1 ## To convert this file to apache.conf using the current Girocco::Config
2 ## values either do "make" or "make apache.conf" or ./make-apache-conf.sh
4 # This is an example configuration of a virtualhost running Girocco, as set up
5 # at repo.or.cz; unfortunately, somewhat independent from Girocco::Config.
6 # It is not essential for Girocco to use a special virtualhost, however.
9 # ---- BEGIN LINES TO DUPLICATE ----
11 ServerName @@httpdnsname@@
12 ServerAlias www.@@httpdnsname@@
15 # This is the standard "combined" log format modified as follows:
16 # the REMOTE_USER (%u) has double-quotes around it
17 # the received time is shown as [YYYY-mm-dd_HH:MM:SS +hhmm] (almost RFC 3339 format)
18 # -- this is one character shorter than the default but sorts so much better
19 # when the logio_module is present (almost always) the %O value is prefixed with:
20 # %I-> -- <bytes-received-including-request-and-headers>
21 # the first line of the request ("%r") is prefixed with
22 # %X%k: -- <connection-status><keepalive-request-num>
23 # <keepalive-request-num> will be omitted if apache < 2.2.11
24 # these fields are added to the end:
25 # :%{local}p -- :<actual-server-port>
26 # %Dus -- <request-time-in-microseconds>
27 # "%o{Content-Range}" -- <outgoing Content-Range header>
29 LogFormat "%h %l \"%u\" %{[%F_%T %z]}t %X%k:\"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" :%{local}p %Dus \"%{Content-Range}o\"" girocco
31 <IfVersion !>= 2.2.11>
32 LogFormat "%h %l \"%u\" %{[%F_%T %z]}t %X:\"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" :%{local}p %Dus \"%{Content-Range}o\"" girocco
34 <IfModule logio_module>
35 # %I and %O are only available with the logio_module
37 LogFormat "%h %l \"%u\" %{[%F_%T %z]}t %X%k:\"%r\" %>s %I->%O \"%{Referer}i\" \"%{User-Agent}i\" :%{local}p %Dus \"%{Content-Range}o\"" girocco
39 <IfVersion !>= 2.2.11>
40 LogFormat "%h %l \"%u\" %{[%F_%T %z]}t %X:\"%r\" %>s %I->%O \"%{Referer}i\" \"%{User-Agent}i\" :%{local}p %Dus \"%{Content-Range}o\"" girocco
44 # If your distribution does not set APACHE_LOG_DIR before
45 # starting Apache you will need to edit the next two directives
46 ErrorLog "${APACHE_LOG_DIR}/@@nickname@@-error.log"
47 CustomLog "${APACHE_LOG_DIR}/@@nickname@@-access.log" girocco
49 <IfModule mime_magic_module>
50 # Avoid spurious Content-Type values when git-http-backend
51 # fails to provide a Content-Type header in its output
52 MimeMagicFile /dev/null
55 DocumentRoot @@webroot@@
56 <Directory @@webroot@@>
57 # Add MultiViews only if pages are truly
58 # offered in more than a single language
59 # FollowSymLinks or SymLinksIfOwnerMatch is required for .htaccess files
60 Options FollowSymLinks
61 # FileInfo (or All) must be enabled to activate .htaccess file mod_rewrite rules
74 # The non-mod_rewrite items are handled first where the magic /[bchrw]
75 # prefix always forces selection of the prefix-indicated cgi handler.
77 ScriptAlias /w @@cgiroot@@/gitweb.cgi
78 ScriptAlias /b @@cgiroot@@/bundles.cgi
79 ScriptAlias /h @@cgiroot@@/html.cgi
80 ScriptAliasMatch ^/(?!(?i)gitweb\.cgi|bundles\.cgi|html\.cgi(?:/|$))([^/]+\.cgi(?:/.*)?)$ @@cgiroot@@/$1
82 # Any requests without the magic /[bchrw] are treated as Git requests if they
83 # are one of the few possible Git URLs otherwise they go to bundles or gitweb
85 # Change the setting of $SmartHTTPOnly in Girocco::Config.pm to
86 # change whether or not non-smart HTTP fetch access will be allowed.
88 <IfDefine !@@SmartHTTPOnly@@>
89 # This accelerates non-smart HTTP access to loose objects, packs and info
91 "(?x)^/(?![bchw]/)(?:r/)? \
92 ((?:[a-zA-Z0-9][a-zA-Z0-9+._-]*(?<!\.git)/)*[a-zA-Z0-9][a-zA-Z0-9+._-]*?)(?:\.git)?/( \
94 objects/info/alternates | \
95 objects/info/http-alternates | \
96 objects/info/packs | \
97 objects/[0-9a-f]{2}/[0-9a-f]{38} | \
98 objects/pack/pack-[0-9a-f]{40}\.(?:pack|idx) )$" \
99 @@reporoot@@/$1.git/$2
102 # SetEnv GIT_HTTP_BACKEND_BIN to override Config.pm $git_http_backend_bin
103 ScriptAlias /r/ @@basedir@@/bin/git-http-backend-verify/
106 "(?x)^/(?![bchrw]/) \
107 ((?:[a-zA-Z0-9][a-zA-Z0-9+._-]*(?<!\.git)/)*[a-zA-Z0-9][a-zA-Z0-9+._-]*?)(?:\.git)?/( \
111 [a-zA-Z0-9][a-zA-Z0-9+._-]*\.bundle )$" \
112 @@basedir@@/bin/git-http-backend-verify/$1.git/$2
114 # Everything else off to bundles.cgi or gitweb.cgi
116 "(?x)^/(?![bchrw]/) \
117 ((?:[a-zA-Z0-9][a-zA-Z0-9+._-]*(?<!\.git)/)*[a-zA-Z0-9][a-zA-Z0-9+._-]*?\.git/bundles)$" \
118 @@cgiroot@@/bundles.cgi/$1
120 "(?x)^/(?![bchrw]/) \
121 ((?:[a-zA-Z0-9][a-zA-Z0-9+._-]*(?<!\.git)/)*[a-zA-Z0-9][a-zA-Z0-9+._-]*?\.git(?!/bundles)(?:/.*)?)$" \
122 @@cgiroot@@/gitweb.cgi/$1
124 # mod_rewrite is not strictly required for gitweb and fetch access, but
125 # if it's not available the trailing ".git" is never optional for
126 # gitweb, the leading /h is always required for *.html, snapshots are
127 # not throttled, some bogus Git http protocol requests will not be
128 # detected early and, if non-smart HTTP is allowed, access to the
129 # /info/refs file will not be accelerated in non-smart HTTP mode.
131 <IfModule rewrite_module>
134 # Snapshot requests are only allowed via the PATH_INFO mechanism
135 RewriteCond %{QUERY_STRING} (^|[&;])a=snapshot([&;]|$) [NC]
136 RewriteRule .? - [NS,F,L]
138 # Redirect snapshot requests to snapshot.cgi
140 "(?x)^/(?![bchr]/)(?:w/)? \
141 ((?:[a-zA-Z0-9][a-zA-Z0-9+._-]*(?<!\.git)/)*[a-zA-Z0-9][a-zA-Z0-9+._-]*?\.git/ \
142 snapshot(?:/.*)?)$" \
143 @@cgiroot@@/snapshot.cgi/$1 [NS,L,H=cgi-script]
145 # Make the leading /h optional for requests that name an existing .html template
146 RewriteCond @@webroot@@/$1 !-f
147 RewriteCond @@cgiroot@@/$1 !-f
148 RewriteCond @@basedir@@/html/$1 -s
150 ^/(?![bchrw]/)(.*\.html)$ \
153 # Redirect bare gitweb requests without .git that name an existing repo...
154 RewriteCond @@webroot@@/$2 !-f
155 RewriteCond @@cgiroot@@/$2 !-f
156 RewriteCond @@reporoot@@/$2.git/HEAD -s
158 "(?x)^/(?![bchr]/)((?:w/)?) \
159 ((?:[a-zA-Z0-9][a-zA-Z0-9+._-]*(?<!\.git)/)*[a-zA-Z0-9][a-zA-Z0-9+._-]*(?<!\.git))$" \
160 /$1$2.git [NS,L,R=301]
162 # Of the 11 possible Git protocol URLs (i.e. passed to git-http-backend-verify),
163 # 9 are only valid with GET/HEAD and the other two are only valid with POST
164 # Furthermore, 7 are only valid when non-smart is allowed and
165 # 1 is only valid when smart-only is enabled if it has the correct query string.
167 # These two always require POST
168 RewriteCond %{REQUEST_METHOD} !=POST
170 "(?x)^/(?![bchw]/)(?:r/)? \
171 (?:[a-zA-Z0-9][a-zA-Z0-9+._-]*(?<!\.git)/)*[a-zA-Z0-9][a-zA-Z0-9+._-]*?(?:\.git)?/(?: \
173 git-receive-pack )$" \
176 <IfDefine @@SmartHTTPOnly@@>
177 # These 7 are always forbidden when non-smart HTTP is disabled
179 "(?x)^/(?![bchw]/)(?:r/)? \
180 (?:[a-zA-Z0-9][a-zA-Z0-9+._-]*(?<!\.git)/)*[a-zA-Z0-9][a-zA-Z0-9+._-]*?(?:\.git)?/(?: \
182 objects/info/alternates | \
183 objects/info/http-alternates | \
184 objects/info/packs | \
185 objects/[0-9a-f]{2}/[0-9a-f]{38} | \
186 objects/pack/pack-[0-9a-f]{40}\.(?:pack|idx) )$" \
188 # This one is forbidden without the magic query string when non-smart is disabled
189 RewriteCond %{REQUEST_METHOD} !^(?:GET|HEAD)$ [OR]
190 RewriteCond %{QUERY_STRING} !(^|&)service=git-(?:upload|receive)-pack(&|$)
192 "(?x)^/(?![bchw]/)(?:r/)? \
193 (?:[a-zA-Z0-9][a-zA-Z0-9+._-]*(?<!\.git)/)*[a-zA-Z0-9][a-zA-Z0-9+._-]*?(?:\.git)?/ \
196 # This one requires GET (or HEAD)
197 RewriteCond %{REQUEST_METHOD} !^(?:GET|HEAD)$
199 "(?x)^/(?![bchw]/)(?:r/)? \
200 (?:[a-zA-Z0-9][a-zA-Z0-9+._-]*(?<!\.git)/)*[a-zA-Z0-9][a-zA-Z0-9+._-]*?(?:\.git)?/ \
201 [a-zA-Z0-9][a-zA-Z0-9+._-]*\.bundle $" \
205 <IfDefine !@@SmartHTTPOnly@@>
206 # These 9 require GET (or HEAD)
207 RewriteCond %{REQUEST_METHOD} !^(?:GET|HEAD)$
209 "(?x)^/(?![bchw]/)(?:r/)? \
210 (?:[a-zA-Z0-9][a-zA-Z0-9+._-]*(?<!\.git)/)*[a-zA-Z0-9][a-zA-Z0-9+._-]*?(?:\.git)?/(?: \
213 objects/info/alternates | \
214 objects/info/http-alternates | \
215 objects/info/packs | \
216 objects/[0-9a-f]{2}/[0-9a-f]{38} | \
217 objects/pack/pack-[0-9a-f]{40}\.(?:pack|idx) | \
218 [a-zA-Z0-9][a-zA-Z0-9+._-]*\.bundle )$" \
220 # This one can be accelerated when accessed with non-smart HTTP
221 RewriteCond %{REQUEST_METHOD} ^(?:GET|HEAD)$
222 RewriteCond %{QUERY_STRING} !(^|&)service=git-(?:upload|receive)-pack(&|$)
224 "(?x)^/(?![bchw]/)(?:r/)? \
225 ((?:[a-zA-Z0-9][a-zA-Z0-9+._-]*(?<!\.git)/)*[a-zA-Z0-9][a-zA-Z0-9+._-]*?)(?:\.git)?/ \
227 @@reporoot@@/$1.git/info/refs [NS,L]
231 <Directory @@reporoot@@>
232 Options FollowSymLinks
243 <IfModule rewrite_module>
244 # Everything fetched over the non-smart git http
245 # protocol should be an existing file. If the request
246 # is not for an existing file, just send back an error
247 # message without emitting anything into the error log.
250 RewriteCond @@reporoot@@/$1 !-f
251 RewriteRule ^(.*)$ - [NS,R=404,L]
255 <Directory @@cgiroot@@>
256 # FollowSymLinks or SymLinksIfOwnerMatch is required for .htaccess files
257 Options SymLinksIfOwnerMatch
258 # FileInfo must be enabled to activate .htaccess file mod_rewrite rules
259 AllowOverride FileInfo
278 <IfModule !mod_fastcgi.c>
279 <IfModule !mod_fcgid.c>
280 SetHandler cgi-script
284 # Note that in testing mod_fastcgi (in dynamic mode)
285 # was found to be slightly faster than mod_fcgid.
287 # However, we prefer mod_fcgid if both are available
288 # because we cannot control the server-global settings
289 # of mod_fastcgi's "FastCgiConfig" options.
291 # In order for gitweb.cgi to run reasonably well as a
292 # mod_fastcgi dynamic FastCGI application, the
293 # "FastCgiConfig" option "-idle-timeout" value needs to
294 # be increased from the default value of "30" to at
295 # least "120", preferably more like "300". But that
296 # will affect ALL dynamic mod_fastcgi applications on
297 # the ENTIRE server, not just gitweb.cgi. Additionally
298 # the "FastCgiConfig" "-restart" option probably ought
299 # to be set as well. Also, unfortunately, there is no
300 # mod_fastcgi option corresponding to mod_fcgid's
301 # MaxRequestsPerProcess option and gitweb.cgi running
302 # in FastCGI mode (without using FCGI::ProcManager) will
303 # always exit after serving 100 requests (a good thing).
305 # The alternative is to make gitweb.cgi a static
306 # mod_fastcgi application (the "FastCgiServer"
307 # directive), but then the number of running instances
308 # will be fixed at whatever value is chosen for the
309 # "-processes" option rather than being dynamically
310 # adjusted based on load and that's probably undesirable
311 # in most cases unless you run gitweb.cgi under a
312 # front-end that dynamically forks multiple copies of
313 # gitweb.cgi based on the current load. See the CPAN
314 # FCGI::ProcManager::Dynamic module for an example of
315 # how to do this in Perl:
317 # http://search.cpan.org/search?query=FCGI::ProcManager::Dynamic&mode=module
319 # So instead we prefer mod_fcgid because we can adjust
320 # the necessary options for good gitweb.cgi behavior
321 # while affecting only gitweb.cgi and having it remain
322 # a dynamic application whose total number of running
323 # instances is adjusted based on current server load.
325 <IfModule mod_fcgid.c>
326 SetHandler fcgid-script
328 <IfModule !mod_fcgid.c>
329 <IfModule mod_fastcgi.c>
330 SetHandler fastcgi-script
334 <FilesMatch ^(?!(?i)gitweb\.cgi$).*\.cgi$>
336 SetHandler cgi-script
348 <IfModule mod_fcgid.c>
349 # mod_fcgid benefits from some additional config for gitweb.cgi
350 # gitweb.cgi has a hard-coded maximum of 100 requests
351 # and we do not want to give up too soon in case Git is lagging.
352 # Note that adding a 'MaxProcesses ...' option here may be valuable
353 # to limit the maximum number of gitweb.cgi processes that can be
354 # spawned (default is 100) -- perhaps to something much lower such
355 # as 1 or 2 times the number of CPU cores. Also note that in the
356 # unlikely event all the children finish their 100 requests at the
357 # same time, the server's FcgidSpawnScoreUpLimit (which defaults
358 # to 10 if not set) should be set to at least 3 times the
359 # MaxProcesses value chosen to allow them all to respawn
360 # immediately. FcgidSpawnScoreUpLimit MUST be at least twice the
361 # chosen MaxProcesses value (assuming FcgidTerminationScore is
362 # still set to the default 2) in order to allow any child at all to
363 # respawn immediately in this case without a delay.
364 FcgidCmdOptions @@cgiroot@@/gitweb.cgi \
365 MaxRequestsPerProcess 100 IOTimeout 300
368 <Directory @@basedir@@/bin>
379 <Files git-http-backend-verify>
381 SetHandler cgi-script
393 # ---- END LINES TO DUPLICATE ----
398 # Change the setting of $TLSHost in Girocco::Config.pm to change
399 # whether or not the following https virtual host is enabled.
401 <IfDefine @@TLSHost@@>
403 # This is an example configuration of an https virtualhost running Girocco, as set
404 # up at repo.or.cz; unfortunately, completely independent from Girocco::Config.
405 # It is not essential for Girocco to use a special virtualhost, however.
406 # The Config.pm $httpspushurl variable needs to be defined to properly enable
410 # These certificate files will all be automatically generated, but the
411 # paths here may need to be corrected to match the paths
412 # (especially $certsdir) from Config.pm
414 SSLCertificateFile @@certsdir@@/girocco_www_crt.pem
415 SSLCertificateKeyFile @@certsdir@@/girocco_www_key.pem
416 SSLCertificateChainFile @@certsdir@@/girocco_www_chain.pem
417 # when using a paid www server cert, only the above three lines should
418 # be changed. Changing any of the below two lines (other than updating
419 # the paths to match $certsdir) will likely break https client auth
420 SSLCACertificateFile @@certsdir@@/girocco_root_crt.pem
421 SSLCADNRequestFile @@certsdir@@/girocco_client_crt.pem
424 SSLOptions +FakeBasicAuth +StrictRequire
427 # This configuration allows fetching over https without a certificate
428 # while always requiring a certificate for pushing over https
430 SSLVerifyClient optional
431 RewriteCond %{REQUEST_METHOD} ^(GET|HEAD)$ [NC]
432 RewriteCond %{QUERY_STRING} (^|&)service=git-receive-pack(&|$) [NC]
433 RewriteRule /info/refs$ - [NC,NS,env=client_auth_required:1]
434 RewriteCond %{REQUEST_METHOD} =POST [NC]
435 RewriteRule /git-receive-pack$ - [NC,NS,env=client_auth_required:1]
436 RewriteCond %{ENV:client_auth_required} 1
437 RewriteCond %{SSL:SSL_CLIENT_VERIFY} !^SUCCESS$
438 RewriteRule .? %{REQUEST_URI} [NS,R=401]
441 SSLOptions +FakeBasicAuth
442 AuthName "Git Client Authentication"
444 AuthBasicProvider anon
448 Deny from env=client_auth_required
456 Require not env client_auth_required
462 ErrorDocument 401 /authrequired.cgi
464 # ---- BEGIN DUPLICATE LINES ----
468 ## ALL the entire contents from the <VirtualHost *:80> section at the top of
469 ## this file must be copied here.
471 ## To avoid this duplication, the contents of the <VirtualHost *:80> section
472 ## above can be moved to a separate file and then included both here and in
473 ## the <VirtualHost *:80> section using an Include directive. Be careful not
474 ## to place the new include file in one of the directories the standard apache
475 ## configuration blindly includes all files from.
477 # ---- END DUPLICATE LINES ----