From b5988111398bf3b5a1cc58c374c1ef1cb58fe0ea Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 25 Jul 2026 22:36:52 -1000
Subject: Reorganize the tree into vendor/ and custom/

---
 custom/extensions/about-render.lua     | 592 +++++++++++++++++++++++++++++++++
 custom/extensions/auth-file.lua        | 556 +++++++++++++++++++++++++++++++
 custom/extensions/auth-inline.lua      | 528 +++++++++++++++++++++++++++++
 custom/extensions/email-gravatar.lua   | 115 +++++++
 custom/extensions/email-libravatar.lua | 114 +++++++
 custom/extensions/link-commits.lua     | 153 +++++++++
 custom/extensions/syntax-highlight.lua | 278 ++++++++++++++++
 7 files changed, 2336 insertions(+)
 create mode 100644 custom/extensions/about-render.lua
 create mode 100644 custom/extensions/auth-file.lua
 create mode 100644 custom/extensions/auth-inline.lua
 create mode 100644 custom/extensions/email-gravatar.lua
 create mode 100644 custom/extensions/email-libravatar.lua
 create mode 100644 custom/extensions/link-commits.lua
 create mode 100644 custom/extensions/syntax-highlight.lua

(limited to 'custom/extensions')

diff --git a/custom/extensions/about-render.lua b/custom/extensions/about-render.lua
new file mode 100644
index 0000000..073b531
--- /dev/null
+++ b/custom/extensions/about-render.lua
@@ -0,0 +1,592 @@
+-- Server-side about-page rendering for cgit, used with the about-filter setting
+-- in cgitrc and the lua: prefix so it runs in cgit's embedded interpreter with
+-- no per-request process.
+--
+--     about-filter=lua:/usr/lib/cgit/filters/about-render.lua
+--
+-- One filter renders the three baseline about formats, chosen by the readme's
+-- file extension.
+--
+--     markdown   .md .markdown .mkd .mdown
+--     man page   .1 through .9 and .man
+--     plain text everything else, and the fallback for anything that fails
+--
+-- Add a format by giving it a render function and a row in the handler table
+-- near the foot of this file. Nothing else needs to change.
+--
+-- SUPPORTED LUA
+--
+-- Lua 5.1 through 5.4 and LuaJIT.
+--
+-- REQUIREMENTS
+--
+-- lpeg, the parsing module, for the Lua cgit is linked against. Markdown and
+-- man pages are parsed with lpeg grammars, so without lpeg both fall back to
+-- escaped plain text. It ships with cgit's syntax highlighter too, so a cgit
+-- that colours source already has it.
+--
+--     # Debian and Ubuntu
+--     sudo apt install lua-lpeg
+--     # Fedora
+--     sudo dnf install lua-lpeg
+--     # Alpine
+--     sudo apk add lua5.1-lpeg
+--     # or with LuaRocks, matched to your Lua version
+--     sudo luarocks --lua-version 5.1 install lpeg
+--
+-- Plain text needs only Lua itself.
+--
+-- SECURITY
+--
+-- The about page renders untrusted repository content, so the safety rule is
+-- that every run of text reaches the page through cgit's own html_txt, every
+-- attribute value through html_attr, and every link or image target through
+-- the safe_url scheme allowlist below before html_attr. Only http, https,
+-- mailto and relative targets survive, so a hostile readme cannot inject markup
+-- or a javascript: url. Because all output is routed through those sinks by
+-- construction, a bug in the parser can only mis-render, never inject.
+--
+-- LIMITATIONS
+--
+-- Markdown is a deliberate subset, not CommonMark. Headings, thematic breaks,
+-- fenced and inline code, blockquotes, pipe tables, single-level lists, links,
+-- images and emphasis. No reference links, no raw HTML passthrough, no nested
+-- lists, no setext headings. Emphasis does not span a hard line break inside a
+-- paragraph. Man rendering covers the common macros (section headings, filled
+-- and no-fill paragraphs, bold and italic, font escapes) and drops the rest.
+-- cgit sends filter output through a C string sink that stops at the first NUL
+-- byte, so content past a NUL is truncated.
+--
+-- OUTPUT
+--
+-- Markdown is wrapped in <div class='markdown'>, man pages in
+-- <div class='markdown manpage'>, plain text in <pre class='plaintext'>, all
+-- styled by assets/cgit.css.
+
+local ok_lpeg, lpeg = pcall(require, "lpeg")
+
+
+-- ===== configuration ===================================================
+
+-- Readmes larger than this are served as escaped plain text rather than parsed.
+local max_bytes = 512 * 1024
+
+-- Ceiling on blockquote and emphasis nesting, so a hostile readme of stacked
+-- markers cannot drive the recursive parser into a stack overflow.
+local max_depth = 24
+
+local filename, chunks = "", {}
+
+
+-- ===== helpers =========================================================
+
+local function trim(s)
+	return (s:gsub("^%s+", ""):gsub("%s+$", ""))
+end
+
+-- Split on newlines after normalising CRLF and CR, returning the lines without
+-- their terminators. A trailing newline yields a final empty line, which every
+-- caller treats as blank.
+local function split_lines(s)
+	s = s:gsub("\r\n?", "\n")
+	local lines, start = {}, 1
+	while true do
+		local nl = s:find("\n", start, true)
+		if not nl then
+			lines[#lines + 1] = s:sub(start)
+			return lines
+		end
+		lines[#lines + 1] = s:sub(start, nl - 1)
+		start = nl + 1
+	end
+end
+
+-- Split a table row into trimmed cells, dropping one optional leading and
+-- trailing pipe.
+local function split_cells(row)
+	row = trim(row):gsub("^|", ""):gsub("|$", "")
+	local cells = {}
+	for c in (row .. "|"):gmatch("(.-)|") do
+		cells[#cells + 1] = trim(c)
+	end
+	return cells
+end
+
+-- Return the url if its scheme is safe, else nil. Control and whitespace bytes
+-- are stripped anywhere first because a browser ignores them when resolving the
+-- scheme, so "java\nscript:" must still be caught as javascript. The class is
+-- %c%s rather than a literal 0x00 range so it is safe on Lua 5.1, where an
+-- embedded zero byte ends a pattern.
+local function safe_url(url)
+	url = url:gsub("[%c%s]", "")
+	-- A leading "//" or "/\" is scheme-relative, which a browser resolves to
+	-- another origin, so it is not the local target the parser meant to allow.
+	if url:sub(1, 2) == "//" or url:sub(1, 2) == "/\\" then
+		return nil
+	end
+	local scheme = url:match("^(%a[%w%+%.%-]*):")
+	if scheme then
+		scheme = scheme:lower()
+		if scheme ~= "http" and scheme ~= "https" and scheme ~= "mailto" then
+			return nil
+		end
+	end
+	return url
+end
+
+
+-- ===== emit ============================================================
+-- html, html_txt and html_attr are injected by cgit's lua filter host. Tag
+-- scaffolding is a literal argument to html; every value that came from the
+-- repository goes through html_txt, html_attr or safe_url.
+
+local emit_inline
+
+emit_inline = function(list)
+	for _, nd in ipairs(list) do
+		local t = nd.t
+		if t == "text" then
+			html_txt(nd.v)
+		elseif t == "code" then
+			html("<code>"); html_txt(nd.v); html("</code>")
+		elseif t == "strong" then
+			html("<strong>"); emit_inline(nd.kids); html("</strong>")
+		elseif t == "em" then
+			html("<em>"); emit_inline(nd.kids); html("</em>")
+		elseif t == "link" then
+			local u = safe_url(nd.url)
+			if u then
+				html("<a href='"); html_attr(u); html("'>")
+				emit_inline(nd.kids)
+				html("</a>")
+			else
+				emit_inline(nd.kids)
+			end
+		elseif t == "image" then
+			local u = safe_url(nd.url)
+			if u then
+				html("<img src='"); html_attr(u)
+				html("' alt='"); html_attr(nd.alt); html("'/>")
+			else
+				html_txt("![" .. nd.alt .. "]")
+			end
+		end
+	end
+end
+
+local emit_blocks
+
+emit_blocks = function(blocks)
+	for _, b in ipairs(blocks) do
+		local t = b.t
+		if t == "heading" then
+			html("<h" .. b.level .. ">")
+			emit_inline(b.kids)
+			html("</h" .. b.level .. ">")
+		elseif t == "hr" then
+			html("<hr/>")
+		elseif t == "code" then
+			html("<pre><code")
+			if b.lang and b.lang ~= "" then
+				html(" data-lang='"); html_attr(b.lang); html("'")
+			end
+			html(">"); html_txt(b.text); html("</code></pre>")
+		elseif t == "blockquote" then
+			html("<blockquote>"); emit_blocks(b.blocks); html("</blockquote>")
+		elseif t == "table" then
+			html("<table><thead><tr>")
+			for _, c in ipairs(b.head) do
+				html("<th>"); emit_inline(c); html("</th>")
+			end
+			html("</tr></thead><tbody>")
+			for _, row in ipairs(b.rows) do
+				html("<tr>")
+				for _, c in ipairs(row) do
+					html("<td>"); emit_inline(c); html("</td>")
+				end
+				html("</tr>")
+			end
+			html("</tbody></table>")
+		elseif t == "list" then
+			local tag = b.ordered and "ol" or "ul"
+			html("<" .. tag .. ">")
+			for _, item in ipairs(b.items) do
+				html("<li>"); emit_inline(item); html("</li>")
+			end
+			html("</" .. tag .. ">")
+		elseif t == "para" then
+			html("<p>")
+			for k, line in ipairs(b.lines) do
+				if k > 1 then html("<br/>") end
+				emit_inline(line)
+			end
+			html("</p>")
+		end
+	end
+end
+
+
+-- ===== plain text ======================================================
+
+local function render_plaintext(text)
+	html("<pre class='plaintext'>")
+	html_txt(text)
+	html("</pre>")
+end
+
+
+-- ===== markdown and man ================================================
+-- Both are parsed with lpeg into the block/inline node trees emit_blocks and
+-- emit_inline above consume. Parsing is pure and builds a tree; emit is the
+-- only step that writes output, so a parse failure falls back to plain text
+-- without leaving half a page behind.
+
+local render_markdown, render_man
+
+if ok_lpeg then
+	local P, R, S, C, Ct = lpeg.P, lpeg.R, lpeg.S, lpeg.C, lpeg.Ct
+
+	local sp = S(" \t")
+	local ws = S(" \t\r\n\f\v")
+	local eol = P(-1)
+
+	-- ----- markdown inline -----
+	local marker = S("`![*_")
+	local urlchar = 1 - S(")") - ws
+	-- Bound the link and image inner scans. Without a cap a readme of unclosed
+	-- brackets ("[[[[...") makes each position scan to end of line for a "]"
+	-- that never comes, which is quadratic. Real link text and urls sit far
+	-- under this, and anything longer simply renders as plain text.
+	local CAP = 512
+
+	local parse_inline
+	local inline_depth = 0
+
+	local function node_text(s) return { t = "text", v = s } end
+	local function node_code(s) return { t = "code", v = s } end
+	local function node_strong(s) return { t = "strong", kids = parse_inline(s) } end
+	local function node_em(s) return { t = "em", kids = parse_inline(s) } end
+	local function node_link(text, url) return { t = "link", kids = parse_inline(text), url = url } end
+	local function node_image(alt, url) return { t = "image", alt = alt, url = url } end
+
+	local inline_grammar = Ct((
+		  (P("`") * C((1 - P("`")) ^ 1) * P("`")) / node_code
+		+ (P("![") * C((1 - P("]")) ^ (-CAP)) * P("]") * P("(") * sp ^ 0
+			* C(urlchar * urlchar ^ (-CAP)) * (1 - P(")")) ^ (-CAP) * P(")")) / node_image
+		+ (P("[") * C((1 - P("]")) ^ (-CAP)) * P("]") * P("(") * sp ^ 0
+			* C(urlchar * urlchar ^ (-CAP)) * (1 - P(")")) ^ (-CAP) * P(")")) / node_link
+		+ (P("**") * C((1 - P("**")) ^ 1) * P("**")) / node_strong
+		+ (P("__") * C((1 - P("__")) ^ 1) * P("__")) / node_strong
+		+ (P("*") * C((1 - ws) * (1 - P("*")) ^ 0) * P("*")) / node_em
+		+ (P("_") * C((1 - ws) * (1 - P("_")) ^ 0) * P("_")) / node_em
+		+ C((1 - marker) ^ 1) / node_text
+		+ C(P(1)) / node_text
+	) ^ 0)
+
+	parse_inline = function(s)
+		if inline_depth >= max_depth then
+			return { node_text(s) }
+		end
+		inline_depth = inline_depth + 1
+		local nodes = inline_grammar:match(s) or { node_text(s) }
+		inline_depth = inline_depth - 1
+		return nodes
+	end
+
+	-- ----- markdown blocks -----
+	-- Line matchers. Each is anchored at the start of a single line and returns
+	-- its captures, or nil when the line is not of that kind.
+	local langchar = R("az", "AZ", "09") + S("_.+#-")
+	local m_heading = C(P("#") * P("#") ^ -5) * sp ^ 1 * C(P(1) ^ 0)
+	local function rule(c) return sp ^ 0 * P(c) * (sp ^ 0 * P(c)) ^ 2 * sp ^ 0 * eol end
+	local m_hr = rule("-") + rule("*") + rule("_")
+	local m_fence = sp ^ 0 * (C(P("`") ^ 3) + C(P("~") ^ 3)) * sp ^ 0 * C(langchar ^ 0)
+	local m_close_bt = sp ^ 0 * P("`") ^ 3 * sp ^ 0 * eol
+	local m_close_ti = sp ^ 0 * P("~") ^ 3 * sp ^ 0 * eol
+	local m_bq = sp ^ 0 * P(">")
+	local bullet = S("-*+")
+	local number = R("09") ^ 1 * S(".)")
+	local m_item = sp ^ 0 * C(bullet + number) * sp ^ 1 * C(P(1) ^ 0)
+	local dcell = sp ^ 0 * P(":") ^ -1 * P("-") ^ 1 * P(":") ^ -1 * sp ^ 0
+	-- A delimiter row is dash-cells joined by pipes. Require at least one pipe,
+	-- a leading one or one between cells, so a bare rule of dashes stays a
+	-- thematic break and an ordinary paragraph line is never taken for a table.
+	local pipe = P("|")
+	local m_tdelim = sp ^ 0 * (
+		  pipe * dcell * (pipe * dcell) ^ 0 * pipe ^ -1
+		+ dcell * (pipe * dcell) ^ 1 * pipe ^ -1
+	) * sp ^ 0 * eol
+	local m_blockstart = sp ^ 0 * ((P("#") * P("#") ^ -5 * sp) + P(">")
+		+ P("`") ^ 3 + P("~") ^ 3 + ((bullet + number) * sp))
+
+	local function ordered(mark) return mark:match("%d") ~= nil end
+
+	local parse_blocks
+
+	parse_blocks = function(lines, depth)
+		local blocks, i, n = {}, 1, #lines
+		while i <= n do
+			local line = lines[i]
+			local fence, lang = m_fence:match(line)
+			local hashes, htext = m_heading:match(line)
+			local mark = m_item:match(line)
+			if line:match("^%s*$") then
+				i = i + 1
+			elseif fence then
+				local close = (fence:sub(1, 1) == "`") and m_close_bt or m_close_ti
+				local code = {}
+				i = i + 1
+				while i <= n and not close:match(lines[i]) do
+					code[#code + 1] = lines[i]; i = i + 1
+				end
+				i = i + 1
+				local body = table.concat(code, "\n")
+				if #code > 0 then body = body .. "\n" end
+				blocks[#blocks + 1] = { t = "code", lang = lang, text = body }
+			elseif hashes then
+				blocks[#blocks + 1] = {
+					t = "heading",
+					level = #hashes,
+					kids = parse_inline((htext:gsub("%s*#*%s*$", ""))),
+				}
+				i = i + 1
+			elseif m_hr:match(line) then
+				blocks[#blocks + 1] = { t = "hr" }
+				i = i + 1
+			elseif m_bq:match(line) then
+				local inner = {}
+				while i <= n and m_bq:match(lines[i]) do
+					inner[#inner + 1] = (lines[i]:gsub("^%s*>%s?", ""))
+					i = i + 1
+				end
+				if depth < max_depth then
+					blocks[#blocks + 1] = { t = "blockquote", blocks = parse_blocks(inner, depth + 1) }
+				else
+					local para = {}
+					for _, l in ipairs(inner) do para[#para + 1] = parse_inline(l) end
+					blocks[#blocks + 1] = { t = "para", lines = para }
+				end
+			elseif i + 1 <= n and line:find("|", 1, true) and m_tdelim:match(lines[i + 1]) then
+				local head = {}
+				for _, c in ipairs(split_cells(line)) do head[#head + 1] = parse_inline(c) end
+				local rows = {}
+				i = i + 2
+				while i <= n and lines[i]:find("|", 1, true) and not lines[i]:match("^%s*$") do
+					local row = {}
+					for _, c in ipairs(split_cells(lines[i])) do row[#row + 1] = parse_inline(c) end
+					rows[#rows + 1] = row
+					i = i + 1
+				end
+				blocks[#blocks + 1] = { t = "table", head = head, rows = rows }
+			elseif mark then
+				local is_ol = ordered(mark)
+				local items = {}
+				while i <= n do
+					local mk, ct = m_item:match(lines[i])
+					if not mk or ordered(mk) ~= is_ol then break end
+					items[#items + 1] = parse_inline(ct)
+					i = i + 1
+				end
+				blocks[#blocks + 1] = { t = "list", ordered = is_ol, items = items }
+			else
+				local para = { parse_inline(line) }
+				i = i + 1
+				while i <= n and not lines[i]:match("^%s*$") and not m_blockstart:match(lines[i]) do
+					para[#para + 1] = parse_inline(lines[i]); i = i + 1
+				end
+				blocks[#blocks + 1] = { t = "para", lines = para }
+			end
+		end
+		return blocks
+	end
+
+	render_markdown = function(text)
+		if #text > max_bytes then
+			return render_plaintext(text)
+		end
+		local ok, blocks = pcall(parse_blocks, split_lines(text), 0)
+		if not ok then
+			return render_plaintext(text)
+		end
+		html("<div class='markdown'>")
+		-- Emit is wrapped so a parser bug can at worst truncate the page, never
+		-- error out and let the outer fallback duplicate what was already sent.
+		pcall(emit_blocks, blocks)
+		html("</div>")
+	end
+
+	-- ----- man pages -----
+	-- Macro lines are matched with lpeg, and the roff inline font and character
+	-- escapes are an lpeg grammar producing a flat token list that a fold turns
+	-- into the same inline nodes markdown emits. Bold and italic are the current
+	-- font, which carries across a run, so the inline pass tokenises and folds
+	-- rather than nesting the way markdown does.
+	local m_macro = S(".'") * sp ^ 0 * C((1 - sp) ^ 1) * sp ^ 0 * C(P(1) ^ 0)
+
+	local one_font = { B = "B", I = "I" }
+	local two_font = { CB = "B", BI = "B", CI = "I" }
+	local man_chars = {
+		aq = "'", cq = "'", oq = "'", dq = '"', lq = '"', rq = '"',
+		hy = "-", en = "-", em = "-",
+	}
+	local esc = P("\\")
+	local function font_tok(f) return { k = "font", f = f } end
+	local function text_tok(v) return { k = "text", v = v } end
+	local skip_tok = { k = "skip" }
+
+	local man_inline_grammar = Ct((
+		  (esc * P("f") * P("(") * C(P(1) * P(1))) / function(nm) return font_tok(two_font[nm] or "R") end
+		+ (esc * P("f") * P("[") * C((1 - P("]")) ^ 0) * P("]")) / function(nm) return font_tok(one_font[nm] or "R") end
+		+ (esc * P("f") * C(P(1))) / function(f) return font_tok(one_font[f] or "R") end
+		+ (esc * P("-")) / function() return text_tok("-") end
+		+ (esc * P("e")) / function() return text_tok("\\") end
+		+ (esc * P(" ")) / function() return text_tok(" ") end
+		+ (esc * S("&|^")) / function() return skip_tok end
+		+ (esc * P("(") * C(P(1) * P(1))) / function(nm) return text_tok(man_chars[nm] or "") end
+		+ (esc * P("*") * (P("(") * P(1) * P(1) + P(1))) / function() return skip_tok end
+		+ (esc * C(P(1))) / text_tok
+		+ esc / function() return skip_tok end
+		+ C((1 - esc) ^ 1) / text_tok
+	) ^ 0)
+
+	local function man_inline(s)
+		local toks = man_inline_grammar:match(s) or {}
+		local nodes, buf, font = {}, {}, "R"
+		local function flush()
+			if #buf == 0 then return end
+			local txt = table.concat(buf); buf = {}
+			if txt == "" then return end
+			if font == "B" then
+				nodes[#nodes + 1] = { t = "strong", kids = { { t = "text", v = txt } } }
+			elseif font == "I" then
+				nodes[#nodes + 1] = { t = "em", kids = { { t = "text", v = txt } } }
+			else
+				nodes[#nodes + 1] = { t = "text", v = txt }
+			end
+		end
+		for _, tk in ipairs(toks) do
+			if tk.k == "text" then
+				buf[#buf + 1] = tk.v
+			elseif tk.k == "font" then
+				flush(); font = tk.f
+			end
+		end
+		flush()
+		return nodes
+	end
+
+	local function parse_man(text)
+		local lines = split_lines(text)
+		local blocks = {}
+		local para, pre, nofill = nil, nil, false
+		local function flush_para()
+			if para and #para > 0 then
+				blocks[#blocks + 1] = { t = "para", lines = para }
+			end
+			para = nil
+		end
+		local function flush_pre()
+			if pre then
+				local body = table.concat(pre, "\n")
+				if #pre > 0 then body = body .. "\n" end
+				blocks[#blocks + 1] = { t = "code", text = body }
+				pre = nil
+			end
+		end
+		local function add_line(nodes)
+			para = para or {}
+			para[#para + 1] = nodes
+		end
+		for _, line in ipairs(lines) do
+			local macro, rest = m_macro:match(line)
+			if rest then rest = (rest:gsub('^"(.*)"$', "%1")) end
+			if nofill then
+				if macro == "fi" then
+					nofill = false; flush_pre()
+				else
+					pre[#pre + 1] = line
+				end
+			elseif line:match("^%s*$") then
+				flush_para()
+			elseif macro and macro:sub(1, 1) == "\\" then
+				-- roff comment, dropped
+			elseif macro == "SH" or macro == "SS" then
+				flush_para()
+				blocks[#blocks + 1] = {
+					t = "heading",
+					level = (macro == "SH") and 2 or 3,
+					kids = man_inline(rest),
+				}
+			elseif macro == "nf" then
+				flush_para(); nofill = true; pre = {}
+			elseif macro == "fi" then
+				flush_pre()
+			elseif macro == "B" or macro == "BR" or macro == "RB"
+			    or macro == "BI" or macro == "IB" then
+				add_line({ { t = "strong", kids = man_inline(rest) } })
+			elseif macro == "I" or macro == "IR" or macro == "RI" then
+				add_line({ { t = "em", kids = man_inline(rest) } })
+			elseif macro == "TH" or macro == "PP" or macro == "LP"
+			    or macro == "P" or macro == "TP" or macro == "IP"
+			    or macro == "HP" or macro == "RS" or macro == "RE"
+			    or macro == "sp" or macro == "br" then
+				flush_para()
+			elseif macro then
+				if rest ~= "" then add_line(man_inline(rest)) end
+			else
+				add_line(man_inline(line))
+			end
+		end
+		flush_para(); flush_pre()
+		return blocks
+	end
+
+	render_man = function(text)
+		if #text > max_bytes then
+			return render_plaintext(text)
+		end
+		local ok, blocks = pcall(parse_man, text)
+		if not ok then
+			return render_plaintext(text)
+		end
+		html("<div class='markdown manpage'>")
+		pcall(emit_blocks, blocks)
+		html("</div>")
+	end
+else
+	-- No lpeg, so markdown and man readmes read as escaped source, not nothing.
+	render_markdown = render_plaintext
+	render_man = render_plaintext
+end
+
+
+-- ===== dispatch ========================================================
+
+local handlers = {}
+for _, ext in ipairs({ "md", "markdown", "mkd", "mdown" }) do
+	handlers[ext] = render_markdown
+end
+for _, ext in ipairs({ "1", "2", "3", "4", "5", "6", "7", "8", "9", "man" }) do
+	handlers[ext] = render_man
+end
+
+function filter_open(name)
+	filename = name or ""
+	chunks = {}
+end
+
+function filter_write(str)
+	chunks[#chunks + 1] = str
+end
+
+function filter_close()
+	local text = table.concat(chunks)
+	chunks = {}
+	local ext = (filename:match("%.([^.]+)$") or ""):lower()
+	local render = handlers[ext] or render_plaintext
+	local ok = pcall(render, text)
+	if not ok then
+		render_plaintext(text)
+	end
+	return 0
+end
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
new file mode 100644
index 0000000..5415ca7
--- /dev/null
+++ b/custom/extensions/auth-file.lua
@@ -0,0 +1,556 @@
+-- cgit auth-filter that gates repositories behind a login form and a signed
+-- session cookie.
+--
+-- This is the FILE-BACKED variant. The user accounts, the groups, and the
+-- per-repository access lists are read from files on disk, whose paths are set
+-- in the CONFIGURATION block below. Edit those files without touching this
+-- script. This suits larger or externally managed user sets.
+--
+-- The companion auth-inline.lua behaves identically but keeps its accounts and
+-- access lists inline in the script itself, which suits a small fixed set of
+-- users.
+--
+-- Enable it in cgitrc with
+--     auth-filter=lua:/path/to/auth-file.lua
+--
+-- SUPPORTED LUA
+--
+-- Lua 5.1, 5.2, 5.3, 5.4 and LuaJIT. Lua 5.5 is not supported, because luaossl
+-- has no 5.5 build. Match the runtime to the Lua that cgit is built against.
+--
+-- HTTPS IS RECOMMENDED
+--
+-- Serve cgit over HTTPS. Terminate TLS at the web server in front of cgit. The
+-- session cookie is marked Secure by default, so a browser only sends it back
+-- over HTTPS. If you genuinely run cgit over plain HTTP with no TLS anywhere,
+-- set cookie_insecure below, otherwise the cookie is never returned and login
+-- appears to loop.
+--
+-- DEPENDENCIES
+--
+--     luaossl    OpenSSL binding, provides openssl.rand and openssl.hmac
+--                <https://github.com/wahern/luaossl>
+--     luaposix   POSIX binding, provides posix.sys.stat and posix.unistd
+--                <https://github.com/luaposix/luaposix>
+--
+-- The reliable cross-platform install is LuaRocks, matched to your Lua
+-- version. luaossl also needs the OpenSSL development headers present.
+--
+--     # Debian and Ubuntu
+--     sudo apt install luarocks libssl-dev
+--     sudo luarocks --lua-version 5.1 install luaossl
+--     sudo luarocks --lua-version 5.1 install luaposix
+--
+--     # Fedora
+--     sudo dnf install luarocks openssl-devel
+--     sudo luarocks --lua-version 5.1 install luaossl luaposix
+--
+--     # Alpine
+--     sudo apk add luarocks openssl-dev
+--     sudo luarocks-5.1 install luaossl luaposix
+--
+--     # macOS with Homebrew
+--     brew install luarocks openssl
+--     luarocks install luaossl OPENSSL_DIR="$(brew --prefix openssl)"
+--     luarocks install luaposix
+--
+-- Some distributions also package these, for example lua-luaossl and lua-posix
+-- on Debian. If you use a distribution package, make sure it is built for the
+-- same Lua version as cgit.
+--
+-- SECURITY NOTES
+--
+-- The cookie carries only a username with no server-side session store, so
+-- deleting an account does not revoke a cookie already issued until it
+-- expires, and instances that share a secret file accept each other's cookies.
+-- The login form carries no CSRF token. Both are acceptable for gating read
+-- access to a git browser. Weigh them before guarding anything more sensitive.
+
+local sysstat = require("posix.sys.stat")
+local unistd = require("posix.unistd")
+local rand = require("openssl.rand")
+local hmac = require("openssl.hmac")
+
+--
+-- ========================= CONFIGURATION =========================
+-- Edit the values in this block. Nothing below it needs changing for
+-- ordinary use.
+--
+
+-- Accounts, one per line, as username:hash. Generate a hash with
+--     mkpasswd -m sha-512 -R 300000
+-- This file should not be world-readable.
+local users_filename = "/etc/cgit-auth/users"
+
+-- Group membership, one per line, as groupname:user1,user2,user3,...
+local groups_filename = "/etc/cgit-auth/groups"
+
+-- Per-repository access, one per line, as reponame:group1,group2,...
+-- A repository listed here is protected. One not listed is public.
+local repos_filename = "/etc/cgit-auth/repos"
+
+-- Where the cookie-signing secret is stored. It is created on first use. It
+-- must be persistent and writable by cgit. Prefer a path OUTSIDE the cache
+-- root, because pruning the cache would delete a secret kept inside it and
+-- invalidate every live session. This file should not be world-readable.
+local secret_filename = "/var/cache/cgit/auth-secret"
+
+-- How long a login stays valid, in seconds. Default one week.
+local session_seconds = 7 * 24 * 60 * 60
+
+-- Name of the session cookie.
+local cookie_name = "cgitauth"
+
+-- Path the cookie is scoped to. "/" covers the whole host. Set it to the cgit
+-- root to scope the cookie more tightly.
+local cookie_path = "/"
+
+-- Leave false so the cookie is marked Secure and only travels over HTTPS. Set
+-- it true ONLY if cgit is served over plain HTTP with no TLS anywhere, see the
+-- HTTPS note in the header.
+local cookie_insecure = false
+
+--
+-- =================================================================
+--
+
+-- A throwaway hash of the documented shape, used only to spend the same work
+-- on a missing account as on a present one, so a failed login does not reveal
+-- by timing whether the username exists.
+local dummy_hash = "$6$rounds=300000$0000000000000000$"
+
+-- Module state shared across the open, write and close calls of one request.
+local action, http, cgit, post
+
+--
+--
+-- Account and access-list storage. This is the ONLY part that differs from
+-- auth-inline.lua. Swap these two functions to change where accounts live.
+--
+--
+
+local function trim(s)
+	return (string.gsub(s, "^%s*(.-)%s*$", "%1"))
+end
+
+-- Return the stored password hash for a user, or nil. Reads the users file
+-- fresh each call. A missing or unreadable file, and any unparsable line, are
+-- skipped rather than fatal.
+function account_hash(user)
+	if user == nil then
+		return nil
+	end
+	local wanted = user:lower()
+	local f = io.open(users_filename, "r")
+	if f == nil then
+		return nil
+	end
+	for line in f:lines() do
+		local u, h = string.match(line, "(.-):(.+)")
+		if u ~= nil and trim(u):lower() == wanted then
+			f:close()
+			return h
+		end
+	end
+	f:close()
+	return nil
+end
+
+-- Return the set of users allowed to access a repository, keyed by lowercased
+-- username, or nil if the repository is not protected. A protected repository
+-- whose groups resolve to no users returns an EMPTY table, which denies
+-- everyone rather than falling through to public.
+function repo_userset(repo)
+	if repo == nil then
+		return nil
+	end
+	local groups = nil
+	local f = io.open(repos_filename, "r")
+	if f ~= nil then
+		for line in f:lines() do
+			local r, g = string.match(line, "(.-):(.+)")
+			if r ~= nil and trim(r) == repo then
+				groups = {}
+				for group in string.gmatch(g, "([^,]+)") do
+					groups[trim(group):lower()] = true
+				end
+				break
+			end
+		end
+		f:close()
+	end
+	if groups == nil then
+		return nil
+	end
+	local users = {}
+	local gf = io.open(groups_filename, "r")
+	if gf ~= nil then
+		for line in gf:lines() do
+			local g, u = string.match(line, "(.-):(.+)")
+			if g ~= nil and groups[trim(g):lower()] then
+				for user in string.gmatch(u, "([^,]+)") do
+					users[trim(user):lower()] = true
+				end
+			end
+		end
+		gf:close()
+	end
+	return users
+end
+
+--
+--
+-- Utility functions based on keplerproject/wsapi.
+--
+--
+
+function url_decode(str)
+	if not str then
+		return ""
+	end
+	str = string.gsub(str, "+", " ")
+	str = string.gsub(str, "%%(%x%x)", function(h) return string.char(tonumber(h, 16)) end)
+	str = string.gsub(str, "\r\n", "\n")
+	return str
+end
+
+function url_encode(str)
+	if not str then
+		return ""
+	end
+	str = string.gsub(str, "\n", "\r\n")
+	str = string.gsub(str, "([^%w ])", function(c) return string.format("%%%02X", string.byte(c)) end)
+	str = string.gsub(str, " ", "+")
+	return str
+end
+
+-- Parse an application/x-www-form-urlencoded body. A value may itself contain
+-- '=', for example a base64 password, so the value runs to the next '&'.
+function parse_qs(qs)
+	local tab = {}
+	for key, val in string.gmatch(qs or "", "([^&=]+)=([^&]*)") do
+		tab[url_decode(key)] = url_decode(val)
+	end
+	return tab
+end
+
+-- Return the value of the named cookie, or nil. The stored token was already
+-- url-encoded by secure_value, so it is returned verbatim, which keeps the
+-- write path (set_cookie) and the read path symmetric. Decoding it here would
+-- break the signature check for any value carrying a percent escape.
+function get_cookie(cookies, name)
+	cookies = string.gsub(";" .. (cookies or "") .. ";", "%s*;%s*", ";")
+	return string.match(cookies, ";" .. name .. "=(.-);")
+end
+
+function tohex(b)
+	local x = ""
+	for i = 1, #b do
+		x = x .. string.format("%.2x", string.byte(b, i))
+	end
+	return x
+end
+
+--
+--
+-- Cookie construction and validation helpers.
+--
+--
+
+local secret = nil
+
+-- Load the cookie-signing secret, creating it on first use. Failures raise,
+-- which cgit turns into a request error, so a broken secret denies rather than
+-- signs with nothing.
+function get_secret()
+	if secret ~= nil then
+		return secret
+	end
+	local secret_file = io.open(secret_filename, "r")
+	if secret_file == nil then
+		local old_umask = sysstat.umask(63)
+		local temporary_filename = secret_filename .. ".tmp." .. tohex(rand.bytes(16))
+		local temporary_file = io.open(temporary_filename, "w")
+		if temporary_file == nil then
+			sysstat.umask(old_umask)
+			error("cgit auth: cannot create secret file " .. secret_filename)
+		end
+		local wrote = temporary_file:write(tohex(rand.bytes(32)))
+		local closed = temporary_file:close()
+		if not wrote or not closed then
+			os.remove(temporary_filename)
+			sysstat.umask(old_umask)
+			error("cgit auth: failed writing secret file " .. secret_filename)
+		end
+		unistd.link(temporary_filename, secret_filename) -- Intentionally fails if another worker won the race.
+		unistd.unlink(temporary_filename)
+		sysstat.umask(old_umask)
+		secret_file = io.open(secret_filename, "r")
+	end
+	if secret_file == nil then
+		error("cgit auth: cannot read secret file " .. secret_filename)
+	end
+	secret = secret_file:read("*l")
+	secret_file:close()
+	if secret == nil or secret:len() ~= 64 then
+		secret = nil
+		error("cgit auth: secret file " .. secret_filename .. " is malformed, expected 64 hex characters")
+	end
+	return secret
+end
+
+-- A redirect target is unsafe if a browser would read it as another origin.
+-- The only such form cgit can be tricked into signing is a scheme-relative
+-- "//host" or "/\host". Everything else stays on this host.
+function is_safe_redirect(url)
+	if type(url) ~= "string" then
+		return false
+	end
+	local head = url:sub(1, 2)
+	if head == "//" or head == "/\\" then
+		return false
+	end
+	return true
+end
+
+-- Return the value carried by a signed cookie, or nil if it does not verify.
+function validate_value(expected_field, cookie)
+	local i = 0
+	local value = ""
+	local field = ""
+	local expiration = 0
+	local salt = ""
+	local chmac = ""
+
+	if cookie == nil or cookie:len() < 3 or cookie:sub(1, 1) == "|" then
+		return nil
+	end
+
+	for component in string.gmatch(cookie, "[^|]+") do
+		if i == 0 then
+			field = component
+		elseif i == 1 then
+			value = component
+		elseif i == 2 then
+			-- The expiration must be a plain integer. Rejecting other forms
+			-- keeps the signed bytes canonical, since tonumber and tostring of
+			-- "1e9" or "100.0" differ across Lua versions.
+			if not string.match(component, "^%d+$") then
+				return nil
+			end
+			expiration = tonumber(component)
+		elseif i == 3 then
+			salt = component
+		elseif i == 4 then
+			chmac = component
+		else
+			break
+		end
+		i = i + 1
+	end
+
+	if chmac == nil or chmac:len() == 0 then
+		return nil
+	end
+
+	-- Compare the HMAC without short-circuiting on the first mismatch.
+	if not constant_equals(chmac, tohex(hmac.new(get_secret(), "sha256"):final(field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt))) then
+		return nil
+	end
+
+	-- An expiration of 0 never expires and is used for the redirect token.
+	if expiration ~= 0 and expiration <= os.time() then
+		return nil
+	end
+
+	if url_decode(field) ~= expected_field then
+		return nil
+	end
+
+	local decoded = url_decode(value)
+	-- Reject values carrying control characters so a signed value cannot
+	-- smuggle CR or LF into a response header.
+	if decoded:find("%c") then
+		return nil
+	end
+	return decoded
+end
+
+function secure_value(field, value, expiration)
+	if value == nil or value:len() <= 0 then
+		return ""
+	end
+
+	local salt = tohex(rand.bytes(16))
+	value = url_encode(value)
+	field = url_encode(field)
+	local authstr = field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt
+	authstr = authstr .. "|" .. tohex(hmac.new(get_secret(), "sha256"):final(authstr))
+	return authstr
+end
+
+-- Strip control characters that could split an HTTP response header.
+function strip_ctl(s)
+	return (string.gsub(s or "", "%c", ""))
+end
+
+-- Compare two strings in time that does not depend on how many leading bytes
+-- match, so a mismatch position is not revealed by timing.
+function constant_equals(a, b)
+	if type(a) ~= "string" or type(b) ~= "string" or #a ~= #b then
+		return false
+	end
+	local diff = 0
+	for i = 1, #a do
+		local d = a:byte(i) - b:byte(i)
+		diff = diff + d * d
+	end
+	return diff == 0
+end
+
+function set_cookie(cookie, value)
+	local attrs = "; HttpOnly; SameSite=Lax; Path=" .. cookie_path
+	if not cookie_insecure then
+		attrs = attrs .. "; Secure"
+	end
+	if value == "" then
+		attrs = attrs .. "; Max-Age=0"
+	elseif session_seconds > 0 then
+		attrs = attrs .. "; Max-Age=" .. tostring(session_seconds)
+	end
+	html("Set-Cookie: " .. cookie .. "=" .. strip_ctl(value) .. attrs .. "\n")
+end
+
+function redirect_to(url)
+	html("Status: 302 Redirect\n")
+	html("Cache-Control: no-cache, no-store\n")
+	html("Location: " .. strip_ctl(url) .. "\n")
+end
+
+function not_found()
+	html("Status: 404 Not Found\n")
+	html("Cache-Control: no-cache, no-store\n\n")
+end
+
+--
+--
+-- Authentication actions. Identical to auth-inline.lua from here down.
+--
+--
+
+-- Sets HTTP cookie headers based on post and sets up redirection.
+function authenticate_post()
+	local redirect = validate_value("redirect", post["redirect"])
+
+	if redirect == nil or not is_safe_redirect(redirect) then
+		not_found()
+		return 0
+	end
+
+	redirect_to(redirect)
+
+	local username = post["username"]
+	local password = post["password"]
+	local ok = false
+	if username ~= nil and password ~= nil then
+		local hash = account_hash(username)
+		if hash == nil then
+			-- Spend the work anyway, see dummy_hash.
+			unistd.crypt(password, dummy_hash)
+		elseif constant_equals(hash, unistd.crypt(password, hash)) then
+			ok = true
+		end
+	end
+
+	if ok then
+		set_cookie(cookie_name, secure_value("username", username, os.time() + session_seconds))
+	else
+		set_cookie(cookie_name, "")
+	end
+
+	html("\n")
+	return 0
+end
+
+-- Returns 1 if the cookie is valid and 0 if it is not.
+function authenticate_cookie()
+	local accepted_users = repo_userset(cgit["repo"])
+	if accepted_users == nil then
+		-- The repository is not protected.
+		return 1
+	end
+
+	local username = validate_value("username", get_cookie(http["cookie"], cookie_name))
+	if username == nil or not accepted_users[username:lower()] then
+		return 0
+	end
+	return 1
+end
+
+-- Prints the html for the login form.
+function body()
+	local target = cgit["url"]
+	if not is_safe_redirect(target) then
+		target = cgit["login"]
+	end
+
+	html("<h2>Authentication Required</h2>")
+	html("<form method='post' action='")
+	html_attr(cgit["login"])
+	html("'>")
+	html("<input type='hidden' name='redirect' value='")
+	html_attr(secure_value("redirect", target, 0))
+	html("' />")
+	html("<table>")
+	html("<tr><td><label for='username'>Username:</label></td><td><input id='username' name='username' autofocus /></td></tr>")
+	html("<tr><td><label for='password'>Password:</label></td><td><input id='password' name='password' type='password' /></td></tr>")
+	html("<tr><td colspan='2'><input value='Login' type='submit' /></td></tr>")
+	html("</table></form>")
+
+	return 0
+end
+
+--
+--
+-- Wrapper around the filter API, exposing the http, cgit and post tables to
+-- the functions above.
+--
+--
+
+local actions = {}
+actions["authenticate-post"] = authenticate_post
+actions["authenticate-cookie"] = authenticate_cookie
+actions["body"] = body
+
+function filter_open(...)
+	action = actions[select(1, ...)]
+
+	post = {}
+
+	http = {}
+	http["cookie"] = select(2, ...)
+	http["method"] = select(3, ...)
+	http["query"] = select(4, ...)
+	http["referer"] = select(5, ...)
+	http["path"] = select(6, ...)
+	http["host"] = select(7, ...)
+	http["https"] = select(8, ...)
+
+	cgit = {}
+	cgit["repo"] = select(9, ...)
+	cgit["page"] = select(10, ...)
+	cgit["url"] = select(11, ...)
+	cgit["login"] = select(12, ...)
+end
+
+function filter_close()
+	if action == nil then
+		-- Unknown action, deny rather than raise.
+		return 0
+	end
+	return action()
+end
+
+function filter_write(str)
+	post = parse_qs(str)
+end
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
new file mode 100644
index 0000000..168a444
--- /dev/null
+++ b/custom/extensions/auth-inline.lua
@@ -0,0 +1,528 @@
+-- cgit auth-filter that gates repositories behind a login form and a signed
+-- session cookie.
+--
+-- This is the INLINE variant. The user accounts and the per-repository access
+-- lists are written directly in this script, in the two tables in the
+-- CONFIGURATION block below. Edit them here and reload. This suits a small
+-- fixed set of users that rarely changes.
+--
+-- The companion auth-file.lua behaves identically but reads its accounts and
+-- access lists from files on disk instead, which suits larger or externally
+-- managed user sets.
+--
+-- Enable it in cgitrc with
+--     auth-filter=lua:/path/to/auth-inline.lua
+--
+-- SUPPORTED LUA
+--
+-- Lua 5.1, 5.2, 5.3, 5.4 and LuaJIT. Lua 5.5 is not supported, because luaossl
+-- has no 5.5 build. Match the runtime to the Lua that cgit is built against.
+--
+-- HTTPS IS RECOMMENDED
+--
+-- Serve cgit over HTTPS. Terminate TLS at the web server in front of cgit. The
+-- session cookie is marked Secure by default, so a browser only sends it back
+-- over HTTPS. If you genuinely run cgit over plain HTTP with no TLS anywhere,
+-- set cookie_insecure below, otherwise the cookie is never returned and login
+-- appears to loop.
+--
+-- DEPENDENCIES
+--
+--     luaossl    OpenSSL binding, provides openssl.rand and openssl.hmac
+--                <https://github.com/wahern/luaossl>
+--     luaposix   POSIX binding, provides posix.sys.stat and posix.unistd
+--                <https://github.com/luaposix/luaposix>
+--
+-- The reliable cross-platform install is LuaRocks, matched to your Lua
+-- version. luaossl also needs the OpenSSL development headers present.
+--
+--     # Debian and Ubuntu
+--     sudo apt install luarocks libssl-dev
+--     sudo luarocks --lua-version 5.1 install luaossl
+--     sudo luarocks --lua-version 5.1 install luaposix
+--
+--     # Fedora
+--     sudo dnf install luarocks openssl-devel
+--     sudo luarocks --lua-version 5.1 install luaossl luaposix
+--
+--     # Alpine
+--     sudo apk add luarocks openssl-dev
+--     sudo luarocks-5.1 install luaossl luaposix
+--
+--     # macOS with Homebrew
+--     brew install luarocks openssl
+--     luarocks install luaossl OPENSSL_DIR="$(brew --prefix openssl)"
+--     luarocks install luaposix
+--
+-- Some distributions also package these, for example lua-luaossl and lua-posix
+-- on Debian. If you use a distribution package, make sure it is built for the
+-- same Lua version as cgit.
+--
+-- SECURITY NOTES
+--
+-- The cookie carries only a username with no server-side session store, so
+-- deleting an account does not revoke a cookie already issued until it
+-- expires, and instances that share a secret file accept each other's cookies.
+-- The login form carries no CSRF token. Both are acceptable for gating read
+-- access to a git browser. Weigh them before guarding anything more sensitive.
+
+local sysstat = require("posix.sys.stat")
+local unistd = require("posix.unistd")
+local rand = require("openssl.rand")
+local hmac = require("openssl.hmac")
+
+--
+-- ========================= CONFIGURATION =========================
+-- Edit the values in this block. Nothing below it needs changing for
+-- ordinary use.
+--
+
+-- Protected repositories and the users allowed into each. A repository listed
+-- here is protected. One not listed is public. Keys and user names are matched
+-- case-insensitively. REPLACE THE EXAMPLES BELOW, they are commented out so an
+-- unedited copy protects nothing and grants no accounts.
+local protected_repos = {
+	-- ["secret-repo"] = { alice = true, bob = true },
+	-- ["another"]     = { alice = true },
+}
+
+-- Accounts as name = hash. Generate a hash with
+--     mkpasswd -m sha-512 -R 300000
+-- REPLACE THE EXAMPLES BELOW. The commented lines are not real credentials and
+-- must not be deployed as-is.
+local users = {
+	-- alice = "$6$rounds=300000$REPLACE_THIS_SALT$REPLACE_THIS_HASH",
+	-- bob   = "$6$rounds=300000$REPLACE_THIS_SALT$REPLACE_THIS_HASH",
+}
+
+-- Where the cookie-signing secret is stored. It is created on first use. It
+-- must be persistent and writable by cgit. Prefer a path OUTSIDE the cache
+-- root, because pruning the cache would delete a secret kept inside it and
+-- invalidate every live session. This file should not be world-readable.
+local secret_filename = "/var/cache/cgit/auth-secret"
+
+-- How long a login stays valid, in seconds. Default one week.
+local session_seconds = 7 * 24 * 60 * 60
+
+-- Name of the session cookie.
+local cookie_name = "cgitauth"
+
+-- Path the cookie is scoped to. "/" covers the whole host. Set it to the cgit
+-- root to scope the cookie more tightly.
+local cookie_path = "/"
+
+-- Leave false so the cookie is marked Secure and only travels over HTTPS. Set
+-- it true ONLY if cgit is served over plain HTTP with no TLS anywhere, see the
+-- HTTPS note in the header.
+local cookie_insecure = false
+
+--
+-- =================================================================
+--
+
+-- A throwaway hash of the documented shape, used only to spend the same work
+-- on a missing account as on a present one, so a failed login does not reveal
+-- by timing whether the username exists.
+local dummy_hash = "$6$rounds=300000$0000000000000000$"
+
+-- Module state shared across the open, write and close calls of one request.
+local action, http, cgit, post
+
+--
+--
+-- Account and access-list storage. This is the ONLY part that differs from
+-- auth-file.lua. Swap these two functions to change where accounts live.
+--
+--
+
+-- Fold the configured tables to lowercased user names once, so lookups match
+-- case-insensitively the same way auth-file.lua does. Repository names keep
+-- their case.
+do
+	local folded = {}
+	for name, hash in pairs(users) do
+		folded[tostring(name):lower()] = hash
+	end
+	users = folded
+	for repo, set in pairs(protected_repos) do
+		local fs = {}
+		for name, allowed in pairs(set) do
+			fs[tostring(name):lower()] = allowed
+		end
+		protected_repos[repo] = fs
+	end
+end
+
+-- Return the stored password hash for a user, or nil.
+function account_hash(user)
+	if user == nil then
+		return nil
+	end
+	return users[user:lower()]
+end
+
+-- Return the set of users allowed to access a repository, keyed by lowercased
+-- user name, or nil if the repository is not protected.
+function repo_userset(repo)
+	if repo == nil then
+		return nil
+	end
+	return protected_repos[repo]
+end
+
+--
+--
+-- Utility functions based on keplerproject/wsapi.
+--
+--
+
+function url_decode(str)
+	if not str then
+		return ""
+	end
+	str = string.gsub(str, "+", " ")
+	str = string.gsub(str, "%%(%x%x)", function(h) return string.char(tonumber(h, 16)) end)
+	str = string.gsub(str, "\r\n", "\n")
+	return str
+end
+
+function url_encode(str)
+	if not str then
+		return ""
+	end
+	str = string.gsub(str, "\n", "\r\n")
+	str = string.gsub(str, "([^%w ])", function(c) return string.format("%%%02X", string.byte(c)) end)
+	str = string.gsub(str, " ", "+")
+	return str
+end
+
+-- Parse an application/x-www-form-urlencoded body. A value may itself contain
+-- '=', for example a base64 password, so the value runs to the next '&'.
+function parse_qs(qs)
+	local tab = {}
+	for key, val in string.gmatch(qs or "", "([^&=]+)=([^&]*)") do
+		tab[url_decode(key)] = url_decode(val)
+	end
+	return tab
+end
+
+-- Return the value of the named cookie, or nil. The stored token was already
+-- url-encoded by secure_value, so it is returned verbatim, which keeps the
+-- write path (set_cookie) and the read path symmetric. Decoding it here would
+-- break the signature check for any value carrying a percent escape.
+function get_cookie(cookies, name)
+	cookies = string.gsub(";" .. (cookies or "") .. ";", "%s*;%s*", ";")
+	return string.match(cookies, ";" .. name .. "=(.-);")
+end
+
+function tohex(b)
+	local x = ""
+	for i = 1, #b do
+		x = x .. string.format("%.2x", string.byte(b, i))
+	end
+	return x
+end
+
+--
+--
+-- Cookie construction and validation helpers.
+--
+--
+
+local secret = nil
+
+-- Load the cookie-signing secret, creating it on first use. Failures raise,
+-- which cgit turns into a request error, so a broken secret denies rather than
+-- signs with nothing.
+function get_secret()
+	if secret ~= nil then
+		return secret
+	end
+	local secret_file = io.open(secret_filename, "r")
+	if secret_file == nil then
+		local old_umask = sysstat.umask(63)
+		local temporary_filename = secret_filename .. ".tmp." .. tohex(rand.bytes(16))
+		local temporary_file = io.open(temporary_filename, "w")
+		if temporary_file == nil then
+			sysstat.umask(old_umask)
+			error("cgit auth: cannot create secret file " .. secret_filename)
+		end
+		local wrote = temporary_file:write(tohex(rand.bytes(32)))
+		local closed = temporary_file:close()
+		if not wrote or not closed then
+			os.remove(temporary_filename)
+			sysstat.umask(old_umask)
+			error("cgit auth: failed writing secret file " .. secret_filename)
+		end
+		unistd.link(temporary_filename, secret_filename) -- Intentionally fails if another worker won the race.
+		unistd.unlink(temporary_filename)
+		sysstat.umask(old_umask)
+		secret_file = io.open(secret_filename, "r")
+	end
+	if secret_file == nil then
+		error("cgit auth: cannot read secret file " .. secret_filename)
+	end
+	secret = secret_file:read("*l")
+	secret_file:close()
+	if secret == nil or secret:len() ~= 64 then
+		secret = nil
+		error("cgit auth: secret file " .. secret_filename .. " is malformed, expected 64 hex characters")
+	end
+	return secret
+end
+
+-- A redirect target is unsafe if a browser would read it as another origin.
+-- The only such form cgit can be tricked into signing is a scheme-relative
+-- "//host" or "/\host". Everything else stays on this host.
+function is_safe_redirect(url)
+	if type(url) ~= "string" then
+		return false
+	end
+	local head = url:sub(1, 2)
+	if head == "//" or head == "/\\" then
+		return false
+	end
+	return true
+end
+
+-- Return the value carried by a signed cookie, or nil if it does not verify.
+function validate_value(expected_field, cookie)
+	local i = 0
+	local value = ""
+	local field = ""
+	local expiration = 0
+	local salt = ""
+	local chmac = ""
+
+	if cookie == nil or cookie:len() < 3 or cookie:sub(1, 1) == "|" then
+		return nil
+	end
+
+	for component in string.gmatch(cookie, "[^|]+") do
+		if i == 0 then
+			field = component
+		elseif i == 1 then
+			value = component
+		elseif i == 2 then
+			-- The expiration must be a plain integer. Rejecting other forms
+			-- keeps the signed bytes canonical, since tonumber and tostring of
+			-- "1e9" or "100.0" differ across Lua versions.
+			if not string.match(component, "^%d+$") then
+				return nil
+			end
+			expiration = tonumber(component)
+		elseif i == 3 then
+			salt = component
+		elseif i == 4 then
+			chmac = component
+		else
+			break
+		end
+		i = i + 1
+	end
+
+	if chmac == nil or chmac:len() == 0 then
+		return nil
+	end
+
+	-- Compare the HMAC without short-circuiting on the first mismatch.
+	if not constant_equals(chmac, tohex(hmac.new(get_secret(), "sha256"):final(field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt))) then
+		return nil
+	end
+
+	-- An expiration of 0 never expires and is used for the redirect token.
+	if expiration ~= 0 and expiration <= os.time() then
+		return nil
+	end
+
+	if url_decode(field) ~= expected_field then
+		return nil
+	end
+
+	local decoded = url_decode(value)
+	-- Reject values carrying control characters so a signed value cannot
+	-- smuggle CR or LF into a response header.
+	if decoded:find("%c") then
+		return nil
+	end
+	return decoded
+end
+
+function secure_value(field, value, expiration)
+	if value == nil or value:len() <= 0 then
+		return ""
+	end
+
+	local salt = tohex(rand.bytes(16))
+	value = url_encode(value)
+	field = url_encode(field)
+	local authstr = field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt
+	authstr = authstr .. "|" .. tohex(hmac.new(get_secret(), "sha256"):final(authstr))
+	return authstr
+end
+
+-- Strip control characters that could split an HTTP response header.
+function strip_ctl(s)
+	return (string.gsub(s or "", "%c", ""))
+end
+
+-- Compare two strings in time that does not depend on how many leading bytes
+-- match, so a mismatch position is not revealed by timing.
+function constant_equals(a, b)
+	if type(a) ~= "string" or type(b) ~= "string" or #a ~= #b then
+		return false
+	end
+	local diff = 0
+	for i = 1, #a do
+		local d = a:byte(i) - b:byte(i)
+		diff = diff + d * d
+	end
+	return diff == 0
+end
+
+function set_cookie(cookie, value)
+	local attrs = "; HttpOnly; SameSite=Lax; Path=" .. cookie_path
+	if not cookie_insecure then
+		attrs = attrs .. "; Secure"
+	end
+	if value == "" then
+		attrs = attrs .. "; Max-Age=0"
+	elseif session_seconds > 0 then
+		attrs = attrs .. "; Max-Age=" .. tostring(session_seconds)
+	end
+	html("Set-Cookie: " .. cookie .. "=" .. strip_ctl(value) .. attrs .. "\n")
+end
+
+function redirect_to(url)
+	html("Status: 302 Redirect\n")
+	html("Cache-Control: no-cache, no-store\n")
+	html("Location: " .. strip_ctl(url) .. "\n")
+end
+
+function not_found()
+	html("Status: 404 Not Found\n")
+	html("Cache-Control: no-cache, no-store\n\n")
+end
+
+--
+--
+-- Authentication actions. Identical to auth-inline.lua from here down.
+--
+--
+
+-- Sets HTTP cookie headers based on post and sets up redirection.
+function authenticate_post()
+	local redirect = validate_value("redirect", post["redirect"])
+
+	if redirect == nil or not is_safe_redirect(redirect) then
+		not_found()
+		return 0
+	end
+
+	redirect_to(redirect)
+
+	local username = post["username"]
+	local password = post["password"]
+	local ok = false
+	if username ~= nil and password ~= nil then
+		local hash = account_hash(username)
+		if hash == nil then
+			-- Spend the work anyway, see dummy_hash.
+			unistd.crypt(password, dummy_hash)
+		elseif constant_equals(hash, unistd.crypt(password, hash)) then
+			ok = true
+		end
+	end
+
+	if ok then
+		set_cookie(cookie_name, secure_value("username", username, os.time() + session_seconds))
+	else
+		set_cookie(cookie_name, "")
+	end
+
+	html("\n")
+	return 0
+end
+
+-- Returns 1 if the cookie is valid and 0 if it is not.
+function authenticate_cookie()
+	local accepted_users = repo_userset(cgit["repo"])
+	if accepted_users == nil then
+		-- The repository is not protected.
+		return 1
+	end
+
+	local username = validate_value("username", get_cookie(http["cookie"], cookie_name))
+	if username == nil or not accepted_users[username:lower()] then
+		return 0
+	end
+	return 1
+end
+
+-- Prints the html for the login form.
+function body()
+	local target = cgit["url"]
+	if not is_safe_redirect(target) then
+		target = cgit["login"]
+	end
+
+	html("<h2>Authentication Required</h2>")
+	html("<form method='post' action='")
+	html_attr(cgit["login"])
+	html("'>")
+	html("<input type='hidden' name='redirect' value='")
+	html_attr(secure_value("redirect", target, 0))
+	html("' />")
+	html("<table>")
+	html("<tr><td><label for='username'>Username:</label></td><td><input id='username' name='username' autofocus /></td></tr>")
+	html("<tr><td><label for='password'>Password:</label></td><td><input id='password' name='password' type='password' /></td></tr>")
+	html("<tr><td colspan='2'><input value='Login' type='submit' /></td></tr>")
+	html("</table></form>")
+
+	return 0
+end
+
+--
+--
+-- Wrapper around the filter API, exposing the http, cgit and post tables to
+-- the functions above.
+--
+--
+
+local actions = {}
+actions["authenticate-post"] = authenticate_post
+actions["authenticate-cookie"] = authenticate_cookie
+actions["body"] = body
+
+function filter_open(...)
+	action = actions[select(1, ...)]
+
+	post = {}
+
+	http = {}
+	http["cookie"] = select(2, ...)
+	http["method"] = select(3, ...)
+	http["query"] = select(4, ...)
+	http["referer"] = select(5, ...)
+	http["path"] = select(6, ...)
+	http["host"] = select(7, ...)
+	http["https"] = select(8, ...)
+
+	cgit = {}
+	cgit["repo"] = select(9, ...)
+	cgit["page"] = select(10, ...)
+	cgit["url"] = select(11, ...)
+	cgit["login"] = select(12, ...)
+end
+
+function filter_close()
+	if action == nil then
+		-- Unknown action, deny rather than raise.
+		return 0
+	end
+	return action()
+end
+
+function filter_write(str)
+	post = parse_qs(str)
+end
diff --git a/custom/extensions/email-gravatar.lua b/custom/extensions/email-gravatar.lua
new file mode 100644
index 0000000..47c359e
--- /dev/null
+++ b/custom/extensions/email-gravatar.lua
@@ -0,0 +1,115 @@
+-- cgit email-filter that shows a Gravatar icon next to author names. Use it
+-- with the email-filter or repo.email-filter setting and the lua: prefix.
+--
+--     email-filter=lua:/path/to/email-gravatar.lua
+--
+-- SUPPORTED LUA
+--
+-- Lua 5.1, 5.2, 5.3, 5.4 and LuaJIT. Lua 5.5 is not supported, because luaossl
+-- has no 5.5 build.
+--
+-- DEPENDENCY
+--
+--     luaossl    OpenSSL binding, provides openssl.digest
+--                <https://github.com/wahern/luaossl>
+--
+--     # Debian and Ubuntu
+--     sudo apt install luarocks libssl-dev
+--     sudo luarocks --lua-version 5.1 install luaossl
+--
+--     # Fedora
+--     sudo dnf install luarocks openssl-devel
+--     sudo luarocks --lua-version 5.1 install luaossl
+--
+--     # macOS with Homebrew
+--     brew install luarocks openssl
+--     luarocks install luaossl OPENSSL_DIR="$(brew --prefix openssl)"
+--
+-- PRIVACY
+--
+-- Every page view sends the visitor's IP address and a hash of each
+-- committer's email to a third-party service. Leave this filter off if that is
+-- not acceptable for your instance.
+--
+-- Addresses are hashed with MD5, which Gravatar still accepts. Gravatar also
+-- supports SHA-256 now, change the digest in hash_hex if you prefer it.
+
+local digest = require("openssl.digest")
+
+--
+-- ===== CONFIGURATION =====
+--
+
+-- Pixel size of the avatar.
+local avatar_size = 13
+
+-- Fallback style for an address with no avatar. See the Gravatar docs for the
+-- choices, for example retro, identicon, monsterid or mp.
+local default_image = "retro"
+
+-- Avatar endpoint. Kept https so the image is not blocked as mixed content on
+-- an https page.
+local base_url = "https://www.gravatar.com/avatar/"
+
+-- Text for the image alt attribute.
+local alt_text = "Gravatar"
+
+--
+-- =========================
+--
+
+-- State shared across the open, write and close calls of one invocation.
+local buffer = ""
+local avatar = nil
+
+local function hash_hex(input)
+	local b = digest.new("md5"):final(input)
+	local x = ""
+	for i = 1, #b do
+		x = x .. string.format("%.2x", string.byte(b, i))
+	end
+	return x
+end
+
+-- Take the address, strip the angle brackets if present, then trim and
+-- lowercase as the avatar services expect. Returns nil for a missing or empty
+-- address.
+local function normalize_email(email)
+	if email == nil then
+		return nil
+	end
+	local inner = email:match("<(.*)>")
+	if inner ~= nil then
+		email = inner
+	end
+	email = (email:gsub("^%s*(.-)%s*$", "%1")):lower()
+	if email == "" then
+		return nil
+	end
+	return email
+end
+
+function filter_open(email, page)
+	buffer = ""
+	local addr = normalize_email(email)
+	if addr == nil then
+		avatar = nil
+	else
+		avatar = hash_hex(addr)
+	end
+end
+
+function filter_close()
+	if avatar == nil then
+		-- No usable address, render the name without an icon.
+		html(buffer)
+	else
+		html("<img src='" .. base_url .. avatar .. "?s=" .. avatar_size .. "&amp;d=" .. default_image ..
+			"' width='" .. avatar_size .. "' height='" .. avatar_size .. "' alt='" .. alt_text .. "' /> " .. buffer)
+	end
+	return 0
+end
+
+function filter_write(str)
+	buffer = buffer .. str
+end
diff --git a/custom/extensions/email-libravatar.lua b/custom/extensions/email-libravatar.lua
new file mode 100644
index 0000000..812bef5
--- /dev/null
+++ b/custom/extensions/email-libravatar.lua
@@ -0,0 +1,114 @@
+-- cgit email-filter that shows a Libravatar icon next to author names. Use it
+-- with the email-filter or repo.email-filter setting and the lua: prefix.
+--
+--     email-filter=lua:/path/to/email-libravatar.lua
+--
+-- SUPPORTED LUA
+--
+-- Lua 5.1, 5.2, 5.3, 5.4 and LuaJIT. Lua 5.5 is not supported, because luaossl
+-- has no 5.5 build.
+--
+-- DEPENDENCY
+--
+--     luaossl    OpenSSL binding, provides openssl.digest
+--                <https://github.com/wahern/luaossl>
+--
+--     # Debian and Ubuntu
+--     sudo apt install luarocks libssl-dev
+--     sudo luarocks --lua-version 5.1 install luaossl
+--
+--     # Fedora
+--     sudo dnf install luarocks openssl-devel
+--     sudo luarocks --lua-version 5.1 install luaossl
+--
+--     # macOS with Homebrew
+--     brew install luarocks openssl
+--     luarocks install luaossl OPENSSL_DIR="$(brew --prefix openssl)"
+--
+-- PRIVACY
+--
+-- Every page view sends the visitor's IP address and a hash of each
+-- committer's email to a third-party service. Leave this filter off if that is
+-- not acceptable for your instance.
+--
+-- The secure CDN is always used, so the icon loads over https and is never
+-- blocked as mixed content. Addresses are hashed with MD5.
+
+local digest = require("openssl.digest")
+
+--
+-- ===== CONFIGURATION =====
+--
+
+-- Pixel size of the avatar.
+local avatar_size = 13
+
+-- Fallback style for an address with no avatar. See the Libravatar docs for
+-- the choices, for example retro, identicon, monsterid or mm.
+local default_image = "retro"
+
+-- Avatar endpoint. The secure CDN is used so the image loads over https.
+local base_url = "https://seccdn.libravatar.org/avatar/"
+
+-- Text for the image alt attribute.
+local alt_text = "Libravatar"
+
+--
+-- =========================
+--
+
+-- State shared across the open, write and close calls of one invocation.
+local buffer = ""
+local avatar = nil
+
+local function hash_hex(input)
+	local b = digest.new("md5"):final(input)
+	local x = ""
+	for i = 1, #b do
+		x = x .. string.format("%.2x", string.byte(b, i))
+	end
+	return x
+end
+
+-- Take the address, strip the angle brackets if present, then trim and
+-- lowercase as the avatar services expect. Returns nil for a missing or empty
+-- address.
+local function normalize_email(email)
+	if email == nil then
+		return nil
+	end
+	local inner = email:match("<(.*)>")
+	if inner ~= nil then
+		email = inner
+	end
+	email = (email:gsub("^%s*(.-)%s*$", "%1")):lower()
+	if email == "" then
+		return nil
+	end
+	return email
+end
+
+function filter_open(email, page)
+	buffer = ""
+	local addr = normalize_email(email)
+	if addr == nil then
+		avatar = nil
+	else
+		avatar = hash_hex(addr)
+	end
+end
+
+function filter_close()
+	if avatar == nil then
+		-- No usable address, render the name without an icon.
+		html(buffer)
+	else
+		html("<img src='" .. base_url .. avatar .. "?s=" .. avatar_size .. "&amp;d=" .. default_image ..
+			"' width='" .. avatar_size .. "' height='" .. avatar_size .. "' alt='" .. alt_text .. "' /> " .. buffer)
+	end
+	return 0
+end
+
+function filter_write(str)
+	buffer = buffer .. str
+end
diff --git a/custom/extensions/link-commits.lua b/custom/extensions/link-commits.lua
new file mode 100644
index 0000000..e7b17cc
--- /dev/null
+++ b/custom/extensions/link-commits.lua
@@ -0,0 +1,153 @@
+-- cgit commit-filter that turns git object names and configurable text
+-- references in commit messages into links. Use it with the commit-filter or
+-- repo.commit-filter setting and the lua: prefix.
+--
+--     commit-filter=lua:/path/to/link-commits.lua
+--
+-- cgit hands the filter the message already HTML-escaped, so this only wraps
+-- matches in anchors. No external dependencies. Runs on Lua 5.1 through 5.4
+-- and LuaJIT.
+--
+-- Two kinds of thing are linked, object names (runs of hex that look like git
+-- hashes) and any number of text-reference rules you define, each a pattern
+-- and a URL. Both are configured in the block below. All matches are resolved
+-- in a single left-to-right pass, so nothing is ever linked twice.
+
+--
+-- ===== CONFIGURATION =====
+--
+
+-- Object names (git hashes). Handled specially, because the length rule cannot
+-- be written as a plain Lua pattern.
+--
+-- Recognition is by shape, since a commit-filter cannot ask the repository
+-- whether a hash is real. Any hex run within the length bounds is linked,
+-- whatever mix of digits and letters it has, so abbreviated and all-digit
+-- hashes are both caught. The cost is that a long hex-looking number can now
+-- and then link to an object that does not exist, which cgit renders as a
+-- harmless "bad object name" page. Shape matching is inherently approximate,
+-- the length bounds are the only filter.
+local objects = {
+	-- Set false to stop linking bare hashes.
+	enabled = true,
+	-- A hex run within these lengths is linked. Git abbreviations run about 7
+	-- to 12 characters, full names are 40 (sha1) or 64 (sha256).
+	min_length = 7,
+	max_length = 64,
+	-- Link target, %s is replaced with the matched hash. "./?id=%s" is relative
+	-- to the current page and works for the common virtual-root layout.
+	url = "./?id=%s",
+}
+
+-- Text-reference rules. Each rule is a Lua pattern with ONE capture and a URL
+-- where %s is replaced by that capture, percent-encoded. The whole match is
+-- shown, the capture is what goes in the URL. Rules are tried in order and the
+-- leftmost match on the line wins, so put more specific patterns first. Leave
+-- the list empty to link only object names.
+--
+-- Lua patterns are not regular expressions. There is no alternation and no
+-- {n,m} repetition. %d is a digit, %a a letter, %w a letter or digit, %x a hex
+-- digit, and a literal magic character is escaped with %, so a literal '-' is
+-- '%-'. Reference: https://www.lua.org/manual/5.1/manual.html#5.4.1
+local rules = {
+	{ pattern = "#(%d+)", url = "https://bugs.example.com/?bug=%s" },
+	-- { pattern = "CVE%-(%d%d%d%d%-%d+)", url = "https://www.cve.org/CVERecord?id=CVE-%s" },
+	-- { pattern = "!(%d+)",               url = "https://gitlab.example.com/group/repo/-/merge_requests/%s" },
+	-- { pattern = "RFC%s?(%d+)",          url = "https://www.rfc-editor.org/rfc/rfc%s" },
+}
+
+--
+-- =========================
+--
+
+local chunks = {}
+
+-- Percent-encode everything but the URL-unreserved characters, so a captured
+-- value cannot break out of the href attribute or the URL.
+local function url_encode(s)
+	return (string.gsub(s, "[^%w._~-]", function(c)
+		return string.format("%%%02X", string.byte(c))
+	end))
+end
+
+-- Build one anchor. url_template has %s where the encoded capture goes, display
+-- is the text shown. A function replacement is used so a '%' in the encoded
+-- value is not treated as a gsub reference.
+local function make_link(url_template, capture, display)
+	local encoded = url_encode(capture)
+	local href = string.gsub(url_template, "%%s", function() return encoded end)
+	return '<a href="' .. href .. '">' .. display .. '</a>'
+end
+
+-- Collect every candidate match as {s, e, pri, link}. A lower pri wins a tie on
+-- the same start position.
+local function collect(text)
+	local cands = {}
+	for pri, rule in ipairs(rules) do
+		-- A malformed pattern is an operator error, skip that rule rather than
+		-- failing the whole page.
+		pcall(function()
+			local init = 1
+			while init <= #text do
+				local s, e, cap = string.find(text, rule.pattern, init)
+				if not s then break end
+				if cap == nil then
+					cap = string.sub(text, s, e)
+				end
+				cands[#cands + 1] = {
+					s = s, e = e, pri = pri,
+					link = make_link(rule.url, cap, string.sub(text, s, e)),
+				}
+				init = (e >= s) and e + 1 or s + 1
+			end
+		end)
+	end
+	if objects.enabled then
+		local objpri = #rules + 1
+		local init = 1
+		while init <= #text do
+			local s, e, run = string.find(text, "%f[%w](%x+)%f[%W]", init)
+			if not s then break end
+			if #run >= objects.min_length and #run <= objects.max_length then
+				cands[#cands + 1] = {
+					s = s, e = e, pri = objpri,
+					link = make_link(objects.url, run, run),
+				}
+			end
+			init = e + 1
+		end
+	end
+	return cands
+end
+
+function filter_open(...)
+	chunks = {}
+end
+
+function filter_write(str)
+	chunks[#chunks + 1] = str
+end
+
+function filter_close()
+	local text = table.concat(chunks)
+	local cands = collect(text)
+	table.sort(cands, function(a, b)
+		if a.s ~= b.s then
+			return a.s < b.s
+		end
+		return a.pri < b.pri
+	end)
+	local out = {}
+	local i = 1
+	for _, c in ipairs(cands) do
+		-- Skip a candidate that overlaps one already emitted.
+		if c.s >= i then
+			out[#out + 1] = string.sub(text, i, c.s - 1)
+			out[#out + 1] = c.link
+			i = c.e + 1
+		end
+	end
+	out[#out + 1] = string.sub(text, i)
+	html(table.concat(out))
+	return 0
+end
diff --git a/custom/extensions/syntax-highlight.lua b/custom/extensions/syntax-highlight.lua
new file mode 100644
index 0000000..8310504
--- /dev/null
+++ b/custom/extensions/syntax-highlight.lua
@@ -0,0 +1,278 @@
+-- Server-side syntax highlighting for the tree and blob views, used with the
+-- source-filter setting in cgitrc and the lua: prefix so it runs in cgit's
+-- embedded interpreter with no per-request process.
+--
+--     source-filter=lua:/usr/lib/cgit/extensions/syntax-highlight.lua
+--
+-- Highlighting is deliberately not built into cgit itself. Without this filter
+-- cgit serves plain escaped text, and any other program can take its place.
+--
+-- SUPPORTED LUA
+--
+-- Lua 5.1 through 5.4 and LuaJIT. The Scintillua version matters too. Recent
+-- Scintillua (6.x) needs Lua 5.3 or newer to load its lexers, older Scintillua
+-- releases still load under 5.1 and 5.2. Pick a Scintillua release that matches
+-- the Lua cgit is built against.
+--
+-- REQUIREMENTS
+--
+-- Two pieces, and BOTH must be installed. When either is missing the filter
+-- serves plain escaped text by design, so uncolored code means a missing
+-- dependency, not an error.
+--
+-- 1. lpeg, the parsing module, for the Lua cgit is linked against. Scintillua
+--    does NOT bundle it, it must come from the system, and forgetting it is the
+--    usual reason nothing happens.
+--
+--        # Debian and Ubuntu
+--        sudo apt install lua-lpeg
+--        # Fedora
+--        sudo dnf install lua-lpeg
+--        # Alpine
+--        sudo apk add lua5.1-lpeg
+--        # or with LuaRocks, matched to your Lua version
+--        sudo luarocks --lua-version 5.1 install lpeg
+--
+-- 2. Scintillua, the lexer collection from the Textadept editor. Roughly 120
+--    languages as plain .lua files, nothing to compile. Download a release and
+--    unpack it anywhere.
+--
+--        https://orbitalquark.github.io/scintillua/
+--
+-- The lexers are found by probing, in order
+--
+--     $CGIT_SCINTILLUA_PATH        (used alone when set, no fallback)
+--     <dir of $CGIT_CONFIG>/scintillua/lexers
+--     the scintillua_dirs list in the CONFIGURATION block below
+--
+-- so either set the variable in the web server environment, or place (or
+-- symlink) the scintillua directory next to your cgitrc.
+--
+-- SECURITY
+--
+-- Every probed directory is placed on package.path and its Lua is executed in
+-- cgit's process. Make sure none of them is writable by other users, or someone
+-- who can write there gains code execution as the web server. On macOS in
+-- particular, /opt/homebrew/share is group-writable by default.
+--
+-- LIMITATIONS
+--
+-- cgit sends the filter output through a C string sink that stops at the first
+-- NUL byte, so a blob containing a NUL is truncated there. This affects binary
+-- files that slip past cgit's text detection, not ordinary source.
+--
+-- OUTPUT
+--
+-- Tokens are wrapped in <span> elements carrying the hl- classes that
+-- assets/cgit.css styles. Every input byte up to the first NUL is preserved, so
+-- the line number gutter stays aligned.
+
+--
+-- ===== CONFIGURATION =====
+--
+
+-- Files larger than this many bytes are served escaped but unhighlighted, so a
+-- huge blob does not cost a lexing pass. Kept well below cgit's max-blob-size.
+local max_bytes = 512 * 1024
+
+-- Environment variable that, when set, points straight at the Scintillua
+-- lexers directory and is used alone.
+local scintillua_env = "CGIT_SCINTILLUA_PATH"
+
+-- Directories probed for the lexers when that variable is not set. The
+-- directory of $CGIT_CONFIG, when set, is tried ahead of these. Keep every one
+-- of these unwritable by others, see the SECURITY note above.
+local scintillua_dirs = {
+	"/usr/local/share/scintillua/lexers",
+	"/usr/share/scintillua/lexers",
+	"/opt/homebrew/share/scintillua/lexers",
+}
+
+-- Scintillua tag name (its first dotted component) to a cgit css class. Only
+-- the six classes below exist in assets/cgit.css. Add a class there and a row
+-- here to style more token kinds. Tokens with no row render as plain text,
+-- which is what most themes want for operators and identifiers.
+local css = {
+	comment      = "hl-comment",
+	string       = "hl-string",
+	regex        = "hl-string",
+	number       = "hl-number",
+	constant     = "hl-number",
+	keyword      = "hl-keyword",
+	preprocessor = "hl-keyword",
+	tag          = "hl-keyword",
+	label        = "hl-keyword",
+	annotation   = "hl-keyword",
+	type         = "hl-type",
+	class        = "hl-type",
+	attribute    = "hl-type",
+	["function"] = "hl-func",
+}
+
+-- Extension to lexer-name fixes for the fallback path, used only when this
+-- Scintillua has no detect(). Most extensions already equal their lexer name,
+-- these are the frequent exceptions. A wrong guess just falls back to plain
+-- text, so there is no harm in listing best-effort entries.
+local ext_lexer = {
+	py = "python", js = "javascript", ts = "typescript",
+	rb = "ruby", pl = "perl", pm = "perl", sh = "bash",
+	md = "markdown", htm = "html", yml = "yaml",
+	rs = "rust", c = "ansi_c", h = "ansi_c",
+}
+
+--
+-- =========================
+--
+
+local lexer_mod = nil
+local filename = ""
+local chunks = {}
+
+local escape_map = { ["&"] = "&amp;", ["<"] = "&lt;", [">"] = "&gt;" }
+
+-- Escape the three HTML metacharacters in a single pass.
+local function escape(s)
+	return (string.gsub(s, "[&<>]", escape_map))
+end
+
+local function scintillua_path()
+	local env = os.getenv(scintillua_env)
+	if env then
+		return env
+	end
+	local candidates = {}
+	local config = os.getenv("CGIT_CONFIG")
+	if config then
+		local dir = string.match(config, "^(.*)/[^/]+$")
+		if dir then
+			candidates[#candidates + 1] = dir .. "/scintillua/lexers"
+		end
+	end
+	for _, d in ipairs(scintillua_dirs) do
+		candidates[#candidates + 1] = d
+	end
+	for _, dir in ipairs(candidates) do
+		local f = io.open(dir .. "/lexer.lua", "r")
+		if f then
+			f:close()
+			return dir
+		end
+	end
+	return nil
+end
+
+local function load_scintillua()
+	local dir = scintillua_path()
+	if not dir then
+		return nil
+	end
+	if not string.find(package.path, dir, 1, true) then
+		package.path = dir .. "/?.lua;" .. package.path
+	end
+	local ok, mod = pcall(require, "lexer")
+	-- A real Scintillua exposes load(). Anything else on the path that happens
+	-- to be called lexer is not usable.
+	if ok and type(mod) == "table" and type(mod.load) == "function" then
+		return mod
+	end
+	return nil
+end
+
+local function load_lexer_name(name)
+	if name == nil then
+		return nil
+	end
+	local ok, lex = pcall(lexer_mod.load, name)
+	if ok and lex then
+		return lex
+	end
+	return nil
+end
+
+-- Resolve a lexer for the file, preferring Scintillua's own filename detection
+-- when this version provides it, then an extension map, then the raw extension.
+local function lexer_for(name)
+	if type(lexer_mod.detect) == "function" then
+		local ok, lang = pcall(lexer_mod.detect, name)
+		if ok and lang then
+			local lex = load_lexer_name(lang)
+			if lex then
+				return lex
+			end
+		end
+	end
+	local ext = string.match(name, "%.([^.]+)$")
+	if not ext then
+		return nil
+	end
+	ext = string.lower(ext)
+	return load_lexer_name(ext_lexer[ext]) or load_lexer_name(ext)
+end
+
+local function highlight(text)
+	local lex = lexer_for(filename)
+	if not lex then
+		return nil
+	end
+	local ok, tokens = pcall(lex.lex, lex, text)
+	if not ok or type(tokens) ~= "table" then
+		return nil
+	end
+	local out = {}
+	local pos = 1
+	for i = 1, #tokens, 2 do
+		local tag = tokens[i]
+		local fin = tokens[i + 1]
+		local part = escape(string.sub(text, pos, fin - 1))
+		local class = css[string.match(tag, "^[%w_]+")]
+		if class and part ~= "" then
+			part = "<span class='" .. class .. "'>" .. part .. "</span>"
+		end
+		out[#out + 1] = part
+		pos = fin
+	end
+	-- Anything the lexer left unconsumed is kept, escaped.
+	if pos <= #text then
+		out[#out + 1] = escape(string.sub(text, pos))
+	end
+	return table.concat(out)
+end
+
+function filter_open(name)
+	filename = name or ""
+	chunks = {}
+end
+
+function filter_write(str)
+	chunks[#chunks + 1] = str
+end
+
+function filter_close()
+	local text = table.concat(chunks)
+	chunks = {}
+	if #text <= max_bytes then
+		if lexer_mod == nil then
+			lexer_mod = load_scintillua() or false
+		end
+		if lexer_mod then
+			local ok, marked = pcall(highlight, text)
+			if ok and marked then
+				html(marked)
+				return 0
+			end
+		end
+	end
+	-- Fallback, escaped plain text emitted in slices so a large blob does not
+	-- cost a full-size second copy all at once.
+	local n = #text
+	if n == 0 then
+		html("")
+		return 0
+	end
+	local pos = 1
+	while pos <= n do
+		html(escape(string.sub(text, pos, pos + 65535)))
+		pos = pos + 65536
+	end
+	return 0
+end
-- 
cgit v2.8.0