# OpenBSD httpd(8) configuration for a Repo Renderer site, for
# /etc/repo-render/httpd.conf, which /etc/httpd.conf includes. It needs
# OpenBSD 8.0 or later, whose httpd can set response headers.
#
# It serves plain HTTP on the config's listen address; relayd(8)
# terminates TLS and forwards to it.
#
# `repo-render httpd-conf` writes this for the configured host and
# htdocs, from the rules the development server serves by, and the tests
# check that `repo-render serve` behaves as this config does.
#
# httpd.conf(5) and patterns(7) govern how this reads:
#   - a request takes the first location that matches it, and only that
#     one, so every rule a path needs is in its one location block;
#   - a location keeps the server's headers, and replaces any it sets
#     again by name; it keeps the server's gzip-static unless it says
#     gzip-static or no gzip-static itself;
#   - by default (static-cache-control) every file is sent with
#     "Cache-Control: no-cache" and its Last-Modified, so a browser asks
#     again each time and gets a 304 if the file has not changed; a
#     "header set" of Cache-Control replaces that;
#   - a "request rewrite" happens once, then the new path is looked up
#     again, and the location that finds is the one that serves it;
#   - "location match" takes Lua patterns, not regular expressions: %
#     escapes, as in %. and %-, and there is no | alternation;
#   - a plain location is a shell glob, where * also matches /;
#   - a directory is redirected to its path with a trailing slash, which
#     serves its index.html, or 403 if it has none.
#
# The headers are required, not optional: the pages carry no Content
# Security Policy of their own, and raw files are served under their real
# names, so the sandbox policy on /raw and /svg is what stops active
# content from running as part of the site.

{{if .Types}}# So /raw images (png, svg, …) get an image type; everything else falls
# back to the server's `default type text/plain`.
types {
	include "/usr/share/misc/mime.types"
}
{{end}}
server "{{.Host}}" {
{{range .Aliases}}	alias {{printf "%q" .}}
{{end}}	listen on {{.Addr}} port {{.Port}}
	# Log the client's address that relayd passes on, not relayd's.
	log style forwarded
	root "{{.Root}}"
	default type text/plain
	errdocs "{{.Root}}/err"
	# Serve foo.gz, which the renderer writes beside foo, to browsers that
	# take gzip.
	gzip-static

	# Pages run only the site's two scripts: ui.js, and search.js, which
	# fetches the search corpus in a worker. They frame the file drawer
	# and the download list, and no other site may frame them.
{{range .Headers}}	header set {{index . 0 | printf "%q"}} {{index . 1 | printf "%q"}} always
{{end}}
	# acme-client(1)'s challenges, for certificates relayd serves.
	location "/.well-known/acme-challenge/*" {
		root "/acme"
		request strip 2
	}
{{range .Locations}}
{{range .Doc}}	#{{if .}} {{.}}{{end}}
{{end}}	location {{.Head}} {
{{range .Body}}		{{.}}
{{end}}	}
{{end}}}