As promissed, a stab at some more dumbed down instructions. (So at least I might be able to figure this out again later)
===================== Checklist For stunnel + althttpd + fossil configuration This configuration allows for multiple fossil projects, static contents, other non-fossil cgi content, to all be served with a single IP address and domain name using only the standard http and https ports (80/443) -You will need a user account. Many/most systems use www-data and are already have this account created. -Start with a dedicated directory for everything. Example “/repos”. The www-data user needs read and write permission. -Generate stunnel keys -Configure and restart stunnel. Example stunnel.conf cert = /etc/ssl/certs/stunnel.pem key = /etc/ssl/certs/stunnel.pem sslVersion = SSLv3 pid = /var/run/stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [https] accept = 443 TIMEOUTclose = 0 exec = /usr/local/bin/althttpd execargs = /usr/local/bin/althttpd -logfile althttpd.log -root /repos -user www-data -https 1 In this example configuration, stunnel does not enter into a chroot environment, nor does it change from another user besides root. Both of these tasks will be left (optionally) to althttpd. -After cranking that up, netstat -ltnp should output a line that looks similar to: tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 29333/stunnel4 -Because althttpd itself is not being run inside a chroot environment, it can be built with static or dynamic linkage. Example gcc althttpd.c -o althttpd mv althttpd /usr/local/bin/ -There is no althttpd configuration file. The configuration is the command line given to it. In this the “execargs” line in the stunnel.conf file. The option -root /repos means that a chroot WILL be taking place., which means that the cgi programs that it runs will all see /repos as /. Therefore either the C runtime library (pretty much /lib/*), and possibly other will need to be inside there, or static linking will be required. “-user www-data” is of course the user to run programs as and access files as (so again everything in /repos needs read/write/execute permission with user www-data). The “-https 1“ is required to get CGI scripts (fossil) to return the correct “https” prefix in the generated urls. -Again, because of the chroot, “-logfile althttpd.log” will mean that the althttpd log file would be /repos/althttpd.log -To build fossil for static linkage try: ./configure --static --with-ssl=none make clean make -althttpd looks for directories that end with the .website suffix, and defaulting to default.website. So create one or more directories like this /repos/project1.website /repos/project2.website, which will then corrispond to the URLs https://domainname/project1, and https://domainname/project2. You could then create a symlink (or just have one project as) to default.website, so one of those comes up as just https://domainname/. -Inside the above directories, create fossil cgi wrapper scripts, ie #!/fossil repository: /project2/project2.fossil -This would require the fossil executable to be at /repos/fossil, and the fossil project file to be at /repos/project2/project2.fossil -If this wrapper script is name /repos/project2/foo (needs to be executable), then the url would be https://domainname/project2/foo -Make sure there is a /tmp folder in the chroot environment for CGI POSTs to work, ie /repos/tmp. Again check permissions. -Regular non-ssl http support comes from configuring inetd or xinetd. [email protected] 1/10/12 _______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
