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -1,4 +1,4 @@
-include ../libraries/git/config.mak.uname
+include ../vendor/git/config.mak.uname
 -include ../cgit.conf
 
 SHELL_PATH ?= $(SHELL)
diff --git a/tests/setup.sh b/tests/setup.sh
index a49a52b..39819e4 100755
--- a/tests/setup.sh
+++ b/tests/setup.sh
@@ -42,7 +42,7 @@ IFS=$LF
 set -- $test_argv
 IFS=$OLDIFS
 
-: ${TEST_DIRECTORY=$(pwd)/../libraries/git/t}
+: ${TEST_DIRECTORY=$(pwd)/../vendor/git/t}
 : ${TEST_OUTPUT_DIRECTORY=$(pwd)}
 TEST_NO_CREATE_REPO=YesPlease
 . "$TEST_DIRECTORY"/test-lib.sh
diff --git a/tests/t0001-validate-git-versions.sh b/tests/t0001-validate-git-versions.sh
index acc412d..65c3c6a 100755
--- a/tests/t0001-validate-git-versions.sh
+++ b/tests/t0001-validate-git-versions.sh
@@ -20,22 +20,22 @@ test_expect_success 'extract Git version from Makefile' '
 # must apply the same transformation to the version in the Makefile before
 # comparing them.
 test_expect_success 'test Git version matches Makefile' '
-	( cat ../../libraries/git/GIT-VERSION-FILE || echo "No GIT-VERSION-FILE" ) |
+	( cat ../../vendor/git/GIT-VERSION-FILE || echo "No GIT-VERSION-FILE" ) |
 	sed -e "s/GIT_VERSION[ 	]*=[ 	]*//" -e "s/\\.dirty$//" >git_version &&
 	sed -e "s/-/./g" makefile_version >makefile_git_version &&
 	test_cmp git_version makefile_git_version
 '
 
 test_expect_success 'test submodule version matches Makefile' '
-	if ! test -e ../../libraries/git/.git
+	if ! test -e ../../vendor/git/.git
 	then
-		echo "libraries/git/ is not a Git repository" >&2
+		echo "vendor/git/ is not a Git repository" >&2
 	else
 		(
 			cd ../.. &&
-			sm_oid=$(git ls-files --stage -- libraries/git |
+			sm_oid=$(git ls-files --stage -- vendor/git |
 				sed -e "s/^[0-9]* \\([0-9a-f]*\\) [0-9]	.*$/\\1/") &&
-			cd libraries/git &&
+			cd vendor/git &&
 			git describe --match "v[0-9]*" $sm_oid
 		) | sed -e "s/^v//" -e "s/-/./" >sm_version &&
 		test_cmp sm_version makefile_version
diff --git a/tests/t0201-limits.sh b/tests/t0201-limits.sh
index 5f04952..a8dce62 100755
--- a/tests/t0201-limits.sh
+++ b/tests/t0201-limits.sh
@@ -131,7 +131,7 @@ test_expect_success LUA 'highlight filter passes text through without scintillua
 	{
 		echo "virtual-root=/" &&
 		echo "cache-size=0" &&
-		echo "source-filter=lua:$(cd ../../extensions && pwd)/syntax-highlight.lua" &&
+		echo "source-filter=lua:$(cd ../../custom/extensions && pwd)/syntax-highlight.lua" &&
 		echo "repo.url=limits" &&
 		echo "repo.path=$PWD/repos/limits/.git"
 	} >hlrc &&
diff --git a/vendor/git b/vendor/git
new file mode 160000
index 0000000..94f0577
--- /dev/null
+++ b/vendor/git
@@ -0,0 +1 @@
+Subproject commit 94f057755b7941b321fd11fec1b2e3ca5313a4e0
-- 
cgit v2.8.0