webserver (2.4.11) bullseye bookworm trixie forky duke; urgency=medium

  * httpd.conf: Introduce Defines for SERVER_ROOT, SERVER_CONF,
    CONTENT_ROOT, DOCUMENT_ROOT
  * templates/: Use the new Defines
  * vhost, apache2cfg, apache2postrotate, myapacheconf, mediawiki,
    cgi-bin/vhosts: Handle Defines when parsing configuration files
  * vhost: Handle the case that NET::WebAPI has consumed STDIN

 -- Andreas Ley <andreas.ley@kit.edu>  Fri, 31 Jul 2026 16:34:49 +0200

webserver (2.4.10) bullseye bookworm trixie forky duke; urgency=medium

  * ssl: Add Reporting-Endpoints
  * myapacheconf: &userfile() now accepts paths in double quotes
  * myapacheconf: Added RewriteOptions
  * myapacheconf: Added RemoveLanguage
  * apache2cfg: Added --json
  * common.conf: Disable stapling
  * run_awstats: Remove leftover ephemeral files
  * myapacheconf: Added ProxyPreserveHost
  * vhost: sp.crt 1096 days
  * analyze_error_log: Handle AH02032 (no compatible SSL setup)
  * Added gpc.json

 -- Andreas Ley <andreas.ley@kit.edu>  Wed, 14 Jan 2026 02:05:27 +0100

webserver (2.4.9) buster bullseye bookworm; urgency=medium

  * vhost, apache2cfg, myapacheconf: dynamically determine PHP version
  * apache2cfg, php-fpm.conf: Use UID instead of USER for listen.owner
    for PHP >= 7.4
  * apache2cfg, common.conf: Migrate APACHE_RUN_DIR from /run/UID:GID to
    /run/httpd/UID:GID since systemd now allows for subdirectories in
    RuntimeDirectory (This also allows the default ScriptSock used in
    modern cgid.conf)
  * apache2cfg: Fail if UID can't be resolved to username
  * info.conf, info-admin.conf: Removed and server-info configuration migrated
    to server.conf.tmpl requiring individual authentication
  * vhost: Split @clcmd and @all
  * Distribute fix_vhost.bookworm since one package for all dists
  * (old|new)-webserver: Adapt to SNI and buster/bookworm
  * Makefile: Use ISRG_Root_X1.pem instead of ca-certificates.crt as template
    chain since the latter provokes
    :error:14160098:SSL routines:read_state_machine:excessive message size:
  * apache2cfg: Add --db-local-only
  * Added modules_conf
  * apache2cfg: Create per instance local-php.conf
  * mediawiki: Adapt to mediawiki >= 1.35
  * myapacheconf: Add WSGIApplicationGroup
  * analyze_error_log: Ignore h2_stream CLEANUP warnings
  * Disable OCSP_MUST_STAPLE due to Let's Encrypt ending OCSP support:
    https://letsencrypt.org/2024/12/05/ending-ocsp/

 -- Andreas Ley <andreas.ley@kit.edu>  Thu, 12 Dec 2024 15:41:43 +0100

webserver (2.4.8) buster bullseye bookworm; urgency=medium

  * vhost: Add --challenge option
  * vhost: Generate shibboleth conf also when mod_shib enabled globally
  * apache2cfg: reload logrotate service after modifying config
  * vhost: Fix parameterless apache2cfg call when user's last VHost deleted
  * vhosts: Added ?format=json
  * identity.conf: Add ServerAlias with trailing dot
  * vhost: Before adding an A RR, make sure the fqdn_type is not alias
  * myapacheconf: Add Define and IfDefine
  * vhost: Changed @vips to %vips to delete only unique VIPs
  * vhost: Replace --skip-reload by --keep-running
  * Remove conf/aliases if no aliases defined
  * myapacheconf: Add AuthMerging
  * conf/single.conf: Access /phpinfo.php from KIT only

 -- Andreas Ley <andreas.ley@kit.edu>  Tue, 28 Nov 2023 13:37:27 +0100

webserver (2.4.7) buster bullseye; urgency=medium

  * common.conf: LimitRequestFieldSize to allow for SPNEGO w/ Chrome
  * analyze_error_log: Skip errors when PHP FPM isn't available
  * acme_cert: individual dehydrated role

 -- Andreas Ley <andreas.ley@kit.edu>  Tue, 23 Nov 2021 15:38:06 +0100

webserver (2.4.6) buster bullseye; urgency=medium

  * vhost, templates: Add SNI capabilities
  * apache2cfg: Collect Listen addresses for SNI mode
  * apache2cfg: Change to long options
  * apache2cfg: --force-sni: change CNAMEs to aliases, delete non-SNI addresses
    from DNSVS, but don't touch httpd.conf yet

 -- Andreas Ley <andreas.ley@kit.edu>  Sun, 31 Oct 2021 12:44:54 +0100

webserver (2.4.5) buster; urgency=medium

  * vhost: Remove call to apache2vip (no longer a separate service)
  * myapacheconf: Add directives for RewriteBase
  * server.conf: Override debian-provided ServerTokens

 -- Andreas Ley <andreas.ley@kit.edu>  Mon, 28 Jun 2021 13:01:11 +0200

webserver (2.4.4) buster; urgency=medium

  * apache2cfg: Do not sort arrays inserted in templates
  * templates/server.conf.tmpl: run dir for mod_fcgid
  * vhost: Call apache2cfg -c whenever we start or stop a server
  * vhost: Reload PHP-FPM on full config
  * vhost: Skip enabling server and requesting certificate upon server deletion
  * vhost: Module shib2 is now known as shib
  * apache2cfg: Do not call apache2postrotate with -u except when running multi
    servers
  * vhost: log directory uses the group the server is running as, and world-
    readable in the single-server case
  * apache2cfg: Only create /etc/php/.../fpm/pool.d/*.conf when running multi
  I  servers
  * vhost: Only create conf/local-php.conf when running multi servers
  * types.conf: Add text/x-yaml
  * cgi-bin/401: Moved from REDIRECT_SCRIPT_URL to REQUEST_URI
  * myapacheconf: Add directives for mod_session and mod_auth_form
  * conf/types.conf: Added image/webp
  * vhosts: Fix permissions for local-php.conf
  * conf/common.conf: Removed h2c since no browser supports it
  * ssl_check: Read config variables from vhost.ini
  * vhost: Implement NET::WebAPI token authentication
  * myapacheconf: Add directives for ProxyPass and ProxyPassReverse
  * include/proxy_http and include/proxy_http2 added
  * myapacheconf: Add directive for SSLProxyEngine
  * myapacheconf: Add directive for AddCharset
  * acme_cert: Implement NET::WebAPI token authentication
  * templates/server.conf.tmpl: Access /phpinfo.php from KIT only
  * myapacheconf: Add directive for ProxyErrorOverride
  * apache2cfg: Fatal error if a base directory has owner or group set to root
  * acme_cert: Removed certificate-based authentication, added -C
  * vhost: Removed certificate-based authentication, added --config
  * conf/common.conf: AllowEncodedSlashes NoDecode

 -- Andreas Ley <andreas.ley@kit.edu>  Wed, 12 May 2021 20:00:36 +0200

webserver (2.4.3) buster; urgency=medium

  * fix_vhost: Fix paths in conf/ssl/server.nfy and conf/ssl/server.cfg
  * fix_vhost: Re-enable httpd@.service to account for new location
  * vhost: no longer create symlinks in /etc/apache2/sites-*
  * analyze_error_log: Ignore messages generated by PHP-FPM for nonexistent
    files
  * analyze_error_log: Ignore messages generated by SNI when used inconsistently
  * apache2postrotate: reload AND restart at logrotate time to switch from DFN
    to LE AND load the new certificates
  * check_cert: Cleanup temporary directory used for splitting received
    certificate chain
  * Makefile: Do not build and install myapacheconf.phpini.directives (since
    we're using PHP-FPM)
  * myapacheconf: Render php_* directives invalid if PHP-FPM in use
  * /etc/apache2/servers no longer lists IP addresses
  * mediawiki now has -f option
  * Added ProxyErrorOverride On
  * Added -r to apache2cfg
  * vhost now detects mod_php as well as PHP-FPM
  * HTTPS-only is now default for new VHosts

 -- Andreas Ley <andreas.ley@kit.edu>  Mon, 27 Jul 2020 18:07:45 +0200

webserver (2.4.2) buster; urgency=medium

  * Fixed dependencies

 -- Andreas Ley <andreas.ley@kit.edu>  Fri, 27 Mar 2020 23:09:37 +0100

webserver (2.4.1) buster; urgency=medium

  * Initial Release.

 -- Andreas Ley <andreas.ley@kit.edu>  Tue, 16 Jul 2019 15:27:04 +0200
