apache.conf

   1 # This is example configuration of a virtualhost running Girocco, as set up
   2 # at repo.or.cz; unfortunately, completely independent from Girocco::Config.
   3 # It is not essential for Girocco to use a special virtualhost, however.
   4 <VirtualHost *:80>
   5
   6         ServerName repo.or.cz
   7         ServerAlias www.repo.or.cz
   8         ServerAdmin admin@repo.or.cz
   9
  10         ErrorLog /var/log/apache2/repo-error.log
  11         CustomLog /var/log/apache2/repo-access.log combined
  12
  13         AddHandler cgi-script .cgi
  14
  15         DocumentRoot /home/repo/WWW
  16         <Directory /home/repo/WWW>
  17                 Options Indexes FollowSymLinks MultiViews ExecCGI
  18                 AllowOverride All
  19                 Order allow,deny
  20                 Allow from all
  21                 DirectoryIndex gitweb.cgi
  22                 Satisfy all
  23         </Directory>
  24
  25         ScriptAlias /w /home/repo/WWW/gitweb.cgi
  26         ScriptAlias /h /home/repo/WWW/html.cgi
  27
  28         <Directory /srv/git>
  29                 Options FollowSymLinks
  30                 AllowOverride None
  31                 Order allow,deny
  32                 Allow from all
  33                 Satisfy all
  34         </Directory>
  35
  36         <Directory /home/repo/repomgr/bin>
  37                 Options None
  38                 AllowOverride None
  39                 Order deny,allow
  40                 Deny from all
  41                 <Files git-http-backend-verify>
  42                         Allow from all
  43                 </Files>
  44                 Satisfy all
  45         </Directory>
  46
  47         SetEnv GIT_PROJECT_ROOT /srv/git
  48         SetEnv GIT_HTTP_EXPORT_ALL 1
  49
  50         # By default non-smart HTTP fetch access will be allowed, however
  51         # by defining SmartHTTPOnly (or changing the sense of the IfDefine tests)
  52         # non-smart HTTP requests can be denied directly by the web server
  53
  54         <IfDefine !SmartHTTPOnly>
  55         # These accelerate non-smart HTTP access to loose objects and packs
  56         AliasMatch ^/r/(.*/objects/[0-9a-f]{2}/[0-9a-f]{38})$           /srv/git/$1
  57         AliasMatch ^/r/(.*/objects/pack/pack-[0-9a-f]{40}.(pack|idx))$  /srv/git/$1
  58         </IfDefine>
  59
  60         <IfDefine SmartHTTPOnly>
  61         # Disable non-smart HTTP access
  62         RewriteEngine On
  63         RewriteCond %{REQUEST_METHOD} !^POST$
  64         RewriteRule ^/r/.*(?<!/info/refs)$ - [F]
  65         RewriteCond %{QUERY_STRING} !(^|&)service=git-(upload|receive)-pack(&|$)
  66         RewriteRule ^/r/.*/info/refs$ - [F]
  67         </IfDefine>
  68
  69         # SetEnv GIT_HTTP_BACKEND_BIN to override Config.pm $git_http_backend_bin
  70         ScriptAlias /r/ /home/repo/repomgr/bin/git-http-backend-verify/
  71
  72 </VirtualHost>
  73
  74
  75 # This comments out the following so this file can be used as-is
  76 <IfDefine DummyThatIsNotDefined>
  77
  78
  79 # This is example configuration of an https virtualhost running Girocco, as set
  80 # up at repo.or.cz; unfortunately, completely independent from Girocco::Config.
  81 # It is not essential for Girocco to use a special virtualhost, however.
  82 # The Config.pm $httpspushurl variable needs to be defined to properly enable
  83 # https pushing.
  84 <VirtualHost *:443>
  85
  86         # These certificate files will all be automatically generated, but the
  87         # paths here may need to be corrected to match the paths
  88         # (especially $certsdir) from Config.pm
  89
  90         SSLCertificateFile /home/repo/certs/girocco_www_crt.pem
  91         SSLCertificateKeyFile /home/repo/certs/girocco_www_key.pem
  92         SSLCertificateChainFile /home/repo/certs/girocco_www_chain.pem
  93         # when using a paid www server cert, only the above three lines should
  94         # be changed.  Changing any of the below two lines (other than updating
  95         # the paths to match $certsdir) will likely break https client auth
  96         SSLCACertificateFile /home/repo/certs/girocco_root_crt.pem
  97         SSLCADNRequestFile /home/repo/certs/girocco_client_crt.pem
  98
  99         SSLVerifyDepth 3
 100         SSLOptions +FakeBasicAuth +StrictRequire
 101         SSLEngine on
 102         <Location />
 103                 SSLRequireSSL
 104         </Location>
 105
 106         # This configuration allows fetching over https without a certificate
 107         # while always requiring a certificate for pushing over https
 108         RewriteEngine On
 109         SSLVerifyClient optional
 110         RewriteCond %{QUERY_STRING} (^|&)service=git-receive-pack(&|$)
 111         RewriteRule ^/r/.*/info/refs$ - [env=client_auth_required:1]
 112         RewriteRule ^/r/.*/git-receive-pack$ - [env=client_auth_required:1]
 113         RewriteCond %{ENV:client_auth_required} 1
 114         RewriteCond %{SSL:SSL_CLIENT_VERIFY} !^SUCCESS$
 115         RewriteRule .* %{REQUEST_URI} [R=401]
 116         <LocationMatch ^/r/>
 117                 Order deny,allow
 118                 Deny from env=client_auth_required
 119                 SSLOptions +FakeBasicAuth
 120                 AuthName "Git Client Authentication"
 121                 AuthType Basic
 122                 AuthBasicProvider anon
 123                 Anonymous *
 124                 Require valid-user
 125                 Satisfy any
 126         </LocationMatch>
 127
 128         # *** IMPORTANT ***
 129         #
 130         # ALL the entire contents from the <VirtualHost *:80> section at
 131         # the top of this file must be copied here.
 132         #
 133         # To avoid this duplication, the contents of the <VirtualHost *:80>
 134         # section above can be moved to a separate file and then included
 135         # both here and in the <VirtualHost *:80> section using an Include
 136         # directive.  Be careful not to place the new include file in one of the
 137         # directories the standard apache configuration blindly includes all
 138         # files from.
 139
 140 </VirtualHost>
 141
 142
 143 # End commenting
 144 </IfDefine>