<?php /* #?ini charset="utf-8"?
# Exponential 6: Velocity serving a public site on ports 80 and 443
#
# Free documentation: GFDL 1.3 or later, see doc/eng-us/README-LICENSE.md.
#
# Copy to settings/override/velocity.ini.append.php (drop ".example"), or
# set each value with "exp:velocity config set <Block> <Setting> <value>",
# which writes the same file. Every setting is described in
# settings/velocity.ini; only what differs from the shipped value goes here.
# Explained in velocity.md next to this file.
#
# After a change: php bin/php/console exp:velocity restart --allow-root-user

[ServerSettings]
# qbix: the recommended engine (persistent workers, response cache, TLS,
# HTTP/2, the /etc/vc tree). The shipped default is php (development only).
Engine=qbix
# Every address, the standard ports. The shipped 127.0.0.1:8088 keeps the
# server reachable only locally or through a reverse proxy.
Host=0.0.0.0
Port=80
HTTPSPort=443
# Started as root (needed for ports below 1024), the workers become this
# user and group, the owner of the installation's files
User=example
Group=example
# Worker processes; SpareWorkers adds a dynamic pool for peaks
Workers=8
SpareWorkers=8

[HTTPSSettings]
# HTTPS is on only when Enabled is true AND both files exist
Enabled=true
Certificate=/etc/ssl/example.com/fullchain.pem
Key=/etc/ssl/example.com/privkey.pem
# Start short; raise to 31536000 once every name is served over HTTPS for good
HSTSMaxAge=300

[CacheSettings]
# The response cache for anonymous visitors (seconds a page is kept)
Enabled=enabled
DefaultTtl=30

[LayoutSettings]
# The name of the site file in /etc/vc/sites-available; empty: the host of
# site.ini [SiteSettings] SiteURL
SiteName=example.com
*/ ?>

php bin/php/console exp:velocity config set --apply ServerSettings Engine qbix --allow-root-user
php bin/php/console exp:velocity config set --apply ServerSettings Host 0.0.0.0 --allow-root-user
php bin/php/console exp:velocity config set --apply ServerSettings Port 80 --allow-root-user
php bin/php/console exp:velocity config set --apply ServerSettings HTTPSPort 443 --allow-root-user
php bin/php/console exp:velocity config set --apply ServerSettings User example --allow-root-user
php bin/php/console exp:velocity config set --apply ServerSettings Group example --allow-root-user
php bin/php/console exp:velocity config set --apply HTTPSSettings Certificate /etc/ssl/example.com/fullchain.pem --allow-root-user
php bin/php/console exp:velocity config set --apply HTTPSSettings Key /etc/ssl/example.com/privkey.pem --allow-root-user
php bin/php/console exp:velocity config set --apply HTTPSSettings Enabled true --allow-root-user
php bin/php/console exp:velocity config list --allow-root-user      # * marks what you set
php bin/php/console exp:velocity restart --allow-root-user
php bin/php/console exp:velocity status --allow-root-user

/etc/vc/
├── vc.conf                   settings shared by every site        (apache2.conf)
├── ports.conf                listen ports                         (ports.conf)
├── envvars                   environment of the server process    (envvars)
├── conf-available/*.conf     shared snippets                      -> conf-enabled/  (symlinks)
├── mods-available/*.conf     engine modules: http2, cache, ...    -> mods-enabled/  (symlinks)
├── sites-available/*.conf    one file per installation            -> sites-enabled/ (symlinks)
├── designs/                  the server's own page designs
└── ssl/                      certificates

{
    "_generated": "exp:velocity",
    "Q": {
        "web": {
            "static": {
                "paths": [
                    "^/(design/[^/]+/(stylesheets|images|javascript|fonts)/|share/icons/|...|w3c/p3p\\.xml$)"
                ]
            },
            "cache": {
                "dir": "/var/www/example.com/var/cache/qbix-reverse"
            }
        },
        "webserver": {
            "scripts": ["/index.php", "/index_rest.php", "/index_treemenu.php"],
            "frontControllers": {
                "^/(api/|index_rest\\.php)": "index_rest.php",
                "^/([^/]+/)?content/treemenu": "index_treemenu.php"
            },
            "log": {
                "dir": "/var/www/example.com/var/vc/qbix/log"
            },
            "headers": {
                "X-Content-Type-Options": "nosniff",
                "X-Frame-Options": "SAMEORIGIN",
                "Referrer-Policy": "strict-origin-when-cross-origin",
                "Permissions-Policy": "camera=(), microphone=(), payment=(), usb=()"
            },
            "headersOnScripts": true,
            "hsts": {
                "maxAge": 300
            }
        }
    }
}

php bin/php/console exp:velocity layout --allow-root-user                 # every path, what is enabled, the files in use
php bin/php/console exp:velocity site enable --apply example.com --allow-root-user
php bin/php/console exp:velocity conf enable --apply reverse-proxy --allow-root-user
php bin/php/console exp:velocity mod disable --apply http2 --allow-root-user
php bin/php/console exp:velocity ctl configtest --allow-root-user         # the engine's own check of the tree

# Exponential 6: a systemd unit that starts Velocity through exp:velocity
#
# Free documentation: GFDL 1.3 or later, see doc/eng-us/README-LICENSE.md.
#
# Not shipped as a unit; derived from what expVelocity::start() does (it
# starts the server detached and returns once the port answers, leaving the
# pid in var/vc/qbix/run/server.pid) and from doc/eng-us/install/08-serving-the-site.md,
# 8.3.11. It keeps every setting in velocity.ini. Explained in velocity.md.
#
# Install: /etc/systemd/system/exponential-velocity-example.service, replace
# /var/www/example.com and the database unit, then
#   systemctl daemon-reload
#   systemctl enable --now exponential-velocity-example
#
# It runs as root so the server can bind ports 80 and 443 and read the key;
# the workers still drop to [ServerSettings] User and Group. With Instances
# above 1, PIDFile names instance 0 only. Do not combine it with the unit of
# the operating-system package for the same ports.

[Unit]
Description=Exponential Velocity for example.com
After=network-online.target mysqld.service
Wants=network-online.target

[Service]
Type=forking
WorkingDirectory=/var/www/example.com
ExecStart=/usr/bin/php bin/php/console exp:velocity start --allow-root-user
ExecStop=/usr/bin/php bin/php/console exp:velocity stop --allow-root-user
ExecReload=/usr/bin/php bin/php/console exp:velocity graceful --allow-root-user
PIDFile=/var/www/example.com/var/vc/qbix/run/server.pid
TimeoutStartSec=90
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

php bin/php/console exp:velocity deploy --dry-run --allow-root-user   # what it would do, nothing else
php bin/php/console exp:velocity deploy --allow-root-user
php bin/php/console exp:velocity deploy --kernel --allow-root-user    # a kernel class was added or renamed

curl -sI https://example.com/ | head -1                                         # HTTP/2 200 or a redirect
curl -s -o /dev/null -w '%{http_code}\n' https://example.com/.git/config        # 403 from the qbix engine
curl -s https://example.com/settings/site.ini | grep -c '^\[DatabaseSettings\]' # 0: a page, not the file
php bin/php/console exp:velocity ssl show --allow-root-user                     # the certificate in use