hg.apache.conf.jinja

<VirtualHost _default_:9000>
    ServerName hg.python.org

    SSLEngine on
    SSLCertificateFile /etc/ssl/private/hg.psf.io.pem
    SSLCertificateKeyFile /etc/ssl/private/hg.psf.io.pem
    SSLCipherSuite {{ pillar["tls"]["ciphers"].get("backend", pillar["tls"]["ciphers"]["default"]) }}
    SSLHonorCipherOrder on
    SSLProtocol TLSv1.2

    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %{ms}T" combined

    CustomLog /var/log/apache2/hg.access.log combined
    ErrorLog /var/log/apache2/hg.error.log

    # Mercurial can send long headers for repositories with many heads. See
    # http://barahilia.github.io/blog/computers/2014/10/09/hg-pull-via-http-fails-400.html
    LimitRequestFieldSize 16384

    Alias /committers.txt /srv/hg/web/committers
    Alias /robots.txt /srv/hg/web/robots.txt
    Alias /410.html /srv/hg/web/410.html
    <Directory /srv/hg/web/>
        Require all granted
    </Directory>

    Alias /icons/ "/usr/share/apache2/icons/"

    <Directory "/usr/share/apache2/icons">
        Options FollowSymlinks
        AllowOverride None
        Require all granted
    </Directory>

    # The lookup app is better run with few processes, since it uses a cache.
    WSGIDaemonProcess hglookup user=hg group=hg \
        threads=2 processes=1 maximum-requests=1000 \
        display-name=hglookup
    # The Location hack ensures the lookup app is run within
    # this process group
    <Location /lookup>
        WSGIProcessGroup hglookup
    </Location>

    WSGIScriptAlias /lookup /srv/hg/wsgi/lookup.wsgi

    # A lightweight standin for revision app to maintain support for /lookup
    WSGIDaemonProcess hgrev user=hg group=hg \
        threads=2 processes=4 maximum-requests=1000 \
        display-name=hgrev
    # The Location hack ensures the lookup app is run within
    # this process group
    <LocationMatch "^(.*)/rev/([A-Fa-f0-9]{12,40})/?">
        WSGIProcessGroup hgrev
    </LocationMatch>

    WSGIScriptAliasMatch "^(.*)/rev/([A-Fa-f0-9]{12,40})/?" /srv/hg/wsgi/rev.wsgi

    # Staticly serve hg repos over HTTP
    DocumentRoot /srv/hg/hg-static/
    <Directory /srv/hg/hg-static>
        Options Indexes FollowSymlinks
        IndexOptions FancyIndexing SuppressColumnSorting
        HeaderName README.html
        Require all granted
    </Directory>

    ErrorDocument 410 /410.html
    RedirectMatch gone "/cpython/annotate/.*/NEWS$"
    RedirectMatch gone "/cpython-fullhistory/annotate/.*/NEWS$"

    # Static files: logo, CSS, favicon... (wired to .../static/)
    # This is optional but a bit faster than letting Mercurial serve the files
    # NOTE: needs to be changed if hg gets wired to another dir or python
    # version

    <Location /_server-status>
        SetHandler server-status
        Require ip 127.0.0.1
    </Location>
</VirtualHost>