###############################################################################
# Default lighttpd.conf for Gentoo.
# $Header: /var/www/glossary.chroot/etc/lighttpd/RCS/lighttpd.conf,v 1.3 2007/05
/22 19:19:34 root Exp root $
###############################################################################

# {{{ variables
        var.basedir  = "/var/www/glossary.pgp.com"
                var.logdir   = "/var/log/lighttpd"
                var.statedir = "/var/lib/lighttpd"
# }}}

# {{{ modules
# At the very least, mod_access and mod_accesslog should be enabled.
# All other modules should only be loaded if necessary.
# NOTE: the order of modules is important.
        server.modules = (
#    "mod_rewrite",
                        "mod_redirect",
#    "mod_alias",
                        "mod_access",
#    "mod_cml",
#    "mod_trigger_b4_dl",
#    "mod_auth",
#    "mod_status",
#    "mod_setenv",
#    "mod_proxy",
#    "mod_simple_vhost",
#    "mod_evhost",
#    "mod_userdir",
#    "mod_compress",
#    "mod_ssi",
#    "mod_usertrack",
#    "mod_expire",
#    "mod_secdownload",
#    "mod_rrdtool",
#    "mod_webdav",
                "mod_accesslog"
                        )
# }}}

# {{{ includes
        include "mime-types.conf"
# uncomment for cgi support
                include "mod_cgi.conf"
# }}}

# {{{ server settings
        server.username      = "lighttpd"
                server.groupname     = "lighttpd"

                server.document-root = var.basedir + "/twiki"
                server.pid-file      = "/var/run/lighttpd.pid"

                server.errorlog      = var.logdir  + "/error.log"
# log errors to syslog instead
#   server.errorlog-use-syslog = "enable"

#server.indexfiles    = ("index.html")


#redirect EVERYTHING to SSL...


$SERVER["socket"] == ":443" {
        protocol = "https://"

        # Provide ssl
        ssl.engine = "enable"
        ssl.pemfile = "/etc/lighttpd/glossary.pgp.com.pem"

}
else  $HTTP["host"] =~ "(.*)" {
    url.redirect = ( "^/(.*)" => "https://%1/$1" )
}

                server.tag           = "lighttpd"

                server.follow-symlink = "enable"

# event handler (defaults to "poll")
# see performance.txt
#
# for >= linux-2.4
#   server.event-handler = "linux-rtsig"
# for >= linux-2.6
#   server.event-handler = "linux-sysepoll"
# for FreeBSD
#   server.event-handler = "freebsd-kqueue"

# chroot to directory (defaults to no chroot)
# server.chroot      = "/"

# bind to port (defaults to 80)/
# server.port          = 81

# bind to name (defaults to all interfaces)
# server.bind          = "grisu.home.kneschke.de"

# error-handler for status 404
                server.error-handler-404 = "/bin/view.cgi"
# server.error-handler-404 = "/error-handler.php"

# Format: <errorfile-prefix><status-code>.html
# -> ..../status-404.html for 'File not found'
                server.errorfile-prefix    = var.basedir + "/error/status-"

# FAM support for caching stat() calls
# requires that lighttpd be built with USE=fam
#   server.stat-cache-engine = "fam"
# }}}

# {{{ BrowserMatch Statements These match on user agent and deny all access on a
 case insensitive match.

        $HTTP["useragent"] =~ "(?i)(Acoona|ActiveAgent|Attache|BecomeBot|bot|Cha
rlotte/|ConveraCrawler|CrownPeak-HttpAgent|EmailCollector|EmailSiphon|e-SocietyR
obot|Exabot|FAST|FDM|GetRight/6.0a|GetWebPics|Gigabot|gonzo1|Google\sSpider|ichi
ro|ie_crawler|iGetter|IRLbot|Jakarta|Java|KrakSpider|larbin|LeechGet|LinkWalker|
Lsearch|Microsoft|MJ12bot|MSIECrawler|MSRBOT|noxtrumbot|NutchCVS|RealDownload|Ro
me|Roverbot|schibstedsokbot|Seekbot|SiteSnagger|SiteSucker|Snapbot|sogou|SpiderK
U|SpiderMan|Squid|Teleport|User-Agent\:|VoilaBot|voyager|W3C|w3search|Web\sDownl
oader|WebCopier|WebDevil|WebSec|WebVac|Webwhacker|Webzip|Wells|WhoWhere|www\.net
forex\.org|WX_mail|yacybot|ZIBB|^$)" {
                url.access-deny = ( "" )
        }


# }}}

# {{{ mod_staticfile

# which extensions should not be handled via static-file transfer
# (extensions that are usually handled by mod_cgi, mod_fastcgi, etc).
        static-file.exclude-extensions = (".cgi")
# }}}

# {{{ mod_accesslog
        accesslog.filename   = var.logdir + "/access.log"
# }}}

# {{{ mod_dirlisting
# enable directory listings
        dir-listing.activate      = "disable"
        dir-listing.exclude = (".*.")
# }}}

# {{{ mod_access
# see access.txt

# used to protect all files of a certain type (redundant to a great degree)

        url.access-deny = ("*.cfg", "configure.cgi", "~", ".inc", ".ht*", "^/tem
p.*", "^/data*")


# used to forbid access to sub dirs of twiki.

$HTTP["url"] =~ "^(/data)|(/lib)|(/templates)|(/locale)|(/tools)" {
        url.access-deny = ("")
}

# if you are trying to access things in the pub directory FAIL if you are not re
ferred by glossary.pgp.com

$HTTP["referer"] !~ "^(?i)(.*glossary\.pgp\.com.*)" {
        $HTTP["url"] =~ "/pub/" {
                url.access-deny = ( "" )
        }
}







# }}}

# {{{ mod_ssl
# see ssl.txt
#
#       ssl.engine    = "enable"
#               ssl.pemfile   = "/etc/lighttpd/glossary.pgp.com.pem"
# }}}

# {{{ mod_status
# see status.txt
#
# status.status-url  = "/server-status"
# status.config-url  = "/server-config"
# }}}

# {{{ mod_compress
# see compress.txt
#
# compress.cache-dir   = var.statedir + "/cache/compress"
# compress.filetype    = ("text/plain", "text/html")
# }}}

# {{{ mod_auth
# see authentication.txt
#
#auth.backend               = "plain"
#auth.backend.plain.userfile = "lighttpd.user"
#auth.backend.plain.groupfile = "lighttpd.group"
#
# auth.backend.ldap.hostname = "localhost"
# auth.backend.ldap.base-dn  = "dc=my-domain,dc=com"
# auth.backend.ldap.filter   = "(uid=$)"

#auth.require           =       ( "/var/www/glossary.pgp.com/twiki/pub" =>
#                                (
#                                 "method" => "digest",
#                                 "realm"  => "Enter your WikiName: (First name
and last name, no space, no dots, capitalized, e.g. JohnSmith). Cancel to regist
er if you do not have one.",
#                                 "require" => "user=BuildUser"
#                                )
#                               )
#
#
# }}}

# {{{ mod_rewrite
# see rewrite.txt
#
# url.rewrite = (
#       "^/$"           =>              "/bin/view.cgi/TWiki/Webhome"
#)
# }}}

# {{{ mod_redirect
# see redirect.txt

        url.redirect = (
                        "^/$"   => "http://glossary.pgp.com/bin/view.cgi",
#"^/temp*" => "http://glossary.pgp.com/bin/view.cgi",
#"^/dat*" => "http://glossary.pgp.com/bin/view.cgi",
#"^/lib*" => "http://glossary.pgp.com/bin/view.cgi",
#"^/loc*" => "http://glossary.pgp.com/bin/view.cgi",
#"^/pub*" => "http://glossary.pgp.com/bin/view.cgi",
#"^/too*" => "http://glossary.pgp.com/bin/view.cgi"
                       )



# url.redirect = (
#       "^/wishlist/(.+)"               =>              "http://www.123.org/$1"
# )
# }}}


# {{{ mod_expire
# expire.url = (
#       "/buggy/"               =>              "access 2 hours",
#       "/asdhas/"              =>              "access plus 1 seconds 2 minutes
"
# )
# }}}

# {{{ mod_rrdtool
# see rrdtool.txt
#
# rrdtool.binary  = "/usr/bin/rrdtool"
# rrdtool.db-name = var.statedir + "/lighttpd.rrd"
# }}}

# {{{ mod_setenv
# see setenv.txt
#
# setenv.add-request-header  = ( "TRAV_ENV" => "mysql://user@host/db" )
# setenv.add-response-header = ( "X-Secret-Message" => "42" )
# }}}

# {{{ extra rules
#
# set Content-Encoding and reset Content-Type for browsers that
# support decompressing on-thy-fly (requires mod_setenv)
# $HTTP["url"] =~ "\.gz$" {
#     setenv.add-response-header = ("Content-Encoding" => "x-gzip")
#     mimetype.assign = (".gz" => "text/plain")
# }

# $HTTP["url"] =~ "\.bz2$" {
#     setenv.add-response-header = ("Content-Encoding" => "x-bzip2")
#     mimetype.assign = (".bz2" => "text/plain")
# }
#
# }}}

# {{{ debug
        debug.log-request-header   = "enable"
                debug.log-response-header  = "enable"
                debug.log-request-handling = "enable"
                debug.log-file-not-found   = "enable"
# }}}

# vim: set ft=conf foldmethod=marker et :