Lighttpd

[prtst33]

Hi!
Does anyone have a mod_rewrite snippet that works with mecha for lighttpd server?
Thanks.

[taufik-nurrohman]

This issue need to be moved to the discussions.

[taufik-nurrohman]

url.rewrite-if-not-file = ("^(.*)$" => "index.php$1")

Like this?

[prtst33]

Yes. Something like that but it doesn't seem to work. I'm trying to figure out why.
In apache or nginx it works perfectly, but I would prefer lighttpd because it is very light.
Maybe could it be resolved only from a .htaccess?

[taufik-nurrohman]

Once you use another web server other than Apache, the existing .htaccess files becomes useless and can be safely deleted. Mecha doesn’t actually use the web server features to its full potential. It only requires the rewrite module feature to remove the index.php part from URL. Other than that are fully optional and usually can be enabled only to maintain the security of the file system.

[taufik-nurrohman]

You may need to specifically allow access to files with extension .css and .js for example, especially in the extension and layout folders. I’ve never used Lighttpd before, but someone else looking at my guessing code might be able to help in the future.

$HTTP["url"] =~ "^/engine" {
  url.access-deny = ( "" )
}
$HTTP["url"] =~ "^/lot" {
  url.access-deny = ( "" )
}
$HTTP["url"] =~ "^/lot/asset" {
  url.access-deny = ( "disable" )
}

url.rewrite-if-not-file = ( "^/(.*)$" => "/index.php/$1" )

[prtst33]

It doesn't work even though it should, I still can't figure out why, I'll start re-reading the documentation, if anyone has the answer, I'd be grateful. Thank you.

[prtst33]

This one works.

$HTTP["url"] =~ "^/engine" {
    url.access-deny = ( "" )
}

$HTTP["url"] =~ "^/lot" {
    url.access-deny = ( "" )
}

$HTTP["url"] =~ "^/lot/layout" {
    url.access-deny = ( "disable" )
}

url.rewrite-if-not-file = ( "^/(.*)" => "/index.php?_=$1" )

[taufik-nurrohman]

Must be for the older version because we no longer have .\lot\layout folder.

[taufik-nurrohman]

Try this one maybe:

$HTTP["url"] =~ "^/engine/" {
    url.access-deny = ( "" )
}

$HTTP["url"] =~ "^/lot/" {
    url.access-deny = ( "" )
}

$HTTP["url"] =~ "^/lot/asset/" {
    url.access-deny = ( "" )
}

$HTTP["url"] =~ "^/lot/[xy]/[^/]+/[^/]*\.(a?png|css|gif|ico|jpe?g|js|svg)$" {
    url.access-deny = ( "disable" )
}

url.rewrite-if-not-file = ( "" => "/index.php${url.path}${qsa}" )

[prtst33]

This one should be correct for lighttpd 1.4.74:

$HTTP["url"] =~ "^/engine/" {
    url.access-deny = ( "" ) # Denies access to everything under /engine/
}

$HTTP["url"] =~ "^/lot/" {
    url.access-deny = ( "" ) # Denies access to everything under /lot/
}

$HTTP["url"] =~ "^/lot/asset/" {
    url.access-allow = ( "all" ) # Allows access to everything under /lot/asset/
}

# Allow access to specific file types 
$HTTP["url"] =~ "^/lot/[xy]/[^/]+/[^/]*\.(a?png|css|gif|ico|jpe?g|js|svg)$" {
    url.access-allow = ( "all" ) # Allows access to specified file types under /lot/x/*/ and /lot/y/*/
}

# Rewrite URLs to index.php if the requested file or directory does not exist
url.rewrite-if-not-file = ( 
    "^(.*)$" => "/index.php?$1" 
)

The following might also be useful:

$HTTP["host"] == "abc.tld" {
    # Adds a series of response headers to all responses sent to clients
    setenv.add-response-header = (
        "X-Powered-By" => "mecha-cms.com", # Identifies the CMS powering the site
        "Content-Security-Policy" => "default-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';", # Enhances security by restricting resources to self and disallowing embedding
        "Referrer-Policy" => "no-referrer", # Prevents the browser from sending the referrer header
        "Strict-Transport-Security" => "max-age=31536000; includeSubDomains; preload", # Enforces strict HTTPS usage for 1 year including subdomains and allows preloading
        "Cache-Control" => "public, max-age=31536000", # Instructs browsers to cache resources for 1 year
        "X-Content-Type-Options" => "nosniff", # Prevents MIME type sniffing
        "X-XSS-Protection" => "0", # Disables browser XSS protection when implementing own XSS protection
        "Timing-Allow-Origin" => "*", # Allows the Timing API to be accessible from any origin
        "X-Frame-Options" => "DENY" # Prevents clickjacking by disallowing the site to be framed
    )

    # Configures compression settings
    deflate.min-compress-size = 256 # Minimum size for compressible responses
    deflate.max-compress-size = 131072 # Maximum size for compressible responses
    deflate.cache-dir = "/var/cache/lighttpd/compress/" # Directory to store compressed versions of static files
    deflate.mimetypes = ( # Specifies MIME types eligible for compression
        "application/javascript",
        "text/css",
        "text/html",
        "text/plain",
        "image/svg+xml"
    )

    # Sets the root directory for the website and the location of the error log
    server.document-root = "/var/www/abc.tld/"
    server.errorlog = "/var/log/lighttpd/abc.tld.log"

    # Enables the expire module and configures cache control for certain URL paths
    server.modules += ( "mod_expire" )
    expire.url = (
        "/lot/path/to/asset/css/" => "access plus 30 days", # Caches CSS files for 30 days
        "/lot/path/to/asset/js/"  => "access plus 30 days", # Caches JS files  for 30 days
    )
}

# Enables compression for CSS files in the specified path
$HTTP["url"] =~ "^/lot/path/to/css/" {
    deflate.allowed-encodings = ("zstd", "br", "gzip", "deflate")
}

# Sets caching headers for a variety of static file types to be cached for 1 year
$HTTP["url"] =~ "\.(css|js|png|jpg|webp|jpeg|gif|ico|svg|woff2|woff|ttf|otf)$" {
    setenv.add-response-header = ( "Cache-Control" => "public, max-age=31536000, immutable" )
}

# Redirects all HTTP requests to HTTPS 
$HTTP["scheme"] == "http" {
    url.redirect = ("" => "https://${url.authority}${url.path}${qsa}")
}

# Denies all TRACE requests to enhance security
$HTTP["request-method"] == "TRACE" {
    url.access-deny = ( "" )
}