1 7edcf2b3 2023-06-24 op .\" Copyright (c) 2022, 2023 Omar Polo <op@omarpolo.com>
3 1595c277 2022-04-07 op .\" Permission to use, copy, modify, and distribute this software for any
4 1595c277 2022-04-07 op .\" purpose with or without fee is hereby granted, provided that the above
5 1595c277 2022-04-07 op .\" copyright notice and this permission notice appear in all copies.
7 1595c277 2022-04-07 op .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 1595c277 2022-04-07 op .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 1595c277 2022-04-07 op .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
10 1595c277 2022-04-07 op .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 1595c277 2022-04-07 op .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
12 1595c277 2022-04-07 op .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
13 1595c277 2022-04-07 op .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
14 56d32bb5 2023-07-24 op .Dd July 24, 2023
15 1595c277 2022-04-07 op .Dt GMID.CONF 5
19 1595c277 2022-04-07 op .Nd gmid Gemini server configuration file
20 1595c277 2022-04-07 op .Sh DESCRIPTION
22 1595c277 2022-04-07 op is the configuration file format for the
24 1595c277 2022-04-07 op Gemini server.
26 7edcf2b3 2023-06-24 op The configuration file is divided into the following sections:
27 7edcf2b3 2023-06-24 op .Bl -tag -width Ds
29 1595c277 2022-04-07 op User-defined variables may be defined and used later, simplifying the
30 1595c277 2022-04-07 op configuration file.
31 1595c277 2022-04-07 op .It Sy Global Options
32 1595c277 2022-04-07 op Global settings for
34 1595c277 2022-04-07 op .It Sy Servers
35 1595c277 2022-04-07 op Virtual hosts definition.
37 1595c277 2022-04-07 op Media types and extensions.
40 1595c277 2022-04-07 op Within the sections, empty lines are ignored and comments can be put
41 1595c277 2022-04-07 op anywhere in the file using a hash mark
43 1595c277 2022-04-07 op and extend to the end of the current line.
44 1595c277 2022-04-07 op A boolean is either the symbol
48 1595c277 2022-04-07 op A string is a sequence of characters wrapped in double quotes,
49 1595c277 2022-04-07 op .Dq like this .
50 1595c277 2022-04-07 op Multiple strings one next to the other are joined into a single
52 1595c277 2022-04-07 op .Bd -literal -offset indent
53 1595c277 2022-04-07 op # equivalent to "temporary-failure"
54 1595c277 2022-04-07 op block return 40 "temporary" "-" "failure"
57 1595c277 2022-04-07 op Furthermore, quoting is necessary only when a string needs to contain
58 1595c277 2022-04-07 op special characters
59 1595c277 2022-04-07 op .Pq like spaces or punctuation ,
60 1595c277 2022-04-07 op something that looks like a number or a reserved keyword.
61 1595c277 2022-04-07 op The last example could have been written also as:
62 1595c277 2022-04-07 op .Bd -literal -offset indent
63 1595c277 2022-04-07 op block return 40 temporary "-" failure
66 1595c277 2022-04-07 op Strict ordering of the sections is not enforced, so that is possible
67 1595c277 2022-04-07 op to mix macros, options and
70 1595c277 2022-04-07 op However, defining all the
72 1595c277 2022-04-07 op blocks after the macros and the global options is recommended.
74 1595c277 2022-04-07 op Newlines are often optional, except around top-level instructions, and
77 1595c277 2022-04-07 op can also be optionally used to separate options.
79 1595c277 2022-04-07 op Additional configuration files can be included with the
81 1595c277 2022-04-07 op keyword, for example:
82 1595c277 2022-04-07 op .Bd -literal -offset indent
83 1595c277 2022-04-07 op include "/etc/gmid.conf.local"
86 1595c277 2022-04-07 op Macros can be defined that will later be expanded in context.
87 1595c277 2022-04-07 op Macro names must start with a letter, digit or underscore and may
88 1595c277 2022-04-07 op contain any of those characters.
89 1595c277 2022-04-07 op Macros names may not be reserved words.
90 1595c277 2022-04-07 op Macros are not expanded inside quotes.
92 1595c277 2022-04-07 op Two kinds of macros are supported: variable-like and proper macros.
93 1595c277 2022-04-07 op When a macro is invoked with a
95 1595c277 2022-04-07 op before its name its expanded as a string, whereas when it's invoked
98 1595c277 2022-04-07 op its expanded in-place.
101 1595c277 2022-04-07 op .Bd -literal -offset indent
102 1595c277 2022-04-07 op dir = "/var/gemini"
103 1595c277 2022-04-07 op certdir = "/etc/keys"
104 1595c277 2022-04-07 op common = "lang it; auto index on"
106 1595c277 2022-04-07 op server "foo" {
107 7edcf2b3 2023-06-24 op root $dir "/foo" # "/var/gemini/foo"
108 7edcf2b3 2023-06-24 op cert $certdir "/foo.pem" # "/etc/keys/foo.pem"
109 7edcf2b3 2023-06-24 op key $certdir "/foo.key" # "/etc/keys/foo.key"
113 1595c277 2022-04-07 op .Ss Global Options
114 1595c277 2022-04-07 op .Bl -tag -width 12m
115 1595c277 2022-04-07 op .It Ic chroot Ar path
117 1595c277 2022-04-07 op the process to the given
119 1595c277 2022-04-07 op The daemon has to be run with root privileges and thus the option
121 7edcf2b3 2023-06-24 op needs to be provided too, so privileges can be dropped afterwards.
122 7edcf2b3 2023-06-24 op All the paths in the configuration file are relative to the chroot
123 7edcf2b3 2023-06-24 op directory, except for the
129 287ab865 2023-06-24 op Defaults to the
131 287ab865 2023-06-24 op home directory, if provided.
132 226f13ec 2023-07-24 op .It Ic log Ar options
133 226f13ec 2023-07-24 op Specify logging options.
134 226f13ec 2023-07-24 op Multiple options may be provided within curly braces.
135 226f13ec 2023-07-24 op The available options are as follows:
136 226f13ec 2023-07-24 op .Bl -tag -width Ds
137 226f13ec 2023-07-24 op .It Ic syslog
138 226f13ec 2023-07-24 op Log to syslog.
139 226f13ec 2023-07-24 op This is the default behaviour.
140 226f13ec 2023-07-24 op .It Ic access Ar file
141 226f13ec 2023-07-24 op Log the requests to
143 4acf495f 2023-07-24 op The path is relative to the
145 abd261d2 2023-07-25 op .It Ic style Ar style
146 abd261d2 2023-07-25 op Set the logging style, defaults to
147 abd261d2 2023-07-25 op .Ic condensed .
150 abd261d2 2023-07-25 op can be one of:
151 abd261d2 2023-07-25 op .Bl -tag -width Ds
152 abd261d2 2023-07-25 op .It Ic common
153 abd261d2 2023-07-25 op Attempt to be compatible with the default Apache httpd log format.
154 abd261d2 2023-07-25 op Each line is formatted as follows: the matching host name,
155 abd261d2 2023-07-25 op the remote IP address, one dash
157 abd261d2 2023-07-25 op Common Name of the client certificate
158 abd261d2 2023-07-25 op .Pq if provided, '-' otherwise ,
159 abd261d2 2023-07-25 op the timestamp of the request, the request URI wrapped in double quotes,
160 abd261d2 2023-07-25 op the response code and the size of the response.
161 abd261d2 2023-07-25 op .It Ic combined
162 abd261d2 2023-07-25 op Attempt to be compatible with the default nginx log format.
163 abd261d2 2023-07-25 op Each line is formatted as follows: the remote IP address, one dash
165 abd261d2 2023-07-25 op Common Name of the client certificate
166 abd261d2 2023-07-25 op .Pq if provided, '-' otherwise ,
167 abd261d2 2023-07-25 op the timestamp wrapped in square brackets, the request URI wrapped in
168 abd261d2 2023-07-25 op double quotes, the response code, the size of the response, a dash
169 abd261d2 2023-07-25 op wrapped in double quotes and "".
170 abd261d2 2023-07-25 op The strangness of these two last fields is because Gemini doesn't have
171 abd261d2 2023-07-25 op the notion of the
173 abd261d2 2023-07-25 op header nor the
174 abd261d2 2023-07-25 op .Dq User-agent .
175 abd261d2 2023-07-25 op .It Ic condensed
178 abd261d2 2023-07-25 op format since 2.0.
179 abd261d2 2023-07-25 op Each line is formatted as follows: RFC 3339 date time,
180 abd261d2 2023-07-25 op remote IP address, Common Name of the client certificate
181 abd261d2 2023-07-25 op .Pq if provided, '-' otherwise ,
182 abd261d2 2023-07-25 op the matching host name, the request URI, the size of the response,
183 abd261d2 2023-07-25 op the response code and meta.
184 abd261d2 2023-07-25 op .It Ic legacy
185 abd261d2 2023-07-25 op The pre-2.0 gmid native format.
186 abd261d2 2023-07-25 op Each line is formatted as follows: the remote IP address and port, the
188 abd261d2 2023-07-25 op keyword, the request URI, the response code and meta.
191 1595c277 2022-04-07 op .It Ic prefork Ar number
192 1595c277 2022-04-07 op Run the specified number of server processes.
193 1595c277 2022-04-07 op This increases the performance and prevents delays when connecting to
196 1595c277 2022-04-07 op runs 3 server processes by default.
197 1595c277 2022-04-07 op The maximum number allowed is 16.
198 1595c277 2022-04-07 op .It Ic protocols Ar string
199 1595c277 2022-04-07 op Specify the TLS protocols to enable.
201 1595c277 2022-04-07 op .Xr tls_config_parse_protocols 3
202 1595c277 2022-04-07 op for the valid protocol string values.
203 1595c277 2022-04-07 op By default, both TLSv1.3 and TLSv1.2 are enabled.
206 1595c277 2022-04-07 op to enable only TLSv1.3.
207 1595c277 2022-04-07 op .It Ic user Ar string
208 1595c277 2022-04-07 op Run the daemon as the given user.
211 1595c277 2022-04-07 op Every virtual host is defined by a
214 1595c277 2022-04-07 op .Bl -tag -width Ds
215 1595c277 2022-04-07 op .It Ic server Ar hostname Brq ...
216 1595c277 2022-04-07 op Match the server name using shell globbing rules.
217 1595c277 2022-04-07 op It can be an explicit name,
218 1595c277 2022-04-07 op .Ar www.example.com ,
219 1595c277 2022-04-07 op or a name including a wildcards,
220 1595c277 2022-04-07 op .Ar *.example.com .
223 1595c277 2022-04-07 op Followed by a block of options that is enclosed in curly brackets:
224 1595c277 2022-04-07 op .Bl -tag -width Ds
225 1595c277 2022-04-07 op .It Ic alias Ar name
226 1595c277 2022-04-07 op Specify an additional alias
228 1595c277 2022-04-07 op for this server.
229 1595c277 2022-04-07 op .It Ic auto Ic index Ar bool
230 1595c277 2022-04-07 op If no index file is found, automatically generate a directory listing.
231 1595c277 2022-04-07 op Disabled by default.
232 1595c277 2022-04-07 op .It Ic block Op Ic return Ar code Op Ar meta
233 1595c277 2022-04-07 op Send a reply and close the connection;
240 1595c277 2022-04-07 op .Dq temporary failure .
243 1595c277 2022-04-07 op is in the 3x range, then
245 1595c277 2022-04-07 op is mandatory.
248 1595c277 2022-04-07 op the following special sequences are supported:
249 1595c277 2022-04-07 op .Bl -tag -width Ds -compact
251 1595c277 2022-04-07 op is replaced with a single
254 1595c277 2022-04-07 op is replaced with the request path.
256 1595c277 2022-04-07 op is replaced with the query string of the request.
258 1595c277 2022-04-07 op is replaced with the server port.
260 1595c277 2022-04-07 op is replaced with the server name.
262 1595c277 2022-04-07 op .It Ic cert Ar file
263 1595c277 2022-04-07 op Path to the certificate to use for this server.
265 1595c277 2022-04-07 op should contain a PEM encoded certificate.
266 1595c277 2022-04-07 op This option is mandatory.
267 9b15e4c6 2022-09-08 op .It Ic default type Ar string
268 9b15e4c6 2022-09-08 op Set the default media type that is used if the media type for a
269 9b15e4c6 2022-09-08 op specified extension is not found.
270 9b15e4c6 2022-09-08 op If not specified, the
271 9b15e4c6 2022-09-08 op .Ic default type
273 9b15e4c6 2022-09-08 op .Dq application/octet-stream .
274 a1ba9650 2023-07-23 op .It Ic fastcgi Ar option
275 a1ba9650 2023-07-23 op Enable FastCGI instead of serving files.
276 a1ba9650 2023-07-23 op Multiple options may be specified within curly braces.
277 a1ba9650 2023-07-23 op Valid options are:
278 a1ba9650 2023-07-23 op .Bl -tag -width Ds
279 a1ba9650 2023-07-23 op .It Ic param Ar name Cm = Ar value
280 a1ba9650 2023-07-23 op Set the param
284 a1ba9650 2023-07-23 op .It Ic socket Oo Ic tcp Oc Ar socket Oo Cm port Ar port Oc
287 9b15e4c6 2022-09-08 op can either be a UNIX-domain socket or a TCP socket.
288 9b15e4c6 2022-09-08 op If the FastCGI application is listening on a UNIX domain socket,
290 9b15e4c6 2022-09-08 op is a local path name within the
292 9b15e4c6 2022-09-08 op root directory of
294 9b15e4c6 2022-09-08 op Otherwise, the
296 9b15e4c6 2022-09-08 op keyword must be provided and
298 9b15e4c6 2022-09-08 op is interpreted as a hostname or an IP address.
300 9b15e4c6 2022-09-08 op can be either a port number or the name of a service enclosed in
301 9b15e4c6 2022-09-08 op double quotes.
302 9b15e4c6 2022-09-08 op If not specified defaults to 9000.
305 a1ba9650 2023-07-23 op The FastCGI handler will be given the following variables by default:
306 1595c277 2022-04-07 op .Bl -tag -width 24m
307 1595c277 2022-04-07 op .It Ev GATEWAY_INTERFACE
309 1595c277 2022-04-07 op .It Ev GEMINI_DOCUMENT_ROOT
310 1595c277 2022-04-07 op The root directory of the virtual host.
311 1595c277 2022-04-07 op .It Ev GEMINI_SCRIPT_FILENAME
312 9b15e4c6 2022-09-08 op Full path to the FastCGI script being executed.
313 1595c277 2022-04-07 op .It Ev GEMINI_URL
314 1595c277 2022-04-07 op The full IRI of the request.
315 1595c277 2022-04-07 op .It Ev GEMINI_URL_PATH
316 1595c277 2022-04-07 op The path of the request.
317 97b306cb 2022-11-27 op .It Ev GEMINI_SEARCH_STRING
319 97b306cb 2022-11-27 op .Ev QUERY_STRING
320 97b306cb 2022-11-27 op if defined in the request and if it doesn't contain any unencoded
322 97b306cb 2022-11-27 op characters, otherwise unset.
323 1595c277 2022-04-07 op .It Ev PATH_INFO
324 1595c277 2022-04-07 op The portion of the requested path that is derived from the the IRI
325 1595c277 2022-04-07 op path hierarchy following the part that identifies the script itself.
326 1595c277 2022-04-07 op Can be unset.
327 1595c277 2022-04-07 op .It Ev PATH_TRANSLATED
328 1595c277 2022-04-07 op Present if and only if
329 1595c277 2022-04-07 op .Ev PATH_INFO
331 1595c277 2022-04-07 op It represent the translation of the
332 1595c277 2022-04-07 op .Ev PATH_INFO .
334 1595c277 2022-04-07 op builds this by appending the
335 1595c277 2022-04-07 op .Ev PATH_INFO
336 1595c277 2022-04-07 op to the virtual host directory root.
337 1595c277 2022-04-07 op .It Ev QUERY_STRING
338 77718c12 2022-11-27 op The URL-encoded search or parameter string.
339 1595c277 2022-04-07 op .It Ev REMOTE_ADDR , Ev REMOTE_HOST
340 1595c277 2022-04-07 op Textual representation of the client IP.
341 1595c277 2022-04-07 op .It Ev REQUEST_METHOD
342 1595c277 2022-04-07 op This is present only for RFC3875 (CGI) compliance.
343 1595c277 2022-04-07 op It's always set to the empty string.
344 1595c277 2022-04-07 op .It Ev SCRIPT_NAME
345 9b15e4c6 2022-09-08 op The virtual URI path to the script.
346 1595c277 2022-04-07 op .It Ev SERVER_NAME
347 1595c277 2022-04-07 op The name of the server
348 1595c277 2022-04-07 op .It Ev SERVER_PORT
349 1595c277 2022-04-07 op The port the server is listening on.
350 1595c277 2022-04-07 op .It Ev SERVER_PROTOCOL
352 1595c277 2022-04-07 op .It Ev SERVER_SOFTWARE
353 1595c277 2022-04-07 op The name and version of the server, i.e.
354 1f6de749 2022-07-04 op .Dq gmid/1.8.4
355 1595c277 2022-04-07 op .It Ev AUTH_TYPE
356 1595c277 2022-04-07 op The string "Certificate" if the client used a certificate, otherwise
358 1595c277 2022-04-07 op .It Ev REMOTE_USER
359 1595c277 2022-04-07 op The subject of the client certificate if provided, otherwise unset.
360 1595c277 2022-04-07 op .It Ev TLS_CLIENT_ISSUER
361 1595c277 2022-04-07 op The is the issuer of the client certificate if provided, otherwise
363 1595c277 2022-04-07 op .It Ev TLS_CLIENT_HASH
364 1595c277 2022-04-07 op The hash of the client certificate if provided, otherwise unset.
365 1595c277 2022-04-07 op The format is
366 1595c277 2022-04-07 op .Dq ALGO:HASH .
367 1595c277 2022-04-07 op .It Ev TLS_VERSION
368 1595c277 2022-04-07 op The TLS version negotiated with the peer.
369 1595c277 2022-04-07 op .It Ev TLS_CIPHER
370 1595c277 2022-04-07 op The cipher suite negotiated with the peer.
371 1595c277 2022-04-07 op .It Ev TLS_CIPHER_STRENGTH
372 1595c277 2022-04-07 op The strength in bits for the symmetric cipher that is being used with
374 1595c277 2022-04-07 op .It Ev TLS_CLIENT_NOT_AFTER
375 1595c277 2022-04-07 op The time corresponding to the end of the validity period of the peer
376 1595c277 2022-04-07 op certificate in the ISO 8601 format
377 1595c277 2022-04-07 op .Pq e.g. Dq 2021-02-07T20:17:41Z .
378 1595c277 2022-04-07 op .It Ev TLS_CLIENT_NOT_BEFORE
379 1595c277 2022-04-07 op The time corresponding to the start of the validity period of the peer
380 1595c277 2022-04-07 op certificate in the ISO 8601 format.
382 6a8387e5 2023-07-23 op .It Ic fastcgi off
383 6a8387e5 2023-07-23 op Disable FastCGI handling in the current location.
384 a1ba9650 2023-07-23 op .It Ic index Ar string
385 a1ba9650 2023-07-23 op Set the directory index file.
386 a1ba9650 2023-07-23 op If not specified, it defaults to
387 a1ba9650 2023-07-23 op .Pa index.gmi .
388 a1ba9650 2023-07-23 op .It Ic key Ar file
389 a1ba9650 2023-07-23 op Specify the private key to use for this server.
391 a1ba9650 2023-07-23 op should contain a PEM encoded private key.
392 a1ba9650 2023-07-23 op This option is mandatory.
393 a1ba9650 2023-07-23 op .It Ic lang Ar string
394 a1ba9650 2023-07-23 op Specify the language tag for the text/gemini content served.
395 a1ba9650 2023-07-23 op If not specified, no
397 a1ba9650 2023-07-23 op parameter will be added in the response.
398 a1ba9650 2023-07-23 op .It Ic listen on Ar address Op Ic port Ar number
399 a1ba9650 2023-07-23 op Set the listen
403 a1ba9650 2023-07-23 op which defaults to
405 a1ba9650 2023-07-23 op This statement can be specified multiple times.
412 a1ba9650 2023-07-23 op will listen on all IPv4 and IPv6 addresses.
414 a1ba9650 2023-07-23 op can be used to listen on all IPv4 addresses and
416 a1ba9650 2023-07-23 op on all IPv6 addresses.
417 a1ba9650 2023-07-23 op .It Ic location Ar path Brq ...
418 a1ba9650 2023-07-23 op Specify server configuration rules for a specific location.
420 a1ba9650 2023-07-23 op argument will be matched against the request path with shell globbing
422 a1ba9650 2023-07-23 op In case of multiple location statements in the same context, the first
423 a1ba9650 2023-07-23 op matching location will be put into effect and the later ones ignored.
424 a1ba9650 2023-07-23 op Therefore is advisable to match for more specific paths first and for
425 a1ba9650 2023-07-23 op generic ones later on.
428 a1ba9650 2023-07-23 op section may include most of the server configuration rules
430 a1ba9650 2023-07-23 op .Ic alias , Ic cert , Ic key , Ic listen , Ic location
433 a1ba9650 2023-07-23 op .It Ic log Ar bool
434 a1ba9650 2023-07-23 op Enable or disable the logging for the current server or location block.
435 1595c277 2022-04-07 op .It Ic ocsp Ar file
436 1595c277 2022-04-07 op Specify an OCSP response to be stapled during TLS handshakes
437 1595c277 2022-04-07 op with this server.
440 1595c277 2022-04-07 op should contain a DER-format OCSP response retrieved from an
441 1595c277 2022-04-07 op OCSP server for the
444 1595c277 2022-04-07 op If the OCSP response in
446 1595c277 2022-04-07 op is empty, OCSP stapling will not be used.
447 1595c277 2022-04-07 op The default is to not use OCSP stapling.
448 d2da235a 2022-10-05 op .It Ic proxy Oo Cm proto Ar name Oc Oo Cm for-host Ar host Oo Cm port Ar port Oc Oc Brq ...
449 1595c277 2022-04-07 op Set up a reverse proxy.
450 1595c277 2022-04-07 op The optional matching rules
454 1595c277 2022-04-07 op can be used to enable proxying only for protocols matching
456 1595c277 2022-04-07 op .Po Dq gemini
459 1595c277 2022-04-07 op and/or whose request IRI matches
463 1595c277 2022-04-07 op .Pq 1965 by default .
464 1595c277 2022-04-07 op Matching happens using shell globbing rules.
466 1595c277 2022-04-07 op In case of multiple matching proxy blocks in the same context, the
467 1595c277 2022-04-07 op first matching proxy will be put into effect and the later ones
470 1595c277 2022-04-07 op Valid options are:
471 1595c277 2022-04-07 op .Bl -tag -width Ds
472 1595c277 2022-04-07 op .It Ic cert Ar file
473 1595c277 2022-04-07 op Specify the client certificate to use when making requests.
474 1595c277 2022-04-07 op .It Ic key Ar file
475 1595c277 2022-04-07 op Specify the client certificate key to use when making requests.
476 1595c277 2022-04-07 op .It Ic protocols Ar string
477 1595c277 2022-04-07 op Specify the TLS protocols allowed when making remote requests.
479 1595c277 2022-04-07 op .Xr tls_config_parse_protocols 3
480 1595c277 2022-04-07 op function for the valid protocol string values.
481 1595c277 2022-04-07 op By default, both TLSv1.2 and TLSv1.3 are enabled.
482 d2da235a 2022-10-05 op .It Ic relay-to Ar host Op Cm port Ar port
483 1595c277 2022-04-07 op Relay the request to the given
487 1595c277 2022-04-07 op 1965 by default.
488 1595c277 2022-04-07 op This is the only mandatory option in a
491 1595c277 2022-04-07 op .It Ic require Ic client Ic ca Ar file
492 1595c277 2022-04-07 op Allow the proxying only from clients that provide a certificate
493 1595c277 2022-04-07 op signed by the CA certificate in
495 1595c277 2022-04-07 op .It Ic sni Ar hostname
496 1595c277 2022-04-07 op Use the given
498 1595c277 2022-04-07 op instead of the one extracted from the
500 1595c277 2022-04-07 op rule for the TLS handshake with the proxied gemini server.
501 1595c277 2022-04-07 op .It Ic use-tls Ar bool
502 1595c277 2022-04-07 op Specify whether to use TLS when connecting to the proxied host.
503 1595c277 2022-04-07 op Enabled by default.
504 1595c277 2022-04-07 op .It Ic verifyname Ar bool
505 1595c277 2022-04-07 op Enable or disable the TLS server name verification.
506 1595c277 2022-04-07 op Enabled by default.
508 1595c277 2022-04-07 op .It Ic root Ar directory
509 1595c277 2022-04-07 op Specify the root directory for this server
510 1595c277 2022-04-07 op .Pq alas the current Dq document root .
511 1595c277 2022-04-07 op It's relative to the chroot if enabled.
512 1595c277 2022-04-07 op .It Ic require Ic client Ic ca Ar path
513 1595c277 2022-04-07 op Allow requests only from clients that provide a certificate signed by
514 1595c277 2022-04-07 op the CA certificate in
516 1595c277 2022-04-07 op It needs to be a PEM-encoded certificate and it's not relative to the
518 1595c277 2022-04-07 op .It Ic strip Ar number
521 1595c277 2022-04-07 op components from the beginning of the path before doing a lookup in the
522 1595c277 2022-04-07 op root directory.
523 1595c277 2022-04-07 op It's also considered for the
525 1595c277 2022-04-07 op parameter in the scope of a
526 1595c277 2022-04-07 op .Ic block return .
531 1595c277 2022-04-07 op section must include one or more lines of the following syntax, enclosed
532 1595c277 2022-04-07 op in curly brances:
533 1595c277 2022-04-07 op .Bl -tag -width Ds
534 7edcf2b3 2023-06-24 op .It Ar type Ns / Ns Ar subtype Ar name Op Ar name ...
535 1595c277 2022-04-07 op Set the media
539 1595c277 2022-04-07 op to the specified extension
541 1595c277 2022-04-07 op One or more names can be specified per line.
542 1595c277 2022-04-07 op Earch line may end with an optional semicolon.
543 1595c277 2022-04-07 op .It Ic include Ar file
544 1595c277 2022-04-07 op Include types definition from an external file, for example
545 1595c277 2022-04-07 op .Pa /usr/share/misc/mime.types .
550 5f03bf17 2022-04-08 op uses the following mapping if no
552 93cab6dc 2022-04-08 op block is defined:
554 1595c277 2022-04-07 op .Bl -tag -offset indent -width 15m -compact
555 1595c277 2022-04-07 op .It application/pdf
557 1595c277 2022-04-07 op .It image/gif
559 1595c277 2022-04-07 op .It image/jpeg
561 1595c277 2022-04-07 op .It image/png
563 1595c277 2022-04-07 op .It image/svg+xml
565 1595c277 2022-04-07 op .It text/gemini
567 1595c277 2022-04-07 op .It text/markdown
569 1595c277 2022-04-07 op .It text/x-patch
575 93cab6dc 2022-04-08 op As an exception,
577 93cab6dc 2022-04-08 op uses the MIME type
578 93cab6dc 2022-04-08 op .Ar text/gemini
579 93cab6dc 2022-04-08 op for file extensions
583 93cab6dc 2022-04-08 op if no mapping was found.
585 1595c277 2022-04-07 op The following is an example of a possible configuration for a site
586 1595c277 2022-04-07 op that enables only TLSv1.3, adds the MIME types mapping from
587 1595c277 2022-04-07 op .Pa /usr/share/misc/mime.types
588 1595c277 2022-04-07 op and defines two virtual host:
589 1595c277 2022-04-07 op .Bd -literal -offset indent
590 1595c277 2022-04-07 op protocols "tlsv1.3"
593 1595c277 2022-04-07 op include "/usr/share/misc/mime.types"
596 1595c277 2022-04-07 op server "example.com" {
597 7edcf2b3 2023-06-24 op listen on * port 1965
598 1595c277 2022-04-07 op cert "/etc/ssl/example.com.pem"
599 1595c277 2022-04-07 op key "/etc/ssl/private/example.com.key"
600 1595c277 2022-04-07 op root "/var/gemini/example.com"
603 1595c277 2022-04-07 op server "example.it" {
604 7edcf2b3 2023-06-24 op listen on * port 1965
605 1595c277 2022-04-07 op cert "/etc/ssl/example.it.pem"
606 1595c277 2022-04-07 op key "/etc/ssl/private/example.it.key"
607 1595c277 2022-04-07 op root "/var/gemini/example.it"
609 1595c277 2022-04-07 op # set the language for text/gemini files
614 1595c277 2022-04-07 op Yet another example, showing how to enable a
619 1595c277 2022-04-07 op .Bd -literal -offset indent
620 1595c277 2022-04-07 op chroot "/var/gemini"
623 1595c277 2022-04-07 op server "example.com" {
624 7edcf2b3 2023-06-24 op listen on * port 1965
626 1595c277 2022-04-07 op # absolute paths:
627 1595c277 2022-04-07 op cert "/etc/ssl/example.com.pem"
628 1595c277 2022-04-07 op key "/etc/ssl/private/example.com.key"
630 1595c277 2022-04-07 op # relative to the chroot:
631 1595c277 2022-04-07 op root "/example.com"
633 1595c277 2022-04-07 op location "/static/*" {
634 1595c277 2022-04-07 op # load the following rules only for
635 1595c277 2022-04-07 op # requests that matches "/static/*"
637 1595c277 2022-04-07 op auto index on
638 1595c277 2022-04-07 op index "index.gemini"
644 1595c277 2022-04-07 op .Xr slowcgi 8
649 1595c277 2022-04-07 op program was written by
650 1595c277 2022-04-07 op .An Omar Polo Aq Mt op@omarpolo.com .
