From db188bb2cd99e3b797382cd584fe9e489b05ea65 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 6 Nov 2026 20:58:20 -1000 Subject: Cut the Apache config down to a generic drop-in The old file was a complete httpd.conf that named RHEL's paths and user and loaded its own modules, so on Debian it had to be rewritten before Apache would start. As a virtual host it leaves all of that to the distribution, and it takes the nginx config's header and commented examples. For HTTPS the one virtual host moves to port 443 rather than a second host repeating its routing, and a small host on port 80 sends plain HTTP on to it. --- custom/servers/apache.conf | 324 ++++++++------------------------------------- 1 file changed, 54 insertions(+), 270 deletions(-) diff --git a/custom/servers/apache.conf b/custom/servers/apache.conf index 3d65d5e..b10750e 100644 --- a/custom/servers/apache.conf +++ b/custom/servers/apache.conf @@ -1,280 +1,64 @@ -# Apache httpd configuration for cgit. +# An Apache httpd virtual host that serves cgit at the root of +# git.example.org. Include it from httpd.conf, which supplies the user, the +# MIME types and the logs. It needs mod_alias and mod_cgid, or mod_cgi under +# the prefork MPM, and the commented examples also need mod_ssl for HTTPS +# and mod_env for git-http-backend. # -# Written for the httpd 2.4 branch, at 2.4.69 when last reviewed. +# The paths are one common layout, so adjust them to your system. +# cgit.cgi /usr/lib/cgit, from make install with the two-line cgit.conf in README +# static files /usr/share/cgit, from the same install +# repositories /var/lib/git, the scan-path custom/cgitrc suggests +# git-http-backend /usr/libexec/git-core, the directory git --exec-path prints +# certificate /etc/ssl/certs/git.example.org.pem +# key /etc/ssl/private/git.example.org.key # -# This is a complete httpd.conf rather than a vhost snippet, so nothing here -# is included from elsewhere and no distro base config is assumed. Check it -# and run it with -# httpd -t -f /path/to/apache.conf # check the syntax -# httpd -f /path/to/apache.conf # run it -# To use it as an ordinary vhost file instead, drop everything above the -# virtual hosts and let your distro's httpd.conf supply it. -# -# Apache runs the cgit.cgi binary directly through mod_cgid, so no FastCGI -# bridge is needed. -# -# Paths assumed below, edit them to match your install. -# cgit CGI binary /usr/lib/cgit/cgit.cgi -# static assets /usr/share/cgit (cgit.css cgit.js cgit.png favicon.ico robots.txt) -# cgit config /etc/cgitrc -# public url https://git.example.org/ (cgit at the domain root) -# -# cgit is one CGI executable. It learns the repository and the page from -# PATH_INFO and reads page options such as h= and id= from QUERY_STRING. The -# five static assets are served straight off disk. mod_alias resolves Alias and -# ScriptAlias in order and the first match wins, so the static Alias lines come -# before the catch-all ScriptAlias to stop the two routes from shadowing each -# other. - - -# ServerRoot is what every relative path below resolves against, including the -# module paths. It is /etc/httpd on RHEL and Fedora and /etc/apache2 on Debian -# and Ubuntu, where the modules live in /usr/lib/apache2/modules and the -# LoadModule lines need that absolute path instead of the relative one. -ServerRoot /etc/httpd -PidFile /var/run/httpd.pid - -# Where Apache puts its runtime scratch, the mutexes and the SSL session -# cache. It is /var/run/httpd on RHEL and Fedora and /var/run/apache2 on -# Debian and Ubuntu. The directory has to exist and be writable before Apache -# starts, which is normally the packaging's job. -DefaultRuntimeDir /var/run/httpd - -Listen 80 -Listen 443 - -# Set globally so Apache does not have to guess a name at startup, which it -# warns about. Each vhost overrides it with its own. -ServerName git.example.org - -# Drop the version number from the Server header and from error pages. -ServerTokens Prod -ServerSignature Off - - -# mod_cgid suits the threaded MPMs that ship by default. Use mod_cgi instead -# only on the old prefork MPM. mod_alias provides Alias and ScriptAlias, -# mod_env provides SetEnv, and the rest are the core pieces a standalone -# config cannot do without. On Debian and Ubuntu run -# a2enmod cgid alias env headers expires ssl -# rather than editing these lines. The guards make double-loading harmless. - - LoadModule mpm_event_module modules/mod_mpm_event.so - - - LoadModule unixd_module modules/mod_unixd.so - - - LoadModule authz_core_module modules/mod_authz_core.so - - - LoadModule log_config_module modules/mod_log_config.so - - - LoadModule mime_module modules/mod_mime.so - - - LoadModule alias_module modules/mod_alias.so - - - LoadModule cgid_module modules/mod_cgid.so - - - LoadModule env_module modules/mod_env.so - - - LoadModule headers_module modules/mod_headers.so - - - LoadModule expires_module modules/mod_expires.so - -# TLS. Delete these two along with the HTTPS vhost to run plain HTTP only. -# mod_socache_shmcb backs the SSL session cache and mod_ssl expects it. - - LoadModule socache_shmcb_module modules/mod_socache_shmcb.so - - - LoadModule ssl_module modules/mod_ssl.so - - - -# The user Apache drops to after binding the ports. It is apache on RHEL and -# Fedora, www-data on Debian and Ubuntu, and http on Arch. -User apache -Group apache - - -# The combined format comes from the distro config rather than from Apache -# itself, so a standalone config has to define it before any CustomLog uses it. -LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined -ErrorLog /var/log/apache2/error.log -LogLevel warn - - -# The usual "TypesConfig conf/mime.types" would pull in a second file. Exactly -# five static files are served off disk, so their types are declared here -# instead. Everything else Apache returns comes from cgit, which sets its own -# Content-Type. -AddType text/css .css -AddType text/javascript .js -AddType image/png .png -AddType image/vnd.microsoft.icon .ico -AddType text/plain .txt - - -# Deny the whole filesystem, then open only the two directories cgit needs. -# Without this a misplaced Alias could expose anything readable on the host. - - AllowOverride None - Require all denied - - -# The static asset directory, read only. - - Options None - AllowOverride None - Require all granted - - # These assets rarely change, so let browsers cache them. Keep the - # caching scoped to this directory. Ordinary cgit pages carry no expiry - # time, so a server-wide ExpiresDefault would stamp freshness onto - # them, fight the no-store cgit puts on the login page, and could let - # one visitor's page be served to another from a shared cache. - - ExpiresActive On - ExpiresDefault "access plus 30 days" - - +# The commented examples add HTTPS, which the bundled auth filters need +# before they log anyone in, and smart HTTP clone and push through +# git-http-backend. -# The cgit binary. - - Options +ExecCGI - # Run cgit.cgi as a CGI even if it is ever reached through a plain Alias - # rather than ScriptAlias. - SetHandler cgi-script - AllowOverride None - Require all granted - - - -# This vhost only bounces plain HTTP up to HTTPS. It serves no cgit itself. -# Every cgit directive lives in the HTTPS vhost below. To run without TLS for -# now, convert the HTTPS vhost to port 80 and delete this whole block rather -# than editing it, since deleting only the Redirect line would leave a vhost -# that serves nothing. ServerName git.example.org - ErrorLog /var/log/apache2/cgit_error.log - CustomLog /var/log/apache2/cgit_access.log combined - - Redirect permanent / https://git.example.org/ - - - -# The vhost that serves cgit. To run without TLS for now, change this opening -# line to port 80, delete the SSL lines, delete the Strict-Transport-Security -# line, and delete the vhost above so there is only one. Everything else stays -# as it is. - - ServerName git.example.org - - ErrorLog /var/log/apache2/cgit_ssl_error.log - CustomLog /var/log/apache2/cgit_ssl_access.log combined - - # Point these at your certificate. - SSLEngine on - SSLCertificateFile /etc/ssl/certs/git.example.org.crt - SSLCertificateKeyFile /etc/ssl/private/git.example.org.key - # Subtractive rather than naming the versions to keep, since a mod_ssl - # built before TLS 1.3 rejects the +TLSv1.3 token outright and refuses to - # start. This form enables 1.3 wherever it exists. - SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 - - # Which config cgit reads. It falls back to the compiled-in /etc/cgitrc, - # the same path used here, but setting it makes the location explicit and - # lets you point at a per-vhost file later. - SetEnv CGIT_CONFIG /etc/cgitrc + # For HTTPS, change *:80 above to *:443, uncomment these three lines and + # uncomment the host at the end, which sends plain HTTP on to HTTPS. + # Apache also has to listen on 443. + #SSLEngine on + #SSLCertificateFile /etc/ssl/certs/git.example.org.pem + #SSLCertificateKeyFile /etc/ssl/private/git.example.org.key + + # The five files cgit links to at the root are served off disk. Apache + # takes the first alias that matches, so they come before the one that + # hands every other path to cgit as its PATH_INFO. + AliasMatch ^/(cgit\.css|cgit\.js|cgit\.png|favicon\.ico|robots\.txt)$ /usr/share/cgit/$1 + + # Smart HTTP clone and push at the urls cgit gives the repositories go to + # git-http-backend. It finds them under GIT_PROJECT_ROOT and, with + # GIT_HTTP_EXPORT_ALL, serves them without a git-daemon-export-ok file. + # The safe.directory setting lets it open them while another user owns + # them. Push is refused until a repository sets http.receivepack or the + # server authenticates the user. + #SetEnv GIT_PROJECT_ROOT /var/lib/git + #SetEnv GIT_HTTP_EXPORT_ALL + #SetEnv GIT_CONFIG_COUNT 1 + #SetEnv GIT_CONFIG_KEY_0 safe.directory + #SetEnv GIT_CONFIG_VALUE_0 * + #ScriptAliasMatch ^/(.+/(info/refs|git-upload-pack|git-receive-pack))$ /usr/libexec/git-core/git-http-backend/$1 - # The only request body cgit ever reads is the auth-filter login form, and - # it stops after 4096 bytes. Nothing else here accepts an upload. - LimitRequestBody 65536 - - # Site-wide security headers are set here so they also cover the static - # assets Apache serves. On raw repository bytes cgit sends a nosniff and - # the stricter policy "default-src 'none'" of its own. - # - # The word setifempty is load bearing on the two headers cgit can also - # emit. "Header always set" replaces a same-named header even when the - # CGI sent it, which would swap the strict policy on raw repository - # content for this looser site one. setifempty yields to whatever cgit - # sent. Referrer-Policy stays a plain set because cgit never emits it. - # - # form-action self covers the login form, the only form cgit renders. If - # you enable the gravatar or libravatar avatar filter, add its host to - # img-src, for example https://www.gravatar.com. A head-include or - # repo.head-content that injects a