Lighttpd

sudo aptitude purge lighttpd

did Setting up a simple SSL configuration with a self-signed certificate
on pre-existing lighttpd.conf

autogen.sh got trap: ERR: bad trap

websearch said build-dep

after running apt-get build-dep lighttpd

make check
make install

www-data@DietPi:~$ sudo lighttpd -tt -f /etc/lighttpd/lighttpd.conf
[sudo] password for www-data:
Sorry, try again.
[sudo] password for www-data:
2024-07-07 11:28:56: (configfile.c.1397) WARNING: unknown config-key: kserver.modules (ignored)
2024-07-07 11:28:56: (configfile.c.1397) WARNING: unknown config-key: url.access-deny (ignored)
2024-07-07 11:28:56: (configfile.c.1397) WARNING: unknown config-key: alias.url (ignored)
2024-07-07 11:28:56: (configfile.c.1397) WARNING: unknown config-key: ssl.pemfile (ignored)
www-data@DietPi:~$

/etc/lighttpd/lighttpd.conf
kserver.modules = (
    "mod_indexfile",
    "mod_access",
    "mod_alias",
     "mod_redirect",
    "mod_openssl",
)

server.document-root        = "/var/www/html" 
server.upload-dirs          = ( "/var/cache/lighttpd/uploads" )
server.errorlog             = "/var/log/lighttpd/error.log" 
server.pid-file             = "/run/lighttpd.pid" 
server.username             = "www-data" 
server.groupname            = "www-data" 
server.port                 = 80

# features
#https://redmine.lighttpd.net/projects/lighttpd/wiki/Server_feature-flagsDetails
server.feature-flags       += ("server.h2proto" => "enable")
server.feature-flags       += ("server.h2c"     => "enable")
server.feature-flags       += ("server.graceful-shutdown-timeout" => 5)
#server.feature-flags       += ("server.graceful-restart-bg" => "enable")

# strict parsing and normalization of URL for consistency and security
# https://redmine.lighttpd.net/projects/lighttpd/wiki/Server_http-parseoptsDetails
# (might need to explicitly set "url-path-2f-decode" = "disable" 
#  if a specific application is encoding URLs inside url-path)
server.http-parseopts = (
  "header-strict"           => "enable",# default
  "host-strict"             => "enable",# default
  "host-normalize"          => "enable",# default
  "url-normalize-unreserved"=> "enable",# recommended highly
  "url-normalize-required"  => "enable",# recommended
  "url-ctrls-reject"        => "enable",# recommended
  "url-path-2f-decode"      => "enable",# recommended highly (unless breaks app)
 #"url-path-2f-reject"      => "enable",
  "url-path-dotseg-remove"  => "enable",# recommended highly (unless breaks app)
 #"url-path-dotseg-reject"  => "enable",
 #"url-query-20-plus"       => "enable",# consistency in query string
)

index-file.names            = ( "index.php", "index.html" )
url.access-deny             = ( "~", ".inc" )
static-file.exclude-extensions = ( ".php", ".pl", ".fcgi", ".js" )

# default listening port for IPv6 falls back to the IPv4 port
include_shell "/usr/share/lighttpd/use-ipv6.pl " + server.port
include_shell "/usr/share/lighttpd/create-mime.conf.pl" 
include "/etc/lighttpd/conf-enabled/*.conf" 

#server.compat-module-load   = "disable" 
server.modules += (
    "mod_dirlisting",
    "mod_staticfile",
)

$SERVER["socket"] == ":443" {
  ssl.engine = "enable" 
  ssl.pemfile = "/etc/lighttpd/certs/lighttpd.pem" 
}

}  # extra '}' ???

www-data@DietPi:~$ sudo lighttpd -p -f /etc/lighttpd/lighttpd.conf
config {
    var.CWD                        = "/home/www-data" 
    var.PID                        = 5907
    kserver.modules                = ("mod_indexfile", "mod_access", "mod_alias", "mod_redirect", "mod_openssl")
    server.document-root           = "/var/www/html" 
    server.upload-dirs             = ("/var/cache/lighttpd/uploads")
    server.errorlog                = "/var/log/lighttpd/error.log" 
    server.pid-file                = "/run/lighttpd.pid" 
    server.username                = "www-data" 
    server.groupname               = "www-data" 
    server.port                    = 80
    server.feature-flags           = (
        "server.h2proto"                   => "enable",
        "server.h2c"                       => "enable",
        "server.graceful-shutdown-timeout" => 5,
    )
    server.http-parseopts          = (
        "header-strict"            => "enable",
        "host-strict"              => "enable",
        "host-normalize"           => "enable",
        "url-normalize-unreserved" => "enable",
        "url-normalize-required"   => "enable",
        "url-ctrls-reject"         => "enable",
        "url-path-2f-decode"       => "enable",
        "url-path-dotseg-remove"   => "enable",
    )
    index-file.names               = ("index.php", "index.html", "index.lighttpd.html")
    url.access-deny                = ("~", ".inc")
    static-file.exclude-extensions = (".php", ".pl", ".fcgi", ".js")
    mimetype.assign                = (
        ".cwl.json"                       => "application/cwl+json",
        ".sarif.json"                     => "application/sarif+json",
        ".sarif-external-properties.json" => "application/sarif-external-properties+json" 

  omitted

    ".movie"                          => "video/x-sgi-movie",
        "README"                          => "text/plain;charset=utf-8",
        "Makefile"                        => "text/x-makefile;charset=utf-8",
        ""                                => "application/octet-stream",
    )
    userdir.exclude-user           = ("root", "postmaster")
    userdir.path                   = "public_html" 
    server.modules                 = ("mod_cgi", "mod_userdir", "mod_dirlisting", "mod_staticfile")

    if $SERVER["socket"] == "[::]:80" {
        # block 1

    } # end of $SERVER["socket"] == "[::]:80" 

    if $HTTP["url"] =^ "/cgi-bin/" {
        # block 2
        cgi.assign = (
            ".sh" => "/usr/bin/bash",confconf
        )
        alias.url  = (
            "/cgi-bin/" => "/var/www/html/cgi-bin/",
        )

    } # end of $HTTP["url"] =^ "/cgi-bin/" 

    if $SERVER["socket"] == ":443" {
Password Manager   # ???????
        # block 3
        ssl.engine  = "enable" 
        ssl.pemfile = "/etc/lighttpd/certs/lighttpd.pem" 

    } # end of $SERVER["socket"] == ":443" 
}
www-data@DietPi:~$