# A lighttpd snippet that serves cgit at the root of git.example.org.
# Include it from lighttpd.conf, which supplies the user, the port, the MIME
# types and the logs. The first line below loads the modules it needs, and
# the next two those of the commented examples. A module the main config
# loads already is loaded only once.
#
# The paths are one common layout, so adjust them to your system.
#   cgit.cgi           /usr/lib/cgit, from make install with the two-line cgit.conf in README
#   static files       /usr/share/cgit, from the same install
#   repositories       /var/lib/git, the scan-path custom/cgitrc suggests
#   git-http-backend   /usr/libexec/git-core, the directory git --exec-path prints
#   certificate        /etc/ssl/certs/git.example.org.pem
#   key                /etc/ssl/private/git.example.org.key
#
# The commented examples add HTTPS, which the bundled auth filters need
# before they log anyone in, and smart HTTP clone and push through
# git-http-backend.

server.modules += ( "mod_access", "mod_alias", "mod_cgi" )
#server.modules += ( "mod_openssl", "mod_redirect" )
#server.modules += ( "mod_setenv" )

# HTTPS on 443 beside plain HTTP. The host block below answers on both.
#$SERVER["socket"] == ":443" {
#    ssl.engine = "enable"
#    ssl.pemfile = "/etc/ssl/certs/git.example.org.pem"
#    ssl.privkey = "/etc/ssl/private/git.example.org.key"
#}

$HTTP["host"] == "git.example.org" {
    # Sends plain HTTP on to HTTPS.
    #$HTTP["scheme"] == "http" {
    #    url.redirect = ( "" => "https://${url.authority}${url.path}${qsa}" )
    #}

    # The five files cgit links to at the root are served off disk. lighttpd
    # takes the first alias that matches, so they come before the one that
    # hands every other path to cgit. That match takes the leading slash off
    # the path and the slash after cgit.cgi puts it back, so cgit gets the
    # whole path as its PATH_INFO.
    alias.url = (
        "/cgit.css"    => "/usr/share/cgit/cgit.css",
        "/cgit.js"     => "/usr/share/cgit/cgit.js",
        "/cgit.png"    => "/usr/share/cgit/cgit.png",
        "/favicon.ico" => "/usr/share/cgit/favicon.ico",
        "/robots.txt"  => "/usr/share/cgit/robots.txt",
        "/"            => "/usr/lib/cgit/cgit.cgi/",
    )

    # The empty value runs cgit.cgi as a program rather than through an
    # interpreter.
    cgi.assign = ( "/cgit.cgi" => "" )

    # Smart HTTP clone and push at the urls cgit gives the repositories go to
    # git-http-backend. It finds them under GIT_PROJECT_ROOT and, with
    # GIT_HTTP_EXPORT_ALL, serves them without a git-daemon-export-ok file.
    # The safe.directory setting lets it open them while another user owns
    # them. Push is refused until a repository sets http.receivepack or the
    # server authenticates the user. The program is assigned outside the url
    # condition, which no longer matches once lighttpd has split the path
    # into the program and its PATH_INFO.
    #cgi.assign += ( "/git-http-backend" => "" )
    #$HTTP["url"] =~ "^/.+/(info/refs|git-upload-pack|git-receive-pack)$" {
    #    alias.url = ( "/" => "/usr/libexec/git-core/git-http-backend/" )
    #    setenv.add-environment = (
    #        "GIT_PROJECT_ROOT" => "/var/lib/git",
    #        "GIT_HTTP_EXPORT_ALL" => "",
    #        "GIT_CONFIG_COUNT" => "1",
    #        "GIT_CONFIG_KEY_0" => "safe.directory",
    #        "GIT_CONFIG_VALUE_0" => "*",
    #    )
    #}

    # The stock lighttpd.conf refuses paths ending in ~ or .inc, which here
    # are files in a repository, so cgit's host clears the list.
    url.access-deny = ()
}