apache.conf.in

   1 ## To convert this file to apache.conf using the current Girocco::Config values
   2 ## either do "make" or "make apache.conf" or ./make-apache-conf.sh
   3 ##
   4 # This is an example configuration of a virtualhost running Girocco, as set up
   5 # at repo.or.cz; unfortunately, completely independent from Girocco::Config.
   6 # It is not essential for Girocco to use a special virtualhost, however.
   7 <VirtualHost *:80>
   8
   9 # ---- BEGIN LINES TO DUPLICATE ----
  10
  11         ServerName @@httpdnsname@@
  12         ServerAlias www.@@httpdnsname@@
  13         ServerAdmin @@admin@@
  14
  15         ErrorLog /var/log/apache2/repo-error.log
  16         CustomLog /var/log/apache2/repo-access.log combined
  17
  18         <IfModule mime_magic_module>
  19                 # Avoid spurious Content-Type values when git-http-backend
  20                 # fails to provide a Content-Type header in its output
  21                 MimeMagicFile /dev/null
  22         </IfModule>
  23
  24         AddHandler cgi-script .cgi
  25
  26         DocumentRoot @@webroot@@
  27         <Directory @@webroot@@>
  28                 # Add MultiViews only if pages are truly
  29                 # offered in more than a single language
  30                 Options FollowSymLinks ExecCGI
  31                 AllowOverride All
  32                 Order allow,deny
  33                 Allow from all
  34                 DirectoryIndex gitweb.cgi
  35                 Satisfy all
  36         </Directory>
  37
  38         ScriptAlias /w @@cgiroot@@/gitweb.cgi
  39         ScriptAlias /h @@cgiroot@@/html.cgi
  40
  41         <IfModule rewrite_module>
  42                 RewriteEngine On
  43                 # Redirect bare /w requests without .git that name an existing repo...
  44                 RewriteCond @@reporoot@@/$1.git/HEAD -f
  45                 RewriteRule \
  46                         ^/w/((?:[a-zA-Z0-9+._-]+(?<!\.git)/)*[a-zA-Z0-9+._-]+(?<!\.git))/?$ \
  47                         /w/$1.git [L,R=301]
  48
  49                 # ...and also make the leading /w optional for those types of requests
  50                 RewriteCond %{HTTP_USER_AGENT} !git/ [NC]
  51                 RewriteCond @@reporoot@@/$1.git/HEAD -f
  52                 RewriteRule \
  53                         ^/(?!w/)((?:[a-zA-Z0-9+._-]+(?<!\.git)/)*[a-zA-Z0-9+._-]+(?<!\.git))/?$ \
  54                         /$1.git [L,R=301]
  55
  56                 # Make the leading /w optional if the rest names an existing repo
  57                 RewriteCond %{HTTP_USER_AGENT} !git/ [NC]
  58                 RewriteCond @@reporoot@@/$1/HEAD -f
  59                 # Might want to use [L,R] instead of [PT] maybe even [L,R=301]
  60                 RewriteRule \
  61                         ^/(?!w/)((?:[a-zA-Z0-9+._-]+(?<!\.git)/)*[a-zA-Z0-9+._-]+?\.git)((?:/.*)?)$ \
  62                         /w/$1$2 [PT]
  63         </IfModule>
  64
  65         <Directory @@reporoot@@>
  66                 Options FollowSymLinks
  67                 AllowOverride None
  68                 Order allow,deny
  69                 Allow from all
  70                 Satisfy all
  71
  72                 <IfModule rewrite_module>
  73                         # Everything fetched over the non-smart git http
  74                         # protocol should be an existing file.  If the request
  75                         # is not for an existing file, just send back an error
  76                         # message without emitting anything into the error log.
  77                         RewriteEngine On
  78                         RewriteCond %{REQUEST_FILENAME} !-f
  79                         RewriteRule .* - [R=404,L]
  80                 </IfModule>
  81         </Directory>
  82
  83         <Directory @@basedir@@/bin>
  84                 Options None
  85                 AllowOverride None
  86                 Order deny,allow
  87                 Deny from all
  88                 <Files git-http-backend-verify>
  89                         Options ExecCGI
  90                         Allow from all
  91                 </Files>
  92                 Satisfy all
  93         </Directory>
  94
  95         # By default non-smart HTTP fetch access will be allowed, however
  96         # by defining SmartHTTPOnly (or changing the sense of the IfDefine tests)
  97         # non-smart HTTP requests can be denied directly by the web server
  98
  99         <IfDefine !SmartHTTPOnly>
 100         # These accelerate non-smart HTTP access to loose objects and packs with the /r/ prefix
 101         # But not for projects starting with '_' to which access should never be allowed
 102         AliasMatch ^/r/([^_].*/objects/[0-9a-f]{2}/[0-9a-f]{38})$               @@reporoot@@/$1
 103         AliasMatch ^/r/([^_].*/objects/pack/pack-[0-9a-f]{40}.(pack|idx))$      @@reporoot@@/$1
 104
 105         # These accelerate non-smart HTTP access for Git user agents without the /r/ prefix
 106         # But not for projects starting with '_' to which access should never be allowed
 107         <IfModule rewrite_module>
 108                         RewriteEngine On
 109                         RewriteCond %{HTTP_USER_AGENT} git/ [NC]
 110                         RewriteRule "(?x) ^/((?!r/)[^_].*/objects/(?: \
 111                                 (?:[0-9a-f]{2}/[0-9a-f]{38}) | \
 112                                 (?:pack/pack-[0-9a-f]{40}.(?:pack|idx)) ))$" \
 113                                 @@reporoot@@/$1 [L]
 114         </IfModule>
 115         </IfDefine>
 116
 117         <IfDefine SmartHTTPOnly>
 118         # Disable non-smart HTTP access
 119         RewriteEngine On
 120         RewriteCond %{REQUEST_METHOD} !^POST$
 121         RewriteRule ^/r/.*(?<!/info/refs)$ - [F]
 122         RewriteCond %{REQUEST_URI} !^/authrequired[.]cgi$
 123         RewriteCond %{HTTP_USER_AGENT} git/ [NC]
 124         RewriteCond %{REQUEST_METHOD} !^POST$
 125         RewriteRule ^/(?!r/).*(?<!/info/refs)$ - [F]
 126         RewriteCond %{QUERY_STRING} !(^|&)service=git-(upload|receive)-pack(&|$)
 127         RewriteRule ^/r/.*/info/refs$ - [F]
 128         RewriteCond %{HTTP_USER_AGENT} git/ [NC]
 129         RewriteCond %{QUERY_STRING} !(^|&)service=git-(upload|receive)-pack(&|$)
 130         RewriteRule ^/(?!r/).*/info/refs$ - [F]
 131         </IfDefine>
 132
 133         # SetEnv GIT_HTTP_BACKEND_BIN to override Config.pm $git_http_backend_bin
 134         # git-http-backend-verify denies all access to projects starting with '_'
 135         ScriptAlias /r/ @@basedir@@/bin/git-http-backend-verify/
 136
 137         # This allows HTTP access for Git user agents without the /r/ prefix
 138         <IfModule rewrite_module>
 139                         RewriteEngine On
 140                         RewriteCond %{REQUEST_URI} !^/authrequired[.]cgi$
 141                         RewriteCond %{HTTP_USER_AGENT} git/ [NC]
 142                         RewriteRule ^/(?!r/)(.*)$ \
 143                                 @@basedir@@/bin/git-http-backend-verify/$1 \
 144                                 [L,H=cgi-script]
 145         </IfModule>
 146
 147 # ---- END LINES TO DUPLICATE ----
 148
 149 </VirtualHost>
 150
 151
 152 # This comments out the following so this file can be used as-is
 153 # for an http-only configuration.  Remove or change the sense of
 154 # the test (by inserting a !) to activate the https virtual host.
 155 <IfDefine EnableGiroccoHttpsVirtualHost>
 156
 157
 158 # This is an example configuration of an https virtualhost running Girocco, as set
 159 # up at repo.or.cz; unfortunately, completely independent from Girocco::Config.
 160 # It is not essential for Girocco to use a special virtualhost, however.
 161 # The Config.pm $httpspushurl variable needs to be defined to properly enable
 162 # https pushing.
 163 <VirtualHost *:443>
 164
 165         # These certificate files will all be automatically generated, but the
 166         # paths here may need to be corrected to match the paths
 167         # (especially $certsdir) from Config.pm
 168
 169         SSLCertificateFile @@certsdir@@/girocco_www_crt.pem
 170         SSLCertificateKeyFile @@certsdir@@/girocco_www_key.pem
 171         SSLCertificateChainFile @@certsdir@@/girocco_www_chain.pem
 172         # when using a paid www server cert, only the above three lines should
 173         # be changed.  Changing any of the below two lines (other than updating
 174         # the paths to match $certsdir) will likely break https client auth
 175         SSLCACertificateFile @@certsdir@@/girocco_root_crt.pem
 176         SSLCADNRequestFile @@certsdir@@/girocco_client_crt.pem
 177
 178         SSLVerifyDepth 3
 179         SSLOptions +FakeBasicAuth +StrictRequire
 180         SSLEngine on
 181
 182         # This configuration allows fetching over https without a certificate
 183         # while always requiring a certificate for pushing over https
 184         RewriteEngine On
 185         SSLVerifyClient optional
 186         RewriteCond %{QUERY_STRING} (^|&)service=git-receive-pack(&|$)
 187         RewriteRule ^/r/.*/info/refs$ - [env=client_auth_required:1]
 188         RewriteCond %{HTTP_USER_AGENT} git/ [NC]
 189         RewriteCond %{QUERY_STRING} (^|&)service=git-receive-pack(&|$)
 190         RewriteRule ^/(?!r/).*/info/refs$ - [env=client_auth_required:1]
 191         RewriteRule ^/r/.*/git-receive-pack$ - [env=client_auth_required:1]
 192         RewriteCond %{HTTP_USER_AGENT} git/ [NC]
 193         RewriteRule ^/(?!r/).*/git-receive-pack$ - [env=client_auth_required:1]
 194         RewriteCond %{ENV:client_auth_required} 1
 195         RewriteCond %{SSL:SSL_CLIENT_VERIFY} !^SUCCESS$
 196         RewriteRule .* %{REQUEST_URI} [R=401]
 197         <Location />
 198                 SSLRequireSSL
 199                 Order deny,allow
 200                 Deny from env=client_auth_required
 201                 SSLOptions +FakeBasicAuth
 202                 AuthName "Git Client Authentication"
 203                 AuthType Basic
 204                 AuthBasicProvider anon
 205                 Anonymous *
 206                 Require valid-user
 207                 Satisfy any
 208         </Location>
 209         ErrorDocument 401 /authrequired.cgi
 210
 211         # *** IMPORTANT ***
 212         #
 213         # ALL the entire contents from the <VirtualHost *:80> section at
 214         # the top of this file must be copied here.
 215         #
 216         # To avoid this duplication, the contents of the <VirtualHost *:80>
 217         # section above can be moved to a separate file and then included
 218         # both here and in the <VirtualHost *:80> section using an Include
 219         # directive.  Be careful not to place the new include file in one of the
 220         # directories the standard apache configuration blindly includes all
 221         # files from.
 222
 223 # ---- BEGIN DUPLICATE LINES ----
 224
 225 # ---- END DUPLICATE LINES ----
 226
 227 </VirtualHost>
 228
 229
 230 # End commenting
 231 </IfDefine>