apache.conf

   1 # This is example configuration of a virtualhost running Girocco, as set up
   2 # at repo.or.cz; unfortunately, completely independent from Girocco::Config.
   3 # It is not essential for Girocco to use a special virtualhost, however.
   4 <VirtualHost *:80>
   5
   6         ServerName repo.or.cz
   7         ServerAlias www.repo.or.cz
   8         ServerAdmin admin@repo.or.cz
   9
  10         ErrorLog /var/log/apache2/repo-error.log
  11         CustomLog /var/log/apache2/repo-access.log combined
  12
  13         AddHandler cgi-script .cgi
  14
  15         DocumentRoot /home/repo/WWW
  16         <Directory /home/repo/WWW>
  17                 # Add MultiViews only if pages are truly
  18                 # offered in more than a single language
  19                 Options Indexes FollowSymLinks ExecCGI
  20                 AllowOverride All
  21                 Order allow,deny
  22                 Allow from all
  23                 DirectoryIndex gitweb.cgi
  24                 Satisfy all
  25         </Directory>
  26
  27         ScriptAlias /w /home/repo/WWW/gitweb.cgi
  28         ScriptAlias /h /home/repo/WWW/html.cgi
  29
  30         <Directory /srv/git>
  31                 Options FollowSymLinks
  32                 AllowOverride None
  33                 Order allow,deny
  34                 Allow from all
  35                 Satisfy all
  36
  37                 <IfModule rewrite_module>
  38                         # Everything fetched over the non-smart git http
  39                         # protocol should be an existing file.  If the request
  40                         # is not for an existing file, just send back an error
  41                         # message without emitting anything into the error log.
  42                         RewriteEngine On
  43                         RewriteCond %{REQUEST_FILENAME} !-f
  44                         RewriteRule .* - [R=404,L]
  45                 </IfModule>
  46         </Directory>
  47
  48         <Directory /home/repo/repomgr/bin>
  49                 Options None
  50                 AllowOverride None
  51                 Order deny,allow
  52                 Deny from all
  53                 <Files git-http-backend-verify>
  54                         Options ExecCGI
  55                         Allow from all
  56                 </Files>
  57                 Satisfy all
  58         </Directory>
  59
  60         SetEnv GIT_PROJECT_ROOT /srv/git
  61         SetEnv GIT_HTTP_EXPORT_ALL 1
  62
  63         # By default non-smart HTTP fetch access will be allowed, however
  64         # by defining SmartHTTPOnly (or changing the sense of the IfDefine tests)
  65         # non-smart HTTP requests can be denied directly by the web server
  66
  67         <IfDefine !SmartHTTPOnly>
  68         # These accelerate non-smart HTTP access to loose objects and packs with the /r/ prefix
  69         AliasMatch ^/r/(.*/objects/[0-9a-f]{2}/[0-9a-f]{38})$           /srv/git/$1
  70         AliasMatch ^/r/(.*/objects/pack/pack-[0-9a-f]{40}.(pack|idx))$  /srv/git/$1
  71
  72         # These accelerate non-smart HTTP access for Git user agents without the /r/ prefix
  73         <IfModule rewrite_module>
  74                         RewriteEngine On
  75                         RewriteCond %{HTTP_USER_AGENT} git/ [NC]
  76                         RewriteRule "(?x) ^/((?!r/).*/objects/(?: \
  77                                 (?:[0-9a-f]{2}/[0-9a-f]{38}) | \
  78                                 (?:pack/pack-[0-9a-f]{40}.(?:pack|idx)) ))$" \
  79                                 /srv/git/$1 [L]
  80         </IfModule>
  81         </IfDefine>
  82
  83         <IfDefine SmartHTTPOnly>
  84         # Disable non-smart HTTP access
  85         RewriteEngine On
  86         RewriteCond %{REQUEST_METHOD} !^POST$
  87         RewriteRule ^/r/.*(?<!/info/refs)$ - [F]
  88         RewriteCond %{HTTP_USER_AGENT} git/ [NC]
  89         RewriteCond %{REQUEST_METHOD} !^POST$
  90         RewriteRule ^/(?!r/).*(?<!/info/refs)$ - [F]
  91         RewriteCond %{QUERY_STRING} !(^|&)service=git-(upload|receive)-pack(&|$)
  92         RewriteRule ^/r/.*/info/refs$ - [F]
  93         RewriteCond %{HTTP_USER_AGENT} git/ [NC]
  94         RewriteCond %{QUERY_STRING} !(^|&)service=git-(upload|receive)-pack(&|$)
  95         RewriteRule ^/(?!r/).*/info/refs$ - [F]
  96         </IfDefine>
  97
  98         # SetEnv GIT_HTTP_BACKEND_BIN to override Config.pm $git_http_backend_bin
  99         ScriptAlias /r/ /home/repo/repomgr/bin/git-http-backend-verify/
 100
 101         # This allows HTTP access for Git user agents without the /r/ prefix
 102         <IfModule rewrite_module>
 103                         RewriteEngine On
 104                         RewriteCond %{HTTP_USER_AGENT} git/ [NC]
 105                         RewriteRule ^/(?!r/)(.*)$ \
 106                                 /home/repo/repomgr/bin/git-http-backend-verify/$1 \
 107                                 [L,H=cgi-script]
 108         </IfModule>
 109 </VirtualHost>
 110
 111
 112 # This comments out the following so this file can be used as-is
 113 <IfDefine DummyThatIsNotDefined>
 114
 115
 116 # This is example configuration of an https virtualhost running Girocco, as set
 117 # up at repo.or.cz; unfortunately, completely independent from Girocco::Config.
 118 # It is not essential for Girocco to use a special virtualhost, however.
 119 # The Config.pm $httpspushurl variable needs to be defined to properly enable
 120 # https pushing.
 121 <VirtualHost *:443>
 122
 123         # These certificate files will all be automatically generated, but the
 124         # paths here may need to be corrected to match the paths
 125         # (especially $certsdir) from Config.pm
 126
 127         SSLCertificateFile /home/repo/certs/girocco_www_crt.pem
 128         SSLCertificateKeyFile /home/repo/certs/girocco_www_key.pem
 129         SSLCertificateChainFile /home/repo/certs/girocco_www_chain.pem
 130         # when using a paid www server cert, only the above three lines should
 131         # be changed.  Changing any of the below two lines (other than updating
 132         # the paths to match $certsdir) will likely break https client auth
 133         SSLCACertificateFile /home/repo/certs/girocco_root_crt.pem
 134         SSLCADNRequestFile /home/repo/certs/girocco_client_crt.pem
 135
 136         SSLVerifyDepth 3
 137         SSLOptions +FakeBasicAuth +StrictRequire
 138         SSLEngine on
 139
 140         # This configuration allows fetching over https without a certificate
 141         # while always requiring a certificate for pushing over https
 142         RewriteEngine On
 143         SSLVerifyClient optional
 144         RewriteCond %{QUERY_STRING} (^|&)service=git-receive-pack(&|$)
 145         RewriteRule ^/r/.*/info/refs$ - [env=client_auth_required:1]
 146         RewriteCond %{HTTP_USER_AGENT} git/ [NC]
 147         RewriteCond %{QUERY_STRING} (^|&)service=git-receive-pack(&|$)
 148         RewriteRule ^/(?!r/).*/info/refs$ - [env=client_auth_required:1]
 149         RewriteRule ^/r/.*/git-receive-pack$ - [env=client_auth_required:1]
 150         RewriteCond %{HTTP_USER_AGENT} git/ [NC]
 151         RewriteRule ^/(?!r/).*/git-receive-pack$ - [env=client_auth_required:1]
 152         RewriteCond %{ENV:client_auth_required} 1
 153         RewriteCond %{SSL:SSL_CLIENT_VERIFY} !^SUCCESS$
 154         RewriteRule .* %{REQUEST_URI} [R=401]
 155         <Location />
 156                 SSLRequireSSL
 157                 Order deny,allow
 158                 Deny from env=client_auth_required
 159                 SSLOptions +FakeBasicAuth
 160                 AuthName "Git Client Authentication"
 161                 AuthType Basic
 162                 AuthBasicProvider anon
 163                 Anonymous *
 164                 Require valid-user
 165                 Satisfy any
 166         </Location>
 167
 168         # *** IMPORTANT ***
 169         #
 170         # ALL the entire contents from the <VirtualHost *:80> section at
 171         # the top of this file must be copied here.
 172         #
 173         # To avoid this duplication, the contents of the <VirtualHost *:80>
 174         # section above can be moved to a separate file and then included
 175         # both here and in the <VirtualHost *:80> section using an Include
 176         # directive.  Be careful not to place the new include file in one of the
 177         # directories the standard apache configuration blindly includes all
 178         # files from.
 179
 180 </VirtualHost>
 181
 182
 183 # End commenting
 184 </IfDefine>