1 ## To convert this file to apache.conf using the current Girocco::Config values
2 ## either do "make" or "make apache.conf" or ./make-apache-conf.sh
4 # This is an example configuration of a virtualhost running Girocco, as set up
5 # at repo.or.cz; unfortunately, completely independent from Girocco::Config.
6 # It is not essential for Girocco to use a special virtualhost, however.
9 ServerName @@httpdnsname@@
10 ServerAlias www.@@httpdnsname@@
13 ErrorLog /var/log/apache2/repo-error.log
14 CustomLog /var/log/apache2/repo-access.log combined
16 AddHandler cgi-script .cgi
18 DocumentRoot @@webroot@@
19 <Directory @@webroot@@>
20 # Add MultiViews only if pages are truly
21 # offered in more than a single language
22 Options FollowSymLinks ExecCGI
26 DirectoryIndex gitweb.cgi
30 ScriptAlias /w @@cgiroot@@/gitweb.cgi
31 ScriptAlias /h @@cgiroot@@/html.cgi
33 <IfModule rewrite_module>
35 # Redirect bare /w requests without .git that name an existing repo...
36 RewriteCond @@reporoot@@/$1.git/HEAD -f
38 ^/w/((?:[a-zA-Z0-9+._-]+(?<!\.git)/)*[a-zA-Z0-9+._-]+(?<!\.git))/?$ \
41 # ...and also make the leading /w optional for those types of requests
42 RewriteCond %{HTTP_USER_AGENT} !git/ [NC]
43 RewriteCond @@reporoot@@/$1.git/HEAD -f
45 ^/(?!w/)((?:[a-zA-Z0-9+._-]+(?<!\.git)/)*[a-zA-Z0-9+._-]+(?<!\.git))/?$ \
48 # Make the leading /w optional if the rest names an existing repo
49 RewriteCond %{HTTP_USER_AGENT} !git/ [NC]
50 RewriteCond @@reporoot@@/$1/HEAD -f
51 # Might want to use [L,R] instead of [PT] maybe even [L,R=301]
53 ^/(?!w/)((?:[a-zA-Z0-9+._-]+(?<!\.git)/)*[a-zA-Z0-9+._-]+?\.git)((?:/.*)?)$ \
57 <Directory @@reporoot@@>
58 Options FollowSymLinks
64 <IfModule rewrite_module>
65 # Everything fetched over the non-smart git http
66 # protocol should be an existing file. If the request
67 # is not for an existing file, just send back an error
68 # message without emitting anything into the error log.
70 RewriteCond %{REQUEST_FILENAME} !-f
71 RewriteRule .* - [R=404,L]
75 <Directory @@basedir@@/bin>
80 <Files git-http-backend-verify>
87 SetEnv GIT_HTTP_EXPORT_ALL 1
89 # By default non-smart HTTP fetch access will be allowed, however
90 # by defining SmartHTTPOnly (or changing the sense of the IfDefine tests)
91 # non-smart HTTP requests can be denied directly by the web server
93 <IfDefine !SmartHTTPOnly>
94 # These accelerate non-smart HTTP access to loose objects and packs with the /r/ prefix
95 # But not for projects starting with '_' to which access should never be allowed
96 AliasMatch ^/r/([^_].*/objects/[0-9a-f]{2}/[0-9a-f]{38})$ @@reporoot@@/$1
97 AliasMatch ^/r/([^_].*/objects/pack/pack-[0-9a-f]{40}.(pack|idx))$ @@reporoot@@/$1
99 # These accelerate non-smart HTTP access for Git user agents without the /r/ prefix
100 # But not for projects starting with '_' to which access should never be allowed
101 <IfModule rewrite_module>
103 RewriteCond %{HTTP_USER_AGENT} git/ [NC]
104 RewriteRule "(?x) ^/((?!r/)[^_].*/objects/(?: \
105 (?:[0-9a-f]{2}/[0-9a-f]{38}) | \
106 (?:pack/pack-[0-9a-f]{40}.(?:pack|idx)) ))$" \
111 <IfDefine SmartHTTPOnly>
112 # Disable non-smart HTTP access
114 RewriteCond %{REQUEST_METHOD} !^POST$
115 RewriteRule ^/r/.*(?<!/info/refs)$ - [F]
116 RewriteCond %{REQUEST_URI} !^/authrequired[.]cgi$
117 RewriteCond %{HTTP_USER_AGENT} git/ [NC]
118 RewriteCond %{REQUEST_METHOD} !^POST$
119 RewriteRule ^/(?!r/).*(?<!/info/refs)$ - [F]
120 RewriteCond %{QUERY_STRING} !(^|&)service=git-(upload|receive)-pack(&|$)
121 RewriteRule ^/r/.*/info/refs$ - [F]
122 RewriteCond %{HTTP_USER_AGENT} git/ [NC]
123 RewriteCond %{QUERY_STRING} !(^|&)service=git-(upload|receive)-pack(&|$)
124 RewriteRule ^/(?!r/).*/info/refs$ - [F]
127 # SetEnv GIT_HTTP_BACKEND_BIN to override Config.pm $git_http_backend_bin
128 # git-http-backend-verify denies all access to projects starting with '_'
129 ScriptAlias /r/ @@basedir@@/bin/git-http-backend-verify/
131 # This allows HTTP access for Git user agents without the /r/ prefix
132 <IfModule rewrite_module>
134 RewriteCond %{REQUEST_URI} !^/authrequired[.]cgi$
135 RewriteCond %{HTTP_USER_AGENT} git/ [NC]
136 RewriteRule ^/(?!r/)(.*)$ \
137 @@basedir@@/bin/git-http-backend-verify/$1 \
143 # This comments out the following so this file can be used as-is
144 <IfDefine DummyThatIsNotDefined>
147 # This is an example configuration of an https virtualhost running Girocco, as set
148 # up at repo.or.cz; unfortunately, completely independent from Girocco::Config.
149 # It is not essential for Girocco to use a special virtualhost, however.
150 # The Config.pm $httpspushurl variable needs to be defined to properly enable
154 # These certificate files will all be automatically generated, but the
155 # paths here may need to be corrected to match the paths
156 # (especially $certsdir) from Config.pm
158 SSLCertificateFile @@certsdir@@/girocco_www_crt.pem
159 SSLCertificateKeyFile @@certsdir@@/girocco_www_key.pem
160 SSLCertificateChainFile @@certsdir@@/girocco_www_chain.pem
161 # when using a paid www server cert, only the above three lines should
162 # be changed. Changing any of the below two lines (other than updating
163 # the paths to match $certsdir) will likely break https client auth
164 SSLCACertificateFile @@certsdir@@/girocco_root_crt.pem
165 SSLCADNRequestFile @@certsdir@@/girocco_client_crt.pem
168 SSLOptions +FakeBasicAuth +StrictRequire
171 # This configuration allows fetching over https without a certificate
172 # while always requiring a certificate for pushing over https
174 SSLVerifyClient optional
175 RewriteCond %{QUERY_STRING} (^|&)service=git-receive-pack(&|$)
176 RewriteRule ^/r/.*/info/refs$ - [env=client_auth_required:1]
177 RewriteCond %{HTTP_USER_AGENT} git/ [NC]
178 RewriteCond %{QUERY_STRING} (^|&)service=git-receive-pack(&|$)
179 RewriteRule ^/(?!r/).*/info/refs$ - [env=client_auth_required:1]
180 RewriteRule ^/r/.*/git-receive-pack$ - [env=client_auth_required:1]
181 RewriteCond %{HTTP_USER_AGENT} git/ [NC]
182 RewriteRule ^/(?!r/).*/git-receive-pack$ - [env=client_auth_required:1]
183 RewriteCond %{ENV:client_auth_required} 1
184 RewriteCond %{SSL:SSL_CLIENT_VERIFY} !^SUCCESS$
185 RewriteRule .* %{REQUEST_URI} [R=401]
189 Deny from env=client_auth_required
190 SSLOptions +FakeBasicAuth
191 AuthName "Git Client Authentication"
193 AuthBasicProvider anon
198 ErrorDocument 401 /authrequired.cgi
202 # ALL the entire contents from the <VirtualHost *:80> section at
203 # the top of this file must be copied here.
205 # To avoid this duplication, the contents of the <VirtualHost *:80>
206 # section above can be moved to a separate file and then included
207 # both here and in the <VirtualHost *:80> section using an Include
208 # directive. Be careful not to place the new include file in one of the
209 # directories the standard apache configuration blindly includes all