Changeset - d483e2df546f
[Not reviewed]
default
0 2 0
Mads Kiilerich (mads) - 5 years ago 2021-05-27 00:48:35
mads@kiilerich.com
ini: set translate_forwarded_server = False when using paste prefix middleware

Paste Deploy PrefixMiddleware will be default trust HTTP headers that a proxy
server might have set. That can be a problem if there is no proxy server or if
the proxy just pass these headers through.

Change the configuration example to disable this translation.
2 files changed with 2 insertions and 0 deletions:
0 comments (0 inline, 0 general)
development.ini
Show inline comments
 
###################################################################################
 
###################################################################################
 
## Kallithea config file generated with kallithea-cli                            ##
 
##                                                                               ##
 
## The %(here)s variable will generally be replaced with the parent directory of ##
 
## this file. Other use of % must be escaped as %% .                             ##
 
###################################################################################
 
###################################################################################
 

	
 
[DEFAULT]
 

	
 
################################################################################
 
## Email settings                                                             ##
 
##                                                                            ##
 
## Refer to the documentation ("Email settings") for more details.            ##
 
##                                                                            ##
 
## It is recommended to use a valid sender address that passes access         ##
 
## validation and spam filtering in mail servers.                             ##
 
################################################################################
 

	
 
## 'From' header for application emails. You can optionally add a name.
 
## Default:
 
#app_email_from = Kallithea
 
## Examples:
 
#app_email_from = Kallithea <kallithea-noreply@example.com>
 
#app_email_from = kallithea-noreply@example.com
 

	
 
## Subject prefix for application emails.
 
## A space between this prefix and the real subject is automatically added.
 
## Default:
 
#email_prefix =
 
## Example:
 
#email_prefix = [Kallithea]
 

	
 
## Recipients for error emails and fallback recipients of application mails.
 
## Multiple addresses can be specified, comma-separated.
 
## Only addresses are allowed, do not add any name part.
 
## Default:
 
#email_to =
 
## Examples:
 
#email_to = admin@example.com
 
#email_to = admin@example.com,another_admin@example.com
 
email_to =
 

	
 
## 'From' header for error emails. You can optionally add a name.
 
## Default: (none)
 
## Examples:
 
#error_email_from = Kallithea Errors <kallithea-noreply@example.com>
 
#error_email_from = kallithea_errors@example.com
 
error_email_from =
 

	
 
## SMTP server settings
 
## If specifying credentials, make sure to use secure connections.
 
## Default: Send unencrypted unauthenticated mails to the specified smtp_server.
 
## For "SSL", use smtp_use_ssl = true and smtp_port = 465.
 
## For "STARTTLS", use smtp_use_tls = true and smtp_port = 587.
 
smtp_server =
 
smtp_username =
 
smtp_password =
 
smtp_port =
 
smtp_use_ssl = false
 
smtp_use_tls = false
 

	
 
## Entry point for 'gearbox serve'
 
[server:main]
 
#host = 127.0.0.1
 
host = 0.0.0.0
 
port = 5000
 

	
 
## Gearbox serve uses the Waitress web server ##
 
use = egg:waitress#main
 
## avoid multi threading
 
threads = 1
 
## allow push of repos bigger than the default of 1 GB
 
max_request_body_size = 107374182400
 
## use poll instead of select, fixes fd limits, may not work on old
 
## windows systems.
 
#asyncore_use_poll = True
 

	
 
## middleware for hosting the WSGI application under a URL prefix
 
#[filter:proxy-prefix]
 
#use = egg:PasteDeploy#prefix
 
#prefix = /<your-prefix>
 
#translate_forwarded_server = False
 

	
 
[app:main]
 
use = egg:kallithea
 
## enable proxy prefix middleware
 
#filter-with = proxy-prefix
 

	
 
full_stack = true
 
static_files = true
 

	
 
## Internationalization (see setup documentation for details)
 
## By default, the languages requested by the browser are used if available, with English as default.
 
## Set i18n.enabled=false to disable automatic language choice.
 
#i18n.enabled = true
 
## To Force a language, set i18n.enabled=false and specify the language in i18n.lang.
 
## Valid values are the names of subdirectories in kallithea/i18n with a LC_MESSAGES/kallithea.mo
 
#i18n.lang = en
 

	
 
cache_dir = %(here)s/data
 
index_dir = %(here)s/data/index
 

	
 
## uncomment and set this path to use archive download cache
 
archive_cache_dir = %(here)s/data/tarballcache
 

	
 
## change this to unique ID for security
 
#app_instance_uuid = VERY-SECRET
 
app_instance_uuid = development-not-secret
 

	
 
## cut off limit for large diffs (size in bytes)
 
cut_off_limit = 256000
 

	
 
## WSGI environment variable to get the IP address of the client (default REMOTE_ADDR)
 
#remote_addr_variable = HTTP_X_FORWARDED_FOR
 

	
 
## WSGI environment variable to get the protocol (http or https) of the client connection (default wsgi.url_scheme)
 
#url_scheme_variable = HTTP_X_FORWARDED_PROTO
 

	
 
## always pretend the client connected using HTTPS (default false)
 
#force_https = true
 

	
 
## use Strict-Transport-Security headers (default false)
 
#use_htsts = true
 

	
 
## number of commits stats will parse on each iteration
 
commit_parse_limit = 25
 

	
 
## Path to Python executable to be used for git hooks.
 
## This value will be written inside the git hook scripts as the text
 
## after '#!' (shebang). When empty or not defined, the value of
 
## 'sys.executable' at the time of installation of the git hooks is
 
## used, which is correct in many cases but for example not when using uwsgi.
 
## If you change this setting, you should reinstall the Git hooks via
 
## Admin > Settings > Remap and Rescan.
 
#git_hook_interpreter = /srv/kallithea/venv/bin/python3
 

	
 
## path to git executable
 
git_path = git
 

	
 
## git rev filter option, --all is the default filter, if you need to
 
## hide all refs in changelog switch this to --branches --tags
 
#git_rev_filter = --branches --tags
 

	
 
## RSS feed options
 
rss_cut_off_limit = 256000
 
rss_items_per_page = 10
 
rss_include_diff = false
 

	
 
## options for showing and identifying changesets
 
show_sha_length = 12
 
show_revision_number = false
 

	
 
## Canonical URL to use when creating full URLs in UI and texts.
 
## Useful when the site is available under different names or protocols.
 
## Defaults to what is provided in the WSGI environment.
 
#canonical_url = https://kallithea.example.com/repos
 

	
 
## gist URL alias, used to create nicer urls for gist. This should be an
 
## url that does rewrites to _admin/gists/<gistid>.
 
## example: http://gist.example.com/{gistid}. Empty means use the internal
 
## Kallithea url, ie. http[s]://kallithea.example.com/_admin/gists/<gistid>
 
gist_alias_url =
 

	
 
## default encoding used to convert from and to unicode
 
## can be also a comma separated list of encoding in case of mixed encodings
 
default_encoding = utf-8
 

	
 
## Set Mercurial encoding, similar to setting HGENCODING before launching Kallithea
 
hgencoding = utf-8
 

	
 
## issue tracker for Kallithea (leave blank to disable, absent for default)
 
#bugtracker = https://bitbucket.org/conservancy/kallithea/issues
 

	
 
## issue tracking mapping for commit messages, comments, PR descriptions, ...
 
## Refer to the documentation ("Integration with issue trackers") for more details.
 

	
 
## regular expression to match issue references
 
## This pattern may/should contain parenthesized groups, that can
kallithea/templates/ini/template.ini.mako
Show inline comments
 
@@ -52,192 +52,193 @@ error_email_from =
 

	
 
<%text>##</%text> SMTP server settings
 
<%text>##</%text> If specifying credentials, make sure to use secure connections.
 
<%text>##</%text> Default: Send unencrypted unauthenticated mails to the specified smtp_server.
 
<%text>##</%text> For "SSL", use smtp_use_ssl = true and smtp_port = 465.
 
<%text>##</%text> For "STARTTLS", use smtp_use_tls = true and smtp_port = 587.
 
smtp_server =
 
smtp_username =
 
smtp_password =
 
smtp_port =
 
smtp_use_ssl = false
 
smtp_use_tls = false
 

	
 
%if http_server != 'uwsgi':
 
<%text>##</%text> Entry point for 'gearbox serve'
 
[server:main]
 
host = ${host}
 
port = ${port}
 

	
 
%if http_server == 'gearbox':
 
<%text>##</%text> Gearbox serve uses the built-in development web server ##
 
use = egg:gearbox#wsgiref
 
<%text>##</%text> nr of worker threads to spawn
 
threadpool_workers = 1
 
<%text>##</%text> max request before thread respawn
 
threadpool_max_requests = 100
 
<%text>##</%text> option to use threads of process
 
use_threadpool = true
 

	
 
%elif http_server == 'gevent':
 
<%text>##</%text> Gearbox serve uses the gevent web server ##
 
use = egg:gearbox#gevent
 

	
 
%elif http_server == 'waitress':
 
<%text>##</%text> Gearbox serve uses the Waitress web server ##
 
use = egg:waitress#main
 
<%text>##</%text> avoid multi threading
 
threads = 1
 
<%text>##</%text> allow push of repos bigger than the default of 1 GB
 
max_request_body_size = 107374182400
 
<%text>##</%text> use poll instead of select, fixes fd limits, may not work on old
 
<%text>##</%text> windows systems.
 
#asyncore_use_poll = True
 

	
 
%elif http_server == 'gunicorn':
 
<%text>##</%text> Gearbox serve uses the Gunicorn web server ##
 
use = egg:gunicorn#main
 
<%text>##</%text> number of process workers. You must set `instance_id = *` when this option
 
<%text>##</%text> is set to more than one worker
 
workers = 4
 
<%text>##</%text> process name
 
proc_name = kallithea
 
<%text>##</%text> type of worker class, one of sync, eventlet, gevent, tornado
 
<%text>##</%text> recommended for bigger setup is using of of other than sync one
 
worker_class = sync
 
max_requests = 1000
 
<%text>##</%text> amount of time a worker can handle request before it gets killed and
 
<%text>##</%text> restarted
 
timeout = 3600
 

	
 
%endif
 
%else:
 
<%text>##</%text> UWSGI ##
 
[uwsgi]
 
<%text>##</%text> Note: this section is parsed by the uWSGI .ini parser when run as:
 
<%text>##</%text> uwsgi --venv /srv/kallithea/venv --ini-paste-logged my.ini
 
<%text>##</%text> Note: in uWSGI 2.0.18 or older, pastescript needs to be installed to
 
<%text>##</%text> get correct application logging. In later versions this is not necessary.
 
<%text>##</%text> pip install pastescript
 

	
 
<%text>##</%text> HTTP Basics:
 
http-socket = ${host}:${port}
 
buffer-size = 65535                    ; Mercurial will use huge GET headers for discovery
 

	
 
<%text>##</%text> Scaling:
 
master = true                          ; Use separate master and worker processes
 
auto-procname = true                   ; Name worker processes accordingly
 
lazy = true                            ; App *must* be loaded in workers - db connections can't be shared
 
workers = 4                            ; On demand scaling up to this many worker processes
 
cheaper = 1                            ; Initial and on demand scaling down to this many worker processes
 
max-requests = 1000                    ; Graceful reload of worker processes to avoid leaks
 

	
 
<%text>##</%text> Tweak defaults:
 
strict = true                          ; Fail on unknown config directives
 
enable-threads = true                  ; Enable Python threads (not threaded workers)
 
vacuum = true                          ; Delete sockets during shutdown
 
single-interpreter = true
 
die-on-term = true                     ; Shutdown when receiving SIGTERM (default is respawn)
 
need-app = true                        ; Exit early if no app can be loaded.
 
reload-on-exception = true             ; Don't assume that the application worker can process more requests after a severe error
 

	
 
%endif
 
<%text>##</%text> middleware for hosting the WSGI application under a URL prefix
 
#[filter:proxy-prefix]
 
#use = egg:PasteDeploy#prefix
 
#prefix = /<your-prefix>
 
#translate_forwarded_server = False
 

	
 
[app:main]
 
use = egg:kallithea
 
<%text>##</%text> enable proxy prefix middleware
 
#filter-with = proxy-prefix
 

	
 
full_stack = true
 
static_files = true
 

	
 
<%text>##</%text> Internationalization (see setup documentation for details)
 
<%text>##</%text> By default, the languages requested by the browser are used if available, with English as default.
 
<%text>##</%text> Set i18n.enabled=false to disable automatic language choice.
 
#i18n.enabled = true
 
<%text>##</%text> To Force a language, set i18n.enabled=false and specify the language in i18n.lang.
 
<%text>##</%text> Valid values are the names of subdirectories in kallithea/i18n with a LC_MESSAGES/kallithea.mo
 
#i18n.lang = en
 

	
 
cache_dir = %(here)s/data
 
index_dir = %(here)s/data/index
 

	
 
<%text>##</%text> uncomment and set this path to use archive download cache
 
archive_cache_dir = %(here)s/data/tarballcache
 

	
 
<%text>##</%text> change this to unique ID for security
 
app_instance_uuid = ${uuid()}
 

	
 
<%text>##</%text> cut off limit for large diffs (size in bytes)
 
cut_off_limit = 256000
 

	
 
<%text>##</%text> WSGI environment variable to get the IP address of the client (default REMOTE_ADDR)
 
#remote_addr_variable = HTTP_X_FORWARDED_FOR
 

	
 
<%text>##</%text> WSGI environment variable to get the protocol (http or https) of the client connection (default wsgi.url_scheme)
 
#url_scheme_variable = HTTP_X_FORWARDED_PROTO
 

	
 
<%text>##</%text> always pretend the client connected using HTTPS (default false)
 
#force_https = true
 

	
 
<%text>##</%text> use Strict-Transport-Security headers (default false)
 
#use_htsts = true
 

	
 
<%text>##</%text> number of commits stats will parse on each iteration
 
commit_parse_limit = 25
 

	
 
<%text>##</%text> Path to Python executable to be used for git hooks.
 
<%text>##</%text> This value will be written inside the git hook scripts as the text
 
<%text>##</%text> after '#!' (shebang). When empty or not defined, the value of
 
<%text>##</%text> 'sys.executable' at the time of installation of the git hooks is
 
<%text>##</%text> used, which is correct in many cases but for example not when using uwsgi.
 
<%text>##</%text> If you change this setting, you should reinstall the Git hooks via
 
<%text>##</%text> Admin > Settings > Remap and Rescan.
 
#git_hook_interpreter = /srv/kallithea/venv/bin/python3
 
%if git_hook_interpreter:
 
git_hook_interpreter = ${git_hook_interpreter}
 
%endif
 

	
 
<%text>##</%text> path to git executable
 
git_path = git
 

	
 
<%text>##</%text> git rev filter option, --all is the default filter, if you need to
 
<%text>##</%text> hide all refs in changelog switch this to --branches --tags
 
#git_rev_filter = --branches --tags
 

	
 
<%text>##</%text> RSS feed options
 
rss_cut_off_limit = 256000
 
rss_items_per_page = 10
 
rss_include_diff = false
 

	
 
<%text>##</%text> options for showing and identifying changesets
 
show_sha_length = 12
 
show_revision_number = false
 

	
 
<%text>##</%text> Canonical URL to use when creating full URLs in UI and texts.
 
<%text>##</%text> Useful when the site is available under different names or protocols.
 
<%text>##</%text> Defaults to what is provided in the WSGI environment.
 
#canonical_url = https://kallithea.example.com/repos
 

	
 
<%text>##</%text> gist URL alias, used to create nicer urls for gist. This should be an
 
<%text>##</%text> url that does rewrites to _admin/gists/<gistid>.
 
<%text>##</%text> example: http://gist.example.com/{gistid}. Empty means use the internal
 
<%text>##</%text> Kallithea url, ie. http[s]://kallithea.example.com/_admin/gists/<gistid>
 
gist_alias_url =
 

	
 
<%text>##</%text> default encoding used to convert from and to unicode
 
<%text>##</%text> can be also a comma separated list of encoding in case of mixed encodings
 
default_encoding = utf-8
 

	
 
<%text>##</%text> Set Mercurial encoding, similar to setting HGENCODING before launching Kallithea
 
hgencoding = utf-8
 

	
 
<%text>##</%text> issue tracker for Kallithea (leave blank to disable, absent for default)
 
#bugtracker = https://bitbucket.org/conservancy/kallithea/issues
 

	
 
<%text>##</%text> issue tracking mapping for commit messages, comments, PR descriptions, ...
 
<%text>##</%text> Refer to the documentation ("Integration with issue trackers") for more details.
 

	
0 comments (0 inline, 0 general)