index : cgit

cgitrc - runtime configuration for cgit
=======================================

cgitrc holds all runtime settings for cgit, including the list of git
repositories, formatted as a line-separated list of NAME=VALUE pairs. Blank
lines, and lines starting with '#' or ';', are ignored, and so is a line
carrying no '='. A comment cannot share a line with a setting, since everything
after the '=' belongs to the value. A NAME cgit does not recognise is ignored
with a warning on stderr, which the web server collects in its error log.

The default location of cgitrc, defined at compile time, is /etc/cgitrc. At
runtime, cgit will consult the environment variable CGIT_CONFIG and, if defined,
use its value instead.


Contents
--------

- Global settings
- Repository settings
- Repository-specific cgitrc file
- Filter API
- Macro expansion
- The cache
- Signatures


Global settings
---------------

cgitrc is read from the top down. Each repository copies the global settings
it can override with a repo.* form, and the current section, when its repo.url
line or the scan-path that finds it is read, so such a setting placed below a
repository does not reach it. logo, logo-link and readme are the exception,
since a repository without its own falls back to them once the whole file is
read. Every other global setting applies wherever it stands, apart from those
whose entry says to define them prior to scan-path.

about-filter::
	Specifies a command which will be invoked to format the content of about
	pages (both top-level and for each repository). When no about-filter is
	set, a repository's readme is escaped and served as plain text. A
	bundled Lua filter, about-render.lua, renders markdown, man pages and
	plain text when about-filter points at it. Default value: none. See
	also: "Filter API", "repo.about-filter".

age-file::
	Specifies a path, relative to each repository path, which can be used to
	specify the date and time of the youngest commit in the repository. The
	first line in the file is read by git's date parser, and the recommended
	form is "yyyy-mm-dd hh:mm:ss". A post-receive hook can write this file.
	Default value: "info/web/last-modified".

auth-filter::
	Specifies a command that will be invoked for authenticating repository
	access. If no auth-filter is specified, no authentication is performed.
	Default value: none. See also: "Filter API".

branch-sort::
	Flag which, when set to "age", enables date ordering in the branch ref
	list, and when set to "name" enables ordering by branch name. Default
	value: "name". See also: "repo.branch-sort".

cache-about-ttl::
	Number which specifies the time-to-live, in minutes, for the cached
	version of the repository about page. A value of "0" leaves the page
	uncached and a negative value never expires it. Default value: "15". See
	also: "The cache".

cache-dynamic-ttl::
	Number which specifies the time-to-live, in minutes, for the cached
	version of repository pages accessed without a fixed object id. A value
	of "0" leaves them uncached and a negative value never expires them.
	Default value: "5". See also: "The cache".

cache-index-ttl::
	Number which specifies the time-to-live, in minutes, for the cached
	version of the repository index page. A value of "0" leaves the page
	uncached and a negative value never expires it. Default value: "5". See
	also: "The cache".

cache-max-slot-size::
	Number which specifies the largest response, in kilobytes, that a cache
	slot may keep. A larger response is still served but not kept, which
	caps the cache directory at about cache-size times this. Set to "0", or
	any negative value, to remove the limit. Default value: "65536" (64 MB).
	See also: "The cache".

cache-root::
	Path used to store the cgit cache entries. A scan-path keeps its cached
	result under the value defined prior to it. Hosts sharing one cache-root
	over NFS mounted with local_lock=flock or local_lock=all do not see each
	other's locks and can rebuild the same entry at once, so give each host
	a cache-root of its own on local disk. Default value: "/var/cache/cgit".
	See also: "Macro expansion" and the note on ownership under "The cache".

cache-scan-ttl::
	Number which specifies the time-to-live, in minutes, for the result of
	scanning a path for git repositories. It is read when scan-path runs,
	along with "cache-size" and "cache-root", so all three must be defined
	prior to scan-path to apply to the scan. Default value: "15". See also:
	"scan-path", "The cache".

cache-size::
	The maximum number of entries in the cgit cache. When set to "0" or
	less, caching is disabled, the scan-path result included. A scan-path
	caches its result only when this is defined prior to it. Default value:
	"0". See also: "The cache".

cache-snapshot-ttl::
	Number which specifies the time-to-live, in minutes, for the cached
	version of snapshots. A snapshot requested with a fixed object id uses
	"cache-static-ttl" instead, since its content can never change. A value
	of "0" leaves them uncached and a negative value never expires them.
	Default value: "5". See also: "The cache".

cache-static-ttl::
	Number which specifies the time-to-live, in minutes, for the cached
	version of repository pages accessed with a fixed object id. A value of
	"0" leaves them uncached and a negative value, as by default, never
	expires them. Default value: "-1". See also: "The cache".

cache-summary-ttl::
	Number which specifies the time-to-live, in minutes, for the cached
	version of the repository summary page. A value of "0" leaves the page
	uncached and a negative value never expires it. Default value: "5". See
	also: "The cache".

case-sensitive-sort::
	Sort items in the repository list case-sensitively. Default value: "1".
	See also: "repository-sort", "section-sort".

clone-prefix::
	Space-separated list of common prefixes which, when combined with a
	repository url, generates valid clone urls for the repository. This
	setting is only used if "repo.clone-url" is unspecified. Default value:
	none.

clone-url::
	Space-separated list of clone-url templates. This setting is only used
	if "repo.clone-url" is unspecified. Default value: none. See also:
	"Macro expansion", "Filter API".

commit-filter::
	Specifies a command which will be invoked to format commit messages, for
	example to link a bug tracker. It applies on the commit page alone, to
	the subject, the message, any notes and the trailer values that
	"trailer-filter" leaves to it. Every other page shows messages
	unfiltered, the log page's expanded messages included. A ready filter
	linking object names and configurable text references ships as
	custom/extensions/link-commits.lua. Default value: none. See also:
	"Filter API", "repo.commit-filter".

commit-sort::
	Flag which, when set to "date", enables strict date ordering in the
	commit log, and when set to "topo" enables strict topological ordering.
	If unset, the default ordering of "git log" is used. Either ordering
	makes git read every commit in the history before the first row unless
	the repository has a commit-graph file, which
	custom/hooks/post-receive.commit-graph keeps current. Default value:
	none. See also: "repo.commit-sort".

css::
	Url which specifies the CSS document to include in all cgit pages. May
	be given multiple times, and each CSS url path is added in the head
	section of the document in turn. Setting this to an empty string will
	disable generation of the link to this file in the head section. The
	first css line replaces the default, so a site stylesheet goes on a line
	of its own after css=/cgit.css. Default value: "/cgit.css".

date-format::
	Format used for the calendar dates in the age columns of the log, refs
	and index pages, both when "enable-relative-dates" is off and when a log
	entry is too old to be shown as an age. Accepts the same names as git's
	--date option: "default", "human", "iso" (or "iso8601"), "iso-strict"
	(or "iso8601-strict"), "raw", "relative", "rfc" (or "rfc2822"), "short"
	and "unix", each of which may carry a "-local" suffix, "local" alone as
	git's alias of "default-local", plus "format:<strftime>" for an
	arbitrary layout. An unrecognised value is ignored. Dates elsewhere,
	such as the author and committer lines on the commit page, are always
	ISO 8601 and are not affected, nor are the exact timestamps shown on
	hover. Default value: "short". See also: "local-time".

email-filter::
	Specifies a command which will be invoked to format names and email
	address of committers, authors, and taggers, as represented in various
	places throughout the cgit interface. Ready filters adding a Gravatar or
	Libravatar icon ship as custom/extensions/email-gravatar.lua and
	custom/extensions/email-libravatar.lua. Default value: none. See also:
	"Filter API", "repo.email-filter".

embedded::
	Flag which, when set to "1", makes cgit generate an HTML fragment
	suitable for embedding in other HTML pages. cgit then writes no document
	head, so css, js, favicon, robots and head-include have no effect. The
	host page, or the header and footer files around the fragment, has to
	link cgit.css itself, load cgit.js with defer, and carry a robots meta
	tag if one is wanted. cgit.css gives the fragment its own background and
	colour scheme, which follows the visitor's light or dark preference
	whatever the host page does, so a host page that is always light can pin
	it with the rule div#cgit.cgit-embedded { color-scheme: light; }.
	Default value: "0". See also: "enable-header".

enable-blame::
	Flag which, when set to "1", lets cgit provide a "blame" page for files
	and makes it generate links to that page in appropriate places. Blame of
	a long file with a deep history can take seconds, and the page cache
	keeps a repeat visit cheap. Default value: "0". See also:
	"repo.enable-blame", "The cache".

enable-cache-list::
	Flag which, when set to "1", exposes the "ls_cache" page. That page
	lists the cache directory path and the urls other visitors requested.
	Default value: "0".

enable-commit-graph::
	Flag which, when set to "1", makes cgit print an ASCII-art commit
	history graph to the left of the commit messages in the repository log
	page. The graph puts the log in topological order, for which git reads
	every commit in the history before the first row unless the repository
	has a commit-graph file. custom/hooks/post-receive.commit-graph keeps
	one current. Default value: "0". See also: "repo.enable-commit-graph".

enable-commit-trailers::
	Flag which, when set to "1", makes the commit page split the trailer
	block, the Signed-off-by lines and their kin, off the end of the commit
	message and show it as a table under the message. The block is found the
	way "git interpret-trailers" finds it. Default value: "0". See also:
	"trailer-filter", "repo.enable-commit-trailers".

enable-follow-links::
	Flag which, when set to "1", allows users to follow a file in the log
	page. Default value: "0". See also: "repo.enable-follow-links".

enable-git-config::
	Flag which, when set to "1", lets cgit read repository settings from git
	config. This option is used in conjunction with "scan-path", and must be
	defined prior, to augment repository settings. The keys gitweb.owner,
	gitweb.category, and gitweb.description map to the cgit keys repo.owner,
	repo.section, and repo.desc respectively. All git config keys that begin
	with "cgit." are mapped to the corresponding "repo." key in cgit,
	subject to "trust-scan-config" the way a repository's cgitrc is. A
	section that "section-from-path" takes from the path overrides
	gitweb.category and cgit.section. Default value: "0". See also:
	"scan-path", "section-from-path", "trust-scan-config".

enable-gitmodules-links::
	Flag which, when set to "1", makes submodule listings derive a link from
	the url recorded in the .gitmodules file at the shown revision, for
	submodules that no module-link template covers. The url is first
	matched, by its trailing path components, against the repositories
	served by this cgit instance, so ssh, file and relative urls still get a
	link when their target is hosted here, and the commit hash then links to
	the target repository's commit page. Otherwise a plain http or https url
	is linked as it is, an ssh url to a well-known public host is rewritten
	to its https form, and any other url is left unlinked and shown as a
	tooltip instead. Default value: "0". See also:
	"repo.enable-gitmodules-links".

enable-header::
	Flag which, when set to "0", makes cgit omit the standard header on all
	pages. Default value: "1". See also: "embedded".

enable-html-serving::
	Flag which, when set to "1", lets the /plain handler serve mimetype
	headers that result in the file being treated as HTML by the browser.
	When set to "0", such file types are returned instead as text/plain or
	application/octet-stream. In a repository found by "scan-path" the
	setting waits on "trust-scan-config", since a page served this way runs
	with the site's own origin. Default value: "0". See also:
	"repo.enable-html-serving".

enable-http-clone::
	If set to "1", cgit acts as a dumb HTTP endpoint for git clones, which
	adding "https://$HTTP_HOST$SCRIPT_NAME/$CGIT_REPO_URL" to clone-url
	exposes. Its files are never cached. cgit does not speak the smart
	protocol git prefers, which a site can offer by routing clone requests
	to git-http-backend in its web server. Default value: "1".

enable-index-links::
	Flag which, when set to "1", makes cgit generate extra links for each
	repository in the index, to the "summary", "log" and "tree" pages.
	Default value: "0".

enable-index-owner::
	Flag which, when set to "1", makes cgit display the owner of each
	repository in the index. Default value: "1".

enable-log-filecount::
	Flag which, when set to "1", makes cgit print the number of modified
	files for each commit on the repository log and summary pages. To count
	them, cgit diffs the tree of every listed commit against that of its
	first parent. Default value: "0". See also: "repo.enable-log-filecount".

enable-log-linecount::
	Flag which, when set to "1", makes cgit print the number of added and
	removed lines for each commit on the repository log and summary pages.
	To count them, cgit diffs every file each listed commit changes against
	its first parent, which can make those pages several times slower.
	Default value: "0". See also: "repo.enable-log-linecount".

enable-mailmap::
	Flag which, when set to "1", applies the repository's mailmap to every
	author, committer and tagger shown, so a person who changed name or
	address appears under one identity in the log, commit, tag, blame and
	statistics pages, the atom feed and the author search. Only the .mailmap
	blob at HEAD is read, as git does for a bare repository, and the
	mailmap.file and mailmap.blob settings are ignored. Default value: "1".
	See also: "repo.enable-mailmap".

enable-plain-email::
	Flag which, when set to "0", hides the full author, committer and tagger
	email addresses wherever they would be shown beside the name. Default
	value: "1".

enable-relative-dates::
	Flag which, when set to "1", shows the age columns of the log, refs and
	index pages as an elapsed time such as "3 days" rather than a calendar
	date. When set to "0" those columns always show a date, formatted
	according to "date-format". Default value: "1".

enable-remote-branches::
	Flag which, when set to "1", makes cgit display remote branches in the
	summary and refs pages. Default value: "0". See also:
	"repo.enable-remote-branches".

enable-subject-links::
	Flag which, when set to "1", makes cgit use the subject of the parent
	commit as link text when generating links to parent commits in the
	commit page. Default value: "0". See also: "repo.enable-subject-links".

enable-tree-group-dirs::
	Flag which, when set to "1", makes the tree page list all directories
	first, sorted, followed by the files. When set to "0", entries appear in
	git's own order, with directories and files intermixed by name. Default
	value: "0".

enable-tree-linenumbers::
	Flag which, when set to "1", makes cgit generate linenumber links for
	plaintext blobs printed in the tree and blame pages. Default value: "1".

enable-version-info::
	Flag which, when set to "1", names the cgit and git versions in the
	standard page footer, and the cgit version in the generator meta tag
	and in the signature that ends each patch. Exact versions help someone
	match a site against published advisories, so they are left out unless
	a site asks for them, and a footer set with footer replaces the
	standard one either way. Default value: "0".

favicon::
	Url used as link to the icon for cgit. Any path works, but keeping the
	value "/favicon.ico" is still worthwhile, since clients that do not
	parse the page head probe that path directly. Default value:
	"/favicon.ico".

footer::
	The content of the file specified with this option will be included
	verbatim at the bottom of all pages (it replaces the standard "generated
	by..." message). Default value: none.

head-include::
	The content of the file specified with this option will be included
	verbatim in the HTML head section on all pages. Default value: none.

header::
	The content of the file specified with this option will be included
	verbatim at the top of all pages. Default value: none.

include::
	Name of a config file to include before the rest of the current
	config file is parsed. Includes may nest eight levels deep, and anything
	deeper is ignored. Default value: none. See also: "Macro expansion".

js::
	Url which specifies the JavaScript document to include in all cgit
	pages. May be given multiple times, and each script url path is
	added in the head section of the document in turn. Each is loaded with
	defer, so it runs once the page has been parsed, still in the order
	given. Setting this to an empty string will disable generation of the
	link to this file in the head section. The first js line replaces the
	default, so a site script goes on a line of its own after js=/cgit.js.
	Default value: "/cgit.js".

local-time::
	Flag which, if set to "1", makes cgit print commit and tag times in the
	server's timezone. Default value: "0". See also: "date-format".

logo::
	Url which specifies the source of an image which will be used as a logo
	on all cgit pages. Default value: "/cgit.png". See also: "repo.logo".

logo-link::
	Url loaded when clicking on the cgit logo image. Default value: the url
	of the repository index page. See also: "repo.logo-link".

max-atom-items::
	Specifies the number of items to display in the atom feed. A value of
	"0" leaves the feed empty and a negative value puts every commit in it.
	Default value: "10".

max-blob-size::
	Specifies the maximum size in KBytes of a blob that cgit will read into
	memory to serve. The tree page's file view, the blame page, a tracked
	readme, a snapshot signature and the raw "plain" and "blob" output all
	refuse a larger object rather than load it whole, and the diff and patch
	pages show it as binary. A larger .mailmap is not applied, though a note
	shown with a commit and a .gitmodules file are still read whole. Whatever
	this is set to, the tree page shows no more than the first 64 KB of a
	binary file as a hex dump, and links a larger one to its "plain" output.
	Set to "0" to disable the limit.
	Default value: "10240" (10 MB).

max-commit-count::
	Specifies the number of entries to list per page in "log" page. A value
	of "0" or less lists none. Default value: "50".

max-diff-files::
	If a commit changes more files than this, the "commit" and "diff" pages
	show only the diffstat, where each file links to its own diff page. The
	"rawdiff" and "patch" pages are never limited. Set to "0" to always
	render every file inline. Default value: "200".

max-diff-lines::
	If a single file's diff spans more lines than this, the whole-commit
	pages print a note in its place linking to the file's own diff page,
	which always renders in full. Set to "0" to always render oversized
	files inline. Default value: "1000".

max-message-length::
	Specifies the maximum number of commit message bytes to display in the
	"log" page. A cut never splits a character. Any value below "15", "0"
	included, turns the limit off. Default value: "80".

max-patch-count::
	Specifies the maximum number of commits emitted as a series by the
	"patch" page when an explicit revision range is requested. A single
	commit is unaffected. Set to "0" for no limit. Default value: "50".

max-ref-count::
	Specifies the number of branches and tags to list per section on the
	"refs" page, and per page on the dedicated branch and tag pages that its
	overflow links lead to. A value of "0" or less lists every ref on one
	page. Default value: "200".

max-repo-count::
	Specifies the number of entries to list per page on the repository index
	page. A value of "0" or less shows all repositories without limitation.
	Default value: "50".

max-repodesc-length::
	Specifies the maximum number of repository description bytes to display
	on the repository index page. A longer description is cut short with an
	ellipsis, so a value of "0" or less shows the ellipsis alone. A cut never
	splits a character. Default value: "80".

max-stats::
	Enable the statistics page, which holds the commits-per-author table,
	and set the coarsest period it offers. Valid values are "week", "month",
	"quarter" and "year", each of which also offers the finer periods before
	it. If unspecified, statistics are disabled, and any other value but "0"
	disables them with a warning. Default value: none. See also:
	"repo.max-stats".

mimetype-file::
	Specifies the file to use for automatic mimetype lookup. If specified
	then this field is used as a fallback when no "mimetype.<ext>" match is
	found. If unspecified then no such lookup is performed. The typical file
	to use on a Linux system is /etc/mime.types. Default value: none. See
	also: "mimetype.<ext>".

mimetype.<ext>::
	Set the mimetype for the specified filename extension. The "plain" page
	uses it when returning blob content. Default value: none. See also:
	"mimetype-file".

module-link::
	Text which will be used as the format string for a hyperlink when a
	submodule is printed in a directory listing. The arguments for the
	format string are the name of the submodule directory and the object id
	of the submodule commit. Default value: none. See also:
	"repo.module-link".

project-list::
	A file listing the subdirectories of scan-path, relative to it, that
	should be loaded as git repositories. This must be defined prior to
	scan-path. Default value: none. See also: "scan-path", "Macro
	expansion".

readme::
	Text which will be used as default value for "repo.readme". Multiple
	config keys may be specified, and cgit will use the first found file in
	this list. This is useful in conjunction with scan-path. Default value:
	none. See also: "scan-path", "repo.readme".

remove-suffix::
	If set to "1" and scan-path is enabled, if any repositories are found
	with a suffix of ".git", this suffix will be removed for the url and
	name. This must be defined prior to scan-path. Default value: "0". See
	also: "scan-path".

rename-limit::
	Maximum number of files to consider when detecting renames. The value
	"-1" uses the compiletime value in git, see git-diff(1). A value of "0"
	removes the limit. Default value: "-1".

repository-sort::
	The way in which repositories in each section are sorted. Valid values
	are "name" for sorting by the repository name or "age" for sorting by
	the most recently updated repository. Default value: "name". See also:
	"section", "case-sensitive-sort", "section-sort".

robots::
	Text used as content for the "robots" meta-tag. Default value: "index,
	nofollow".

root-desc::
	Text printed below the heading on the repository index page. Default
	value: "a fast webinterface for the git dscm".

root-readme::
	A file shown as the site's own about page, which an "about" tab on the
	repository index page leads to once this is set. The file goes through
	about-filter when one is set and is included verbatim otherwise.
	Default value: none.

root-title::
	Text printed as heading on the repository index page, and last in
	the title of every page. Default value: "Git repository browser".

scan-hidden-path::
	If set to "1" and scan-path is enabled, scan-path recurses into
	directories whose name starts with a period ('.'). Otherwise, scan-path
	skips such directories as hidden. The ".git" directory of a non-bare
	repository is still found. This must be defined prior to scan-path.
	Default value: "0". See also: "scan-path".

scan-path::
	A path which is scanned for repositories. If caching is enabled, the
	result is cached as a cgitrc include-file in the cache directory, under
	a name drawn from the path and every setting the scan depends on, so
	configs that would scan differently never share one. If project-list
	has been defined prior to scan-path, scan-path loads only the
	directories listed in the file pointed to by project-list. A
	repository containing a file named "noweb" is skipped, the reverse of
	what "strict-export" checks. Only the global settings taken before the
	scan-path directive apply to each repository. That holds for every
	setting a repository inherits, among them section, snapshots, the
	filters and the enable flags, not only the entries that say so
	explicitly. The readme list is the exception, since a repository with
	none of its own follows the global list as the whole cgitrc leaves it.
	The scan adds repositories in path order, comparing names as a
	"case-sensitive-sort" defined prior to scan-path says, and takes those
	a project-list names in the order it lists them. Default value: none.
	See also: "cache-scan-ttl", "case-sensitive-sort", "project-list",
	"strict-export", "Macro expansion".

section::
	The name of the current repository section. All repositories defined
	after this option will inherit the current section name. Default value:
	none. See also: "repo.section".

section-from-path::
	A number which, if defined prior to scan-path, specifies how many path
	elements from each repository path to use as a default section name. If
	negative, cgit instead drops that many path elements from the end, the
	repository directory included, so "-1" uses every directory above the
	repository. A section taken from the path overrides one that
	"enable-git-config" reads from gitweb.category or cgit.section, and a
	section line in the repository's own cgitrc overrides both. Default
	value: "0". See also: "enable-git-config".

section-sort::
	Flag which, when set to "1", sorts the sections on the repository
	listing by name, along with the repositories within each section. Set
	this flag to "0" to preserve the order in the cgitrc file, where the
	repositories a scan-path finds come in path order. Default value: "0".
	See also: "section", "case-sensitive-sort", "repository-sort",
	"scan-path".

side-by-side-diffs::
	If set to "1" shows side-by-side diffs instead of unidiffs by default.
	Default value: "0".

snapshots::
	Text which specifies the default set of snapshot formats that cgit
	generates links for. The value is a space-separated list of zero or more
	of the values "tar", "tar.gz", "tar.bz2", "tar.lz", "tar.xz", "tar.zst"
	and "zip", and any other name in it is ignored with a warning. The
	special value "all" enables all snapshot formats. A value that starts
	with a number other than "0" is the legacy form and enables "tar" alone
	whatever follows the number, while "0" enables none. All
	compressors use default settings. Some settings can be influenced with
	environment variables, for example set ZSTD_CLEVEL=10 in the web server
	environment for higher (but slower) zstd compression. A ref with a slash
	in its name, such as "release/2.0", has its snapshots named with a dash
	in place of the slash. Default value: none.

source-filter::
	Specifies a command which will be invoked to format plaintext blobs in
	the tree and blame pages, which is how syntax highlighting is done. When
	no source-filter is configured, cgit serves the text plain. A ready
	syntax highlighter using the Scintillua lexer collection ships as
	custom/extensions/syntax-highlight.lua, see the comments in that file
	for its dependencies. Default value: none. See also: "Filter API",
	"repo.source-filter".

strict-export::
	Filename which, if specified, needs to be present within the repository
	for cgit to allow access to that repository. This can be used to emulate
	gitweb's EXPORT_OK and STRICT_EXPORT functionality and limit cgit's
	repositories to match those exported by git-daemon. This option must be
	defined prior to scan-path, and it only filters what scan-path finds, so
	a repository listed with repo.url is served whether the file is there or
	not. Default value: none. See also: "scan-path".

summary-branches::
	Specifies the number of branches to display in the repository "summary"
	page. A value of "0" or less lists every branch. Default value: "10".

summary-log::
	Specifies the number of log entries to display in the repository
	"summary" page. A value of "0" or less leaves the log off the summary
	page. Default value: "10".

summary-tags::
	Specifies the number of tags to display in the repository "summary"
	page. A value of "0" or less lists every tag. Default value: "10".

trailer-filter::
	Specifies a command which will be invoked to format the value of a
	commit trailer when "enable-commit-trailers" is set. Trailers whose
	value is a name and email address, such as Signed-off-by, go through
	the email-filter instead, and when no trailer-filter is configured the
	remaining values go through the commit-filter. A ready filter ships as
	custom/extensions/link-trailers.lua. It links the object name in a
	Fixes or Reverts value and any value that is a single url, and holds
	Closes and Bug rules to switch on for a tracker. Default value: none.
	See also: "Filter API", "repo.trailer-filter".

trust-scan-config::
	Flag which, when set to "1", honours every setting in a repository's own
	cgitrc file and git config found by "scan-path". Those files belong to
	whoever can push to the repository, so without it the settings that run
	a command, put raw markup on the page, serve a file as markup, place a
	link or read a file off the disk are ignored with a warning. Those are
	the filters, head-content, module-link, module-link.<path>, logo,
	logo-link, clone-url, enable-html-serving and a readme that names a file
	rather than a git object. Settings in the main cgitrc, the
	"repo.<option>" form included, never need this. This must be defined
	prior to scan-path. Default value: "0". See also: "scan-path",
	"enable-git-config".

virtual-root::
	Url used as root for all cgit links, such as "/cgit/" for links like
	"/cgit/repo/tree/README". The bundled auth filters send a visitor back
	after a login only to a path on this host, so logins need it to be a
	path rather than a full url. Default value: SCRIPT_NAME followed by a
	slash.


Repository settings
-------------------

repo.about-filter::
	Override the default about-filter. Default value: <about-filter>. See
	also: "Filter API", "trust-scan-config".

repo.branch-sort::
	Override the default branch-sort. Default value: <branch-sort>.

repo.clone-url::
	A list of space-separated urls which can be used to clone this
	repository. Default value: <clone-url>. See also: "Macro expansion".

repo.commit-filter::
	Override the default commit-filter. Default value: <commit-filter>. See
	also: "Filter API", "trust-scan-config".

repo.commit-sort::
	Override the default commit-sort. Default value: <commit-sort>.

repo.defbranch::
	The name of the default branch for this repository. If no such branch
	exists in the repository, the first branch name (when sorted) is used as
	default instead. Default value: branch pointed to by HEAD, or "master"
	if there is no suitable HEAD.

repo.desc::
	The value to show as repository description. Without one, the first
	line of the description file inside the repository is shown, unless it
	still holds git's "Unnamed repository" boilerplate. Default value:
	"[no description]".

repo.email-filter::
	Override the default email-filter. Default value: <email-filter>. See
	also: "Filter API", "trust-scan-config".

repo.enable-blame::
	A flag which can be used to override the global setting "enable-blame".
	Default value: <enable-blame>.

repo.enable-commit-graph::
	A flag which can be used to override the global setting
	"enable-commit-graph". Default value: <enable-commit-graph>.

repo.enable-commit-trailers::
	A flag which can be used to override the global setting
	"enable-commit-trailers". Default value: <enable-commit-trailers>.

repo.enable-follow-links::
	A flag which can be used to override the global setting
	"enable-follow-links". Default value: <enable-follow-links>.

repo.enable-gitmodules-links::
	A flag which can be used to override the global setting
	"enable-gitmodules-links". Default value: <enable-gitmodules-links>.

repo.enable-html-serving::
	A flag which can be used to override the global setting
	"enable-html-serving". Default value: <enable-html-serving>.

repo.enable-log-filecount::
	A flag which can be used to override the global setting
	"enable-log-filecount". Default value: <enable-log-filecount>.

repo.enable-log-linecount::
	A flag which can be used to override the global setting
	"enable-log-linecount". Default value: <enable-log-linecount>.

repo.enable-mailmap::
	A flag which can be used to override the global setting
	"enable-mailmap". Default value: <enable-mailmap>.

repo.enable-remote-branches::
	A flag which can be used to override the global setting
	"enable-remote-branches". Default value: <enable-remote-branches>.

repo.enable-subject-links::
	A flag which can be used to override the global setting
	"enable-subject-links". Default value: <enable-subject-links>.

repo.head-content::
	This value will be added verbatim to the HTML head section of each page
	displayed for this repository. Default value: none. See also:
	"head-include".

repo.hide::
	Flag which, when set to "1", hides the repository from the repository
	index. The repository can still be accessed by providing a direct path.
	Default value: "0". See also: "repo.ignore".

repo.ignore::
	Flag which, when set to "1", ignores the repository. The repository is
	not shown in the index and cannot be accessed by providing a direct
	path. Default value: "0". See also: "repo.hide".

repo.logo::
	Override the default logo. Default value: <logo>.

repo.logo-link::
	Override the default logo-link. Default value: <logo-link>.

repo.max-stats::
	Override the default maximum statistics period. Valid values are equal
	to the values specified for the global "max-stats" setting, and a value
	of "0" disables the statistics page for this repository. Default value:
	<max-stats>.

repo.module-link::
	Override the default module-link. Default value: <module-link>.

repo.module-link.<path>::
	Text which will be used as the format string for a hyperlink when a
	submodule with the specified subdirectory path is printed in a directory
	listing. The only argument for the format string is the object id of the
	submodule commit. Default value: none.

repo.name::
	The value to show as repository name. Default value: <repo.url>.

repo.owner::
	A value used to identify the owner of the repository. When repositories
	are found by scan-path the name of the repository directory's owner, as
	recorded in the password database, is used as a fallback. Default value:
	none.

repo.path::
	An absolute path to the repository directory. For non-bare repositories
	this is the .git-directory. When cgit cannot open the path as a
	repository, its pages answer 404 and the path is named in the error
	log. Default value: none.

repo.readme::
	A path (relative to <repo.path>) which specifies a file to show as the
	"About" page for this repository. A git refspec by head or by hash may
	be prepended, followed by a colon, as in "master:docs/readme.mkd". If
	the value begins with a colon, as in ":docs/readme.rst", the head given
	in the query or the default branch of the repository is used. Default
	value: <readme>.

repo.section::
	Override the current section name for this repository. Default value:
	<section>.

repo.snapshot-prefix::
	Prefix to use for snapshot links instead of the repository basename. For
	example, the "linux-stable" repository may wish to set this to "linux"
	so that snapshots are in the format "linux-3.15.4" instead of
	"linux-stable-3.15.4". Default value: the repository basename.

repo.snapshots::
	A mask of snapshot formats for this repository that cgit generates links
	for. It is intersected with the global "snapshots" setting, so a
	repository can withhold formats but never offer one the global setting
	does not. Default value: <snapshots>.

repo.source-filter::
	Override the default source-filter. Default value: <source-filter>. See
	also: "Filter API", "trust-scan-config".

repo.trailer-filter::
	Override the default trailer-filter. Default value: <trailer-filter>.
	See also: "Filter API", "trust-scan-config".

repo.url::
	The relative url used to access the repository. This must be the first
	setting specified for each repository. A repository both listed this way
	and found by scan-path appears twice on the index, and when the two
	share a url the one defined first answers it. Default value: none.


Repository-specific cgitrc file
-------------------------------

When the option "scan-path" is used to auto-discover git repositories, cgit
tries to parse the file "cgitrc" within any found repository. Such a file may
contain any of the repository settings described above, except "repo.url" and
"repo.path", with the "repo." prefix dropped, so "repo.desc" becomes "desc". The
settings "trust-scan-config" guards are only honoured when it is set to "1".


Filter API
----------

By default, filters are separate processes that are executed each time they are
needed. Alternative technologies may be used by prefixing the filter
specification with one of these strings.

'exec:'::
	The default "one process per filter" mode.

'lua:'::
	Executes the script using a built-in Lua interpreter. The script is
	loaded once per execution of cgit, and may be called multiple times
	during cgit's lifetime, making it a good choice for repeated filters
	such as the 'email filter'. A cgit built with NO_LUA has no interpreter
	and refuses a filter with this prefix. It responds to three functions:

	'filter_open(argument1, argument2, argument3, ...)'::
		This is called upon activation of the filter for a particular
		set of data.
	'filter_write(buffer)'::
		This is called whenever cgit writes data to the webpage.
	'filter_close()'::
		This is called when the current filtering operation is
		completed. It must return an integer value. Usually 0 indicates
		success.

	cgit also exposes these built-in functions to the Lua script.

	'html(str)'::
		Writes 'str' to the webpage.
	'html_txt(str)'::
		HTML escapes and writes 'str' to the webpage.
	'html_attr(str)'::
		HTML escapes for an attribute and writes 'str' to the webpage.
	'html_url_path(str)'::
		Url escapes for a path and writes 'str' to the webpage.
	'html_url_arg(str)'::
		Url escapes for an argument and writes 'str' to the webpage.
	'html_include(file)'::
		Includes 'file' in webpage.
	'print(...)'::
		Writes its arguments to the webpage unescaped, a tab between
		each and a newline at the end, as Lua's own print lays them out.


Parameters are provided to filters as follows.

about filter::
	This filter is given three parameters. The first is the filename of the
	source file to filter, which the filter can use to determine (for
	example) the type of syntax to follow when formatting the readme file.
	For a readme tracked in the repository, the second is the url of the
	repository's tree page at the ref the readme was read from, ending in a
	slash so a path in the tree can follow it, and the third is the query
	that has to come after such a path, empty for the default branch. Both
	are escaped for a url, and both are empty for a readme on disk and for
	the site readme. The about text that is to be filtered is available on
	standard input and the filtered text is expected on standard output.

auth filter::
	The authentication filter receives 12 parameters, in this order.
	  - filter action, explained below, which specifies which action the
	    filter is called for
	  - http cookie
	  - http method
	  - http query string
	  - http referer
	  - http path
	  - http host
	  - http https flag
	  - cgit repo, the url of the repository asked for, such as
	    team/tools.git where section-from-path lists it as tools.git, or
	    empty when there is none
	  - cgit page
	  - cgit url
	  - cgit login url
	When the filter action is "body", this filter must write to output the
	HTML for displaying the login form, which POSTs to the login url. When
	the filter action is "authenticate-cookie", this filter must validate
	the http cookie and return a 0 if it is invalid or 1 if it is valid, in
	the exit code or the close function. If the filter action is
	"authenticate-post", this filter receives the posted parameters on
	standard input, and should write a complete CGI response, preferably
	with a 302 redirect, and write to output one or more "Set-Cookie" HTTP
	headers, each followed by a newline.

	See custom/extensions/auth-inline.lua for a ready to modify example that
	keeps its user list inline, or custom/extensions/auth-file.lua for the
	same filter reading its users from files on disk.

commit filter::
	This filter is given no arguments. The commit message text that is to be
	filtered is available on standard input and the filtered text is
	expected on standard output.

email filter::
	This filter is given two parameters, the email address of the relevant
	author and a string indicating the originating page. The filter will
	then receive the text string to format on standard input and is expected
	to write to standard output the formatted text to be included in the
	page.

source filter::
	This filter is given a single parameter, the filename of the source file
	to filter. The filter can use the filename to determine (for example)
	the syntax highlighting mode. The contents of the source file that is to
	be filtered is available on standard input and the filtered contents is
	expected on standard output.

	The line numbers beside the output are counted from the line feeds of
	the input, so the output has to break lines exactly where those fall.
	A browser also starts a line at a carriage return with no line feed
	after it, and may at a vertical tab, a form feed, or the Unicode next
	line, line separator and paragraph separator, which is why cgit and
	syntax-highlight.lua show each of those as an escape sequence in
	span.escape.

trailer filter::
	This filter is given two parameters, the key of the trailer being
	formatted, such as "Fixes", and a string indicating the originating
	page. The filter will then receive the trailer value, already HTML
	escaped, on standard input and is expected to write to standard output
	the formatted value to be included in the page.


The filters that run for a repository's pages are handed these environment
variables. The auth filter runs before a repository is chosen and the site's
about page has none, so neither of them sees these.

- CGIT_REPO_URL (from repo.url)
- CGIT_REPO_NAME (from repo.name)
- CGIT_REPO_PATH (from repo.path)
- CGIT_REPO_OWNER (from repo.owner)
- CGIT_REPO_DEFBRANCH (from repo.defbranch)
- CGIT_REPO_SECTION (from repo.section)
- CGIT_REPO_CLONE_URL (from repo.clone-url)

If a setting is not defined for a repository and the corresponding global
setting is also not defined (if applicable), then the corresponding environment
variable will be unset.


Macro expansion
---------------

The following cgitrc options support a simple macro expansion feature, where
tokens prefixed with "$" are replaced with the value of a similarly named
environment variable.

- cache-root
- include
- project-list
- scan-path

Macro expansion will also happen on the content of $CGIT_CONFIG, if defined.

The options above are expanded while the configuration is parsed. Any variable
in the environment the web server hands cgit can be used, from the CGI request
variables such as $HTTP_HOST to anything set with SetEnv (Apache), fastcgi_param
(nginx) or setenv.add-environment (lighttpd). cgit unsets $HOME and
$XDG_CONFIG_HOME before reading its configuration, so those two never expand.

One usage of this feature is virtual hosting, which in its simplest form can be
accomplished by adding a line like this one to /etc/cgitrc.

	include=/etc/cgitrc.d/$HTTP_HOST

The following options are expanded later, during request processing, and
additionally support the seven CGIT_REPO_* variables defined in "Filter API".

- clone-url
- repo.clone-url


The cache
---------

All cache ttl values are in minutes. Negative ttl values indicate that a page
type will never expire, and thus the first time a url is accessed, the result
will be cached indefinitely, even if the underlying git repository changes.
Conversely, when a ttl value is zero, the cache is disabled for that particular
page type. A response larger than "cache-max-slot-size" is served but not kept.

Each cached page is kept in a slot, a file in the cache directory named after a
hash of the request. cache-size sets how many slots there are, and two pages
whose hashes land on the same slot push each other out, which is logged.

The cache directory holds one file per slot and the cached results of scan-path
as rc-* files, plus transient lock files, all created by cgit itself. Create the
directory ahead of time, owned by the account the web server runs cgit as, with
mode 0700. cgit creates its files by name without guarding against links planted
beside them, so a directory other accounts can write to would let those accounts
redirect the writes. A directory other accounts can read exposes every cached
page along with the urls visitors asked for.

A slot or a scan result is rebuilt only by the process holding an flock on its
lock file. A request that finds the lock held serves the expired copy, or goes
without the cache when there is none, and logs nothing. Any other failure to
open, lock or write a lock file is logged with its path, apart from one in the
background rebuild of an expired scan result, whose output is discarded.

A cached page outlives an edit to cgitrc and is served until its ttl runs out.
Delete the files in the cache directory other than the .lock ones to see a
change at once.


Signatures
----------

cgit can host .asc signatures corresponding to various snapshot formats, through
use of git notes. For example, the following command may be used to add a
signature to a .tar.xz archive.

    git notes --ref=refs/notes/signatures/tar.xz add -C "$(
        gpg --output - --armor --detach-sign cgit-1.1.tar.xz |
        git hash-object -w --stdin
    )" v1.1

If it is instead desirable to attach a signature of the underlying .tar, this
will be linked, as a special case, beside a .tar.* link that does not have its
own signature. For example, a signature of a tarball of the latest tag might be
added with a similar command.

    tag="$(git describe --abbrev=0)"
    git notes --ref=refs/notes/signatures/tar add -C "$(
        git archive --format tar --prefix "cgit-${tag#v}/" "$tag" |
        gpg --output - --armor --detach-sign |
        git hash-object -w --stdin
    )" "$tag"

Since git-archive(1) is expected to produce stable output between versions, this
allows one to generate a long-term signature of the contents of a given tag.