# Exponential 6: an OpenLiteSpeed virtual host (vhconf.conf)
#
# Free documentation: GFDL 1.3 or later, see doc/eng-us/README-LICENSE.md; rules derived from .htaccess_root (GPL v2 or later).
#
# Derived, not shipped by the kernel, and NOT syntax-checked here (no
# OpenLiteSpeed on the machine the examples are verified on): a translation
# of .htaccess_root (this release). Check it in the WebAdmin console
# (Virtual Hosts > example.com, then a graceful restart) and with the requests
# in litespeed.md before the site is public. Compare it with .htaccess_root
# after every upgrade.
#
# LiteSpeed Enterprise reads .htaccess like Apache: there, copy
# .htaccess_root to .htaccess and you need none of this file.
# OpenLiteSpeed reads only the rewrite rules of .htaccess, and only with
# autoLoadHtaccess; this file puts the rules in the virtual host instead.
#
# Install: /usr/local/lsws/conf/vhosts/example.com/vhconf.conf, with the
# virtual host and its listener mapping defined in httpd_config.conf (or
# through WebAdmin). Replace example.com, /var/www/example.com and the
# lsphp version.

docRoot                   /var/www/example.com
vhDomain                  example.com
vhAliases                 www.example.com
enableGzip                1
enableBr                  1

errorlog $VH_ROOT/logs/error.log {
  useServer               0
  logLevel                WARN
  rollingSize             10M
}

accesslog $VH_ROOT/logs/access.log {
  useServer               0
  rollingSize             10M
  keepDays                30
}

index  {
  useServer               0
  indexFiles              index.php
  autoIndex               0
}

# PHP through LSAPI; the external app "lsphp" is defined at server level
# (WebAdmin > Server Configuration > External App), or here:
extprocessor lsphp {
  type                    lsapi
  address                 uds://tmp/lshttpd/example.com.sock
  maxConns                10
  env                     PHP_LSAPI_CHILDREN=10
  initTimeout             60
  retryTimeout            0
  respBuffer              0
  autoStart               2
  path                    /usr/local/lsws/lsphp83/bin/lsphp
  backlog                 100
  instances               1
  extUser                 example
  extGroup                example
  memSoftLimit            2047M
  memHardLimit            2047M
}

scripthandler  {
  add                     lsapi:lsphp php
}

# Response headers: the values of the kernel's site.ini [HTTPHeaderSettings]
# SecurityHeaders[] for the files OpenLiteSpeed serves itself
context / {
  location                $DOC_ROOT/
  allowBrowse             1
  extraHeaders            <<<END_extraHeaders
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
Referrer-Policy strict-origin-when-cross-origin
Permissions-Policy camera=(), microphone=(), payment=(), usb=()
  END_extraHeaders
}

# Defense in depth: never served even if the rewrite rules were switched off.
# With the rules on, these paths are rewritten to index.php before any
# context is chosen.
context /.git/ {
  allowBrowse             0
}
context /settings/ {
  allowBrowse             0
}
context /vendor/ {
  allowBrowse             0
}
context /var/log/ {
  allowBrowse             0
}

# Page cache (off). OpenLiteSpeed keeps whole pages and answers anonymous
# visitors and crawlers from them without PHP. To switch it on, remove the "#"
# of the lines below and of the cache rules in the rewrite block, then a
# graceful restart. Guide: doc/eng-us/guides/litespeed-page-cache.md
# enableCache 0 with checkPublicCache 1 leaves the choice to the rewrite rule:
# only requests it marks with cache-control are stored. respCookieCache 0
# never stores a page that sets a cookie. ignoreRespCacheCtrl 0 obeys the
# page's own Cache-Control: with it, switch on site.ini [HTTPHeaderSettings]
# for anonymous visitors (OnlyForAnonymous=enabled, see the guide), or no
# page is stored.
#module cache {
#  ls_enabled              1
#  enableCache             0
#  enablePrivateCache      0
#  checkPublicCache        1
#  checkPrivateCache       0
#  qsCache                 0
#  reqCookieCache          1
#  respCookieCache         0
#  ignoreReqCacheCtrl      1
#  ignoreRespCacheCtrl     0
#  expireInSeconds         120
#  storagePath             $VH_ROOT/lscache
#}

rewrite  {
  enable                  1
  autoLoadHtaccess        0
  logLevel                0
  # The rules of .htaccess_root, in its order. "^/?" accepts the URL with
  # and without its leading slash, as the virtual host and a context see it.
  rules                   <<<END_rules
# No dot file or dot directory; .well-known stays reachable
RewriteRule (^|/)\.(?!well-known(/|$)) - [R=404,L]
# No script below the root runs because its path was asked for
RewriteCond %{DOCUMENT_ROOT}%{REQUEST_URI} -f
RewriteRule ^/?.+/[^/]+\.(php[0-9]?|phtml|phar)$ - [R=404,L]
RewriteRule ^/?api/ /index_rest.php [L]
RewriteRule ^/?index_rest\.php - [L]
RewriteRule ^/?([^/]+/)?content/treemenu.* /index_treemenu.php [L]
RewriteRule ^/?var/([^/]+/)?storage/images(-versioned)?/.* - [L]
RewriteRule ^/?var/([^/]+/)?storage/pdf/[A-Za-z0-9][A-Za-z0-9._-]*\.pdf$ - [L]
RewriteRule ^/?var/([^/]+/)?storage/original/image/.+\.(png|jpe?g|gif|webp|svg)$ - [L]
RewriteRule ^/?var/([^/]+/)?cache/(texttoimage|public)/.* - [L]
#RewriteRule ^/?var_cache/([^/]+/)?cache/(texttoimage|public)/.* - [L]
RewriteRule ^/?design/[^/]+/(stylesheets|images|javascript|fonts)/.* - [L]
RewriteRule ^/?share/icons/.* - [L]
# Icon themes of extensions (icon.ini [ExtensionSettings] IconExtensions[]): images with exactly one extension
RewriteRule ^/?extension/[^/]+/icons/[A-Za-z0-9_/-]+\.(svg|png|gif)$ - [L]
RewriteRule ^/?extension/[^/]+/design/[^/]+/(stylesheets|flash|images|lib|javascripts?|fonts|vendor|media)/.* - [L]
RewriteRule ^/?packages/styles/.+/(stylesheets|images|javascript)/[^/]+/.* - [L]
RewriteRule ^/?packages/styles/.+/thumbnail/.* - [L]
RewriteRule ^/?var/storage/packages/.+\.(png|jpe?g|gif|webp)$ - [L]
RewriteRule ^/?favicon\.ico - [L]
RewriteRule ^/?design/standard/images/favicon\.ico - [L]
RewriteRule ^/?robots\.txt - [L]
RewriteRule ^/?index\.js$ - [L]
RewriteRule ^/?sw\.js$ - [L]
RewriteRule ^/?w3c/p3p\.xml - [L]
# Page cache (off; see "module cache" above): GET or HEAD, no query string,
# no session or sign-in cookie, not the administration, user/, shop/,
# notification/, layout/, ezjscore/, setup/ or content/ other than view/.
# Kept max-age seconds; nothing removes a page when an editor publishes.
#RewriteCond %{REQUEST_METHOD} ^(GET|HEAD)$
#RewriteCond %{QUERY_STRING} ^$
#RewriteCond %{HTTP_COOKIE} !(eZSESSID|PHPSESSID|is_logged_in) [NC]
#RewriteCond %{REQUEST_URI} !^/([^/]+/)?((admin|user|shop|notification|layout|ezjscore|setup)(/|$)|content/(?!view/)) [NC]
#RewriteCond %{HTTP_HOST} !^admin\. [NC]
#RewriteRule ^/?(.*)$ - [E=cache-control:max-age=120]
# Everything else, settings/, var/, vendor/ and composer.json included
RewriteRule .* /index.php [L]
  END_rules
}

vhssl  {
  keyFile                 /etc/ssl/example.com/privkey.pem
  certFile                /etc/ssl/example.com/fullchain.pem
  certChain               1
  enableSpdy              15
}

for p in /.git/config /.env /kernel/classes/ezini.php /extension/ezjscore/ezinfo.php; do
  printf '%-34s %s\n' "$p" "$(curl -s -o /dev/null -w '%{http_code}' https://example.com$p)"     # 404 each
done
curl -s https://example.com/settings/site.ini | grep -c '^\[DatabaseSettings\]'   # 0: a page, not the file
curl -sI https://example.com/design/admin4/stylesheets/components.css | head -1   # 200