-
Notifications
You must be signed in to change notification settings - Fork 0
/
openacs-config.tcl
1020 lines (907 loc) · 39.4 KB
/
openacs-config.tcl
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
######################################################################
#
# Config parameter for an OpenACS site using NaviServer.
#
# These default settings will only work in limited circumstances.
# Two servers with default settings cannot run on the same host
#
######################################################################
ns_log notice "nsd.tcl: starting to read configuration file..."
#---------------------------------------------------------------------
# Port settings:
# Change the HTTP and HTTPS port to e.g. 80 and 443 for production
# use. Setting the HTTPS port to 0 means to active the https
# driver for ns_http, but do not listen on this port.
#
# Note: If port is privileged (usually < 1024), OpenACS must be
# started by root, and the run script must contain the flag '-b
# address:port' which matches the address and port as specified below.
#
# httpsport 0
# httpsport 8443
#
# The "hostname" and "ipaddress" should be set to actual values such
# that the server is reachable over the Internet. The default values
# are fine for testing purposes. One can specify for the "ipaddress"
# also multiple values (e.g. IPv4 and IPv6).
#
# hostname localhost
# ipaddress 127.0.0.1 ;# listen on loopback via IPv4
# ipaddress 0.0.0.0 ;# listen on all IPv4 addresses
# ipaddress ::1 ;# listen on loopback via IPv6
# ipaddress ::0 ;# listen on all IPv6 addresses
#
# All default variables in defaultConfig can be overloaded by
# 1) setting these variables in this file (highest precedence)
# 2) setting these variables as environment variables with
# the "oacs_" prefix (suitable for e.g. docker setups)
# 3) set the variables from the default values.
#
set defaultConfig {
hostname localhost
ipaddress 127.0.0.1
httpport 8000
httpsport ""
server "openacs"
serverroot /var/www/$server
logroot $serverroot/log/
homedir /usr/local/ns
bindir $homedir/bin
db_name $server
db_user $server
db_host localhost
db_port ""
}
set servername "New OpenACS Installation - Development"
# Are we running behind a proxy?
set proxy_mode false
#---------------------------------------------------------------------
# Which database do you want to use? PostgreSQL or Oracle?
#
set database postgres
if { $database eq "oracle" } {
set db_password "openacs"
set ::env(ORACLE_HOME) /opt/oracle/product/19c/dbhome_1
set ::env(NLS_DATE_FORMAT) YYYY-MM-DD
set ::env(NLS_TIMESTAMP_FORMAT) "YYYY-MM-DD HH24:MI:SS.FF6"
set ::env(NLS_TIMESTAMP_TZ_FORMAT) "YYYY-MM-DD HH24:MI:SS.FF6 TZH:TZM"
set ::env(NLS_LANG) American_America.UTF8
if {$db_port eq ""} {
set db_port 1521
}
#set datasource ""
set datasource ${db_host}:${db_port}/$db_name ;# name of the pluggable database / service
}
#---------------------------------------------------------------------
# If debug is false, all debugging will be turned off.
set debug false
set dev false
set verboseSQL false
set max_file_upload_mb 20
set max_file_upload_min 5
#---------------------------------------------------------------------
# Set headers that should be included in every response from the
# server.
#
set nssock_extraheaders {
X-Frame-Options "SAMEORIGIN"
X-Content-Type-Options "nosniff"
X-XSS-Protection "1; mode=block"
Referrer-Policy "strict-origin"
}
set nsssl_extraheaders {
Strict-Transport-Security "max-age=31536000; includeSubDomains"
}
append nsssl_extraheaders $nssock_extraheaders
######################################################################
#
# End of instance-specific settings
#
# Nothing below this point need be changed in a default install.
#
######################################################################
#
# For all potential variables, allow environment variables such as
# "oacs_httpport" or "oacs_ipaddress" to override local values.
#
source [file dirname [ns_info nsd]]/../tcl/init.tcl
ns_configure_variables "oacs_" $defaultConfig
#---------------------------------------------------------------------
# Set environment variables HOME and LANG. HOME is needed since
# otherwise some programs called via exec might try to write into the
# root home directory.
#
set env(HOME) $homedir
set env(LANG) en_US.UTF-8
ns_logctl severity "Debug(ns:driver)" $debug
#---------------------------------------------------------------------
#
# NaviServer's directories. Auto-configurable.
#
#---------------------------------------------------------------------
# Where are your pages going to live ?
set pageroot ${serverroot}/www
set directoryfile "index.tcl index.adp index.html index.htm"
#---------------------------------------------------------------------
# Global server parameters
#---------------------------------------------------------------------
ns_section ns/parameters {
ns_param serverlog ${logroot}/error.log
ns_param pidfile ${logroot}/nsd.pid
ns_param home $homedir
ns_param debug $debug
# Define optionally the tmpdir. If not specified, the
# environment variable TMPDIR is used. If that is not
# specified either, a system specific constant us used
# (compile time macro P_tmpdir)
#
# ns_param tmpdir c:/tmp
# Timeout for shutdown to let existing connections and background
# jobs finish. When this time limit is exceeded the server shuts
# down immediately.
#
# ns_param shutdowntimeout 20s ;# 20s is the default
#
# Configuration of error.log
#
# Rolling of logfile:
ns_param logroll on
ns_param logmaxbackup 100 ;# 10 is default
ns_param logrollfmt %Y-%m-%d ;# format appended to serverlog filename when rolled
#
# Format of log entries in serverlog:
# ns_param logsec false ;# add timestamps in second resolution (default: true)
# ns_param logusec true ;# add timestamps in microsecond (usec) resolution (default: false)
# ns_param logusecdiff true ;# add timestamp diffs since in microsecond (usec) resolution (default: false)
# ns_param logthread false ;# add thread-info the log file lines (default: true)
ns_param logcolorize true ;# colorize log file with ANSI colors (default: false)
ns_param logprefixcolor green ;# black, red, green, yellow, blue, magenta, cyan, gray, default
# ns_param logprefixintensity normal;# bright or normal
#
# Severities to be logged (can be controlled at runtime via ns_logctl)
#ns_param logdebug $debug ;# debug messages
ns_param logdev $dev ;# development message
ns_param lognotice true ;# informational messages
#ns_param sanitizelogfiles 2 ;# default: 2; 0: none, 1: full, 2: human-friendly
# ns_param mailhost localhost
# ns_param jobsperthread 0 ;# number of ns_jobs before thread exits
# ns_param jobtimeout 5m ;# default "ns_job wait" timeout
# ns_param joblogminduration 1s ;# default: 1s
# ns_param schedsperthread 0 ;# number of scheduled jobs before thread exits
# ns_param schedlogminduration 2s ;# print warnings when scheduled job takes longer than that
# Write asynchronously to log files (access log and error log)
# ns_param asynclogwriter true ;# false
#ns_param mutexlocktrace true ;# default false; print durations of long mutex calls to stderr
# Reject output operations on already closed connections (e.g. subsequent ns_return statements)
#ns_param rejectalreadyclosedconn false ;# default: true
# Allow concurrent create operations of Tcl interpreters.
# Versions up to at least Tcl 8.5 are known that these might
# crash in case two threads create interpreters at the same
# time. These crashes were hard to reproduce, but serializing
# interpreter creation helped. Starting with Tcl 8.6,
# the default is set to "true".
#ns_param concurrentinterpcreate false ;# default: true
# Enforce sequential thread initialization. This is not really
# desirably in general, but might be useful for hunting strange
# crashes or for debugging with valgrind.
# ns_param tclinitlock true ;# default: false
#
# Encoding settings (see http://dqd.com/~mayoff/encoding-doc.html)
#
# ns_param HackContentType 1
# NaviServer's defaults charsets are all utf-8. Although the
# default charset is utf-8, set the parameter "OutputCharset"
# here, since otherwise OpenACS uses in the meta-tags the charset
# from [ad_conn charset], which is taken from the db and
# per-default ISO-8859-1.
ns_param OutputCharset utf-8
# ns_param URLCharset utf-8
#
# DNS configuration parameters
#
ns_param dnscache true ;# default: true
ns_param dnswaittimeout 5s ;# time for waiting for a DNS reply; default: 5s
ns_param dnscachetimeout 1h ;# time to keep entries in cache; default: 1h
ns_param dnscachemaxsize 500kB ;# max size of DNS cache in memory units; default: 500kB
# Running behind proxy? Used also by OpenACS...
ns_param reverseproxymode $proxy_mode
}
#---------------------------------------------------------------------
# Definition of NaviServer servers (add more, when true NaviServer
# virtual hosting should be used).
#---------------------------------------------------------------------
ns_section ns/servers {
ns_param $server $servername
}
#---------------------------------------------------------------------
# Global server modules
#---------------------------------------------------------------------
ns_section ns/modules {
#
# Load networking modules named "nssock" and/or "nsssl" depending
# on existence of Tcl variables "httpport" and "httpsport".
#
if {[info exists httpport] && $httpport ne ""} { ns_param nssock ${bindir}/nssock }
if {[info exists httpsport] && $httpsport ne ""} { ns_param nsssl ${bindir}/nsssl }
}
#---------------------------------------------------------------------
# Configuration for plain HTTP interface -- module nssock
#---------------------------------------------------------------------
if {[info exists httpport]} {
#
# We have an "httpport" configured, so configure this module.
#
ns_section ns/module/nssock {
ns_param defaultserver $server
ns_param address $ipaddress
ns_param hostname $hostname
ns_param port $httpport ;# default 80
ns_param maxinput ${max_file_upload_mb}MB ;# 1MB, maximum size for inputs (uploads)
ns_param recvwait ${max_file_upload_min}m ;# 30s, timeout for receive operations
# ns_param maxline 8192 ;# 8192, max size of a header line
# ns_param maxheaders 128 ;# 128, max number of header lines
# ns_param uploadpath /tmp ;# directory for uploads
# ns_param backlog 256 ;# 256, backlog for listen operations
# ns_param maxqueuesize 256 ;# 1024, maximum size of the queue
# ns_param acceptsize 10 ;# backlog; Maximum number of requests accepted at once.
# ns_param deferaccept true ;# false, Performance optimization, may cause recvwait to be ignored
# ns_param bufsize 16kB ;# 16kB, buffersize
# ns_param readahead 16kB ;# value of bufsize, size of readahead for requests
# ns_param sendwait 30s ;# 30s, timeout for send operations
# ns_param closewait 2s ;# 2s, timeout for close on socket
# ns_param keepwait 2s ;# 5s, timeout for keep-alive
# ns_param nodelay false ;# true; deactivate TCP_NODELAY if Nagle algorithm is wanted
# ns_param keepalivemaxuploadsize 500kB ;# 0, don't allow keep-alive for upload content larger than this
# ns_param keepalivemaxdownloadsize 1MB ;# 0, don't allow keep-alive for download content larger than this
# ns_param spoolerthreads 1 ;# 0, number of upload spooler threads
ns_param maxupload 100kB ;# 0, when specified, spool uploads larger than this value to a temp file
ns_param writerthreads 2 ;# 0, number of writer threads
ns_param writersize 1kB ;# 1MB, use writer threads for files larger than this value
# ns_param writerbufsize 8kB ;# 8kB, buffer size for writer threads
# ns_param writerstreaming true ;# false; activate writer for streaming HTML output (when using ns_write)
#
# Options for port reuse (see https://lwn.net/Articles/542629/)
# These options require proper OS support.
#
# ns_param reuseport true ;# false; normally not needed to be set, set by driverthreads when necessary
# ns_param driverthreads 2 ;# 1; use multiple driver threads; activates "reuseport"
#
# Extra driver-specific response headers fields to be added for
# every request.
#
ns_param extraheaders $nssock_extraheaders
}
#
# Define, which "host" (as supplied by the "host:" header
# field) accepted over this driver should be associated with
# which server.
#
ns_section ns/module/nssock/servers {
ns_param $server $hostname
foreach address $ipaddress {
ns_param $server $address
}
}
}
#---------------------------------------------------------------------
# Configuration for HTTPS interface (SSL/TLS) -- module nsssl
#---------------------------------------------------------------------
if {[info exists httpsport]} {
#
# We have an "httpsport" configured, so configure this module.
#
ns_section ns/module/nsssl {
ns_param defaultserver $server
ns_param address $ipaddress
ns_param port $httpsport
ns_param hostname $hostname
ns_param ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"
ns_param protocols "!SSLv2:!SSLv3:!TLSv1.0:!TLSv1.1"
ns_param certificate $serverroot/etc/certfile.pem
ns_param verify 0
ns_param writerthreads 2
ns_param writersize 1kB
ns_param writerbufsize 16kB ;# 8kB, buffer size for writer threads
# ns_param writerstreaming true ;# false
# ns_param spoolerthreads 1 ;# 0, number of upload spooler threads
# ns_param maxupload 100kB ;# 0, when specified, spool uploads larger than this value to a temp file
# ns_param deferaccept true ;# false, Performance optimization
# ns_param nodelay false ;# true; deactivate TCP_NODELAY if Nagle algorithm is wanted
ns_param maxinput ${max_file_upload_mb}MB ;# Maximum file size for uploads in bytes
ns_param extraheaders $nsssl_extraheaders
ns_param OCSPstapling on ;# off; activate OCSP stapling
# ns_param OCSPstaplingVerbose on ;# off; make OCSP stapling more verbose
}
#
# Define, which "host" (as supplied by the "host:" header field)
# accepted over this driver should be associated with which
# server. This parameter is for virtual servers. Here we just
# register the $hostname and the $address (in case, the server is
# addressed via its IP address).
#
ns_section ns/module/nsssl/servers {
ns_param $server $hostname
foreach address $ipaddress {
ns_param $server $address
}
}
}
#---------------------------------------------------------------------
# Thread library (nsthread) parameters
#---------------------------------------------------------------------
ns_section ns/threads {
ns_param stacksize 1MB
}
#---------------------------------------------------------------------
# Extra mime types
#---------------------------------------------------------------------
ns_section ns/mimetypes {
# Note: NaviServer already has an exhaustive list of MIME types:
# see: /usr/local/src/naviserver/nsd/mimetypes.c
# but in case something is missing you can add it here.
#ns_param default */*
#ns_param noextension text/html
#ns_param .pcd image/x-photo-cd
#ns_param .prc application/x-pilot
}
#---------------------------------------------------------------------
# Global fastpath parameters
#---------------------------------------------------------------------
ns_section ns/fastpath {
#ns_param cache true ;# default: false
#ns_param cachemaxsize 10MB ;# default: 10MB
#ns_param cachemaxentry 100kB ;# default: 8kB
#ns_param mmap true ;# default: false
#ns_param gzip_static true ;# check for static gzip; default: false
#ns_param gzip_refresh true ;# refresh stale .gz files on the fly using ::ns_gzipfile
#ns_param gzip_cmd "/usr/bin/gzip -9" ;# use for re-compressing
#ns_param minify_css_cmd "/usr/bin/yui-compressor --type css"
#ns_param minify_js_cmd "/usr/bin/yui-compressor --type js"
#ns_param brotli_static true ;# check for static brotli files; default: false
#ns_param brotli_refresh true ;# refresh stale .br files on the fly using ::ns_brotlifile
#ns_param brotli_cmd "/usr/bin/brotli -f -Z" ;# use for re-compressing
}
#---------------------------------------------------------------------
#
# Server-level configuration
#
# There is only one server in NaviServer, but this is helpful when multiple
# servers share the same configuration file. This file assumes that only
# one server is in use so it is set at the top in the "server" Tcl variable
# Other host-specific values are set up above as Tcl variables, too.
#
#---------------------------------------------------------------------
#
# Server parameters
#
ns_section ns/server/$server {
#
# Scaling and Tuning Options
#
# ns_param maxconnections 100 ;# 100; number of allocated connection structures
ns_param rejectoverrun true ;# false (send 503 when queue overruns)
#ns_param retryafter 5s ;# time for Retry-After in 503 cases
#ns_param filterrwlocks false ;# default: true
# ns_param maxthreads 10 ;# 10; maximal number of connection threads
ns_param minthreads 2 ;# 1; minimal number of connection threads
ns_param connsperthread 1000 ;# 10000; number of connections (requests) handled per thread
;# Setting connsperthread to > 0 will cause the thread to
;# graciously exit, after processing that many requests, thus
;# initiating kind-of Tcl-level garbage collection.
# ns_param threadtimeout 2m ;# 2m; timeout for idle threads.
;# In case, minthreads < maxthreads, threads are shutdown after
;# this idle time until minthreads are reached.
# ns_param lowwatermark 10 ;# 10; create additional threads above this queue-full percentage
ns_param highwatermark 100 ;# 80; allow concurrent creates above this queue-is percentage
;# 100 means to disable concurrent creates
#ns_param connectionratelimit 200 ;# 0; limit rate per connection to this amount (KB/s); 0 means unlimited
#ns_param poolratelimit 200 ;# 0; limit rate for pool to this amount (KB/s); 0 means unlimited
# Compress response character data: ns_return, ADP etc.
#
ns_param compressenable on ;# false, use "ns_conn compress" to override
# ns_param compresslevel 4 ;# 4, 1-9 where 9 is high compression, high overhead
# ns_param compressminsize 512 ;# Compress responses larger than this
# ns_param compresspreinit true ;# false, if true then initialize and allocate buffers at startup
# Enable nicer directory listing (as handled by the OpenACS request processor)
# ns_param directorylisting fancy ;# Can be simple or fancy
#
# Configuration of replies
#
# ns_param realm yourrealm ;# Default realm for Basic authentication
# ns_param noticedetail false ;# true, return detail information in server reply
# ns_param errorminsize 0 ;# 514, fill-up reply to at least specified bytes (for ?early? MSIE)
# ns_param headercase preserve ;# preserve, might be "tolower" or "toupper"
# ns_param checkmodifiedsince false ;# true, check modified-since before returning files from cache. Disable for speedup
#
# Extra server-specific response headers fields to be added for
# every response on this server
#
#ns_param extraheaders {...}
}
########################################################################
# Connection thread pools.
#
# Per default, NaviServer uses a "default" connection pool, which
# needs no extra configuration. Optionally, multiple connection
# thread pools can be configured using the following parameters.
#
# map
# connsperthread
# highwatermark
# lowwatermark
# maxconnections
# rejectoverrun
# retryafter
# maxthreads
# minthreads
# poolratelimit
# connectionratelimit
# threadtimeout
#
# In order to define thread pools, do the following:
#
# 1. Add pool names to "ns/server/$server/pools"
# 2. Configure pools with the noted parameters
# 3. Map method/URL combinations for these pools
#
# All unmapped method/URL's will go to the default server pool of the
# server.
#
########################################################################
ns_section ns/server/$server/pools {
#
# To activate connection thread pools, uncomment one of the
# following lines and/or add other pools.
#ns_param monitor "Monitoring actions to check healthiness of the system"
#ns_param fast "Fast requests, e.g. less than 10ms"
#ns_param slow "Slow lane pool, for request remapping"
}
ns_section ns/server/$server/pool/monitor {
ns_param minthreads 2
ns_param maxthreads 2
ns_param map "GET /SYSTEM"
ns_param map "GET /admin/nsstats"
ns_param map "GET /ds"
ns_param map "GET /request-monitor"
ns_param map "POST /SYSTEM"
ns_param map "POST /admin/nsstats"
ns_param map "POST /ds"
}
ns_section ns/server/$server/pool/fast {
ns_param minthreads 2
ns_param maxthreads 2
ns_param rejectoverrun true
ns_param map "GET /*.png"
ns_param map "GET /*.PNG"
ns_param map "GET /*.jpg"
ns_param map "GET /*.pdf"
ns_param map "GET /*.gif"
ns_param map "GET /*.mp4"
ns_param map "GET /*.ts"
ns_param map "GET /*.m3u8"
}
ns_section ns/server/$server/pool/slow {
ns_param minthreads 2
ns_param maxthreads 5
ns_param maxconnections 600
ns_param rejectoverrun true
}
#---------------------------------------------------------------------
# Special HTTP pages
#---------------------------------------------------------------------
ns_section ns/server/$server/redirects {
ns_param 404 /shared/404
ns_param 403 /shared/403
ns_param 503 /shared/503
ns_param 500 /shared/500
}
#---------------------------------------------------------------------
# ADP (AOLserver Dynamic Page) configuration
#---------------------------------------------------------------------
ns_section ns/server/$server/adp {
ns_param enabledebug $debug
ns_param map /*.adp ;# Extensions to parse as ADP's
# ns_param map "/*.html" ;# Any extension can be mapped
#
# ns_param cache true ;# false, enable ADP caching
# ns_param cachesize 10MB ;# 5MB, size of ADP cache
# ns_param bufsize 5MB ;# 1MB, size of ADP buffer
#
# ns_param trace true ;# false, trace execution of adp scripts
# ns_param tracesize 100 ;# 40, max number of entries in trace
#
# ns_param stream true ;# false, enable ADP streaming
# ns_param enableexpire true ;# false, set "Expires: now" on all ADP's
# ns_param safeeval true ;# false, disable inline scripts
# ns_param singlescript true ;# false, collapse Tcl blocks to a single Tcl script
# ns_param detailerror false ;# true, include connection info in error backtrace
# ns_param stricterror true ;# false, interrupt execution on any error
# ns_param displayerror true ;# false, include error message in output
# ns_param trimspace true ;# false, trim whitespace from output buffer
# ns_param autoabort false ;# true, failure to flush a buffer (e.g. closed HTTP connection) generates an ADP exception
#
# ns_param errorpage /.../errorpage.adp ;# page for returning errors
# ns_param startpage /.../startpage.adp ;# file to be run for every adp request; should include "ns_adp_include [ns_adp_argv 0]"
# ns_param debuginit some-proc ;# ns_adp_debuginit, proc to be executed on debug init
#
}
ns_section ns/server/$server/adp/parsers {
ns_param fancy ".adp"
}
#
# Tcl Configuration
#
ns_section ns/server/$server/tcl {
ns_param library ${serverroot}/tcl
ns_param debug $debug
# ns_param nsvbuckets 16 ;# default: 8
# ns_param nsvrwlocks false ;# default: true
}
ns_section ns/server/$server/fastpath {
ns_param serverdir ${homedir}
ns_param pagedir ${pageroot}
#
# Directory listing options
#
# ns_param directoryfile "index.adp index.tcl index.html index.htm"
# ns_param directoryadp $pageroot/dirlist.adp ;# Choose one or the other
# ns_param directoryproc _ns_dirlist ;# ...but not both!
# ns_param directorylisting fancy ;# Can be simple or fancy
#
}
#---------------------------------------------------------------------
# HTTP client configuration
#---------------------------------------------------------------------
ns_section ns/server/$server/httpclient {
ns_param logging on ;# default: off
ns_param logfile ${logroot}/httpclient.log
ns_param logrollfmt %Y-%m-%d ;# format appended to log filename
#ns_param logmaxbackup 100 ;# 10, max number of backup log files
#ns_param logroll true ;# true, should server log files automatically
#ns_param logrollonsignal true ;# false, perform roll on a sighup
#ns_param logrollhour 0 ;# 0, specify at which hour to roll
}
#---------------------------------------------------------------------
# OpenACS specific settings (per server)
#---------------------------------------------------------------------
#
# Define/override OpenACS kernel parameter for $server
#
ns_section ns/server/$server/acs {
#
# Provide optionally a different cookie namespace (used for
# prefixing OpenACS cookies)
# ns_param CookieNamespace "ad_"
#
# Define a mapping between MIME types and CSP rules for static
# files. The mapping is of the form of a Tcl dict. The mapping is
# used e.g. in "security::csp::add_static_resource_header".
#
ns_param StaticCSP {
image/svg+xml "script-src 'none'"
}
#
# The following option should causes on acs-admin/server-restart
# the usage of "ns_shutdown -restart" instead of plain
# "ns_shutdown". This seems to be required in current Windows
# installations. Default is 0.
#
# ns_param NsShutdownWithNonZeroExitCode 1
#
# Should deprecated log be used? Use value of 1 on legacy
# sites. Default is 1.
#
# ns_param WithDeprecatedCode 0
#
# Should user_ids be included in log files? Some sensitive sites
# do not allow this. Default is 0.
#
# ns_param LogIncludeUserId 1
#
}
# Define/override OpenACS package parameters in section
# ending with /acs/PACKAGENAME
#
# Provide tailored sizes for the site node cache in acs-tcl:
#
ns_section ns/server/$server/acs/acs-tcl {
# ns_param SiteNodesCacheSize 2000000
# ns_param SiteNodesIdCacheSize 100000
# ns_param SiteNodesChildenCacheSize 100000
# ns_param SiteNodesPrefetch {/file /changelogs /munin}
# ns_param UserInfoCacheSize 2000000
}
#
# Set for all package instances of acs-mail-lite the
# EmailDeliveryMode. Setting this to "log" is useful for developer
# instances.
#
ns_section ns/server/$server/acs/acs-mail-lite {
# ns_param EmailDeliveryMode log
}
#
# API browser configuration: setting IncludeCallingInfo to "true" is
# useful mostly for developer instances.
#
ns_section ns/server/$server/acs/acs-api-browser {
# ns_param IncludeCallingInfo true
}
#---------------------------------------------------------------------
# WebDAV Support (optional, requires oacs-dav package to be installed
#---------------------------------------------------------------------
ns_section ns/server/$server/tdav {
ns_param propdir ${serverroot}/data/dav/properties
ns_param lockdir ${serverroot}/data/dav/locks
ns_param defaultlocktimeout 300
}
ns_section ns/server/$server/tdav/shares {
ns_param share1 "OpenACS"
# ns_param share2 "Share 2 description"
}
ns_section ns/server/$server/tdav/share/share1 {
ns_param uri "/dav/*"
# all WebDAV options
ns_param options "OPTIONS COPY GET PUT MOVE DELETE HEAD MKCOL POST PROPFIND PROPPATCH LOCK UNLOCK"
}
#ns_section ns/server/$server/tdav/share/share2 {
# ns_param uri "/share2/path/*"
# read-only WebDAV options
# ns_param options "OPTIONS COPY GET HEAD MKCOL POST PROPFIND PROPPATCH"
#}
#---------------------------------------------------------------------
# Access log -- nslog
#---------------------------------------------------------------------
ns_section ns/server/$server/module/nslog {
#
# General parameters for access.log
#
ns_param file ${logroot}/access.log
# ns_param maxbuffer 100 ;# 0, number of logfile entries to keep in memory before flushing to disk
#
# Control what to log
#
# ns_param suppressquery true ;# false, suppress query portion in log entry
# ns_param logreqtime true ;# false, include time to service the request
ns_param logpartialtimes true ;# false, include high-res start time and partial request durations (accept, queue, filter, run)
ns_param logthreadname true ;# default: false; include thread name for linking with error.log
# ns_param formattedtime true ;# true, timestamps formatted or in secs (unix time)
# ns_param logcombined true ;# true, Log in NSCA Combined Log Format (referer, user-agent)
ns_param checkforproxy $proxy_mode ;# false, check for proxy header (X-Forwarded-For)
ns_param masklogaddr true ;# false, mask IP address in log file for GDPR (like anonip IP anonymizer)
ns_param maskipv4 255.255.255.0 ;# mask for IPv4 addresses
ns_param maskipv6 ff:ff:ff:ff:: ;# mask for IPv6 addresses
#
# Add extra entries to the access log via specifying a Tcl
# list of request header fields in "extendedheaders"
#
if {[ns_config "ns/server/$server/acs" LogIncludeUserId 0]} {
ns_param extendedheaders "X-User-Id"
}
#
#
# Control log file rolling
#
# ns_param maxbackup 100 ;# 10, max number of backup log files
# ns_param rolllog true ;# true, should server log files automatically
# ns_param rollhour 0 ;# 0, specify at which hour to roll
# ns_param rollonsignal true ;# false, perform roll on a sighup
ns_param rollfmt %Y-%m-%d ;# format appended to log filename
}
#---------------------------------------------------------------------
#
# CGI interface -- nscgi, if you have legacy stuff. Tcl or ADP files
# inside NaviServer are vastly superior to CGIs.
#
#---------------------------------------------------------------------
# ns_section ns/server/$server/modules {
# ns_param nscgi ${bindir}/nscgi
# }
# ns_section ns/server/$server/module/nscgi {
# ns_param map "GET /cgi-bin ${serverroot}/cgi-bin"
# ns_param map "POST /cgi-bin ${serverroot}/cgi-bin"
# ns_param Interps CGIinterps
# ns_param allowstaticresources true ;# default: false
# }
# ns_section ns/interps/CGIinterps {
# ns_param .pl "/usr/bin/perl"
# }
#---------------------------------------------------------------------
#
# PAM authentication
#
#---------------------------------------------------------------------
# ns_section ns/server/$server/modules {
# ns_param nspam ${bindir}/nspam
# }
# ns_section ns/server/$server/module/nspam {
# ns_param PamDomain "pam_domain"
# }
#---------------------------------------------------------------------
#
# Database drivers:
#
# Make sure the drivers are compiled and put it in $bindir.
#
#---------------------------------------------------------------------
ns_section ns/db/drivers {
if { $database eq "oracle" } {
ns_param nsoracle ${bindir}/nsoracle
} else {
ns_param postgres ${bindir}/nsdbpg
#
ns_logctl severity "Debug(sql)" -color blue $verboseSQL
}
if { $database eq "oracle" } {
ns_section ns/db/driver/nsoracle
ns_param maxStringLogLength -1
ns_param LobBufferSize 32768
} else {
ns_section ns/db/driver/postgres
# Set this parameter, when "psql" is not on your path (OpenACS specific)
# ns_param pgbin "/usr/local/pg960/bin/"
}
}
# Database Pools: This is how NaviServer "talks" to the RDBMS. You
# need three for OpenACS, named here pool1, pool2 and pool3. Most
# queries use to first pool, nested queries (i.e. in a db_foreach,
# which is actually not recommended) use pool2 and so on. Make sure to
# set the "db_*" the variables with actual values on top of this file.
#
# NaviServer can have different pools connecting to different databases
# and even different database servers. See
#
# http://openacs.org/doc/tutorial-second-database
#
ns_section ns/server/$server/db {
ns_param pools pool1,pool2,pool3
ns_param defaultpool pool1
}
ns_section ns/db/pools {
ns_param pool1 "Pool 1"
ns_param pool2 "Pool 2"
ns_param pool3 "Pool 3"
}
ns_section ns/db/pool/pool1 {
# ns_param maxidle 0 ;# time interval for shut-down of idle connections; default: 5m
# ns_param maxopen 0 ;# time interval for maximum time of open connections; default: 60m
# ns_param checkinterval 5m ;# check pools for stale handles in this interval
ns_param connections 15
ns_param LogMinDuration 10ms ;# when SQL logging is on, log only statements above this duration
ns_param logsqlerrors $debug
if { $database eq "oracle" } {
ns_param driver nsoracle
ns_param datasource $datasource
ns_param user $db_name
ns_param password $db_password
} else {
ns_param driver postgres
ns_param datasource ${db_host}:${db_port}:dbname=${db_name}
ns_param user $db_user
ns_param password ""
}
}
#
# In case, you want to activate (more intense) SQL logging at runtime,
# consider the two commands (e.g. entered over ds/shell)
#
# ns_logctl severity "Debug(sql)" on
# ns_db logminduration pool1 10ms
#
ns_section ns/db/pool/pool2 {
# ns_param maxidle 0
# ns_param maxopen 0
# ns_param checkinterval 5m ;# check pools for stale handles in this interval
ns_param connections 5
ns_param LogMinDuration 10ms ;# when SQL logging is on, log only statements above this duration
ns_param logsqlerrors $debug
if { $database eq "oracle" } {
ns_param driver nsoracle
ns_param datasource $datasource
ns_param user $db_name
ns_param password $db_password
} else {
ns_param driver postgres
ns_param datasource ${db_host}:${db_port}:dbname=${db_name}
ns_param user $db_user
ns_param password ""
}
}
ns_section ns/db/pool/pool3 {
# ns_param maxidle 0
# ns_param maxopen 0
# ns_param checkinterval 5m ;# check pools for stale handles in this interval
ns_param connections 5
# ns_param LogMinDuration 0ms ;# when SQL logging is on, log only statements above this duration
ns_param logsqlerrors $debug
if { $database eq "oracle" } {
ns_param driver nsoracle
ns_param datasource $datasource
ns_param user $db_name
ns_param password $db_password
} else {
ns_param driver postgres
ns_param datasource ${db_host}:${db_port}:dbname=${db_name}
ns_param user $db_user
ns_param password ""
}
}
#---------------------------------------------------------------------
# Which modules should be loaded for $server? Missing modules break
# the server, so don't uncomment modules unless they have been
# installed.
ns_section ns/server/$server/modules {
ns_param nslog ${bindir}/nslog
ns_param nsdb ${bindir}/nsdb
ns_param nsproxy ${bindir}/nsproxy
#
# Determine, if libthread is installed
#
set libthread [lindex [lsort [glob -nocomplain $homedir/lib/thread*/libthread*[info sharedlibextension]]] end]
if {$libthread eq ""} {
ns_log notice "No Tcl thread library installed in $homedir/lib/"
} else {
ns_param libthread $libthread
ns_log notice "Use Tcl thread library $libthread"
}
# authorize-gateway package requires dqd_utils
# ns_param dqd_utils dqd_utils[expr {int($tcl_version)}]
# LDAP authentication
# ns_param nsldap ${bindir}/nsldap
# These modules aren't used in standard OpenACS installs
# ns_param nsperm ${bindir}/nsperm
}
#
# nsproxy configuration
#
ns_section ns/server/$server/module/nsproxy {
# ns_param maxworkers 8
# ns_param sendtimeout 5s
# ns_param recvtimeout 5s
# ns_param waittimeout 100ms
# ns_param idletimeout 5m
# ns_param logminduration 1s
}
#
# nsstats configuration (global module)
#
# When installed under acs-subsite/www/admin/nsstats.tcl it is due to
# its /admin/ location safe from public access.
#
ns_section ns/module/nsstats {
ns_param enabled 1
ns_param user ""
ns_param password ""
ns_param bglocks {oacs:sched_procs}
}
#
# Sample letsencrypt configuration.
#
# To use this, it is necessary to install the NaviServer letsencrypt
# module first, uncomment the two "ns_param" lines, and provide your
# desired domain names.
#
ns_section "ns/server/${server}/modules" {
#ns_param letsencrypt tcl
}
ns_section ns/server/${server}/module/letsencrypt {
# Provide one or more domain names (latter for multi-domain SAN
# certificates). These values are a default in case the domains
# are not provided by other means (e.g. "letsencrypt.tcl"). In
# case multiple NaviServer virtual hosts are in used, this
# definition must be on the ${server}, which is used for
# obtaining updates (e.g. main site) although it retrieves a
# certificate for many subsites.