###########################
### Server configuration ###
############################

###
# Server-wide config
###

# Can only be standalone
ServerType standalone

# Port number to run the server on
Port 8443

# Listen: Allows you to bind Apache to specific IP addresses and/or
# ports, in addition to the default. See also the VirtualHost command
# Listen 443

# User/Group: The name (or #number) of the user/group to run httpd as.
#  On SCO (ODT 3) use User nouser and Group nogroup
User nobody
Group nobody

# HostnameLookups: Log the names of clients or just their IP numbers
#   e.g.   www.apache.org (on) or 204.62.129.132 (off)
HostnameLookups on

# ServerAdmin: Your address, where problems with the server should be
# e-mailed.
ServerAdmin cyoun@npac.syr.edu

# ServerName allows you to set a host name which is sent back to clients for
# your server if it's different than the one the program would get (i.e. use
# "www" instead of the host's real name).
#
# Note: You cannot just invent host names and hope they work. The name you 
# define here must be a valid DNS name for your host. If you don't understand
# this, ask your network administrator.
ServerName osprey3.npac.syr.edu

# ServerRoot: The directory the server's config, error, and log files
# are kept in
ServerRoot /npac/home/webflow/Akenti

AkentiConf /npac/home/webflow/Akenti/conf/Akenti.conf

# Set LockFile to be something other than the default logs/accept.lock if
# the logs directories are NFS mounted, since the lock primitives do
# not work well enough with NFS files.

LockFile /tmp/apache-lock

###
# Logging
###
# ScoreBoardFile: File used to store internal server process information
ScoreboardFile akenti-logs/apache_runtime_status

# LogLevel: Control the number of messages logged to the error_log.
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn

# ErrorLog: The location of the error log file. If this does not start
# with /, ServerRoot is prepended to it.

ErrorLog akenti-logs/error_log

# TransferLog: The location of the transfer log file. If this does not
# start with /, ServerRoot is prepended to it.

TransferLog akenti-logs/access_log
CustomLog akenti-logs/access_log_cert "%h %l %{clientcert}c %{errcode}c %t \"%r\" %>s %b"

# PidFile: The file the server should log its pid to
PidFile akenti-logs/httpd.pid


# AgentLog: The location of the agent log file.  If this does not start
# with /, ServerRoot is prepended to it.
 
#AgentLog akenti-logs/agent_log

# UserDir: The name of the directory which is appended onto a user's home
# directory if a ~user request is recieved.
UserDir public_html

# RefererLog: The location of the referer log file.  If this does not
# start with /, ServerRoot is prepended to it.
 
#RefererLog akenti-logs/referer_log

# RefererIgnore: If you don't want to keep track of links from certain
# servers (like your own), place it here.  If you want to log them all,
# keep this line commented.
 
#RefererIgnore osprey3.npac.syr.edu

# Config files
TypesConfig mime.types
AccessConfig /dev/null
ResourceConfig /dev/null

###
# Server Tuning
###
# CacheNegotiatedDocs: By default, Apache sends Pragma: no-cache with each
# document that was negotiated on the basis of content. This asks proxy
# servers not to cache the document. Uncommenting the following line disables
# this behavior, and proxies will be allowed to cache the documents.

#CacheNegotiatedDocs

# Timeout: The number of seconds before receives and sends time out
#  n.b. the compiled default is 1200 (20 minutes !)

Timeout 400

# KeepAlive: The number of Keep-Alive persistent requests to accept
# per connection. Set to 0 to deactivate Keep-Alive support

KeepAlive 5
# KeepAliveTimeout: Number of seconds to wait for the next request

KeepAliveTimeout 15

# Server-pool size regulation.  Rather than making you guess how many
# server processes you need, Apache dynamically adapts to the load it
# sees --- that is, it tries to maintain enough server processes to
# handle the current load, plus a few spare servers to handle transient
# load spikes (e.g., multiple simultaneous requests from a single
# Netscape browser).

# It does this by periodically checking how many servers are waiting
# for a request.  If there are fewer than MinSpareServers, it creates
# a new spare.  If there are more than MaxSpareServers, some of the
# spares die off.  These values are probably OK for most sites ---

MinSpareServers 5
MaxSpareServers 10

# Number of servers to start --- should be a reasonable ballpark figure.

StartServers 5

# MaxRequestsPerChild: the number of requests each child process is
#  allowed to process before the child dies.
#  The child will exit so as to avoid problems after prolonged use when
#  Apache (and maybe the libraries it uses) leak.  On most systems, this
#  isn't really needed, but a few (such as Solaris) do have notable leaks
#  in the libraries.

MaxRequestsPerChild 30

###
# Proxy/Cache configuration
###
#ProxyRequests On

# To enable the cache as well, edit and uncomment the following lines:

#CacheRoot /npac/home/webflow/Akenti/cache
#CacheSize 5
#CacheGcInterval 4
#CacheMaxExpire 24
#CacheLastModifiedFactor 0.1
#CacheDefaultExpire 1
#NoCache adomain.com anotherdomain.edu joes.garage.com

###
# Server Resources
###

# DocumentRoot: The directory out of which you will serve your
# documents. By default, all requests are taken from this directory, but
# symbolic links and aliases may be used to point to other locations.
DocumentRoot /npac/home/webflow/Akenti/akenti-docs

# DirectoryIndex: Name of the file or files to use as a pre-written HTML
# directory index.  Separate multiple entries with spaces.
DirectoryIndex homepage.html
#index.html index.htm index.cgi

# FancyIndexing is whether you want fancy directory indexing or standard
FancyIndexing on

###
# Aliases & Icons
###
# Alias fakename realname
#????Alias /ftp /home/itg10/users/ftp/pub

Alias /icons/ /npac/home/webflow/Akenti/icons/

Alias /d_public/ /npac/home/webflow/WEBFLOW3/HTDOCS/d_public/
Alias /restricted/ /npac/home/webflow/WEBFLOW3/HTDOCS/restricted/
Alias /testpage/ /npac/home/webflow/WEBFLOW3/HTDOCS/testpage/
Alias /conf/ /npac/home/webflow/WEBFLOW3/WEBSERVER/conf/
Alias /logs/ /npac/home/webflow/WEBFLOW3/WEBSERVER/logs/
Alias /wcgi-bin/ /npac/home/webflow/WEBFLOW3/WEBSERVER/cgi-bin/
Alias /servlets/ /npac/home/webflow/WEBFLOW3/JSERVER/servlets/
Alias /BC/ /npac/home/webflow/WEBFLOW/BC/
Alias /BC21/ /npac/home/webflow/WEBFLOW/BC21/
Alias /BeanContext_2.0/ /npac/home/webflow/WEBFLOW/BeanContext_2.0/
Alias /BeanContext_2.1/ /npac/home/webflow/WEBFLOW/BeanContext_2.1/
Alias /JIGSAW/ /npac/home/webflow/WEBFLOW/JIGSAW/
Alias /XML/ /npac/home/webflow/WEBFLOW/XML/

# ScriptAlias: This controls which directories contain server scripts.
# Format: ScriptAlias fakename realname
# this puts scripts under the Akenti root .htauthority file in akenti-docs
# but also causes any files in this directory to be executed as script and
# not displayed to the user

ScriptAlias /cgi-bin/ /npac/home/webflow/Akenti/akenti-docs/cgi-bin/

# AddIcon tells the server which icon to show for different files or filename
AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
AddIconByType (TXT,/icons/text.gif) text/*
AddIconByType (IMG,/icons/image2.gif) image/*
AddIconByType (SND,/icons/sound2.gif) audio/*
AddIconByType (VID,/icons/movie.gif) video/*
AddIcon /icons/movie.xbm .mpg .qt
AddIcon /icons/menu.xbm **DIRECTORY**

AddIcon /icons/binary.gif .bin .exe
AddIcon /icons/binhex.gif .hqx
AddIcon /icons/tar.gif .tar
AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
AddIcon /icons/a.gif .ps .ai .eps
AddIcon /icons/layout.gif .html .shtml .htm .pdf
AddIcon /icons/text.gif .txt
AddIcon /icons/c.gif .c
AddIcon /icons/p.gif .pl .py
AddIcon /icons/f.gif .for
AddIcon /icons/dvi.gif .dvi
AddIcon /icons/uuencoded.gif .uu
AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
AddIcon /icons/tex.gif .tex
AddIcon /icons/bomb.gif core
AddIcon /icons/back.gif ..
AddIcon /icons/hand.right.gif README
AddIcon /icons/folder.gif ^^DIRECTORY^^
AddIcon /icons/blank.gif ^^BLANKICON^^

# DefaultIcon is which icon to show for files which do not have an icon
# explicitly set.

DefaultIcon /icons/unknown.gif

# AddDescription allows you to place a short description after a file in
# server-generated indexes.
# Format: AddDescription "description" filename

# ReadmeName is the name of the README file the server will look for by
# default. Format: ReadmeName name
#
# The server will first look for name.html, include it if found, and it will
# then look for name and include it as plaintext if found.
#
# HeaderName is the name of a file which should be prepended to
# directory indexes. 

ReadmeName README
HeaderName HEADER

IndexIgnore /.htaccess ~ # */.??* *~ *# */HEADER* */README*

AccessFileName .htauthority

# DefaultType is the default MIME type for documents which the server
# cannot find the type of from filename extensions.
DefaultType text/plain
# Yvan says this is better (but it messes up .h, .c etc files
#DefaultType application/octet-stream

# AddEncoding allows you to have certain browsers (Mosaic/X 2.1+) uncompress
# information on the fly. Note: Not all browsers support this.

AddEncoding x-compress Z
AddEncoding x-gzip gz

# AddLanguage allows you to specify the language of a document. You can
# then use content negotiation to give a browser a file in a language
# it can understand.  Note that the suffix does not have to be the same
# as the language keyword --- those with documents in Polish (whose
# net-standard language code is pl) may wish to use "AddLanguage pl .po" 
# to avoid the ambiguity with the common suffix for perl scripts.

AddLanguage en .en
AddLanguage fr .fr
AddLanguage de .de
AddLanguage da .da
AddLanguage el .el
AddLanguage it .it

# LanguagePriority allows you to give precedence to some languages
# in case of a tie during content negotiation.
# Just list the languages in decreasing order of preference.

LanguagePriority en fr de

# AddType allows you to tweak mime.types without actually editing it, or to
# make certain files to be certain types.
# Format: AddType type/subtype ext1
AddType application/x-httpd-php .php

# AddHandler allows you to map certain file extensions to "handlers",
# actions unrelated to filetype. These can be either built into the server
# or added with the Action command (see below)
# Format: AddHandler action-name ext1

# To use CGI scripts:
AddHandler cgi-script .cgi

# To use server-parsed HTML files
#AddType text/html .shtml
#AddHandler server-parsed .shtml
AddType text/html shtml
# process all files as if they were shtml
AddType text/x-server-parsed-html .html
AddType text/x-server-parsed-html .shtml
AddType x-world/x-vrml .wrl
AddType application/x-httpd-cgi .cgi .pl

# Uncomment the following line to enable Apache's send-asis HTTP file
# feature
#AddHandler send-as-is asis

# If you wish to use server-parsed imagemap files, use
#AddHandler imap-file map
# To enable type maps, you might want to use
#AddHandler type-map var

# Action lets you define media types that will execute a script whenever
# a matching file is called. This eliminates the need for repeated URL
# pathnames for oft-used CGI file processors.
# Format: Action media/type /cgi-script/location
# Format: Action handler-name /cgi-script/location

# For example to add a footer (footer.html in your document root) to
# files with extension .foot (e.g. foo.html.foot), you could use:
#AddHandler foot-action foot
#Action foot-action /cgi-bin/footer

# Or to do this for all HTML files, for example, use:
#Action text/html /cgi-bin/footer

# MetaDir: specifies the name of the directory in which Apache can find
# meta information files. These files contain additional HTTP headers
# to include when sending the document

#MetaDir .web

# MetaSuffix: specifies the file name suffix for the file containing the
# meta information.

#MetaSuffix .meta

# Customizable error response (Apache style)
#  these come in three flavors
#
#    1) plain text
#ErrorDocument 500 "The server made a boo boo.
#  n.b.  the (") marks it as text, it does not get output
#
#    2) local redirects
#ErrorDocument 404 /missing.html
#  to redirect to local url /missing.html
#ErrorDocument 404 /cgi-bin/missing_handler.pl
#  n.b. can redirect to a script or a document using server-side-includes.
#
#    3) external redirects
#ErrorDocument 402 http://other.server.com/subscription_info.html
#

<Directory /npac/home/webflow/Akenti/cgi-bin>
Options FollowSymLinks
</Directory>

<Directory /npac/home/webflow/Akenti/akenti-docs>
#Options Indexes FollowSymLinks Includes
# this is more secure
#Options Indexes FollowSymLinks IncludesNoExec
#Options FollowSymLinks IncludesNoExec -Indexes

# This controls which options the .htaccess files in directories can
# override. Can also be "None", or any combination of "Options", "FileInfo", 
# "AuthConfig", and "Limit"

#AllowOverride None
#AllowOverride Options
#AllowOverride All
AllowOverride AuthConfig Limit

# Controls who can get stuff from this server.

<Limit GET>
order allow,deny
allow from all
#order deny,allow
#deny from all
#allow from .lbl.gov .icsi.berkeley.edu 
</Limit>

</Directory>

##
# NOTE
##
#
# The following three Location sections could be a security hole
# if you do not with the whole world to know who is accessing what
# pages on your server when, and other details about the server. 
# It is highly suggested that you add a statement limiting access
# to these locations. For example:
#
# <Location /stronghold-status>
# SetHandler server-status
#
# order deny,allow
# deny from all
# allow from .foo.com
# </Location>
<Location /server-status>
SetHandler server-status
#order deny,allow
#deny from all
#allow from .lbl.gov
#AllowOverride All
</Location>

<Location /stronghold-status>
SetHandler server-status
</Location>

<Location /stronghold-info>
SetHandler server-info
</Location>

# SSL parameters
# Note that all SSL options can apply to virtual hosts.
# Disable SSL. Useful in combination with virtual hosts if you want to run
# both a secure and insecure server on the same host. Note that SSLEnable is
# now also supported.
#SSLDisable

# Set the path for the global cache server executable.
# If this facility gives you trouble, you can disable it by setting
# CACHE_SESSIONS to FALSE in apache_ssl.c
SSLCacheServerPath /npac/home/webflow/Akenti/ssl/bin/gcache

# Set the global cache server port number, or path. If it is a path, a Unix
# domain socket is used. If a number, a TCP socket.
SSLCacheServerPort 1234

# Directory for the cache server to run in (in case of crashes). Optional.
#SSLCacheServerRunDir /tmp

# Set the session cache timeout, in seconds (set to 15 for testing, use a
# higher value in real life)
SSLSessionCacheTimeout 15

# Set the CA certificate verification path or a single file (must be PEM encoded).
# (in addition to getenv("SSL_CERT_DIR"), I think).
#SSLCACertificateFile /npac/home/webflow/Akenti/ssl/certs/ornl-ca.cert
SSLCACertificateFile /npac/home/webflow/Akenti/ssl/certs/webflow-ca.cert
SSLCACertificatePath /npac/home/webflow/Akenti/ssl/certs/

# Set the CA certificate verification files (must be PEM encoded).
# (in addition to getenv("SSL_CERT_FILE"), I think).
# If the certificate is encrypted, then you will be prompted for a pass phrase.
# Note that a kill -1 will prompt again.
SSLCertificateFile /npac/home/webflow/Akenti/ssl/certs/osprey3.npac.syr.edu.cert

# If the key is not combined with the certificate, use this directive to
# point at the key file. If this starts with a '/' it specifies an absolute
# path, otherwise it is relative to the default certificate area. That is, it
# means "<default>/private/<keyfile>".
SSLCertificateKeyFile /npac/home/webflow/Akenti/ssl/private/osprey3.npac.syr.edu.key

# Set SSLVerifyClient to
#0-NoCert, 1 - May supply cert, 2 - must supply cert, 3 - May supply cert from
# unknown CA
SSLVerifyClient 2 

# How deeply to verify before deciding they don't have a valid certificate  
SSLVerifyDepth 10

# If you have enables client cert exports (in buff.h) you need to use
# SSLExportClientCertificates to enable them. Note that the server still has to
# mess about with certs even if this is disabled (and exports are enabled)
# because the cert chain is received before we can know whether it is needed or
# not.
#<Location /scripts>
#SSLExportClientCertificates
#</Location>

#SSLFakeBasicAuth
#SSLLogFile /npac/home/webflow/Akenti/akenti-logs/ssl.log

# List the ciphers that the client is permitted to negotiate. See the source
# for a definitive list. For example:
#SSLRequiredCiphers RC4-MD5:RC4-SHA:IDEA-CBC-MD5:DES-CBC3-SHA

# Custom logging
CustomLog       akenti-logs/ssl_log "%t %{version}c %{cipher}c %{clientcert}c"

