apache.conf.in

   1 ## To convert this file to apache.conf using the current Girocco::Config values
   2 ## either do "make" or "make apache.conf" or ./make-apache-conf.sh
   3 ##
   4 # This is an example configuration of a virtualhost running Girocco, as set up
   5 # at repo.or.cz; unfortunately, completely independent from Girocco::Config.
   6 # It is not essential for Girocco to use a special virtualhost, however.
   7 <VirtualHost *:80>
   8
   9         ServerName @@httpdnsname@@
  10         ServerAlias www.@@httpdnsname@@
  11         ServerAdmin @@admin@@
  12
  13         ErrorLog /var/log/apache2/repo-error.log
  14         CustomLog /var/log/apache2/repo-access.log combined
  15
  16         AddHandler cgi-script .cgi
  17
  18         DocumentRoot @@webroot@@
  19         <Directory @@webroot@@>
  20                 # Add MultiViews only if pages are truly
  21                 # offered in more than a single language
  22                 Options FollowSymLinks ExecCGI
  23                 AllowOverride All
  24                 Order allow,deny
  25                 Allow from all
  26                 DirectoryIndex gitweb.cgi
  27                 Satisfy all
  28         </Directory>
  29
  30         ScriptAlias /w @@cgiroot@@/gitweb.cgi
  31         ScriptAlias /h @@cgiroot@@/html.cgi
  32
  33         <IfModule rewrite_module>
  34                 RewriteEngine On
  35                 # Redirect bare /w requests without .git that name an existing repo...
  36                 RewriteCond @@reporoot@@/$1.git/HEAD -f
  37                 RewriteRule \
  38                         ^/w/((?:[a-zA-Z0-9+._-]+(?<!\.git)/)*[a-zA-Z0-9+._-]+(?<!\.git))/?$ \
  39                         /w/$1.git [L,R=301]
  40
  41                 # ...and also make the leading /w optional for those types of requests
  42                 RewriteCond %{HTTP_USER_AGENT} !git/ [NC]
  43                 RewriteCond @@reporoot@@/$1.git/HEAD -f
  44                 RewriteRule \
  45                         ^/(?!w/)((?:[a-zA-Z0-9+._-]+(?<!\.git)/)*[a-zA-Z0-9+._-]+(?<!\.git))/?$ \
  46                         /$1.git [L,R=301]
  47
  48                 # Make the leading /w optional if the rest names an existing repo
  49                 RewriteCond %{HTTP_USER_AGENT} !git/ [NC]
  50                 RewriteCond @@reporoot@@/$1/HEAD -f
  51                 # Might want to use [L,R] instead of [PT] maybe even [L,R=301]
  52                 RewriteRule \
  53                         ^/(?!w/)((?:[a-zA-Z0-9+._-]+(?<!\.git)/)*[a-zA-Z0-9+._-]+?\.git)((?:/.*)?)$ \
  54                         /w/$1$2 [PT]
  55         </IfModule>
  56
  57         <Directory @@reporoot@@>
  58                 Options FollowSymLinks
  59                 AllowOverride None
  60                 Order allow,deny
  61                 Allow from all
  62                 Satisfy all
  63
  64                 <IfModule rewrite_module>
  65                         # Everything fetched over the non-smart git http
  66                         # protocol should be an existing file.  If the request
  67                         # is not for an existing file, just send back an error
  68                         # message without emitting anything into the error log.
  69                         RewriteEngine On
  70                         RewriteCond %{REQUEST_FILENAME} !-f
  71                         RewriteRule .* - [R=404,L]
  72                 </IfModule>
  73         </Directory>
  74
  75         <Directory @@basedir@@/bin>
  76                 Options None
  77                 AllowOverride None
  78                 Order deny,allow
  79                 Deny from all
  80                 <Files git-http-backend-verify>
  81                         Options ExecCGI
  82                         Allow from all
  83                 </Files>
  84                 Satisfy all
  85         </Directory>
  86
  87         SetEnv GIT_HTTP_EXPORT_ALL 1
  88
  89         # By default non-smart HTTP fetch access will be allowed, however
  90         # by defining SmartHTTPOnly (or changing the sense of the IfDefine tests)
  91         # non-smart HTTP requests can be denied directly by the web server
  92
  93         <IfDefine !SmartHTTPOnly>
  94         # These accelerate non-smart HTTP access to loose objects and packs with the /r/ prefix
  95         # But not for projects starting with '_' to which access should never be allowed
  96         AliasMatch ^/r/([^_].*/objects/[0-9a-f]{2}/[0-9a-f]{38})$               @@reporoot@@/$1
  97         AliasMatch ^/r/([^_].*/objects/pack/pack-[0-9a-f]{40}.(pack|idx))$      @@reporoot@@/$1
  98
  99         # These accelerate non-smart HTTP access for Git user agents without the /r/ prefix
 100         # But not for projects starting with '_' to which access should never be allowed
 101         <IfModule rewrite_module>
 102                         RewriteEngine On
 103                         RewriteCond %{HTTP_USER_AGENT} git/ [NC]
 104                         RewriteRule "(?x) ^/((?!r/)[^_].*/objects/(?: \
 105                                 (?:[0-9a-f]{2}/[0-9a-f]{38}) | \
 106                                 (?:pack/pack-[0-9a-f]{40}.(?:pack|idx)) ))$" \
 107                                 @@reporoot@@/$1 [L]
 108         </IfModule>
 109         </IfDefine>
 110
 111         <IfDefine SmartHTTPOnly>
 112         # Disable non-smart HTTP access
 113         RewriteEngine On
 114         RewriteCond %{REQUEST_METHOD} !^POST$
 115         RewriteRule ^/r/.*(?<!/info/refs)$ - [F]
 116         RewriteCond %{REQUEST_URI} !^/authrequired[.]cgi$
 117         RewriteCond %{HTTP_USER_AGENT} git/ [NC]
 118         RewriteCond %{REQUEST_METHOD} !^POST$
 119         RewriteRule ^/(?!r/).*(?<!/info/refs)$ - [F]
 120         RewriteCond %{QUERY_STRING} !(^|&)service=git-(upload|receive)-pack(&|$)
 121         RewriteRule ^/r/.*/info/refs$ - [F]
 122         RewriteCond %{HTTP_USER_AGENT} git/ [NC]
 123         RewriteCond %{QUERY_STRING} !(^|&)service=git-(upload|receive)-pack(&|$)
 124         RewriteRule ^/(?!r/).*/info/refs$ - [F]
 125         </IfDefine>
 126
 127         # SetEnv GIT_HTTP_BACKEND_BIN to override Config.pm $git_http_backend_bin
 128         # git-http-backend-verify denies all access to projects starting with '_'
 129         ScriptAlias /r/ @@basedir@@/bin/git-http-backend-verify/
 130
 131         # This allows HTTP access for Git user agents without the /r/ prefix
 132         <IfModule rewrite_module>
 133                         RewriteEngine On
 134                         RewriteCond %{REQUEST_URI} !^/authrequired[.]cgi$
 135                         RewriteCond %{HTTP_USER_AGENT} git/ [NC]
 136                         RewriteRule ^/(?!r/)(.*)$ \
 137                                 @@basedir@@/bin/git-http-backend-verify/$1 \
 138                                 [L,H=cgi-script]
 139         </IfModule>
 140 </VirtualHost>
 141
 142
 143 # This comments out the following so this file can be used as-is
 144 <IfDefine DummyThatIsNotDefined>
 145
 146
 147 # This is an example configuration of an https virtualhost running Girocco, as set
 148 # up at repo.or.cz; unfortunately, completely independent from Girocco::Config.
 149 # It is not essential for Girocco to use a special virtualhost, however.
 150 # The Config.pm $httpspushurl variable needs to be defined to properly enable
 151 # https pushing.
 152 <VirtualHost *:443>
 153
 154         # These certificate files will all be automatically generated, but the
 155         # paths here may need to be corrected to match the paths
 156         # (especially $certsdir) from Config.pm
 157
 158         SSLCertificateFile @@certsdir@@/girocco_www_crt.pem
 159         SSLCertificateKeyFile @@certsdir@@/girocco_www_key.pem
 160         SSLCertificateChainFile @@certsdir@@/girocco_www_chain.pem
 161         # when using a paid www server cert, only the above three lines should
 162         # be changed.  Changing any of the below two lines (other than updating
 163         # the paths to match $certsdir) will likely break https client auth
 164         SSLCACertificateFile @@certsdir@@/girocco_root_crt.pem
 165         SSLCADNRequestFile @@certsdir@@/girocco_client_crt.pem
 166
 167         SSLVerifyDepth 3
 168         SSLOptions +FakeBasicAuth +StrictRequire
 169         SSLEngine on
 170
 171         # This configuration allows fetching over https without a certificate
 172         # while always requiring a certificate for pushing over https
 173         RewriteEngine On
 174         SSLVerifyClient optional
 175         RewriteCond %{QUERY_STRING} (^|&)service=git-receive-pack(&|$)
 176         RewriteRule ^/r/.*/info/refs$ - [env=client_auth_required:1]
 177         RewriteCond %{HTTP_USER_AGENT} git/ [NC]
 178         RewriteCond %{QUERY_STRING} (^|&)service=git-receive-pack(&|$)
 179         RewriteRule ^/(?!r/).*/info/refs$ - [env=client_auth_required:1]
 180         RewriteRule ^/r/.*/git-receive-pack$ - [env=client_auth_required:1]
 181         RewriteCond %{HTTP_USER_AGENT} git/ [NC]
 182         RewriteRule ^/(?!r/).*/git-receive-pack$ - [env=client_auth_required:1]
 183         RewriteCond %{ENV:client_auth_required} 1
 184         RewriteCond %{SSL:SSL_CLIENT_VERIFY} !^SUCCESS$
 185         RewriteRule .* %{REQUEST_URI} [R=401]
 186         <Location />
 187                 SSLRequireSSL
 188                 Order deny,allow
 189                 Deny from env=client_auth_required
 190                 SSLOptions +FakeBasicAuth
 191                 AuthName "Git Client Authentication"
 192                 AuthType Basic
 193                 AuthBasicProvider anon
 194                 Anonymous *
 195                 Require valid-user
 196                 Satisfy any
 197         </Location>
 198         ErrorDocument 401 /authrequired.cgi
 199
 200         # *** IMPORTANT ***
 201         #
 202         # ALL the entire contents from the <VirtualHost *:80> section at
 203         # the top of this file must be copied here.
 204         #
 205         # To avoid this duplication, the contents of the <VirtualHost *:80>
 206         # section above can be moved to a separate file and then included
 207         # both here and in the <VirtualHost *:80> section using an Include
 208         # directive.  Be careful not to place the new include file in one of the
 209         # directories the standard apache configuration blindly includes all
 210         # files from.
 211
 212 </VirtualHost>
 213
 214
 215 # End commenting
 216 </IfDefine>