http(8gx)

📦
version 3.6 · 2 versions
, in alpine 3.24

💅 http(8gx) — Gromox admin reference 🫶

okay so bestie, welcome to the http page — she's the Gromox protocol handler for HTTP and RPCH, and honestly she's doing a lot. grab a snack. 🍓

✨ Name ✨

http — the protocol handler for HTTP and RPCH. that's the whole vibe check. 👑

✨ Synopsis ✨

http [-c config]

that's it. that's the whole invocation. slay. 💅

✨ Description ✨

so http(8gx) is a trivial HTTP server — her words, not mine — but don't let that fool you. she understands the special HTTP methods that RPC-over-HTTP (the protocol Outlook uses) requires, she can serve files verbatim like a good little static host, and she can forward requests on to a FastCGI server such as php-fpm(8). multitasking icon behavior. ✨

generally speaking, http(8gx) also executed the Information Store, exmdb_provider(4gx) — which is a loadable module. yes "executed", that's what the page says, we're not going to argue with it, we're just reporting it fr fr. 🙈

✨ Options ✨

  • -c config — read configuration directives from the given file. if you don't pass this, she'll read /etc/gromox/gromox.cfg and /etc/gromox/http.cfg — both of them, she's thorough. 💖
  • -? — display the option summary. that's it, that's the flag. cute little question mark. 🎀

✨ URI processing order ✨

this is the part where you learn exactly how a request gets juggled around. the order is not vibes-based, it's real:

  • Requests are passed to the mod_rewrite(4gx) module (built-in) so their URI can potentially get rewritten. ✏️
  • If a HTTP request is using the methods RPC_IN_DATA or RPC_OUT_DATA, the data stream gets handed off to the exchange_emsmdb(4gx) component. special delivery 🚚
  • Otherwise, the HTTP processing modules (HPM) are invoked. processing ends the moment one module signals that the request was handled. the order depends on the HPM list (which is fixed, no you can't reorder it): ews, mh_emsmdb, mh_nsp, oxdisco, oab.
  • Otherwise, the mod_fastcgi(4gx) module (built-in) is invoked. processing ends if this module handled the request.
  • Otherwise, the mod_cache(4gx) module (built-in) is invoked. processing ends if this module handled the request.
  • Otherwise? the request is rejected. 💀 sorry bestie. that's the end of the line.

✨ RPC-over-HTTP ✨

RPC-over-HTTP utilizes two special HTTP methods: RPC_IN_DATA and RPC_OUT_DATA. these requests can, similarly to HTTP CONNECT, be very long-lived — like, stay on the phone for hours long-lived. the RPC data stream is handled by the included exchange_emsmdb(4gx) component. 🌈

heads up bestie: all the time-based command-line options and configuration file directives are subject to the syntax described in gromox(7), section "Duration specifications". so like, 1minute, 3 minutes, that whole language. ⏳

✨ Configuration directives (gromox.cfg) ✨

these are the directives she recognizes when reading from /etc/gromox/gromox.cfg, or when you used the -c option to point at a custom file. 📂

  • daemons_fd_limit — in gromox-http, this is treated as an alias for http_fd_limit. same thing, different name, we love a nickname. 💫
  • http_basic_auth_cred_caching — perform credential caching for HTTP Basic. Default: 1minute
  • http_fd_limit — request that the file descriptor table be at least this large. the magic value 0 means the system default hard limit (rlim_max, cf. setrlimit(2)) should be used. Default: 0
  • http_listen — a space-separated list of bind address specifiers to expose HTTP on. Default: [::]:80
  • http_listen_tls — a space-separated list of bind address specifiers to expose implicit-TLS (HTTPS) on. Default: [::]:443
  • http_remote_host_hdr — the name of the HTTP request header which contains the actual client IPv6/IPv4 address. when a (reverse) proxy sits in front of gromox-http, the address gxhttp normally sees is the proxy address (e.g. ::1). if the proxy sets a custom header to convey the actual client address, Gromox can pick this up for its own reporting, which in turn is useful for e.g. fail2ban setups. Default: (empty)
  • istore_standalone — this directive is a mutual exclusion device between http(8gx) and istore(8gx), and controls which one of the two is in charge of running the mailbox engine. if this is set to no, http will be the one, and istore(8gx) has no function. Default: no

✨ Configuration directives (http.cfg) ✨

and these are the ones she recognizes when reading from /etc/gromox/http.cfg, or when the -c option points at a custom file. same deal, different file. 🎀

  • block_interval_auths — the amount of time a user is blocked from connecting to the service after too many failed logins. sit down, be humble. Default: 1 minute
  • config_file_path — colon-separated list of directories which will be scanned when locating further configuration files, especially those used by subcomponent instances. (for example, mysql_adaptor(4gx) would be directed to look at /etc/gromox/http/mysql_adaptor.cfg before /etc/gromox/mysql_adaptor.cfg.) Default: /etc/gromox/http:/etc/gromox
  • context_average_mem — Default: 256K
  • context_num — Default: 400
  • data_file_path — colon-separated list of directories which will be scanned when locating data files. Default: /usr/share/gromox/http
  • fastcgi_exec_timeout — maximum execution time for CGI scripts. Default: 10 minutes
  • gss_program — the helper program to use for authenticating HTTP requests when Negotiate-SPNEGO headers are presented. the value is rudimentarily tokenized at whitespaces, and no special characters may be used. if necessary, write your own wrapper. the special value "internal-gss" uses libgssapi directly.

Negotiate was meant to carry GSS-API auth data (appearing as "Authorization: Negotiate YII..." in HTTP protocol dumps). NTLM can be wrapped in SPNEGO (also shows up as "YII"), but a handful of clients may also send raw NTLM tokens (appearing as "Authorization: Negotiate TlRMTVNT..."). whether raw NTLM tokens are accepted by internal-gss depends on your GSS library and, more broadly, your Kerberos setup. otherwise, you may need to use a helper program like the one from Squid. internal-gss also does not offer a way to specify a separate keytab or replay cache parameters, so use Squid's helper if you need such parameters.

Default: internal-gss

Example: /usr/lib/squid/negotiate_wrapper_auth --ntlm /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp --kerberos /usr/lib/squid/negotiate_kerberos_auth -s GSS_C_NO_NAME

  • host_id — a unique identifier for this system. it's used for the Server HTTP responses header, for components like exmdb_provider(4gx), which makes use of it for SMTP HELO lines, for DSN report texts, for MIDB database/EML cache. the identifier should only use characters allowed for hostnames. Default: (system hostname)
  • http_auth_basic — enable HTTP Basic authentication. Default: yes
  • http_auth_spnego — enable HTTP Negotiate authentication. Default: no
  • http_auth_times — the number of login tries a user is allowed before the account is blocked. Default: 10
  • http_certificate_passwd — the password to unlock TLS certificates. Default: (unset)
  • http_certificate_path — a colon-separated list of TLS certificate files. the complete certificate chain should be present (as there is no other config directive to pull CA certs in, and implicit loading from system directories is not guaranteed by Gromox). no shortcuts bestie. Default: (unset)
  • http_conn_timeout — if a HTTP connection is inactive for the given period, the connection is terminated. Default: 3 minutes
  • http_debug — if set to 1, prints all incoming and outgoing HTTP traffic to stderr (not http_log_file!). 👀 Default: 0
  • http_enforce_auth — enforce authentication at all times. this is a debugging knob, not a lifestyle. Default: no
  • http_krb_service_principal — Kerberos service principal to use when gss_program=internal-gss. the form is often something like HTTP/fqdn@REALM, but may vary. when using an external GSS authentication helper, http_krb_service_principal has no effect, and any principal you want to use needs to be passed via the gss_program directive in some way. be Default: (empty)
(yes that be is genuinely sitting there at the end of the original line, bestie — we did not add it, we are simply honoring it. 😭)
  • http_listen_addr — deprecated in favor of gromox.cfg:http_listen / gromox.cfg:http_listen_tls. 💀
  • http_listen_port — deprecated in favor of gromox.cfg:http_listen. 💀
  • http_listen_tls_port — deprecated in favor of gromox.cfg:http_listen_tls. 💀
  • http_log_file — target for log messages here. special values: "-" (stderr/syslog depending on parent PID) or "syslog" are recognized. Default: - (auto)
  • http_log_level — maximum verbosity of logging. 1=crit, 2=error, 3=warn, 4=notice, 5=info, 6=debug. Default: 4 (notice)
  • http_private_key_path — a colon-separated list of TLS certificate private key files. Default: (unset)
  • http_rqbody_flush_size — if the HTTP request to a CGI endpoint has a HTTP body larger than the limit given here, the data is buffered in a file rather than kept in memory. if the request uses Chunked Transfer Encoding, a file is used unconditionally. Default: 512K
  • http_rqbody_max_size — if the Content-Length of a HTTP request to a CGI endpoint is larger than this value, the request is rejected. 🚫 Default: 50M
  • http_support_tls — this flag controls whether (or not) the server offers TLS at all. the default is false because you need a certificate for this first. 🔐 Default: false
  • http_thread_charge_num — connection load factor (oversubscription ratio) for a processing thread. Default: 20
  • http_thread_init_num — the initial and also minimum number of client processing threads to keep around. this is similar to php-fpm's start_servers/min_spare_servere. (the maximum number of threads, i.e. what would be max_spare_servers, is determined by: context_num divided by http_thread_charge_num) Default: 5
  • msrpc_debug — log every completed RPC call and the return code of the operation in a minimal fashion to stderr. level 1 emits RPCs with a failure return code, level 2 emits all RPCs. note the daemon log level needs to be "debug" (6), too. ✨ Default: 0
  • request_max_mem — the maximum hint size for fragmented RPC PDU requests that will be allowed (C706 §12.6.3.7, MS-RPCE v33 §2.2.2.6). Default: 4M
  • tls_min_proto — the lowest TLS version to offer. possible values are: tls1.0, tls1.1, tls1.2, and, if supported by the system, tls1.3. Default: tls1.2
  • running_identity — an unprivileged user account to switch the process to after startup. to inhibit the switch, assign the empty value. Default: gromox
  • user_default_lang — Default: en

✨ SIGNALS ✨

Okay so signals, bestie — these are the little pokes http(8gx) listens for. 🫶

  • SIGHUP — when this lands, the configuration files are re-read. But plot twist: only a few select directives can actually be changed this way, because many parts do not implement reload. So don’t expect a full glow-up. 💅
  • SIGUSR1 — when this lands, a dump of the currently active HTTP connections gets printed to stderr. Very “show me the receipts” energy. 👀

📚 NORMATIVE REFERENCES 📚

The lore it’s built on, periodt:

  • MS-RPCE: Remote Procedure Call Protocol Extensions
  • DCERPC / C706: Technical Standard DCE 1.1: Remote Procedure Call by The Open Group, 1997

👑 SEE ALSO 👑

Go read these next, iykyk:

And that’s the whole page, bestie — footer source/version/date vibes: Gromox, http(8gx), with the date exactly as the original footer says. 💖✨

📦 where this page comes from