## /etc/merecat.conf                                     -*-conf-unix-*-
## This is a sample configuration file for Merecat httpd
## For more help and more settings, see merecat.conf(5).
##

## what interface to bind to?
## (default is binding to any interface)
#hostname=www.example.org

## Port to listen to, overrides command line argument
## Defaults to 80, or 443 when enabling HTTPS
#port = 80

## Unpriviliged user to run as, usually nobody or www-data
#username = nobody

## Global .htpasswd (true) or local per-directory (false)
#global-passwd = false

## Chrooting is a security measure which means isolating the webserver's
## access to files only available from a the given directory.  To access
## files outside the chroot the administrator can either copy or bind
## mount files and directories into the chroot.
#chroot = false

## Only useful if not chrooting
#check-symlinks = false

## Alt. charset=iso-8859-1
#charset = UTF-8

## Deflate (gzip) compression level: -1 .. 9
## -1: Default (zlib's reasonable default, currently 6)
##  0: Disabled
##  1: Best speed
##  9: Best compression
#compression-level = -1

## Webserver document root, or chroot
#directory = /var/www

## When chrooting, alt. document root inside chroot
## => /var/www/htdocs
#data-directory = /htdocs

## Skip dotfiles in dirlistings
#list-dotfiles = false

## Virtual hosting
## /var/www/cgi-bin/          <-- Shared CGI
## /var/www/git.example.com   <-- git.example.com
## /var/www/ftp.example.com   <-- ftp.example.com
#virtual-host = false

## Control the caching, in seconds, by setting the following header for
## all transactions.  Depends heavily on the content you provide, and
## this global setting is disabled by default.  It is recommended to
## instead set it per server location, e.g. for all image files.
##
##    Cache-Control: max-age=SEC
##
## Min max-age value 0 (browser caching disabled)
## Max max-age value 31536000 (1 year)
##
#max-age = 0

## Some bots behave really badly and may overload your server.  Often
## they cannot be blocked based on IP address, so the only means we are
## left with is User-Agent blocking.  Use patterns like this:
#user-agent-deny = "**SemrushBot**|**MJ12bot**|**DotBot**|**PetalBot**"

## Enable HTTPS support.  The certificate (public) and key (private) are
## required when enabling HTTPS support.  The (min) protocol and cipher
## settings are optional and have sane built-in defaults, e.g. 'protocol'
## defaults to TLSv1.1.  See ciphers(1) man page for possible values.
##
## Note: You may want to enable this on a per-server basis instead.
#ssl {
#    protocol = "TLSv1.1"
#    ciphers  = "..."
#    certfile = certs/cert.pem
#    keyfile  = private/key.pem
#    dhfile   = certs/dhparam.pem
#}

## The CGI module is a core part of Merecat httpd and is for security
## reasons disabled by default.  Like other modules it uses pattern
## matching to trigger the CGI functionality:
##	?	match a single char
##	*	matches any string excluding "/"
##	**	matches any string including "/"
##	separate multiple patterns with "|"
## Example: "**.sh|**.cgi"
##
## `limit` sets the max number of simultaneous CGI programs allowed.
##
## `setenv` passes custom environment variables to all CGI programs.
## Merecat scrubs the environment before forking CGI children, so any
## variables from the shell or systemd EnvironmentFile are not visible
## to CGI scripts.  Use `setenv` to inject variables directly.
##
## The below values are the default, so to enable CGI only `enabled`
## need to be set to 'true'.
#cgi "**.cgi|/cgi-bin/*" {
#    enabled = false
#    limit   = 50
#    setenv  = { "GIT_PROJECT_ROOT=/srv/repos", "GIT_HTTP_EXPORT_ALL=1" }
#}

## The PHP module is bolted on top of the CGI module, so the same limits
## apply also to PHP scripts.  The below are the built-in defaults.
## Verify the path to the php-cgi binary for your system and expand on
## the pattern if you have, e.g. .php5 files.
#php "**.php*" {
#    enabled  = false
#    cgi-path = "/usr/bin/php-cgi"
#}

## The SSI module, like PHP above, is built on top of the CGI module,
## and it also requires the Merecat SSI CGI script to be installed, the
## defaults are commented out below.  The silent setting controls the
## default <!--#config errmsg="..." --> value.
#ssi "**.shtml" {
#    enabled  = false
#    silent   = false
#    cgi-path = "cgi-bin/ssi"
#}

## Server specific settings, overrides certain global settings
## Notice the HTTP redirect from the default server to HTTPS.
#server default {
#    port = 80
#    redirect "/" {
#        code = 301
#        location = "https://$host$request_uri$args"
#    }
#}
#server secure {
#    port = 443
#    ssl {
#      certfile = /etc/letsencrypt/live/example.com/fullchain.pem
#      keyfile = /etc/letsencrypt/live/example.com/privkey.pem
#      dhfile = certs/dhparam.pem
#    }
#}

## Reverse proxy (proxy-pass): forward matching requests to a local backend.
## This is how you front a Node.js, Python, Go, or other app server with
## Merecat -- similar to nginx's proxy_pass directive.
##
## The backend URL is resolved at startup (no per-request DNS).  Only plain
## HTTP backends are supported (Merecat handles TLS termination).  IPv6
## backends use bracketed literals, e.g. "http://[::1]:3000".
##
## Request bodies and responses are buffered in full, capped at 8 MiB
## (413/502 beyond that), and a backend stalled for 60 seconds is dropped
## with a 502 to the client.
##
## When the backend URL includes a path (/v2 below), the matched URL prefix
## is stripped and replaced with the backend path:
##   GET /api/users/42  →  GET /v2/users/42  (sent to localhost:3000)
##
## Without a backend path, the original URI is forwarded unchanged:
##   GET /api/users/42  →  GET /api/users/42  (sent to localhost:3000)
##
## proxy-redirect rewrites Location: and Refresh: headers in the backend
## response.  Use it when the backend redirects to absolute URLs that include
## its own host or path prefix and you need them rewritten to the frontend URL.
##
##   proxy-redirect = "FROM TO"
##
## Any response header starting with FROM is rewritten so that prefix
## becomes TO.  Both are literal URL prefixes separated by a space.
##
## Up to 8 proxy-pass rules are supported per server block.
##
#server default {
#    port = 80
#
#    ## Proxy /api/** to a local app server
#    proxy-pass "/api/**" {
#        backend = "http://localhost:3000"
#    }
#
#    ## Proxy /app/** to a backend that redirects using its own URL prefix.
#    ## proxy-redirect rewrites those Location: headers so browsers follow
#    ## the /app/ prefix instead of hitting the backend port directly.
#    proxy-pass "/app/**" {
#        backend        = "http://localhost:4000/"
#        proxy-redirect = "http://localhost:4000 http://localhost"
#    }
#
#    ## Serve static files from the filesystem for everything else
#}
#
## Combined HTTPS + reverse proxy example:
#server secure {
#    port    = 443
#    certfile = /etc/letsencrypt/live/example.com/fullchain.pem
#    keyfile  = /etc/letsencrypt/live/example.com/privkey.pem
#
#    proxy-pass "/api/**" {
#        backend = "http://localhost:3000"
#    }
#}

## Multihoming (virtual-host) + proxy-pass: route different virtual hosts
## to different backends on the same port.  Enable virtual-host mode so
## Merecat reads the Host: header, then use the optional "host" key in each
## proxy-pass rule to restrict which vhost the rule applies to.
##
## Example: git.example.com → local Forgejo on :3000
##          www.example.com → static files served from /var/www/www.example.com/
##
#virtual-host = true
#
#server secure {
#    port    = 443
#    certfile = /etc/letsencrypt/live/example.com/fullchain.pem
#    keyfile  = /etc/letsencrypt/live/example.com/privkey.pem
#
#    ## Forward all requests for git.example.com to a local Forgejo instance
#    proxy-pass "/**" {
#        host    = "git.example.com"
#        backend = "http://localhost:3000"
#    }
#
#    ## www.example.com is served from /var/www/www.example.com/ (no proxy rule)
#}
