First WIP of rework to lighttpd

lighttpd/README.md

@@ -0,0 +1,7 @@
+lighttpd
+lighttpd-mod-auth
+lighttpd-mod-authn_file
+lighttpd-mod-cgi
+lighttpd-mod-openssl
+lighttpd-mod-proxy
+printf "USER:$(openssl passwd -crypt PASSWORD)\n" >> .htpasswd

lighttpd/gencert.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \
+    -subj "/C=US/ST=MI/L=Romulus/O=RMIITools/CN=localhost" \
+    -keyout server.key -out server.crt

lighttpd/lighttpd.conf

@@ -0,0 +1,47 @@
+server.modules = (
+    "mod_redirect",
+    "mod_cgi",
+    "mod_proxy",
+    "mod_openssl",
+    "mod_authn_file",
+)
+
+server.username = "nobody"
+server.groupname = "nogroup"
+
+server.port = 80
+server.document-root = "/usrdata/simpleadmin/www"
+index-file.names = ( "index.html" )
+
+auth.backend = "htpasswd"
+auth.backend.htpasswd.userfile = "/usrdata/lighttpd/.htpasswd"
+
+$SERVER["socket"] == "0.0.0.0:443" {
+    ssl.engine = "enable"
+    ssl.privkey= "/usrdata/lighttpd/server.key"
+    ssl.pemfile= "/usrdata/lighttpd/server.crt"
+    ssl.acme-tls-1 = "/etc/lighttpd/dehydrated/tls-alpn-01"
+    ssl.openssl.ssl-conf-cmd = ("MinProtocol" => "TLSv1.2") # (lighttpd 1.4.56 default; recommended to accept only TLSv1.2 and TLSv1.3)
+    auth.require = ( "/" => (
+      "method" => "basic",
+      "realm" => "Authorized users only",
+      "require" => "valid-user"
+      )
+    )
+}
+
+# Redirect everything to https
+$HTTP["scheme"] == "http" {
+    url.redirect = ("" => "https://${url.authority}${url.path}${qsa}")
+}
+
+# Anything in /cgi-bin will be run as a script
+$HTTP["url"] =~ "/cgi-bin/" {
+    cgi.assign = ( "" => "" )
+}
+
+# Handle proxy to ttyd if it's running
+$HTTP["url"] =~ "(^/ttyd)" {
+  proxy.header = ("map-urlpath" => ( "/ttyd" => "/" ), "upgrade" => "enable" )
+  proxy.server  = ( "" => ("" => ( "host" => "127.0.0.1", "port" => 8443 )))
+}

lighttpd/lighttpd.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Lighttpd Daemon
+After=network.target
+
+[Service]
+Type=simple
+PIDFile=/opt/var/run/lighttpd.pid
+ExecStartPre=/opt/sbin/lighttpd -tt -f /usrdata/lighttpd/lighttpd.conf
+ExecStart=/opt/sbin/lighttpd -D -f /usrdata/lighttpd/lighttpd.conf
+ExecReload=/bin/kill -USR1 $MAINPID
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target