Next commands start gateway services:
@@ -706,9 +716,24 @@ A.B.C.D - W.X.Y.Z (since 0.8) or CIDRs (W.X.Y.Z/L). Since addresses. It´s possible to use a wildmask in the beginning and at the end of the hostname, e.g. *badsite.com or *badcontent*. The hostname is only checked if a hostname -is present in the request. Targetportlist may contain ports -(X) or port ranges lists (X-Y). For any field * sign means -ANY. If access list is empty it´s assumed to beThe +httpsrv service answers requests itself instead of +forwarding them. What it does with a request is decided by +http rules, which are taken in the order they are +written: the first whose host and URL both match handles the +request. Rules belong to the service that follows them, the +way access rules do, and admin is httpsrv with +a set of rules already in place.
+ +http
+OPERATION HOST URL [PARAMETERS]
+Handle a request for URL on HOST with
+OPERATION. HOST is matched against the Host header,
+URL against the path, with the query string removed.
file
+PATH [TYPE [MAX-AGE [HEADERS [CODE]]]] - send the
+file at PATH. The file is handed to the socket by the system
+where it can do that (sendfile, TransmitFile) and read here
+where it cannot, as when the connection carries TLS. The
+arguments after PATH are described below, and each of them
+may be written as * to leave it out.
+cache PATH [TYPE [MAX-AGE [HEADERS [CODE]]]] -
+the same, but the file is read into memory on the first
+request and answered from there afterwards. A file that has
+changed on disk is read again, and one larger than a
+megabyte is sent as file would. With a MAX-AGE the
+file is not looked at again for that long: the rule has
+already told clients the file may be treated as unchanged
+for that time, so the server treats its own copy the same
+way and a request costs nothing but the copy out. Without
+one every request stats the file, so a change is picked up
+at once.
+reply [CODE [HEADERS]] - answer with a status and
+nothing else. CODE is the status to send, 200 without one. A
+status which carries no body of its own (1xx, 204, 304) is
+sent without a length; anything else is sent with a length
+of zero.
+redir [CODE] LOCATION - answer with a redirect.
+CODE is 301 or 302, or any status from 300 to 399; without
+one, 302 is used.
+rewrite PATH - change the path of the request and
+hand it to the rules that follow this one.
+rewrite_host HOST - the same for the host, which
+decides which of the rules after it match. $1 upwards
+stand for what the stars, or the groups, of this
+rule´s host pattern matched, the way they stand for
+those of the URL in a rewrite. What is built has to
+be a host name; the name the client sent is what access
+rules matched and what the log records.
+echo - answer with a description of the request: the
+method, path, query, host, and the address and port it came
+from. For testing.
+data [size=N] [block=N] [status=N] [chunked=1]
+[delay=N] - answer with generated content of the size
+asked for. For testing.
+proxypass - hand the request to the proxy code, which
+fetches it the way proxy would, see BOTH A SITE AND A
+PROXY.
+admin, admin_counters, admin_reload,
+admin_services - the pages of the administration
+interface.
TYPE is
+the content type to answer with. Without it, or with
+*, the type is worked out from the name of the file,
+see http_content_type.
+MAX-AGE is a number of seconds, and is sent as
+Cache-Control: max-age. Without it, or with *,
+nothing is said about caching.
+HEADERS is one argument holding whole header lines,
+separated by a backslash and an n - the two characters,
+since a configuration line cannot carry a line ending. Each
+becomes a real line ending in the answer. Quote the argument
+if any header holds a space, which they usually do.
+CODE is the status to answer with instead of 200, which
+is how a file serves as the body of an error page.
+A rule’s headers and MAX-AGE go with whatever status
+that rule asked for. They are not sent with a refusal the
+server itself decided on: a request for a file which is not
+there is answered 404 by the server, not by the rule.
+
+file and cache send Last-Modified, and answer a
+request carrying If-Modified-Since with 304 and no body when
+the file has not changed since the time it names. All three
+date formats HTTP allows are read; one which cannot be read
+is treated as no date at all. A rule answering with a CODE
+of its own is answering something other than the file, so it
+is never turned into a 304.
+http file * /err/** "/usr/local/web/404.html"
+text/html * "X-Served: static" 404
+http reply * /health** 200 "X-Health: ok"
+http reply * /down** 503 "Retry-After: 30"
http_content_type
+EXTENSION TYPE
+Answer for a file with that extension with that content
+type, in addition to the types already known. The extension
+may be written with or without its dot. A type named by a
+rule is used whatever this says, and a name the server knows
+nothing about is answered as application/octet-stream.
+http_content_type .webp image/webp
A URL is matched
+with stars, or with a regular expression when it carries a
+pcre: prefix (regex: is taken as well). A host
+is matched the way an access list matches one, and takes the
+same prefix.
+* stands for any run of characters within one element of
+the path: it does not cross a /, so a rule cannot
+reach into a directory it did not name.
+** crosses them, and is what a rule which should match
+everything below a point, or everything at all, is written
+with.
+Each star, and each group of a regular expression, is
+remembered in the order it appears. $1 upwards stand
+for them in the path or location a rule builds, and
+$0 for the whole request path.
+Outside quotes a dollar begins the name of a file to
+include, so an argument holding one - a path or location
+built with $1, a regular expression anchored with
+$ - is written in quotes. $$ stands for a
+single dollar and is not read as an include either, which is
+how a dollar reaches a rule as text.
A request may
+arrive the way it arrives at a site, naming a path and a
+host in the Host header, or the way it arrives at a proxy,
+naming the whole URL, or, for a tunnel, the host alone with
+CONNECT. Both are read. A request in the proxy form
+authenticates with Proxy-Authorization and is refused with
+407, as a proxy refuses one; a request in the site form uses
+Authorization and 401.
+What answers a request is still decided by the rules.
+proxypass is the rule which answers by fetching, so a
+service can serve what it has and proxy the rest:
+http file * /local/** "/usr/local/web/$1"
+http proxypass * /**
+httpsrv -p8080
+The same happens without a rule for it where an access rule
+redirects to the local proxy, which is written as a chain of
+no address: the rules are asked first, and a request none of
+them answers is fetched.
+allow *
+parent 1000 http 0.0.0.0 0
+allow *
+The second allow is what the proxy matches on the
+pass it makes itself: a rule carrying the chain is not taken
+twice. Authentication happens twice for the same reason,
+once for the service and once for the proxy, so a
+configuration asking for credentials asks for them as a
+proxy does.
+The access rules are read from the top on both passes, and
+it is the second pass which describes where the request is
+going. On the first one the service is answering for itself,
+so the destination an address or a port is matched against
+is the address the client connected to; the name from the
+request is matched on both. On the second the destination is
+the one the request names, so rules written with an address,
+a port or a name decide what the proxy is allowed to fetch,
+and they decide it before the connection is made:
+allow *
+parent 1000 http 0.0.0.0 0
+allow * * * 80,443
+deny *
+Everything reaches the rules, and only ports 80 and 443 are
+fetched. A rule before the one carrying the chain applies on
+both passes just the same, so a deny written there
+stops the request as well.
+The connection to the server is kept for the request after
+it, and closed when the request after it goes somewhere
+else, or when the server has closed it in the meantime. A
+tunnel is fetched by the proxy code as well, which means the
+connection carrying it belongs to that request alone.
An answer is
+sent as HTTP/1.1 to a client which asked in HTTP/1.1, and
+the connection is kept for the next request unless the
+client sent Connection: close. A 1.0 client gets a
+1.0 answer, and the connection is kept only when it asked
+with Connection: keep-alive.
+The connection is kept only when what was sent is framed
+exactly: every operation but the administration pages states
+a length, or sends a chunked body a 1.1 client can read, so
+the pages of admin are always the last thing on a
+connection. A request body which cannot be read to its end
+ends the connection as well: one sent with
+Transfer-Encoding, which this server does not read,
+and one longer than a megabyte, which it will not.
The path a rule
+builds is used as it is, so it is refused rather than
+corrected when it is not a plain full path. A relative path
+is refused: it would be read against whatever directory the
+service happens to be in. So is one holding . or
+.. as an element, a carriage return, a newline or a
+star. On Windows a path must name a drive or a share, and is
+converted to the extended \\?\ form and opened through the
+wide interface, so a long path works.
+A request is checked before any of this: a path which
+decodes to one leaving the tree is refused outright.
http file
+example.com /my/webpath/*.html
+"/usr/local/web/$1.html"
+http cache example.com
+"pcre:ˆ/(.*)/pic/(.*).(gif|jpeg)$"
+"/usr/local/web/picts/$1/$2.$3"
+http redir * /old/** 301 "https://example.org/$1"
+
+http rewrite * /alias/** "/w/$1"
+http rewrite_host *.old.example **
+"$1.new.example"
+http file * /static/** "/usr/local/web/static/$1"
+
+httpsrv -p8080