From 66f8e52c867f2b6edf501021d8be522741fdde95 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 6 Nov 2026 20:24:02 -1000 Subject: Cut the nginx config down to a generic drop-in The old file was a complete nginx.conf with TLS, compression, catch-all hosts and security headers, and it had to be taken apart before it ran beside a distribution's own nginx.conf. A server block included from the http block leaves the user, the MIME types and the logs to the distribution. Its header gives one default path per thing, adjusted where a system differs, which leaves packagers a plain base to adapt rather than a table for each distribution. HTTPS and git-http-backend are commented examples, so the file serves plain HTTP as shipped. The backend takes only the three smart HTTP paths at cgit's own repository urls, so every page still reaches cgit. git refuses a repository another user owns, which failed every clone until safe.directory was set for the backend, and a 3 MB push got 413 until the location lifted nginx's body limit. The split empties SCRIPT_NAME because a second SCRIPT_NAME after the include reaches fcgiwrap as well, and cgit reads the first one, which put every link under the request path. cgit sends nosniff and a locked policy on raw output itself, so the configs no longer carry one. The t0004 check that all three agree goes here, with the first of them to drop it. --- tests/t0004-docs.sh | 18 ++---------------- 1 file changed, 2 insertions(+), 16 deletions(-) (limited to 'tests') diff --git a/tests/t0004-docs.sh b/tests/t0004-docs.sh index 79c36b1..db6083f 100755 --- a/tests/t0004-docs.sh +++ b/tests/t0004-docs.sh @@ -3,9 +3,8 @@ # Checks that the configuration documents stay consistent with each other. # The manual documents every key the reference config sets, the reference # config sets every key the manual documents and puts scan-path after every -# global setting, both settings sections of the manual keep their entries -# sorted, and the three server configs carry one identical content security -# policy. +# global setting, and both settings sections of the manual keep their entries +# sorted. test_description='Check the configuration documents' CGIT_TEST_NO_CREATE_REPOS=YesPlease @@ -57,17 +56,4 @@ test_expect_success 'the manual lists its repository settings in order' ' LC_ALL=C sort -c repo-order ' -# The policy is spelled out once per server syntax, so nothing but this check -# keeps the three copies from drifting apart. -test_expect_success 'the server configs agree on one content security policy' ' - for server in apache lighttpd nginx - do - grep "Content-Security-Policy" "$ROOT/custom/servers/$server.conf" | - grep "default-src" | - sed "s/.*\"\(default-src[^\"]*\)\".*/\1/" || return 1 - done >policies && - test_line_count = 3 policies && - test $(sort -u policies | wc -l) -eq 1 -' - test_done -- cgit 2.12.1