Blame


1 207dc0f9 2021-01-02 op .\" Copyright (c) 2021, 2022 Omar Polo <op@omarpolo.com>
2 3e4749f7 2020-10-02 op .\"
3 3e4749f7 2020-10-02 op .\" Permission to use, copy, modify, and distribute this software for any
4 3e4749f7 2020-10-02 op .\" purpose with or without fee is hereby granted, provided that the above
5 3e4749f7 2020-10-02 op .\" copyright notice and this permission notice appear in all copies.
6 3e4749f7 2020-10-02 op .\"
7 3e4749f7 2020-10-02 op .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 3e4749f7 2020-10-02 op .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 3e4749f7 2020-10-02 op .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
10 3e4749f7 2020-10-02 op .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 3e4749f7 2020-10-02 op .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
12 3e4749f7 2020-10-02 op .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
13 3e4749f7 2020-10-02 op .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
14 207dc0f9 2021-01-02 op .Dd $Mdocdate: January 02 2022$
15 3f47867e 2021-04-16 op .Dt GMID 1
16 3e4749f7 2020-10-02 op .Os
17 3e4749f7 2020-10-02 op .Sh NAME
18 3e4749f7 2020-10-02 op .Nm gmid
19 714685c1 2021-01-30 op .Nd simple and secure Gemini server
20 3e4749f7 2020-10-02 op .Sh SYNOPSIS
21 3e4749f7 2020-10-02 op .Nm
22 3e4749f7 2020-10-02 op .Bk -words
23 38d4db74 2021-02-04 op .Op Fl fnv
24 15902770 2021-01-15 op .Op Fl c Ar config
25 8b743dda 2021-06-29 op .Op Fl D Ar macro Ns = Ns Ar value
26 8e8b2e25 2021-04-28 op .Op Fl P Ar pidfile
27 38d4db74 2021-02-04 op .Ek
28 38d4db74 2021-02-04 op .Nm
29 38d4db74 2021-02-04 op .Bk -words
30 ba65dcc8 2021-06-29 op .Op Fl 6hVv
31 14cee926 2022-01-04 op .Op Fl d Ar certs-dir
32 f28d96d3 2021-01-25 op .Op Fl H Ar hostname
33 721e2325 2020-11-18 op .Op Fl p Ar port
34 14cee926 2022-01-04 op .Op Fl x Ar cgi
35 14cee926 2022-01-04 op .Op Ar dir
36 3e4749f7 2020-10-02 op .Ek
37 3e4749f7 2020-10-02 op .Sh DESCRIPTION
38 3e4749f7 2020-10-02 op .Nm
39 8ff40039 2021-05-24 op is a simple and minimal gemini server that can serve static files,
40 8ff40039 2021-05-24 op execute CGI scripts and talk to FastCGI applications.
41 eb699783 2021-01-18 op It can run without a configuration file with a limited set of features
42 eb699783 2021-01-18 op available.
43 3007f565 2021-02-04 op .Pp
44 3007f565 2021-02-04 op .Nm
45 3007f565 2021-02-04 op rereads the configuration file when it receives
46 3007f565 2021-02-04 op .Dv SIGHUP .
47 3e4749f7 2020-10-02 op .Pp
48 eb699783 2021-01-18 op The options are as follows:
49 f28d96d3 2021-01-25 op .Bl -tag -width 14m
50 14cee926 2022-01-04 op .It Fl c Ar config
51 f28d96d3 2021-01-25 op Specify the configuration file.
52 8b743dda 2021-06-29 op .It Fl D Ar macro Ns = Ns Ar value
53 8b743dda 2021-06-29 op Define
54 8b743dda 2021-06-29 op .Ar macro
55 8b743dda 2021-06-29 op to be set to
56 8b743dda 2021-06-29 op .Ar value
57 8b743dda 2021-06-29 op on the command line.
58 8b743dda 2021-06-29 op Overrides the definition of
59 8b743dda 2021-06-29 op .Ar macro
60 8b743dda 2021-06-29 op in the config file if present.
61 46af8c6c 2021-01-27 op .It Fl f
62 46af8c6c 2021-01-27 op Stays and logs on the foreground.
63 eb699783 2021-01-18 op .It Fl n
64 eb699783 2021-01-18 op Check that the configuration is valid, but don't start the server.
65 f0a01fc7 2021-10-09 op If specified two or more time, dump the configuration in addition to
66 f0a01fc7 2021-10-09 op verify it.
67 14cee926 2022-01-04 op .It Fl P Ar pidfile
68 301e039d 2021-07-29 op Write daemon's pid to the given location.
69 2b520ad5 2021-07-09 op .Ar pidfile
70 2b520ad5 2021-07-09 op will also act as lock: if another process is holding a lock on that
71 2b520ad5 2021-07-09 op file,
72 8e8b2e25 2021-04-28 op .Nm
73 2b520ad5 2021-07-09 op will refuse to start.
74 eb699783 2021-01-18 op .El
75 3e4749f7 2020-10-02 op .Pp
76 eb699783 2021-01-18 op If no configuration file is given,
77 fab952e1 2020-10-03 op .Nm
78 ebf3373d 2021-12-02 op runs in
79 ebf3373d 2021-12-02 op .Dq config-less mode
80 ebf3373d 2021-12-02 op .Pq i.e. runs in the foreground to serve a directory from the shell
81 ebf3373d 2021-12-02 op and looks for the following options
82 f28d96d3 2021-01-25 op .Bl -tag -width 14m
83 85dff1f9 2021-01-11 op .It Fl 6
84 85dff1f9 2021-01-11 op Enable IPv6.
85 14cee926 2022-01-04 op .It Fl d Ar certs-path
86 f28d96d3 2021-01-25 op Directory where certificates for the config-less mode are stored.
87 301e039d 2021-07-29 op By default it is
88 f28d96d3 2021-01-25 op .Pa $XDG_DATA_HOME/gmid ,
89 f28d96d3 2021-01-25 op i.e.
90 f28d96d3 2021-01-25 op .Pa ~/.local/share/gmid .
91 71cf3975 2021-01-25 op .It Fl H Ar hostname
92 2b520ad5 2021-07-09 op The hostname
93 301e039d 2021-07-29 op .Po
94 2b520ad5 2021-07-09 op .Ar localhost
95 301e039d 2021-07-29 op by default
96 301e039d 2021-07-29 op .Pc .
97 f28d96d3 2021-01-25 op Certificates for the given
98 f28d96d3 2021-01-25 op .Ar hostname
99 f28d96d3 2021-01-25 op are searched inside the
100 14cee926 2022-01-04 op .Ar certs-dir
101 f28d96d3 2021-01-25 op directory given with the
102 f28d96d3 2021-01-25 op .Fl d
103 f28d96d3 2021-01-25 op option.
104 714685c1 2021-01-30 op They have the form
105 f28d96d3 2021-01-25 op .Pa hostname.cert.pem
106 f28d96d3 2021-01-25 op and
107 f28d96d3 2021-01-25 op .Pa hostname.key.pem .
108 301e039d 2021-07-29 op If a certificate or a key doesn't exist for a given hostname, they
109 301e039d 2021-07-29 op will be generated automatically.
110 ba65dcc8 2021-06-29 op .It Fl h , Fl -help
111 fab952e1 2020-10-03 op Print the usage and exit.
112 721e2325 2020-11-18 op .It Fl p Ar port
113 eb699783 2021-01-18 op The port to listen on, by default 1965.
114 ba65dcc8 2021-06-29 op .It Fl V , Fl -version
115 ba65dcc8 2021-06-29 op Print the version and exit.
116 8904fa0e 2021-01-27 op .It Fl v
117 3abf91b0 2021-02-07 op Verbose mode.
118 3abf91b0 2021-02-07 op Multiple
119 3abf91b0 2021-02-07 op .Fl v
120 3abf91b0 2021-02-07 op options increase the verbosity.
121 14cee926 2022-01-04 op .It Fl x Ar path
122 301e039d 2021-07-29 op Enable execution of
123 301e039d 2021-07-29 op .Sx CGI
124 301e039d 2021-07-29 op scripts.
125 eb699783 2021-01-18 op See the description of the
126 eb699783 2021-01-18 op .Ic cgi
127 301e039d 2021-07-29 op option in the
128 eb699783 2021-01-18 op .Sq Servers
129 301e039d 2021-07-29 op section below to learn how
130 14cee926 2022-01-04 op .Ar path
131 eb699783 2021-01-18 op is processed.
132 eb699783 2021-01-18 op Cannot be provided more than once.
133 14cee926 2022-01-04 op .It Ar dir
134 f28d96d3 2021-01-25 op The root directory to serve.
135 f28d96d3 2021-01-25 op By default the current working directory is assumed.
136 3e4749f7 2020-10-02 op .El
137 eb699783 2021-01-18 op .Sh CONFIGURATION FILE
138 8b743dda 2021-06-29 op The configuration file is divided into three sections:
139 eb699783 2021-01-18 op .Bl -tag -width xxxx
140 8b743dda 2021-06-29 op .It Sy Macros
141 8b743dda 2021-06-29 op User-defined variables may be defined and used later, simplifying the
142 8b743dda 2021-06-29 op configuration file.
143 eb699783 2021-01-18 op .It Sy Global Options
144 eb699783 2021-01-18 op Global settings for
145 eb699783 2021-01-18 op .Nm .
146 eb699783 2021-01-18 op .It Sy Servers
147 f28d96d3 2021-01-25 op Virtual hosts definition.
148 eb699783 2021-01-18 op .El
149 eb699783 2021-01-18 op .Pp
150 eb699783 2021-01-18 op Within the sections, empty lines are ignored and comments can be put
151 eb699783 2021-01-18 op anywhere in the file using a hash mark
152 eb699783 2021-01-18 op .Pq Sq # ,
153 eb699783 2021-01-18 op and extend to the end of the current line.
154 eb699783 2021-01-18 op A boolean is either the symbol
155 eb699783 2021-01-18 op .Sq on
156 eb699783 2021-01-18 op or
157 eb699783 2021-01-18 op .Sq off .
158 f28d96d3 2021-01-25 op A string is a sequence of characters wrapped in double quotes,
159 f28d96d3 2021-01-25 op .Dq like this .
160 eaf7f776 2021-06-29 op Multiple strings one next to the other are joined into a single
161 eaf7f776 2021-06-29 op string:
162 eaf7f776 2021-06-29 op .Bd -literal -offset indent
163 eaf7f776 2021-06-29 op # equivalent to "temporary-failure"
164 eaf7f776 2021-06-29 op block return 40 "temporary" "-" "failure"
165 eaf7f776 2021-06-29 op .Ed
166 8b743dda 2021-06-29 op .Pp
167 2b520ad5 2021-07-09 op Furthermore, quoting is necessary only when a string needs to contain
168 528f37cd 2021-07-09 op special characters
169 528f37cd 2021-07-09 op .Pq like spaces or punctuation ,
170 528f37cd 2021-07-09 op something that looks like a number or a reserved keyword.
171 2b520ad5 2021-07-09 op The last example could have been written also as:
172 2b520ad5 2021-07-09 op .Bd -literal -offset indent
173 2b520ad5 2021-07-09 op block return 40 temporary "-" failure
174 2b520ad5 2021-07-09 op .Ed
175 2b520ad5 2021-07-09 op .Pp
176 8b743dda 2021-06-29 op Strict ordering of the sections is not enforced, so that is possible
177 8b743dda 2021-06-29 op to mix macros, options and
178 8b743dda 2021-06-29 op .Ic server
179 8b743dda 2021-06-29 op blocks.
180 8b743dda 2021-06-29 op However, defining all the
181 8b743dda 2021-06-29 op .Ic server
182 8b743dda 2021-06-29 op blocks after the macros and the global options is recommended.
183 528f37cd 2021-07-09 op .Pp
184 528f37cd 2021-07-09 op Newlines are often optional, except around top-level instructions, and
185 528f37cd 2021-07-09 op semicolons
186 528f37cd 2021-07-09 op .Dq \&;
187 528f37cd 2021-07-09 op can also be optionally used to separate options.
188 528f37cd 2021-07-09 op .Pp
189 528f37cd 2021-07-09 op Additional configuration files can be included with the
190 528f37cd 2021-07-09 op .Ic include
191 528f37cd 2021-07-09 op keyword, for example:
192 528f37cd 2021-07-09 op .Bd -literal -offset indent
193 528f37cd 2021-07-09 op include "/etc/gmid.conf.local"
194 528f37cd 2021-07-09 op .Ed
195 8b743dda 2021-06-29 op .Ss Macros
196 8b743dda 2021-06-29 op Macros can be defined that will later be expanded in context.
197 8b743dda 2021-06-29 op Macro names must start with a letter, digit or underscore and may
198 8b743dda 2021-06-29 op contain any of those characters.
199 4f9a2760 2021-07-02 op Macros names may not be reserved words.
200 bfb076ed 2021-06-29 op Macros are not expanded inside quotes.
201 528f37cd 2021-07-09 op .Pp
202 528f37cd 2021-07-09 op Two kinds of macros are supported: variable-like and proper macros.
203 528f37cd 2021-07-09 op When a macro is invoked with a
204 528f37cd 2021-07-09 op .Dq $
205 528f37cd 2021-07-09 op before its name its expanded as a string, whereas when it's invoked
206 528f37cd 2021-07-09 op with a
207 528f37cd 2021-07-09 op .Dq @
208 528f37cd 2021-07-09 op its expanded in-place.
209 8b743dda 2021-06-29 op .Pp
210 8b743dda 2021-06-29 op For example:
211 8b743dda 2021-06-29 op .Bd -literal -offset indent
212 8b743dda 2021-06-29 op dir = "/var/gemini"
213 2d06ae62 2021-07-11 op certdir = "/etc/keys"
214 528f37cd 2021-07-09 op common = "lang it; auto index on"
215 8b743dda 2021-06-29 op
216 8b743dda 2021-06-29 op server "foo" {
217 ad15003b 2021-07-11 op root $dir "/foo" # -> /var/gemini/foo
218 2d06ae62 2021-07-11 op cert $certdir "/foo.crt" # -> /etc/keys/foo.crt
219 2d06ae62 2021-07-11 op key $certdir "/foo.pem" # -> /etc/keys/foo.pem
220 528f37cd 2021-07-09 op @common
221 8b743dda 2021-06-29 op }
222 8b743dda 2021-06-29 op .Ed
223 eb699783 2021-01-18 op .Ss Global Options
224 eb699783 2021-01-18 op .Bl -tag -width 12m
225 14cee926 2022-01-04 op .It Ic chroot Ar path
226 ae08ec7d 2021-01-25 op .Xr chroot 2
227 ae08ec7d 2021-01-25 op the process to the given
228 14cee926 2022-01-04 op .Ar path .
229 ae08ec7d 2021-01-25 op The daemon has to be run with root privileges and thus the option
230 ae08ec7d 2021-01-25 op .Ic user
231 714685c1 2021-01-30 op needs to be provided, so privileges can be dropped.
232 714685c1 2021-01-30 op Note that
233 ae08ec7d 2021-01-25 op .Nm
234 714685c1 2021-01-30 op will enter the chroot after loading the TLS keys, but before opening
235 714685c1 2021-01-30 op the virtual host root directories.
236 714685c1 2021-01-30 op It's recommended to keep the TLS keys outside the chroot.
237 ae08ec7d 2021-01-25 op Future version of
238 ae08ec7d 2021-01-25 op .Nm
239 1de92289 2021-04-15 op may enforce this.
240 2b92a447 2021-02-06 op .It Ic ipv6 Ar bool
241 2b520ad5 2021-07-09 op Enable or disable IPv6 support, off by default.
242 d19951cf 2021-07-09 op .It Ic map Ar mime-type Cm to-ext Ar file-extension
243 2b520ad5 2021-07-09 op Map
244 2b520ad5 2021-07-09 op .Ar mime-type
245 2b92a447 2021-02-06 op to the given
246 2b520ad5 2021-07-09 op .Ar file-extension .
247 2b92a447 2021-02-06 op Both argument are strings.
248 2b92a447 2021-02-06 op .It Ic port Ar portno
249 2b92a447 2021-02-06 op The port to listen on.
250 2b520ad5 2021-07-09 op 1965 by default.
251 a709ddf5 2021-02-07 op .It Ic prefork Ar number
252 a709ddf5 2021-02-07 op Run the specified number of server processes.
253 a709ddf5 2021-02-07 op This increases the performance and prevents delays when connecting to
254 a709ddf5 2021-02-07 op a server.
255 2b520ad5 2021-07-09 op When not in config-less mode,
256 a709ddf5 2021-02-07 op .Nm
257 2b520ad5 2021-07-09 op runs 3 server processes by default.
258 2c3e53da 2021-03-03 op The maximum number allowed is 16.
259 2b92a447 2021-02-06 op .It Ic protocols Ar string
260 2b92a447 2021-02-06 op Specify the TLS protocols to enable.
261 2b92a447 2021-02-06 op Refer to
262 2b92a447 2021-02-06 op .Xr tls_config_parse_protocols 3
263 2b92a447 2021-02-06 op for the valid protocol string values.
264 2b92a447 2021-02-06 op By default, both TLSv1.3 and TLSv1.2 are enabled.
265 2b92a447 2021-02-06 op Use
266 2b92a447 2021-02-06 op .Dq tlsv1.3
267 2b92a447 2021-02-06 op to enable only TLSv1.3.
268 ae08ec7d 2021-01-25 op .It Ic user Ar string
269 ae08ec7d 2021-01-25 op Run the daemon as the given user.
270 eb699783 2021-01-18 op .El
271 eb699783 2021-01-18 op .Ss Servers
272 eb699783 2021-01-18 op Every virtual host is defined by a
273 eb699783 2021-01-18 op .Ic server
274 eb699783 2021-01-18 op block:
275 eb699783 2021-01-18 op .Bl -tag -width Ds
276 eb699783 2021-01-18 op .It Ic server Ar hostname Brq ...
277 75fbb178 2021-01-28 op Match the server name using shell globbing rules.
278 2b520ad5 2021-07-09 op It can be an explicit name,
279 de27389e 2021-01-21 op .Ar www.example.com ,
280 de27389e 2021-01-21 op or a name including a wildcards,
281 de27389e 2021-01-21 op .Ar *.example.com .
282 eb699783 2021-01-18 op .El
283 eb699783 2021-01-18 op .Pp
284 eb699783 2021-01-18 op Followed by a block of options that is enclosed in curly brackets:
285 eb699783 2021-01-18 op .Bl -tag -width Ds
286 cc8c2901 2021-04-29 op .It Ic alias Ar name
287 cc8c2901 2021-04-29 op Specify an additional alias
288 cc8c2901 2021-04-29 op .Ar name
289 cc8c2901 2021-04-29 op for this server.
290 2b92a447 2021-02-06 op .It Ic auto Ic index Ar bool
291 2b92a447 2021-02-06 op If no index file is found, automatically generate a directory listing.
292 2b520ad5 2021-07-09 op Disabled by default.
293 2b92a447 2021-02-06 op .It Ic block Op Ic return Ar code Op Ar meta
294 2b92a447 2021-02-06 op Send a reply and close the connection;
295 2b520ad5 2021-07-09 op by default
296 2b92a447 2021-02-06 op .Ar code
297 2b92a447 2021-02-06 op is 40
298 2b92a447 2021-02-06 op and
299 2b92a447 2021-02-06 op .Ar meta
300 2b92a447 2021-02-06 op is
301 2b520ad5 2021-07-09 op .Dq temporary failure .
302 2b92a447 2021-02-06 op If
303 2b92a447 2021-02-06 op .Ar code
304 2b92a447 2021-02-06 op is in the 3x range, then
305 2b92a447 2021-02-06 op .Ar meta
306 2b520ad5 2021-07-09 op is mandatory.
307 2b92a447 2021-02-06 op Inside
308 2b92a447 2021-02-06 op .Ar meta ,
309 2b520ad5 2021-07-09 op the following special sequences are supported:
310 fd1ae83d 2021-06-11 op .Bl -tag -width Ds -compact
311 2b92a447 2021-02-06 op .It \&%\&%
312 2b92a447 2021-02-06 op is replaced with a single
313 2b92a447 2021-02-06 op .Sq \&% .
314 2b92a447 2021-02-06 op .It \&%p
315 2b92a447 2021-02-06 op is replaced with the request path.
316 2b92a447 2021-02-06 op .It \&%q
317 2b92a447 2021-02-06 op is replaced with the query string of the request.
318 2b92a447 2021-02-06 op .It \&%P
319 2b92a447 2021-02-06 op is replaced with the server port.
320 2b92a447 2021-02-06 op .It \&%N
321 2b92a447 2021-02-06 op is replaced with the server name.
322 2b92a447 2021-02-06 op .El
323 14cee926 2022-01-04 op .It Ic cert Ar file
324 eb699783 2021-01-18 op Path to the certificate to use for this server.
325 14cee926 2022-01-04 op .Ar file
326 eb699783 2021-01-18 op should contain a PEM encoded certificate.
327 eb699783 2021-01-18 op This option is mandatory.
328 14cee926 2022-01-04 op .It Ic cgi Ar path
329 301e039d 2021-07-29 op Execute
330 301e039d 2021-07-29 op .Sx CGI
331 301e039d 2021-07-29 op scripts that matches
332 14cee926 2022-01-04 op .Ar path
333 87f2b68b 2021-02-02 op using shell globbing rules.
334 6119e13e 2021-01-19 op .It Ic default type Ar string
335 6119e13e 2021-01-19 op Set the default media type that is used if the media type for a
336 6119e13e 2021-01-19 op specified extension is not found.
337 6119e13e 2021-01-19 op If not specified, the
338 6119e13e 2021-01-19 op .Ic default type
339 6119e13e 2021-01-19 op is set to
340 6119e13e 2021-01-19 op .Dq application/octet-stream .
341 14cee926 2022-01-04 op .It Ic entrypoint Ar path
342 dafaf467 2021-04-15 op Handle all the requests for the current virtual host using the
343 301e039d 2021-07-29 op .Sx CGI
344 301e039d 2021-07-29 op script at
345 14cee926 2022-01-04 op .Ar path ,
346 2b520ad5 2021-07-09 op relative to the current document root.
347 efacb859 2021-07-09 op .It Ic env Ar name Cm = Ar value
348 9cc630aa 2021-04-28 op Set the environment variable
349 9cc630aa 2021-04-28 op .Ar name
350 9cc630aa 2021-04-28 op to
351 9cc630aa 2021-04-28 op .Ar value
352 9cc630aa 2021-04-28 op when executing CGI scripts.
353 9cc630aa 2021-04-28 op Can be provided more than once.
354 8ff40039 2021-05-24 op .\" don't document the "spawn <prog>" form because it probably won't
355 ada16f87 2021-06-11 op .\" be kept.
356 14cee926 2022-01-04 op .It Ic fastcgi Oo Ic tcp Oc Ar socket Oo Cm port Ar port Oc
357 301e039d 2021-07-29 op Enable
358 301e039d 2021-07-29 op .Sx FastCGI
359 301e039d 2021-07-29 op instead of serving files.
360 8ff40039 2021-05-24 op The
361 14cee926 2022-01-04 op .Ar socket
362 2b520ad5 2021-07-09 op can either be a UNIX-domain socket or a TCP socket.
363 8ff40039 2021-05-24 op If the FastCGI application is listening on a UNIX domain socket,
364 14cee926 2022-01-04 op .Ar socket
365 8ff40039 2021-05-24 op is a local path name within the
366 8ff40039 2021-05-24 op .Xr chroot 2
367 8ff40039 2021-05-24 op root directory of
368 8ff40039 2021-05-24 op .Nm .
369 8ff40039 2021-05-24 op Otherwise, the
370 8ff40039 2021-05-24 op .Ic tcp
371 8ff40039 2021-05-24 op keyword must be provided and
372 14cee926 2022-01-04 op .Ar socket
373 8ff40039 2021-05-24 op is interpreted as a hostname or an IP address.
374 8ff40039 2021-05-24 op .Ar port
375 8ff40039 2021-05-24 op can be either a port number or the name of a service enclosed in
376 8ff40039 2021-05-24 op double quotes.
377 2b520ad5 2021-07-09 op If not specified defaults to 9000.
378 2b92a447 2021-02-06 op .It Ic index Ar string
379 2b92a447 2021-02-06 op Set the directory index file.
380 2b92a447 2021-02-06 op If not specified, it defaults to
381 2b92a447 2021-02-06 op .Pa index.gmi .
382 14cee926 2022-01-04 op .It Ic key Ar file
383 2b92a447 2021-02-06 op Specify the private key to use for this server.
384 14cee926 2022-01-04 op .Ar file
385 2b92a447 2021-02-06 op should contain a PEM encoded private key.
386 2b92a447 2021-02-06 op This option is mandatory.
387 05c23a54 2021-01-19 op .It Ic lang Ar string
388 05c23a54 2021-01-19 op Specify the language tag for the text/gemini content served.
389 05c23a54 2021-01-19 op If not specified, no
390 05c23a54 2021-01-19 op .Dq lang
391 05c23a54 2021-01-19 op parameter will be added in the response.
392 14cee926 2022-01-04 op .It Ic location Ar path Brq ...
393 c8b74339 2021-01-24 op Specify server configuration rules for a specific location.
394 14cee926 2022-01-04 op .Ar path
395 c8b74339 2021-01-24 op argument will be matched against the request path with shell globbing
396 c8b74339 2021-01-24 op rules.
397 6016a593 2021-01-30 op In case of multiple location statements in the same context, the first
398 6016a593 2021-01-30 op matching location will be put into effect and the later ones ignored.
399 6016a593 2021-01-30 op Therefore is advisable to match for more specific paths first and for
400 6016a593 2021-01-30 op generic ones later on.
401 c8b74339 2021-01-24 op A
402 c8b74339 2021-01-24 op .Ic location
403 c8b74339 2021-01-24 op section may include most of the server configuration rules
404 c8b74339 2021-01-24 op except
405 3d132b28 2021-07-09 op .Ic alias , Ic cert , Ic cgi , Ic entrypoint , Ic env , Ic key ,
406 c143dcfa 2021-12-29 op .Ic location , Ic param No and Ic proxy .
407 2c43dcce 2021-06-17 op .It Ic log Ar bool
408 2c43dcce 2021-06-17 op Enable or disable the logging for the current server or location block.
409 efacb859 2021-07-09 op .It Ic param Ar name Cm = Ar value
410 ada16f87 2021-06-11 op Set the param
411 ada16f87 2021-06-11 op .Ar name
412 ada16f87 2021-06-11 op to
413 ada16f87 2021-06-11 op .Ar value
414 ada16f87 2021-06-11 op for FastCGI.
415 ff05125e 2021-10-15 op .It Ic ocsp Ar file
416 ff05125e 2021-10-15 op Specify an OCSP response to be stapled during TLS handshakes
417 ff05125e 2021-10-15 op with this server.
418 ff05125e 2021-10-15 op The
419 ff05125e 2021-10-15 op .Ar file
420 ff05125e 2021-10-15 op should contain a DER-format OCSP response retrieved from an
421 ff05125e 2021-10-15 op OCSP server for the
422 ff05125e 2021-10-15 op .Ic cert
423 ff05125e 2021-10-15 op in use.
424 ff05125e 2021-10-15 op If the OCSP response in
425 ff05125e 2021-10-15 op .Ar file
426 ff05125e 2021-10-15 op is empty, OCSP stapling will not be used.
427 ff05125e 2021-10-15 op The default is to not use OCSP stapling.
428 207dc0f9 2021-01-02 op .It Ic proxy Oo Cm proto Ar name Oc Oo Cm for-host Ar host : Ns Oo Ar port Oc Oc Brq ...
429 207dc0f9 2021-01-02 op Set up a reverse proxy.
430 207dc0f9 2021-01-02 op The optional matching rules
431 207dc0f9 2021-01-02 op .Cm proto
432 207dc0f9 2021-01-02 op and
433 207dc0f9 2021-01-02 op .Cm for-host
434 207dc0f9 2021-01-02 op can be used to enable proxying only for protocols matching
435 207dc0f9 2021-01-02 op .Ar name
436 207dc0f9 2021-01-02 op .Po Dq gemini
437 207dc0f9 2021-01-02 op by default
438 207dc0f9 2021-01-02 op .Pc
439 207dc0f9 2021-01-02 op and/or whose request IRI matches
440 207dc0f9 2021-01-02 op .Ar host
441 207dc0f9 2021-01-02 op and
442 207dc0f9 2021-01-02 op .Ar port
443 207dc0f9 2021-01-02 op .Pq 1965 by default .
444 207dc0f9 2021-01-02 op Matching happens using shell globbing rules.
445 207dc0f9 2021-01-02 op .Pp
446 207dc0f9 2021-01-02 op In case of multiple matching proxy blocks in the same context, the
447 207dc0f9 2021-01-02 op first matching proxy will be put into effect and the later ones
448 207dc0f9 2021-01-02 op ignored.
449 207dc0f9 2021-01-02 op .Pp
450 ee68c361 2021-01-01 op Valid options are:
451 ee68c361 2021-01-01 op .Bl -tag -width Ds
452 ee68c361 2021-01-01 op .It Ic cert Ar file
453 ee68c361 2021-01-01 op Specify the client certificate to use when making requests.
454 ee68c361 2021-01-01 op .It Ic key Ar file
455 ee68c361 2021-01-01 op Specify the client certificate key to use when making requests.
456 ee68c361 2021-01-01 op .It Ic protocols Ar string
457 ee68c361 2021-01-01 op Specify the TLS protocols allowed when making remote requests.
458 ee68c361 2021-01-01 op Refer to the
459 ee68c361 2021-01-01 op .Xr tls_config_parse_protocols 3
460 ee68c361 2021-01-01 op function for the valid protocol string values.
461 ee68c361 2021-01-01 op By default, both TLSv1.2 and TLSv1.3 are enabled.
462 ee68c361 2021-01-01 op .It Ic relay-to Ar host : Ns Op Ar port
463 ee68c361 2021-01-01 op Relay the request to the given
464 ee68c361 2021-01-01 op .Ar host
465 ee68c361 2021-01-01 op at the given
466 207dc0f9 2021-01-02 op .Ar port ,
467 207dc0f9 2021-01-02 op 1965 by default.
468 207dc0f9 2021-01-02 op This is the only mandatory option in a
469 207dc0f9 2021-01-02 op .Ic proxy
470 207dc0f9 2021-01-02 op block.
471 7c2374af 2022-01-04 op .It Ic require Ic client Ic ca Ar file
472 7c2374af 2022-01-04 op Allow the proxying only from clients that provide a certificate
473 7c2374af 2022-01-04 op signed by the CA certificate in
474 7c2374af 2022-01-04 op .Ar file .
475 1cdea97b 2022-01-30 op .It Ic sni Ar hostname
476 1cdea97b 2022-01-30 op Use the given
477 1cdea97b 2022-01-30 op .Ar hostname
478 1cdea97b 2022-01-30 op instead of the one extracted from the
479 1cdea97b 2022-01-30 op .Ic relay-to
480 1cdea97b 2022-01-30 op rule for the TLS handshake with the proxied gemini server.
481 53884ec0 2021-01-01 op .It Ic use-tls Ar bool
482 53884ec0 2021-01-01 op Specify whether to use TLS when connecting to the proxied host.
483 53884ec0 2021-01-01 op Enabled by default.
484 ee68c361 2021-01-01 op .It Ic verifyname Ar bool
485 207dc0f9 2021-01-02 op Enable or disable the TLS server name verification.
486 207dc0f9 2021-01-02 op Enabled by default.
487 ee68c361 2021-01-01 op .El
488 14cee926 2022-01-04 op .It Ic root Ar directory
489 2b520ad5 2021-07-09 op Specify the root directory for this server
490 2b520ad5 2021-07-09 op .Pq alas the current Dq document root .
491 2b520ad5 2021-07-09 op It's relative to the chroot if enabled.
492 14cee926 2022-01-04 op .It Ic require Ic client Ic ca Ar path
493 02be96c6 2021-02-09 op Allow requests only from clients that provide a certificate signed by
494 02be96c6 2021-02-09 op the CA certificate in
495 14cee926 2022-01-04 op .Ar path .
496 02be96c6 2021-02-09 op It needs to be a PEM-encoded certificate and it's not relative to the
497 02be96c6 2021-02-09 op chroot.
498 6abda252 2021-02-06 op .It Ic strip Ar number
499 6abda252 2021-02-06 op Strip
500 6abda252 2021-02-06 op .Ar number
501 0773413c 2021-05-15 op components from the beginning of the path before doing a lookup in the
502 0773413c 2021-05-15 op root directory.
503 0773413c 2021-05-15 op It's also considered for the
504 6abda252 2021-02-06 op .Ar meta
505 2b92a447 2021-02-06 op parameter in the scope of a
506 6abda252 2021-02-06 op .Ic block return .
507 6abda252 2021-02-06 op .El
508 72342dc9 2020-11-06 op .Sh CGI
509 87f2b68b 2021-02-02 op When a request for an executable file matches the
510 87f2b68b 2021-02-02 op .Ic cgi
511 301e039d 2021-07-29 op rule, that file will be executed and its output fed to the client.
512 72342dc9 2020-11-06 op .Pp
513 ee655e64 2021-02-01 op The CGI scripts are executed in the directory they reside and inherit
514 a7b9bb4d 2021-01-24 op the environment from
515 0ed56567 2020-11-06 op .Nm
516 0ed56567 2020-11-06 op with these additional variables set:
517 ee655e64 2021-02-01 op .Bl -tag -width 24m
518 28ec6178 2021-01-24 op .It Ev GATEWAY_INTERFACE
519 ee655e64 2021-02-01 op .Dq CGI/1.1
520 ee655e64 2021-02-01 op .It Ev GEMINI_DOCUMENT_ROOT
521 ee655e64 2021-02-01 op The root directory of the virtual host.
522 ee655e64 2021-02-01 op .It Ev GEMINI_SCRIPT_FILENAME
523 ee655e64 2021-02-01 op Full path to the CGI script being executed.
524 ee655e64 2021-02-01 op .It Ev GEMINI_URL
525 ee655e64 2021-02-01 op The full IRI of the request.
526 ee655e64 2021-02-01 op .It Ev GEMINI_URL_PATH
527 ee655e64 2021-02-01 op The path of the request.
528 ee655e64 2021-02-01 op .It Ev PATH_INFO
529 ee655e64 2021-02-01 op The portion of the requested path that is derived from the the IRI
530 ee655e64 2021-02-01 op path hierarchy following the part that identifies the script itself.
531 ee655e64 2021-02-01 op Can be unset.
532 ee655e64 2021-02-01 op .It Ev PATH_TRANSLATED
533 ee655e64 2021-02-01 op Present if and only if
534 ee655e64 2021-02-01 op .Ev PATH_INFO
535 ee655e64 2021-02-01 op is set.
536 ee655e64 2021-02-01 op It represent the translation of the
537 ee655e64 2021-02-01 op .Ev PATH_INFO .
538 ee655e64 2021-02-01 op .Nm
539 ee655e64 2021-02-01 op builds this by appending the
540 ee655e64 2021-02-01 op .Ev PATH_INFO
541 ee655e64 2021-02-01 op to the virtual host directory root.
542 ee655e64 2021-02-01 op .It Ev QUERY_STRING
543 ee655e64 2021-02-01 op The decoded query string.
544 ee655e64 2021-02-01 op .It Ev REMOTE_ADDR , Ev REMOTE_HOST
545 ee655e64 2021-02-01 op Textual representation of the client IP.
546 ee655e64 2021-02-01 op .It Ev REQUEST_METHOD
547 ee655e64 2021-02-01 op This is present only for RFC3875 (CGI) compliance.
548 ee655e64 2021-02-01 op It's always set to the empty string.
549 ee655e64 2021-02-01 op .It Ev SCRIPT_NAME
550 ee655e64 2021-02-01 op The part of the
551 ee655e64 2021-02-01 op .Ev GEMINI_URL_PATH
552 ee655e64 2021-02-01 op that identifies the current CGI script.
553 ee655e64 2021-02-01 op .It Ev SERVER_NAME
554 ee655e64 2021-02-01 op The name of the server
555 ee655e64 2021-02-01 op .It Ev SERVER_PORT
556 ee655e64 2021-02-01 op The port the server is listening on.
557 28ec6178 2021-01-24 op .It Ev SERVER_PROTOCOL
558 ee655e64 2021-02-01 op .Dq GEMINI
559 0ed56567 2020-11-06 op .It Ev SERVER_SOFTWARE
560 ee655e64 2021-02-01 op The name and version of the server, i.e.
561 fba809b5 2021-09-19 op .Dq gmid/1.7.3
562 677afbd3 2020-12-02 op .It Ev AUTH_TYPE
563 28ec6178 2021-01-24 op The string "Certificate" if the client used a certificate, otherwise
564 28ec6178 2021-01-24 op unset.
565 677afbd3 2020-12-02 op .It Ev REMOTE_USER
566 677afbd3 2020-12-02 op The subject of the client certificate if provided, otherwise unset.
567 677afbd3 2020-12-02 op .It Ev TLS_CLIENT_ISSUER
568 28ec6178 2021-01-24 op The is the issuer of the client certificate if provided, otherwise
569 28ec6178 2021-01-24 op unset.
570 677afbd3 2020-12-02 op .It Ev TLS_CLIENT_HASH
571 677afbd3 2020-12-02 op The hash of the client certificate if provided, otherwise unset.
572 ee655e64 2021-02-01 op The format is
573 ee655e64 2021-02-01 op .Dq ALGO:HASH .
574 89541eee 2021-04-13 op .It Ev TLS_VERSION
575 89541eee 2021-04-13 op The TLS version negotiated with the peer.
576 89541eee 2021-04-13 op .It Ev TLS_CIPHER
577 89541eee 2021-04-13 op The cipher suite negotiated with the peer.
578 89541eee 2021-04-13 op .It Ev TLS_CIPHER_STRENGTH
579 89541eee 2021-04-13 op The strength in bits for the symmetric cipher that is being used with
580 89541eee 2021-04-13 op the peer.
581 b63e30ff 2021-02-07 op .It Ev TLS_CLIENT_NOT_AFTER
582 b63e30ff 2021-02-07 op The time corresponding to the end of the validity period of the peer
583 b63e30ff 2021-02-07 op certificate in the ISO 8601 format
584 b63e30ff 2021-02-07 op .Pq e.g. Dq 2021-02-07T20:17:41Z .
585 b63e30ff 2021-02-07 op .It Ev TLS_CLIENT_NOT_BEFORE
586 b63e30ff 2021-02-07 op The time corresponding to the start of the validity period of the peer
587 b63e30ff 2021-02-07 op certificate in the ISO 8601 format.
588 0ed56567 2020-11-06 op .El
589 ada16f87 2021-06-11 op .Sh FastCGI
590 ada16f87 2021-06-11 op .Nm
591 ada16f87 2021-06-11 op optionally supports FastCGI.
592 ada16f87 2021-06-11 op A
593 ada16f87 2021-06-11 op .Ic fastcgi
594 ada16f87 2021-06-11 op rule must be present in a server or location block.
595 ada16f87 2021-06-11 op Then, all requests matching that server or location will be handled
596 ada16f87 2021-06-11 op via the specified FastCGI backend.
597 a5d310bc 2020-11-10 op .Pp
598 ada16f87 2021-06-11 op By default the following variables
599 ada16f87 2021-06-11 op .Pq parameters
600 ada16f87 2021-06-11 op are sent, and carry the same semantics as with CGI.
601 ada16f87 2021-06-11 op More parameters can be added with the
602 ada16f87 2021-06-11 op .Ic param
603 ada16f87 2021-06-11 op option.
604 2b520ad5 2021-07-09 op .Pp
605 ada16f87 2021-06-11 op .Bl -bullet -compact
606 ada16f87 2021-06-11 op .It
607 ada16f87 2021-06-11 op GATEWAY_INTERFACE
608 ada16f87 2021-06-11 op .It
609 ada16f87 2021-06-11 op GEMINI_URL_PATH
610 ada16f87 2021-06-11 op .It
611 ada16f87 2021-06-11 op QUERY_STRING
612 ada16f87 2021-06-11 op .It
613 ada16f87 2021-06-11 op REMOTE_ADDR
614 ada16f87 2021-06-11 op .It
615 ada16f87 2021-06-11 op REMOTE_HOST
616 ada16f87 2021-06-11 op .It
617 ada16f87 2021-06-11 op REQUEST_METHOD
618 ada16f87 2021-06-11 op .It
619 ada16f87 2021-06-11 op SERVER_NAME
620 ada16f87 2021-06-11 op .It
621 ada16f87 2021-06-11 op SERVER_PROTOCOL
622 ada16f87 2021-06-11 op .It
623 ada16f87 2021-06-11 op SERVER_SOFTWARE
624 ada16f87 2021-06-11 op .It
625 ada16f87 2021-06-11 op AUTH_TYPE
626 ada16f87 2021-06-11 op .It
627 ada16f87 2021-06-11 op REMOTE_USER
628 ada16f87 2021-06-11 op .It
629 ada16f87 2021-06-11 op TLS_CLIENT_ISSUER
630 ada16f87 2021-06-11 op .It
631 ada16f87 2021-06-11 op TLS_CLIENT_HASH
632 ada16f87 2021-06-11 op .It
633 ada16f87 2021-06-11 op TLS_VERSION
634 ada16f87 2021-06-11 op .It
635 ada16f87 2021-06-11 op TLS_CIPHER
636 ada16f87 2021-06-11 op .It
637 ada16f87 2021-06-11 op TLS_CIPHER_STRENGTH
638 ada16f87 2021-06-11 op .It
639 ada16f87 2021-06-11 op TLS_CLIENT_NOT_BEFORE
640 ada16f87 2021-06-11 op .It
641 ada16f87 2021-06-11 op TLS_CLIENT_NOT_AFTER
642 ada16f87 2021-06-11 op .El
643 c586dfea 2022-01-30 op .Sh MEDIA TYPES
644 75fbb178 2021-01-28 op To auto-detect the MIME type of the response
645 75fbb178 2021-01-28 op .Nm
646 75fbb178 2021-01-28 op looks at the file extension and consults its internal table.
647 75fbb178 2021-01-28 op By default the following mappings are loaded, but they can be
648 75fbb178 2021-01-28 op overridden or extended using the
649 d19951cf 2021-07-09 op .Ic map
650 75fbb178 2021-01-28 op configuration option.
651 75fbb178 2021-01-28 op If no MIME is found, the value of
652 75fbb178 2021-01-28 op .Ic default type
653 75fbb178 2021-01-28 op matching the file
654 75fbb178 2021-01-28 op .Ic location
655 75fbb178 2021-01-28 op will be used, which is
656 75fbb178 2021-01-28 op .Dq application/octet-stream
657 75fbb178 2021-01-28 op by default.
658 75fbb178 2021-01-28 op .Pp
659 75fbb178 2021-01-28 op .Bl -tag -offset indent -width 14m -compact
660 4d820b6c 2021-04-21 op .It diff
661 4d820b6c 2021-04-21 op text/x-patch
662 75fbb178 2021-01-28 op .It gemini, gmi
663 75fbb178 2021-01-28 op text/gemini
664 75fbb178 2021-01-28 op .It gif
665 75fbb178 2021-01-28 op image/gif
666 75fbb178 2021-01-28 op .It jpeg
667 75fbb178 2021-01-28 op image/jpeg
668 75fbb178 2021-01-28 op .It jpg
669 75fbb178 2021-01-28 op image/jpeg
670 75fbb178 2021-01-28 op .It markdown, md
671 75fbb178 2021-01-28 op text/markdown
672 4d820b6c 2021-04-21 op .It patch
673 4d820b6c 2021-04-21 op text/x-patch
674 75fbb178 2021-01-28 op .It pdf
675 75fbb178 2021-01-28 op application/pdf
676 75fbb178 2021-01-28 op .It png
677 75fbb178 2021-01-28 op image/png
678 75fbb178 2021-01-28 op .It svg
679 75fbb178 2021-01-28 op image/svg+xml
680 75fbb178 2021-01-28 op .It txt
681 75fbb178 2021-01-28 op text/plain
682 75fbb178 2021-01-28 op .It xml
683 75fbb178 2021-01-28 op text/xml
684 75fbb178 2021-01-28 op .El
685 e58a447a 2021-07-29 op .Sh LOGGING
686 e58a447a 2021-07-29 op Messages and requests are logged by
687 e58a447a 2021-07-29 op .Xr syslog 3
688 e58a447a 2021-07-29 op using the
689 e58a447a 2021-07-29 op .Dv DAEMON
690 e58a447a 2021-07-29 op facility or printed on
691 e58a447a 2021-07-29 op .Em stderr .
692 e58a447a 2021-07-29 op .Pp
693 e58a447a 2021-07-29 op Requests are logged with the
694 e58a447a 2021-07-29 op .Dv NOTICE
695 e58a447a 2021-07-29 op severity.
696 e58a447a 2021-07-29 op Each request log entry has the following fields, separated by
697 e58a447a 2021-07-29 op whitespace:
698 e58a447a 2021-07-29 op .Pp
699 e58a447a 2021-07-29 op .Bl -bullet -compact
700 e58a447a 2021-07-29 op .It
701 e58a447a 2021-07-29 op Client IP address and the source port number, separated by a colon
702 e58a447a 2021-07-29 op .It
703 e58a447a 2021-07-29 op .Sy GET
704 e58a447a 2021-07-29 op keyword
705 e58a447a 2021-07-29 op .It
706 e58a447a 2021-07-29 op Request URL
707 e58a447a 2021-07-29 op .It
708 e58a447a 2021-07-29 op Response status
709 e58a447a 2021-07-29 op .It
710 e58a447a 2021-07-29 op Response meta
711 e58a447a 2021-07-29 op .El
712 3e4749f7 2020-10-02 op .Sh EXAMPLES
713 f28d96d3 2021-01-25 op Serve the current directory
714 6980aad6 2020-10-02 op .Bd -literal -offset indent
715 f28d96d3 2021-01-25 op $ gmid .
716 6980aad6 2020-10-02 op .Ed
717 3e4749f7 2020-10-02 op .Pp
718 f28d96d3 2021-01-25 op To serve the directory
719 f28d96d3 2021-01-25 op .Pa docs
720 f28d96d3 2021-01-25 op and enable CGI scripts inside
721 2b520ad5 2021-07-09 op .Pa docs/cgi
722 0ed56567 2020-11-06 op .Bd -literal -offset indent
723 f28d96d3 2021-01-25 op $ mkdir docs/cgi
724 b7a99061 2021-04-15 op $ cat <<EOF > docs/cgi/hello
725 0ed56567 2020-11-06 op #!/bin/sh
726 af5f9b27 2021-07-21 op printf "20 text/plain\er\en"
727 f28d96d3 2021-01-25 op echo "hello world"
728 0ed56567 2020-11-06 op EOF
729 f28d96d3 2021-01-25 op $ chmod +x docs/cgi/hello
730 b890467e 2021-03-20 op $ gmid -x '/cgi/*' docs
731 0ed56567 2020-11-06 op .Ed
732 e308526c 2021-07-29 op .Pp
733 e308526c 2021-07-29 op An X.509 certificate must be provided to run
734 e308526c 2021-07-29 op .Nm
735 e308526c 2021-07-29 op using a configuration file.
736 e308526c 2021-07-29 op First, the RSA certificate is created using a wildcard common name:
737 e308526c 2021-07-29 op .Bd -literal -offset indent
738 e308526c 2021-07-29 op # openssl genrsa \-out /etc/ssl/private/example.com.key 4096
739 1298e430 2021-10-09 op # openssl req \-new \-x509 \e
740 1298e430 2021-10-09 op \-key /etc/ssl/private/example.com.key \e
741 1298e430 2021-10-09 op \-out /etc/ssl/example.com.crt \e
742 1298e430 2021-10-09 op \-days 36500 \-nodes \e
743 2bb1776b 2021-07-29 op \-subj "/CN=example.com"
744 e308526c 2021-07-29 op # chmod 600 /etc/ssl/example.com.crt
745 e308526c 2021-07-29 op # chmod 600 /etc/ssl/private/example.com.key
746 e308526c 2021-07-29 op .Ed
747 e308526c 2021-07-29 op .Pp
748 e308526c 2021-07-29 op In the example above, a certificate is valid for one hundred years from
749 e308526c 2021-07-29 op the date it was created, which is normal for TOFU.
750 0ed56567 2020-11-06 op .Pp
751 eb699783 2021-01-18 op The following is an example of a possible configuration for a site
752 eb699783 2021-01-18 op that enables only TLSv1.3, adds a mime type for the file extension
753 e308526c 2021-07-29 op .Qq rtf
754 e308526c 2021-07-29 op and defines two virtual host:
755 eb699783 2021-01-18 op .Bd -literal -offset indent
756 eb699783 2021-01-18 op ipv6 on # enable ipv6
757 eb699783 2021-01-18 op
758 eb699783 2021-01-18 op protocols "tlsv1.3"
759 eb699783 2021-01-18 op
760 d19951cf 2021-07-09 op map "application/rtf" to-ext "rtf"
761 eb699783 2021-01-18 op
762 eb699783 2021-01-18 op server "example.com" {
763 e308526c 2021-07-29 op cert "/etc/ssl/example.com.crt"
764 e308526c 2021-07-29 op key "/etc/ssl/private/example.com.key"
765 eb699783 2021-01-18 op root "/var/gemini/example.com"
766 eb699783 2021-01-18 op }
767 eb699783 2021-01-18 op
768 eb699783 2021-01-18 op server "it.example.com" {
769 e308526c 2021-07-29 op cert "/etc/ssl/example.com.crt"
770 e308526c 2021-07-29 op key "/etc/ssl/private/example.com.key"
771 eb699783 2021-01-18 op root "/var/gemini/it.example.com"
772 2b520ad5 2021-07-09 op
773 2b520ad5 2021-07-09 op # enable cgi scripts inside "cgi-bin"
774 87f2b68b 2021-02-02 op cgi "/cgi-bin/*"
775 2b520ad5 2021-07-09 op
776 2b520ad5 2021-07-09 op # set the language for text/gemini files
777 de27389e 2021-01-21 op lang "it"
778 eb699783 2021-01-18 op }
779 eb699783 2021-01-18 op .Ed
780 f28d96d3 2021-01-25 op .Pp
781 f28d96d3 2021-01-25 op Yet another example, showing how to enable a
782 f28d96d3 2021-01-25 op .Ic chroot
783 f28d96d3 2021-01-25 op and use
784 f28d96d3 2021-01-25 op .Ic location
785 f28d96d3 2021-01-25 op rule
786 f28d96d3 2021-01-25 op .Bd -literal -offset indent
787 f28d96d3 2021-01-25 op chroot "/var/gemini"
788 f28d96d3 2021-01-25 op user "_gmid"
789 f28d96d3 2021-01-25 op
790 f28d96d3 2021-01-25 op server "example.com" {
791 2b520ad5 2021-07-09 op cert "/path/to/cert.pem" # absolute path
792 2b520ad5 2021-07-09 op key "/path/to/key.pem" # also absolute
793 2b520ad5 2021-07-09 op root "/example.com" # relative to the chroot
794 f28d96d3 2021-01-25 op
795 4ee08bd1 2021-02-03 op location "/static/*" {
796 2b520ad5 2021-07-09 op # load the following rules only for
797 2b520ad5 2021-07-09 op # requests that matches "/static/*"
798 2b520ad5 2021-07-09 op
799 f28d96d3 2021-01-25 op auto index on
800 f28d96d3 2021-01-25 op index "index.gemini"
801 f28d96d3 2021-01-25 op }
802 f28d96d3 2021-01-25 op }
803 f28d96d3 2021-01-25 op .Ed
804 ef04b551 2021-01-09 op .Sh ACKNOWLEDGEMENTS
805 ef04b551 2021-01-09 op .Nm
806 eb699783 2021-01-18 op uses the
807 eb699783 2021-01-18 op .Dq Flexible and Economical
808 eb699783 2021-01-18 op UTF-8 decoder written by
809 f28d96d3 2021-01-25 op .An Bjoern Hoehrmann .
810 714685c1 2021-01-30 op .Sh AUTHORS
811 714685c1 2021-01-30 op .An -nosplit
812 714685c1 2021-01-30 op The
813 714685c1 2021-01-30 op .Nm
814 714685c1 2021-01-30 op program was written by
815 714685c1 2021-01-30 op .An Omar Polo Aq Mt op@omarpolo.com .
816 3e4749f7 2020-10-02 op .Sh CAVEATS
817 3e4749f7 2020-10-02 op .Bl -bullet
818 3e4749f7 2020-10-02 op .It
819 2b520ad5 2021-07-09 op All the root directories are opened during the daemon startup; if a
820 2b520ad5 2021-07-09 op root directory is deleted and then re-created,
821 eb699783 2021-01-18 op .Nm
822 eb699783 2021-01-18 op won't be able to serve files inside that directory until a restart.
823 2b520ad5 2021-07-09 op This restriction only applies to the root directories and not their
824 2b520ad5 2021-07-09 op content.
825 043acc97 2020-12-25 op .It
826 714685c1 2021-01-30 op a %2F sequence is indistinguishable from a literal slash: this is not
827 714685c1 2021-01-30 op RFC3986-compliant.
828 00781742 2020-12-25 op .It
829 714685c1 2021-01-30 op a %00 sequence is treated as invalid character and thus rejected.
830 3e4749f7 2020-10-02 op .El