gmid “Interstellar Overdrive” v1.5 update

> 20 days of work = whole bunch of new features

Written while listening to “Interstellar Overdrive” by Pink Floyd.

Published: 2021-01-30

Tagged with:

#gemini

#gmid

These last twenty days were pretty productive on the gmid front: I ended up doing way more things that I had planned for this v1.5 release.

The headlines are the automatic sandboxing on OpenBSD, FreeBSD and linux and the introduction of the configuration file, but you’ll find the whole change log at the end of this entry.

On OpenBSD pledge and unveil were already in place, but their usage has been improved during this release cycle: the daemon was split into two processes that run with different pledges. This enabled also the usage of capsicum on FreeBSD and seccomp on linux. Always in the same spirit, support for chroot and privilege dropping has been added, so it’s safe to start the daemon with root privileges.

Read “Comparing sandboxing techniques” for more information.

With this release gmid has two modes: a daemon mode and a config-less mode. The config-less mode is similar to how gmid operated until now (i.e. running from the command line) and has been improved with an automatic certificate generation, while the daemon more is more akin to “normal” network daemons and needs a configuration file.

The configuration file syntax has been inspired from OpenBSD’ httpd and is quite flexible. It supports a wide range of customizable parameters and location blocks to alter the behaviour per matching path.

v1.5 “Interstellar Overdrive” Changelog

New features

vhost support

configuration file

sandboxed by default on OpenBSD, FreeBSD and linux

customize the accepted TLS version

customizable default type

customizable mime mappings

provide a dockerfile

provide a lang parameter when serving text/gemini files

added a ‘configure’ script

customizable directory index

directory listings (disabled by default)

[config] location blocks support

chroot support

punycode support

Improvements

log ip, port, full request and response code (even for CGI scripts)

host name matching with globbing rules

automatically generate TLS certificates when running in config-less mode and no certificate was found

Bugfixes

[IRI] normalize scheme

[IRI] normalize hostnames

[IRI] accept a wider range of codepoints in hostnames

set SERVER_NAME when executing CGI scripts

Breaking changes

removed -C, -K flags

-d changed meaning: the directory to serve is now given as positional parameter and -d is used to specify the directory for the TLS certificates (either autogenerated or not.)

-- text: CC0 1.0; code: public domain (unless specified otherwise). No copyright here.