1####################################################################### 2## 3## /etc/lighttpd/lighttpd.conf 4## 5## check /etc/lighttpd/conf.d/*.conf for the configuration of modules. 6## 7####################################################################### 8 9####################################################################### 10## 11## Some Variable definition which will make chrooting easier. 12## 13## if you add a variable here. Add the corresponding variable in the 14## chroot example as well. 15## 16var.log_root = "/var/log/lighttpd" 17var.server_root = "/srv/www" 18var.state_dir = "/run" 19var.home_dir = "/var/lib/lighttpd" 20var.conf_dir = "/etc/lighttpd" 21 22## 23## run the server chrooted. 24## 25## This requires root permissions during startup. 26## 27## If you run chroot'ed, set the variables to directories relative to 28## the chroot dir. 29## 30## example chroot configuration: 31## 32#var.log_root = "/logs" 33#var.server_root = "/" 34#var.state_dir = "/run" 35#var.home_dir = "/lib/lighttpd" 36#var.vhosts_dir = "/vhosts" 37#var.conf_dir = "/etc" 38# 39#server.chroot = "/srv/www" 40 41## 42## Some additional variables to make the configuration easier 43## 44 45## 46## Base directory for all virtual hosts 47## 48## used in: 49## conf.d/evhost.conf 50## conf.d/simple_vhost.conf 51## vhosts.d/vhosts.template 52## 53var.vhosts_dir = server_root + "/vhosts" 54 55## 56## Cache for mod_deflate 57## 58## used in: 59## conf.d/deflate.conf 60## 61var.cache_dir = "/var/cache/lighttpd" 62 63## 64## Base directory for sockets. 65## 66## used in: 67## conf.d/fastcgi.conf 68## conf.d/scgi.conf 69## 70var.socket_dir = home_dir + "/sockets" 71 72## 73####################################################################### 74 75####################################################################### 76## 77## Load the modules. 78include conf_dir + "/modules.conf" 79 80## 81####################################################################### 82 83####################################################################### 84## 85## Basic Configuration 86## --------------------- 87## 88server.port = 80 89 90## 91## bind to a specific IP 92## (default: "*" for all local IPv4 interfaces) 93## 94#server.bind = "localhost" 95 96## 97## Run as a different username/groupname. 98## This requires root permissions during startup. 99## 100server.username = "lighttpd" 101server.groupname = "lighttpd" 102 103## 104## Enable lighttpd to serve requests on sockets received from systemd 105## https://www.freedesktop.org/software/systemd/man/systemd.socket.html 106## 107#server.systemd-socket-activation = "enable" 108 109## 110## enable core files. 111## 112#server.core-files = "disable" 113 114## 115## Document root 116## 117server.document-root = server_root + "/htdocs" 118 119## 120## The value for the "Server:" response field. 121## 122## It would be nice to keep it at "lighttpd". 123## 124#server.tag = "lighttpd" 125 126## 127## store a pid file 128## 129server.pid-file = state_dir + "/lighttpd.pid" 130 131## 132####################################################################### 133 134####################################################################### 135## 136## Logging Options 137## ------------------ 138## 139## all logging options can be overwritten per vhost. 140## 141## Path to the error log file 142## 143server.errorlog = log_root + "/error.log" 144 145## 146## If you want to log to syslog you have to unset the 147## server.errorlog setting and uncomment the next line. 148## 149#server.errorlog-use-syslog = "enable" 150 151## 152## Access log config 153## 154include conf_dir + "/conf.d/access_log.conf" 155 156## 157## The debug options are moved into their own file. 158## see conf.d/debug.conf for various options for request debugging. 159## 160include conf_dir + "/conf.d/debug.conf" 161 162## 163####################################################################### 164 165####################################################################### 166## 167## Tuning/Performance 168## -------------------- 169## 170## corresponding documentation: 171## https://wiki.lighttpd.net/Docs_Performance 172## 173## set the event-handler (read the performance section in the manual) 174## 175## The recommended server.event-handler is chosen by default for each OS. 176## 177## epoll (recommended on Linux) 178## kqueue (recommended on *BSD and MacOS X) 179## solaris-eventports (recommended on Solaris) 180## poll (recommended if none of above are available) 181## select (*not* recommended) 182## 183#server.event-handler = "linux-sysepoll" 184 185## 186## The basic network interface for all platforms at the syscalls read() 187## and write(). Every modern OS provides its own syscall to help network 188## servers transfer files as fast as possible 189## 190#server.network-backend = "sendfile" 191 192## 193## As lighttpd is a single-threaded server, its main resource limit is 194## the number of file descriptors, which is set to 1024 by default (on 195## most systems). 196## 197## If you are running a high-traffic site you might want to increase this 198## limit by setting server.max-fds. 199## 200## Changing this setting requires root permissions on startup. see 201## server.username/server.groupname. 202## 203## By default lighttpd would not change the operation system default. 204## But setting it to 16384 is a better default for busy servers. 205## 206## With SELinux enabled, this is denied by default and needs to be allowed 207## by running the following once: setsebool -P httpd_setrlimit on 208## 209server.max-fds = 16384 210 211## 212## listen-backlog is the size of the listen() backlog queue requested when 213## the lighttpd server ask the kernel to listen() on the provided network 214## address. Clients attempting to connect() to the server enter the listen() 215## backlog queue and wait for the lighttpd server to accept() the connection. 216## 217## The out-of-box default on many operating systems is 128 and is identified 218## as SOMAXCONN. This can be tuned on many operating systems. (On Linux, 219## cat /proc/sys/net/core/somaxconn) Requesting a size larger than operating 220## system limit will be silently reduced to the limit by the operating system. 221## 222## When there are too many connection attempts waiting for the server to 223## accept() new connections, the listen backlog queue fills and the kernel 224## rejects additional connection attempts. This can be useful as an 225## indication to an upstream load balancer that the server is busy, and 226## possibly overloaded. In that case, configure a smaller limit for 227## server.listen-backlog. On the other hand, configure a larger limit to be 228## able to handle bursts of new connections, but only do so up to an amount 229## that the server can keep up with responding in a reasonable amount of 230## time. Otherwise, clients may abandon the connection attempts and the 231## server will waste resources servicing abandoned connections. 232## 233## It is best to leave this setting at its default unless you have modelled 234## your traffic and tested that changing this benefits your traffic patterns. 235## 236## Default: 1024 237## 238#server.listen-backlog = 128 239 240## 241## Stat() call caching. 242## 243## lighttpd can utilize FAM/Gamin to cache stat call. 244## 245## possible values are: 246## disable, simple, inotify, kqueue, or fam. 247## 248#server.stat-cache-engine = "simple" 249 250## 251## Fine tuning for the request handling 252## 253## max-connections == max-fds/3) 254## (other file handles are used for fastcgi/files) 255## 256#server.max-connections = 1024 257 258## 259## How many seconds to keep a keep-alive connection open, 260## until we consider it idle. 261## 262## Default: 5 263## 264#server.max-keep-alive-idle = 5 265 266## 267## How many keep-alive requests until closing the connection. 268## 269## Default: 16 270## 271#server.max-keep-alive-requests = 16 272 273## 274## Maximum size of a request in kilobytes. 275## By default it is unlimited (0). 276## 277## Uploads to your server cant be larger than this value. 278## 279#server.max-request-size = 0 280 281## 282## Time to read from a socket before we consider it idle. 283## 284## Default: 60 285## 286#server.max-read-idle = 60 287 288## 289## Time to write to a socket before we consider it idle. 290## 291## Default: 360 292## 293#server.max-write-idle = 360 294 295## 296## Traffic Shaping 297## ----------------- 298## 299## see /usr/share/doc/lighttpd/traffic-shaping.txt 300## 301## Values are in kilobyte per second. 302## 303## Keep in mind that a limit below 32kB/s might actually limit the 304## traffic to 32kB/s. This is caused by the size of the TCP send 305## buffer. 306## 307## per server: 308## 309#server.kbytes-per-second = 128 310 311## 312## per connection: 313## 314#connection.kbytes-per-second = 32 315 316## 317####################################################################### 318 319####################################################################### 320## 321## Filename/File handling 322## ------------------------ 323 324## 325## files to check for if .../ is requested 326## index-file.names = ( "index.php", "index.rb", "index.html", 327## "index.htm", "default.htm" ) 328## 329index-file.names += ( 330 "index.xhtml", "index.html", "index.htm", "default.htm", "index.php" 331) 332 333## 334## deny access the file-extensions 335## 336## ~ is for backupfiles from vi, emacs, joe, ... 337## .inc is often used for code includes which should in general not be part 338## of the document-root 339url.access-deny = ( "~", ".inc" ) 340 341## 342## disable range requests for pdf files 343## workaround for a bug in the Acrobat Reader plugin. 344## (ancient; should no longer be needed) 345## 346#$HTTP["url"] =~ "\.pdf$" { 347# server.range-requests = "disable" 348#} 349 350## 351## url handling modules (rewrite, redirect) 352## 353#url.rewrite = ( "^/$" => "/server-status" ) 354#url.redirect = ( "^/wishlist/(.+)" => "http://www.example.com/$1" ) 355 356## 357## both rewrite/redirect support back reference to regex conditional using %n 358## 359#$HTTP["host"] =~ "^www\.(.*)" { 360# url.redirect = ( "^/(.*)" => "http://%1/$1" ) 361#} 362 363## 364## which extensions should not be handle via static-file transfer 365## 366## .php, .pl, .fcgi are most often handled by mod_fastcgi or mod_cgi 367## 368static-file.exclude-extensions = ( ".php", ".pl", ".fcgi", ".scgi" ) 369 370## 371## error-handler for all status 400-599 372## 373#server.error-handler = "/error-handler.html" 374#server.error-handler = "/error-handler.php" 375 376## 377## error-handler for status 404 378## 379#server.error-handler-404 = "/error-handler.html" 380#server.error-handler-404 = "/error-handler.php" 381 382## 383## Format: <errorfile-prefix><status-code>.html 384## -> ..../status-404.html for 'File not found' 385## 386#server.errorfile-prefix = server_root + "/htdocs/errors/status-" 387 388## 389## mimetype mapping 390## 391include conf_dir + "/conf.d/mime.conf" 392 393## 394## directory listing configuration 395## 396include conf_dir + "/conf.d/dirlisting.conf" 397 398## 399## Should lighttpd follow symlinks? 400## default: "enable" 401#server.follow-symlink = "enable" 402 403## 404## force all filenames to be lowercase? 405## 406#server.force-lowercase-filenames = "disable" 407 408## 409## defaults to /var/tmp as we assume it is a local harddisk 410## default: "/var/tmp" 411#server.upload-dirs = ( "/var/tmp" ) 412 413## 414####################################################################### 415 416####################################################################### 417## 418## SSL Support 419## ------------- 420## 421## https://wiki.lighttpd.net/Docs_SSL 422# 423## To enable SSL for the whole server you have to provide a valid 424## certificate and have to enable the SSL engine.:: 425## 426## server.modules += ( "mod_openssl" ) 427## 428## ssl.privkey = "/path/to/privkey.pem" 429## ssl.pemfile = "/path/to/fullchain.pem" 430## # ssl.pemfile should contain the sorted certificate chain, including 431## # intermediate certificates, as provided by the certificate issuer. 432## # If both privkey and cert are in same file, specify only ssl.pemfile. 433## 434## # Check your cipher list with: openssl ciphers -v '...' 435## # (use single quotes with: openssl ciphers -v '...' 436## # as your shell won't like ! in double quotes) 437## #ssl.cipher-list = "HIGH" # default 438## 439## # (recommended to accept only TLSv1.2 and TLSv1.3) 440## #ssl.openssl.ssl-conf-cmd = ("MinProtocol" => "TLSv1.2") # default 441## 442## $SERVER["socket"] == "*:443" { 443## ssl.engine = "enable" 444## } 445## $SERVER["socket"] == "[::]:443" { 446## ssl.engine = "enable" 447## } 448## 449####################################################################### 450 451####################################################################### 452## 453## custom includes like vhosts. 454## 455#include conf_dir + "/conf.d/config.conf" 456#include conf_dir + "/vhosts.d/*.conf" 457## 458####################################################################### 459