From 7866935216c8e8eec6193a704867a6fbce5a9701 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 6 Nov 2026 21:50:32 -1000 Subject: Cut the lighttpd config down to a generic drop-in The old file was a complete lighttpd.conf with its own user, modules and MIME table. As a snippet it takes those from the distribution and loads only the three modules it uses, which lighttpd skips when the main config loads them already. It takes the nginx config's header and commented examples. The host block matches on every socket, so HTTPS needs only the socket, and the redirect is a condition on the scheme inside it. The stock lighttpd.conf on Debian, Alpine and Fedora refuses urls ending in ~ or .inc, so a repository's config.inc answered 403 until the host block cleared the list. git-http-backend's cgi.assign sits outside the url condition because lighttpd checks it after splitting the path, when that condition no longer matches, and inside it the program itself was served as a file. --- custom/servers/lighttpd.conf | 216 ++++++++++++------------------------------- 1 file changed, 61 insertions(+), 155 deletions(-) (limited to 'custom') diff --git a/custom/servers/lighttpd.conf b/custom/servers/lighttpd.conf index edbf162..5b6010c 100644 --- a/custom/servers/lighttpd.conf +++ b/custom/servers/lighttpd.conf @@ -1,134 +1,43 @@ -# lighttpd configuration for cgit. +# A lighttpd snippet that serves cgit at the root of git.example.org. +# Include it from lighttpd.conf, which supplies the user, the port, the MIME +# types and the logs. The first line below loads the modules it needs, and +# the next two those of the commented examples. A module the main config +# loads already is loaded only once. # -# Written for the lighttpd 1.4 branch, at 1.4.85 when last reviewed. +# The paths are one common layout, so adjust them to your system. +# cgit.cgi /usr/lib/cgit, from make install with the two-line cgit.conf in README +# static files /usr/share/cgit, from the same install +# repositories /var/lib/git, the scan-path custom/cgitrc suggests +# git-http-backend /usr/libexec/git-core, the directory git --exec-path prints +# certificate /etc/ssl/certs/git.example.org.pem +# key /etc/ssl/private/git.example.org.key # -# This is a complete lighttpd.conf rather than a snippet for conf-enabled, so -# nothing here is included from elsewhere and no distro base config is -# assumed. Check it and run it with -# lighttpd -tt -f /path/to/lighttpd.conf # check the syntax and modules -# lighttpd -D -f /path/to/lighttpd.conf # run it in the foreground -# -# lighttpd runs the cgit.cgi binary directly through mod_cgi, so no FastCGI -# bridge is needed. -# -# Paths assumed below, edit them to match your install. -# cgit CGI binary /usr/lib/cgit/cgit.cgi -# static assets /usr/share/cgit (cgit.css cgit.js cgit.png favicon.ico robots.txt) -# cgit config /etc/cgitrc -# public url https://git.example.org/ (cgit at the domain root) -# -# cgit is one CGI executable. It learns the repository and the page from -# PATH_INFO and reads page options such as h= and id= from QUERY_STRING. The -# five static assets are served straight off disk and must never be routed -# through cgit. - - -# A plain assignment rather than "+=", since this config stands on its own -# and there is no distro base list to append to. Adding mod_accesslog here -# is what the access log below needs. -server.modules = ( - "mod_alias", - "mod_setenv", - "mod_cgi", - "mod_accesslog", -) - +# The commented examples add HTTPS, which the bundled auth filters need +# before they log anyone in, and smart HTTP clone and push through +# git-http-backend. -server.port = 80 -server.username = "http" # Debian and Ubuntu use www-data -server.groupname = "http" -server.document-root = "/usr/share/cgit" # a valid docroot must exist. The - # alias rules below do the routing. -server.pid-file = "/run/lighttpd.pid" -server.errorlog = "/var/log/lighttpd/error.log" -accesslog.filename = "/var/log/lighttpd/access.log" - -# Drop the version number from the Server header and from error pages. -server.tag = "lighttpd" - -# The only request body cgit ever reads is the auth-filter login form, and it -# stops after 4096 bytes. Nothing else here accepts an upload. The value is in -# kilobytes and the default of 0 means unlimited. -server.max-request-size = 64 - - -# mod_alias serves the assets off disk, so lighttpd must know their content -# types. Without this the stylesheet is sent as application/octet-stream and -# the browser ignores it. Only these five files are served off disk, so this -# short table is the whole of it and no external mime file is needed. -mimetype.assign = ( - ".css" => "text/css", - ".js" => "text/javascript", - ".png" => "image/png", - ".ico" => "image/vnd.microsoft.icon", - ".txt" => "text/plain", -) +server.modules += ( "mod_access", "mod_alias", "mod_cgi" ) +#server.modules += ( "mod_openssl", "mod_redirect" ) +#server.modules += ( "mod_setenv" ) +# HTTPS on 443 beside plain HTTP. The host block below answers on both. +#$SERVER["socket"] == ":443" { +# ssl.engine = "enable" +# ssl.pemfile = "/etc/ssl/certs/git.example.org.pem" +# ssl.privkey = "/etc/ssl/private/git.example.org.key" +#} -# The vhost, as a top-level conditional so it matches on both the port 80 -# socket and the optional TLS socket at the end of this file. $HTTP["host"] == "git.example.org" { - - # Which config cgit reads. It falls back to the compiled-in /etc/cgitrc, - # the same path used here, but setting it makes the location explicit. - setenv.add-environment = ( "CGIT_CONFIG" => "/etc/cgitrc" ) - - # Site-wide security headers are set here so they also cover the static - # assets lighttpd serves. On raw repository bytes cgit sends a nosniff and - # the stricter policy "default-src 'none'" of its own. - # - # The add in add-response-header is load bearing. It appends a second - # copy next to what cgit emitted, so a raw page carries both policies and - # the browser enforces the stricter one, while the doubled nosniff line - # is harmless. The set-response-header directive would instead replace - # what cgit sent, swapping the strict policy on raw repository content - # for this looser site one. Never switch add to set. - # - # form-action self covers the login form, the only form cgit renders. If - # you enable the gravatar or libravatar avatar filter, add its host to - # img-src. A head-include or repo.head-content that injects a