Update dependencies

Bumps [env_logger](https://github.com/rust-cli/env_logger) from 0.11.8 to 0.11.9.
- [Release notes](https://github.com/rust-cli/env_logger/releases)
- [Changelog](https://github.com/rust-cli/env_logger/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rust-cli/env_logger/compare/v0.11.8...v0.11.9)

---
updated-dependencies:
- dependency-name: env_logger
  dependency-version: 0.11.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.dockerignore

@@ -0,0 +1,7 @@
+**
+
+!src/**
+!tools/docker/**
+!Cross.toml
+!Cargo.toml
+!Cargo.lock

.github/dependabot.yml

@@ -0,0 +1,21 @@
+---
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: chore
+      include: scope
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    allow:
+      - dependency-type: "direct"
+    commit-message:
+      prefix: chore
+      include: scope

.github/workflows/cargo-audit.yml

@@ -0,0 +1,19 @@
+name: Cargo Audit Scanning
+on:
+  push:
+    paths:
+      - "**/Cargo.toml"
+      - "**/Cargo.lock"
+  schedule:
+    - cron: "0 14 * * *" # 14:00 UTC
+jobs:
+  cargo-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions-rs/audit-check@v1
+        # Don't run on dependabot PRs or forks
+        # https://github.com/actions-rs/clippy-check/issues/2#issuecomment-807852653
+        if: github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+# This is used to build cross platform linux binaries for a release in CI.
+# Since this is not supervised, abort if anything does not work.
+set -e
+
+sudo apt update
+# Cross-compiling needs a linker for the respective platforms. If you are on a Debian-based x86_64 Linux,
+# you can install them with:
+sudo apt -y install podman gcc-arm-linux-gnueabihf gcc-aarch64-linux-gnu
+# Also install cross compilation tool for cargo
+cargo install cross
+
+for i in x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu arm-unknown-linux-gnueabihf armv7-unknown-linux-gnueabihf
+do
+	cross build --verbose --release --target $i
+	cp target/$i/release/agate agate.$i
+done
+
+# Strip all the binaries.
+strip agate.x86_64-unknown-linux-gnu
+aarch64-linux-gnu-strip agate.aarch64-unknown-linux-gnu
+arm-linux-gnueabihf-strip agate.arm-unknown-linux-gnueabihf agate.armv7-unknown-linux-gnueabihf
+
+# compress the binaries.
+gzip agate.*

.github/workflows/release.yml

@@ -0,0 +1,119 @@
+name: Release Builds
+
+on:
+  push:
+    tags:
+      - 'v*' # on every version tag
+
+jobs:
+  # first just a small job to draft the release so all others can use the upload_url
+  create_release:
+    runs-on: ubuntu-latest
+    steps:
+    - name: create release
+      id: create_release
+      uses: ncipollo/release-action@v1
+
+  build_ubuntu:
+    runs-on: ubuntu-22.04
+    needs: create_release
+    steps:
+    - uses: actions/checkout@v6
+    - name: build
+      run: bash .github/workflows/release.sh
+    - name: upload release assets linux
+      uses: AButler/upload-release-assets@v3.0
+      with:
+        files: 'agate.*.gz'
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        release-tag: ${{ github.ref_name }}
+
+  build_windows:
+    runs-on: windows-latest
+    needs: create_release
+    steps:
+    - uses: actions/checkout@v6
+    - name: Build
+      run: cargo build --verbose --release
+    - name: strip names
+      run: strip target/release/agate.exe
+    - name: compress
+      run: Compress-Archive -LiteralPath target/release/agate.exe -DestinationPath agate.x86_64-pc-windows-msvc.zip
+    - name: upload release asset win
+      uses: AButler/upload-release-assets@v3.0
+      with:
+        files: agate.x86_64-pc-windows-msvc.zip
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        release-tag: ${{ github.ref_name }}
+
+  build_macos_x86_64:
+    runs-on: macos-latest
+    needs: create_release
+    steps:
+    - uses: actions/checkout@v6
+    - name: install toolchain
+      run: rustup target add aarch64-apple-darwin
+    - name: Build x86_64
+      run: cargo build --verbose --release
+    - name: strip names x86
+      run: strip target/release/agate
+    - name: compress x86
+      run: gzip -c target/release/agate > ./agate.x86_64-apple-darwin.gz
+    - name: Build ARM
+      run: SDKROOT=$(xcrun -sdk macosx --show-sdk-path) MACOSX_DEPLOYMENT_TARGET=$(xcrun -sdk macosx --show-sdk-platform-version) cargo build --verbose --release --target=aarch64-apple-darwin
+    - name: strip names ARM
+      run: strip target/aarch64-apple-darwin/release/agate
+    - name: compress ARM
+      run: gzip -c target/aarch64-apple-darwin/release/agate > ./agate.aarch64-apple-darwin.gz
+    - name: upload release assets darwin
+      uses: AButler/upload-release-assets@v3.0
+      with:
+        files: 'agate.*.gz'
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        release-tag: ${{ github.ref_name }}
+
+  build_docker:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Log into GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Extract metadata for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          # Because this workflow only runs on commits tagged `v*` (i n semver format) this section ensures that
+          # a docker build tagged `v1.2.3+podman.build` is tagged with `1`, `1.2`, `1.2.3` and `1.2.3+podman.build`
+          # as well as being tagged with `latest`. For each of these, a subsequent build that has the same tag will
+          # replace it. This means that pulling `ghcr.io/mbrubeck/agate:1` will always get the most recent image
+          # released with a v1 tag, container, `ghcr.io/mbrubeck/agate:1.2` will get the latest v1.2 tag, and so on.
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}.{{patch}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/test.yml

@@ -0,0 +1,45 @@
+name: Tests
+
+on:
+  push:
+    branches-ignore:
+      - dependabot/*
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  clippy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Run clippy action to produce annotations
+        # Don't run on dependabot PRs
+        # https://github.com/actions-rs/clippy-check/issues/2#issuecomment-807852653
+        if: github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'
+        uses: actions-rs/clippy-check@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          args: --all-features
+      - name: Run clippy manually without annotations
+        if: github.event.pull_request.head.repo.full_name != github.repository || github.actor == 'dependabot[bot]'
+        uses: actions-rs/cargo@v1
+        with:
+          command: clippy
+          args: --all-targets -- -D warnings
+  formatting:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Formatting
+        uses: actions-rs/cargo@v1
+        with:
+          command: fmt
+          args: -- --check
+  tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions-rs/cargo@v1
+        with:
+          command: test

.gitignore

@@ -1 +1,2 @@
 /target
+/.certificates

.mailmap

@@ -0,0 +1,3 @@
+<johann.galle@protonmail.com> <johann@qwertqwefsday.eu>
+<johann.galle@protonmail.com> <20990607+Johann150@users.noreply.github.com>
+j-k <dev@j-k.io>

CHANGELOG.md

@@ -0,0 +1,451 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+Updates to dependencies are not considered notable changes for the purpose of this changelog.
+This may lead to no listed changes for a version.
+
+## [Unreleased]
+
+## [3.3.19] - 2025-09-18
+
+### Fixed
+* Update dependencies.
+* Document commands for converting PEM to DER.
+
+## [3.3.18] - 2025-08-05
+## [3.3.17] - 2025-06-27
+## [3.3.16] - 2025-05-06
+
+### Changed
+* Build release artifacts with Ubuntu 22.04, because Ubuntu 20.04 is no longer supported
+	* pre-built binaries may no longer run on Linux distributions older than Ubuntu 22.04 (glibc 2.35)
+	* users with older glibc versions will need to build from source
+
+## [3.3.15] - 2025-05-06
+## [3.3.14] - 2025-03-24
+## [3.3.13] - 2025-02-24
+Thank you to @luineth for contributing to this release.
+
+### Added
+* aarch64 support for Docker image (#376)
+
+## [3.3.12] - 2025-02-18
+## [3.3.11] - 2024-11-29
+Thank you to @geraldwuhoo and @jphastings for contributing to this release.
+
+### Added
+* Automatically publish docker images to GHCR (#366)
+
+### Fixed
+* Refactor Dockerfile for multi-stage build (#144)
+
+## [3.3.10] - 2024-11-04
+## [3.3.9] - 2024-09-10
+## [3.3.8] - 2024-07-24
+## [3.3.7] - 2024-04-01
+## [3.3.6] - 2024-03-22
+## [3.3.5] - 2024-03-15
+
+### Fixed
+* updated and simplified dependencies
+* fix syntax of license field in Cargo manifest
+
+## [3.3.4] - 2024-01-16
+
+### Fixed
+* cleaned up documentation
+
+## [3.3.3] - 2023-12-27
+
+### Fixed
+* fixed release automation
+
+## [3.3.2] - 2023-12-27
+## [3.3.1] - 2023-08-05
+Thank you to Jan Stępień and @michaelnordmeyer for contributing to this release.
+
+### Fixed
+* set permissions for generated key files so only owner can read them
+* improve documentation and tests
+
+## [3.3.0] - 2023-03-18
+Thank you to @equalsraf, @michaelnordmeyer and @wanderer1988 for contributing to this release.
+
+### Added
+* listening on unix sockets (#244)
+
+### Fixed
+* misstyped email address in section on how to report security vulnerabilities (#239)
+* wrong language code in README (#189)
+
+## [3.2.4] - 2022-05-18
+Thank you to @06kellyjac, @albertlarsan68 and @kahays for contributing to this release.
+
+### Fixed
+* removed port collisions in tests, for the last time (#143)
+* fixed Dockerfile startup command (#169)
+
+## [3.2.3] - 2022-02-04
+Thank you to T. Spivey for contributing to this release.
+
+### Fixed
+* improper IRIs are handled instead of crashing (bug reported via email)
+
+## [3.2.2] - 2022-01-25
+Thank you to @Suzie97 for contributing to this release.
+
+### Added
+* CI build for `aarch64-apple-darwin` target (#137)
+
+## [3.2.1] - 2021-12-02
+Thank you to @MatthiasPortzel for contributing to this release.
+
+### Fixed
+* host name comparisons are now case insensitive (#115)
+* made automatic certificate configuration more prominent in the README
+
+## [3.2.0] - 2021-11-15
+Thank you to @balazsbtond and @joseph-marques for contributing to this release.
+
+### Added
+* you can add header text to a directory listing. See the updated readme for details. (#98)
+
+### Fixed
+* error pages also send close_notify (#100)
+
+## [3.1.3] - 2021-10-25
+Thank you to @FoxKyong for contributing to this release.
+
+### Fixed
+* the fix for dual stack listening from 3.1.2 was executed asynchronously and would thus
+  sometimes fail. starting the listeners on different socket addresses is now synchronous
+  (#79)
+
+## [3.1.2] - 2021-10-15
+Thank you to @etam for contributing to this release.
+
+### Fixed
+* when starting up on a system that automatically listens in dual stack mode (e.g. some
+  linux distributions seem to do this), detect a second unspecified address to not cause
+  the "address in use" error with the default listening addresses (#79)
+* updated a dependency
+
+## [3.1.1] - 2021-10-14
+Thank you to @jgarte and @alvaro-cuesta for contributing to this release.
+
+### Added
+* running Agate using GNU Guix (#62)
+
+### Fixed
+* actually bind to multiple IP addresses. Despite the documentation saying so,
+  Agate would only bind to the first address that did not result in an error. (#63)
+
+## [3.1.0] - 2021-06-08
+Thank you to Matthew Ingwersen and Oliver Simmons (@GoodClover) for contributing to this release.
+
+### Added
+* tests for symlink files (#60)
+  Symlinks were already working before.
+
+### Fixed
+* A path traversal security issue was closed: Percent-encoded slashes were misunderstood.
+
+### Changed
+* Visiting a directory without `index.gmi` and `.directory-listing-ok` now returns a different error message to better show the cause of the error.
+  To retain the current behaviour of showing a `51 Not found, sorry.` error, add the following line to the respective directories' `.meta` file:
+```
+index.gmi: 51 Not found, sorry.
+```
+
+## [3.0.3] - 2021-05-24
+Thank you to @06kellyjac, @cpnfeeny, @lifelike, @skittlesvampir and @steko for contributing to this release.
+
+### Added
+* Dockerfile for compiling Agate from source (#52, #53, #56, #57)
+
+### Fixed
+* If the remote IP address can not be fetched, log an error instead of panicking.
+  The previous handling could be exploited as a DoS attack vector. (#59)
+* Two tests were running on the same port, causing them to fail nondeterministically. (#51)
+* Rephrased the changelog for 3.0.0 on continuing to use older certificates. (#55)
+
+## [3.0.2] - 2021-04-08
+Thank you to @kvibber, @lifelike and @pasdechance for contributing to this release.
+
+### Changed
+* The new specfication changes are obeyed regarding rejecting request URLs that contain fragments or userinfo parts.
+* The default signature algorithm used for generating certificates has been changed to ECDSA since there were multiple complaints about Ed25519.
+
+## [3.0.1] - 2021-03-28
+Thank you to @MidAutumnMoon and @steko for contributing to this release.
+
+### Added
+* Installation instructions for Arch Linux from Arch User Repositories. (#47)
+
+### Fixed
+* The certificate file extensions in the README example. (#45)
+* The certificate directory is automatically created if it does not exist. (#44)
+
+## [3.0.0] - 2021-03-27
+Thank you to @ddevault for contributing to this release.
+
+### Added
+* Support for ECDSA and Ed25519 keys.
+* Agate now generates certificates and keys for each `--hostname` that is specified but no matching files exist. (#41)
+
+### Changed
+* The ability to specify a certificate and key with `--cert` and `--key` respectively has been replaced with the `--certs` option. (#40)
+  Certificates are now stored in a special directory. To migrate to this version, the keys should be stored in the `.certificates` directory (or any other directory you specify).
+  This enables us to use multiple certificates for multiple domains.
+  Note that if you want to continue to use your old certificates (recommended because of TOFU), they probably lack the `subjectAltName` directive so your old certificates should be placed at the top level of the certificates directory. Otherwise you will get an error similar to this: "The certificate file for example.com is malformed: unexpected error: The server certificate is not valid for the given name"
+* The certificate and key file format has been changed from PEM to DER. This simplifies loading certificate and key files without relying on unstable portions of other crates.
+  If you want to continue using your existing certificates and keys, please convert them to DER format. You should be able to use these commands if you have openssl installed:
+```
+openssl x509 -in cert.pem -out cert.der -outform DER
+openssl rsa -in key.rsa -out key.der -outform DER
+```
+  Since agate will automatically generate certificates from now on, the different format should not be a problem because users are not expected to handle certificates unless experienced enough to be able to handle DER formatting as well.
+
+### Fixed
+* Agate now requires the use of SNI by any connecting client.
+* All log lines are in the same format now:
+  `<local ip>:<local port> <remote ip or dash> "<request>" <response status> "<response meta>" [error:<error>]`
+  If the connection could not be established correctly (e.g. because of TLS errors), the status code `00` is used.
+* Messages from modules other than Agate itself are not logged by default.
+
+## [2.5.3] - 2021-02-27
+Thank you to @littleli and @06kellyjac for contributing to this release.
+
+### Added
+* Automated tests have been added so things like 2.5.2 should not happen again (#34).
+* Version information flag (`-V` or `--version` as conventional with e.g. cargo)
+
+### Changed
+* Forbid unsafe code. (There was none before, just make it harder to add some.)
+* When logging remote IP addresses, the port is now never logged, which also changes the address format.
+
+### Fixed
+* Updated `url` to newest version, which resolves a TODO.
+* The help exits successfully with `0` rather than `1` (#37).
+* The GitHub workflow has been fixed so Windows binaries are compressed correctly (#36).
+* Split out install steps to allow for more options in the future.
+* Add install notes for nix/NixOS to the README (#38).
+
+## [2.5.2] - 2021-02-12
+
+### Fixed
+* Semicolons are no longer considered to be starting a comment in `.mime` files.
+
+## [2.5.1] - 2021-02-12
+Functionally equivalent to version 2.5.1, only releasing a new version to update README on crates.io.
+
+### Fixed
+* Fixed mistakes in the README.
+
+## [2.5.0] - 2021-02-12
+Agate now has an explicit code of conduct and contributing guidelines.
+Thank you to @ERnsTL, @gegeweb, @SuddenPineapple, and @Ylhp for contributing to this release.
+
+### Added
+* You can now supply multiple `--hostname`s to enable basic vhosts (#28, #31).
+* Disabling support for TLSv1.2 can now be done using the `--only-tls13` flag, but this is *NOT RECOMMENDED* (#12).
+* The tools now also contain a startup script for FreeBSD (#13).
+* Using central config mode (flag `-C`), all configuration can be done in one `.meta` file (see README.md for details).
+* The `.meta` configuration file now allows for globs to be used.
+
+### Changed
+* The `.meta` file parser now uses the `configparser` crate. The syntax does not change.
+* The changelog is now also kept in this file in addition to the GitHub releases.
+* Certificate chain and key file are now only loaded once at startup, certificate changes need a restart to take effect.
+* Hidden files are now served if there is an explicit setting in a `.meta` file for them, regardless of the `--serve-secret` flag.
+
+### Fixed
+* The Syntax for the IPv6 address in the README has been corrected.
+* Give a better error message when no keys are found in the key file instead of panicking with a range check (#33).
+
+## [2.4.1] - 2020-02-08
+### Fixed
+* Re-enabled multiple occurrences of `--addr`. This was accidentally disabled by a merge.
+
+## [2.4.0]+podman.build - 2020-02-06
+This is the same as [2.4.0], only the build process has been changed so it should accommodate a wider range of architectures and devices.
+
+## [2.4.0] - 2020-02-06
+Since there is a new maintainer (@Johann150), the range in pre-compiled binaries has changed a bit.
+
+### Added
+* Added some installation tools for Debian.
+* Added a sidecar file for specifying languages, MIME media types or complete headers on a per file basis (#16).
+
+### Changed
+* Improved logging output. Agate now also respects the `RUST_LOG` environment variable, so you can configure the log level (#22, #23).
+
+## [2.3.0] - 2020-01-17
+Thanks to @Johann150.
+
+### Changed
+* Combine address and port back into a single command-line argument (#21).
+
+## [2.2.0] - 2020-01-16
+Thank you to @gegeweb, @Johann150 and @purexo for contributing to this release.
+
+### Changed
+* Split address and port into separate command-line parameters.
+
+### Fixed
+* Listen on both IPv6 and IPv4 interfaces by default (#14, #15).
+* Do not serve files whose path contains a segment starting with a dot (#17, #20).
+* Fix redirects of URLs with query strings (#19).
+
+## [2.1.3] - 2020-01-02
+### Changed
+* Switch to the Tokio async run time.
+
+### Fixed
+* Send TLS close-notify message when closing a connection.
+* Require absolute URLs in requests.
+
+## [2.1.2] - 2020-01-01
+### Fixed
+* More complete percent-encoding of special characters in filenames.
+* Minor improvements to error logging.
+* Internal code cleanup.
+
+## [2.1.1] - 2020-12-31
+### Changed
+* List directory content in alphabetical order.
+
+### Fixed
+* Handle percent-escaped paths in URLs.
+* Percent-escape white space characters in directory listings.
+
+## [2.1.0] - 2020-12-29
+* Enabled GitHub Discussions. If you are using Agate, please feel free to leave a comment to let us know about it!
+Thank you to @Johann150 and @KilianKemps for contributing to this release.
+
+### Added
+* Optional directory listings (#8, #9).
+
+## [2.0.0] - 2020-12-23
+Thank you to @bortzmeyer, @KillianKemps, and @Ylhp for contributing to this release.
+
+### Added
+* New `--language` option to add a language tag to the MIME type for text/gemini responses (#6).
+
+### Changed
+* New format for command-line options. See the documentation or run `agate --help` for details.
+* Logging is enabled by default. Use the `--silent` flag to disable it.
+* Pre-compiled binaries are built with the [`cross`](https://github.com/rust-embedded/cross) tool, for better compatibility with older Linux systems.
+
+## [1.3.2] - 2020-12-09
+This release is functionally identical to Agate 1.3.1, and users of that version do not need to update.
+
+### Fixed
+* Update to async-tls 0.11 because the previous version was [yanked](https://github.com/async-rs/async-tls/issues/42).
+
+## [1.3.1] - 2020-12-08
+Thanks @dcreager for contributing this fix.
+
+### Fixed
+* Updated dependencies to fix `cargo install` (#7).
+
+## [1.3.0] - 2020-11-20
+Thank you @Johann150, @jonhiggs and @tronje for contributing to this release!
+
+### Fixed
+* verify hostname and port in request URL (#4).
+* improved logging (#2, #3).
+* Don't redirect to "/" when the path is empty (#5).
+
+## [1.2.2] - 2020-09-21
+Thank you to @m040601 for contributing to this release.
+
+### Changed
+* Switch from `tree_magic` to `mime_guess` for simpler MIME type guessing.
+* Built both x86_64 and ARM binaries. These binaries are built for Linux operating systems with glibc 2.28 or later, such as Debian 10 ("buster") or newer, Ubuntu 18.10 or newer, and Raspberry Pi OS 2019-06-20 or newer (#1).
+
+### Fixed
+* Minor internal code cleanup.
+
+## [1.2.1] - 2020-06-20
+### Fixed
+* Reduce memory usage when serving large files.
+
+## [1.2.0] - 2020-06-10
+### Changed
+* text/gemini filename extension from `.gemini` to `.gmi`.
+
+### Fixed
+* Handling for requests that exceed 1KB.
+* Reduce memory allocations and speed up request parsing.
+
+## [1.1.0] - 2020-05-22
+### Added
+* Auto-detect MIME types.
+
+## [1.0.1] - 2020-05-21
+### Added
+* Send more accurate error codes for unsupported requests.
+* Do more validation of request URLs.
+
+## [1.0.0] - 2020-05-21
+
+[Unreleased]: https://github.com/mbrubeck/agate/compare/v3.3.18...HEAD
+[3.3.18]: https://github.com/mbrubeck/agate/compare/v3.3.17...v3.3.18
+[3.3.17]: https://github.com/mbrubeck/agate/compare/v3.3.16...v3.3.17
+[3.3.16]: https://github.com/mbrubeck/agate/compare/v3.3.15...v3.3.16
+[3.3.15]: https://github.com/mbrubeck/agate/compare/v3.3.14...v3.3.15
+[3.3.14]: https://github.com/mbrubeck/agate/compare/v3.3.13...v3.3.14
+[3.3.13]: https://github.com/mbrubeck/agate/compare/v3.3.12...v3.3.13
+[3.3.12]: https://github.com/mbrubeck/agate/compare/v3.3.11...v3.3.12
+[3.3.11]: https://github.com/mbrubeck/agate/compare/v3.3.10...v3.3.11
+[3.3.10]: https://github.com/mbrubeck/agate/compare/v3.3.9...v3.3.10
+[3.3.9]: https://github.com/mbrubeck/agate/compare/v3.3.8...v3.3.9
+[3.3.8]: https://github.com/mbrubeck/agate/compare/v3.3.7...v3.3.8
+[3.3.7]: https://github.com/mbrubeck/agate/compare/v3.3.6...v3.3.7
+[3.3.6]: https://github.com/mbrubeck/agate/compare/v3.3.5...v3.3.6
+[3.3.5]: https://github.com/mbrubeck/agate/compare/v3.3.4...v3.3.5
+[3.3.4]: https://github.com/mbrubeck/agate/compare/v3.3.3...v3.3.4
+[3.3.3]: https://github.com/mbrubeck/agate/compare/v3.3.2...v3.3.3
+[3.3.2]: https://github.com/mbrubeck/agate/compare/v3.3.1...v3.3.2
+[3.3.1]: https://github.com/mbrubeck/agate/compare/v3.3.0...v3.3.1
+[3.3.0]: https://github.com/mbrubeck/agate/compare/v3.2.4...v3.3.0
+[3.2.4]: https://github.com/mbrubeck/agate/compare/v3.2.3...v3.2.4
+[3.2.3]: https://github.com/mbrubeck/agate/compare/v3.2.2...v3.2.3
+[3.2.2]: https://github.com/mbrubeck/agate/compare/v3.2.1...v3.2.2
+[3.2.1]: https://github.com/mbrubeck/agate/compare/v3.2.0...v3.2.1
+[3.2.0]: https://github.com/mbrubeck/agate/compare/v3.1.3...v3.2.0
+[3.1.3]: https://github.com/mbrubeck/agate/compare/v3.1.2...v3.1.3
+[3.1.2]: https://github.com/mbrubeck/agate/compare/v3.1.1...v3.1.2
+[3.1.1]: https://github.com/mbrubeck/agate/compare/v3.1.0...v3.1.1
+[3.1.0]: https://github.com/mbrubeck/agate/compare/v3.0.3...v3.1.0
+[3.0.3]: https://github.com/mbrubeck/agate/compare/v3.0.2...v3.0.3
+[3.0.2]: https://github.com/mbrubeck/agate/compare/v3.0.1...v3.0.2
+[3.0.1]: https://github.com/mbrubeck/agate/compare/v3.0.0...v3.0.1
+[3.0.0]: https://github.com/mbrubeck/agate/compare/v2.5.3...v3.0.0
+[2.5.3]: https://github.com/mbrubeck/agate/compare/v2.5.2...v2.5.3
+[2.5.2]: https://github.com/mbrubeck/agate/compare/v2.5.1...v2.5.2
+[2.5.1]: https://github.com/mbrubeck/agate/compare/v2.5.0...v2.5.1
+[2.5.0]: https://github.com/mbrubeck/agate/compare/v2.4.1...v2.5.0
+[2.4.1]: https://github.com/mbrubeck/agate/compare/v2.4.0...v2.4.1
+[2.4.0]: https://github.com/mbrubeck/agate/compare/v2.3.0...v2.4.0
+[2.3.0]: https://github.com/mbrubeck/agate/compare/v2.2.0...v2.3.0
+[2.2.0]: https://github.com/mbrubeck/agate/compare/v2.1.3...v2.2.0
+[2.1.3]: https://github.com/mbrubeck/agate/compare/v2.1.2...v2.1.3
+[2.1.2]: https://github.com/mbrubeck/agate/compare/v2.1.1...v2.1.2
+[2.1.1]: https://github.com/mbrubeck/agate/compare/v2.1.0...v2.1.1
+[2.1.0]: https://github.com/mbrubeck/agate/compare/v2.0.0...v2.1.0
+[2.0.0]: https://github.com/mbrubeck/agate/compare/v1.3.2...v2.0.0
+[1.3.2]: https://github.com/mbrubeck/agate/compare/v1.3.1...v1.3.2
+[1.3.1]: https://github.com/mbrubeck/agate/compare/v1.3.0...v1.3.1
+[1.3.0]: https://github.com/mbrubeck/agate/compare/v1.2.2...v1.3.0
+[1.2.2]: https://github.com/mbrubeck/agate/compare/v1.2.1...v1.2.2
+[1.2.1]: https://github.com/mbrubeck/agate/compare/v1.2.0...v1.2.1
+[1.2.0]: https://github.com/mbrubeck/agate/compare/v1.1.0...v1.2.0
+[1.1.0]: https://github.com/mbrubeck/agate/compare/v1.0.1...v1.1.0
+[1.0.1]: https://github.com/mbrubeck/agate/compare/v1.0.0...v1.0.1
+[1.0.0]: https://github.com/mbrubeck/agate/releases/tag/v1.0.0

CODE_OF_CONDUCT.md

@@ -0,0 +1,85 @@
+
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces. Examples of representing our community include using an official e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to a maintainer listed in the `Cargo.toml` file via email.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior,  harassment of an individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.0, available at [https://www.contributor-covenant.org/version/2/0/code_of_conduct.html][v2.0].
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at [https://www.contributor-covenant.org/faq][FAQ]. Translations are available at [https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.0]: https://www.contributor-covenant.org/version/2/0/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations

CONTRIBUTING.md

@@ -0,0 +1,113 @@
+# Contributing
+
+## Contents
+
+- [Introduction](#introduction)
+- [Code of Conduct](#code-of-conduct)
+- [Reporting Bugs and Suggesting Improvements](#reporting-bugs-and-suggesting-improvements)
+- [Contribution Workflow](#contribution-workflow)
+- [Quality Standards](#quality-standards)
+- [Release Process](#release-process)
+
+## Introduction
+
+Hello, and welcome to the contributing guide for Agate!
+
+Agate is mostly maintained in the spare time of contributors, so be patient if it takes a bit longer to respond.
+By following this guide you'll make it easier for us to address your issues or incorporate your contributions.
+
+We look forward to working with you!
+
+## Code of Conduct
+
+Please note that this project is released with a [Code of Conduct](./CODE_OF_CONDUCT.md).
+By participating in this project you agree to abide by its terms.
+
+## Reporting security issues
+
+If you find a security issue, please disclose it to Johann150 privately, e.g. per [email](mailto:johann+agate@qwertqwefsday.eu). If you know how to fix the issue, please follow the contribution workflow as if you do not use GitHub, regardless of if you actually use it. I.e. patches should also be submitted privately.
+
+An effort will be made to respond to such issues quickly, at least responding with a "read receipt". If you do not hear back anything regarding the security issue within three days, try contacting other maintainers listed in the Cargo.toml file or on crates.io for this crate.
+
+There are no bug bounties. You can not expect any compensation apart from attribution in the changelog and/or for any patches you supply.
+
+## Reporting Bugs and Suggesting Improvements
+
+Bugs (unwanted behaviour) and suggested improvements are tracked as [GitHub issues][github-issues].
+Before reporting an issue, please check the following points:
+
+1. The issue is caused by Agate itself and not by how it is used.
+  Have a look at the documentation if you are not sure.
+  If you cannot connect to Agate via the Internet, please try connecting with a client on the same machine to make sure the problem is not caused by intermediate infrastructure.
+1. Your issue has not already been reported by someone else.
+  Please look through the open issues in the [issue tracker][github-issues].
+
+When reporting an issue, please add as much relevant information as possible.
+This will help developers and maintainers to resolve your issue. Some things you might consider:
+
+* Use a descriptive title.
+* State which version you are using (use a version tag like `v2.4.1` or the commit hash).
+* If you are using tools provided with agate (like a startup script), please also state that.
+* Describe how the problem can be reproduced.
+* Explain what exactly is the problem and what you expect instead.
+
+[github-issues]: https://github.com/mbrubeck/agate/issues
+
+## Contribution Workflow
+
+Follow these steps to contribute to the project:
+
+### If you use git but not GitHub:
+
+1. Clone the repository where you want.
+1. Make the appropriate changes, meeting all [contribution quality standards](#quality-standards).
+1. Update the changelog with any added, removed, changed, or fixed functionality. Adhere to the changelog format.
+1. Mail the patches or a pull request to [Johann150](mailto:johann+agate@qwertqwefsday.eu).
+    - Patches are prefered for small changes.
+    - Pull requests have to contain the repository URL and branch name.
+1. You will be notified of any further actions (e.g. requested changes, merged) by the same address you sent from. So please make sure you can receive mail on that address.
+
+### If you use GitHub:
+
+1. Make a fork of the [Agate repository][agate-repo].
+1. Within your fork, create a branch for your contribution. Use a meaningful name.
+1. Create your contribution, meeting all [contribution quality standards](#quality-standards).
+1. Update the changelog with any added, removed, changed, or fixed functionality. Adhere to the changelog format.
+1. [Create a pull request][create-a-pr] against the `master` branch of the repository.
+1. Once the pull request is reviewed and CI passes, it will be merged.
+
+[agate-repo]: https://github.com/mbrubeck/agate
+[create-a-pr]: https://help.github.com/articles/creating-a-pull-request-from-a-fork/
+
+## Quality Standards
+
+Most quality and style standards are checked automatically by the CI build.
+Contributions should:
+
+- Separate each **logical change** into its own commit.
+- Ensure the code compiles correctly, if you can also run `cargo clippy`.
+- Format code with `cargo fmt`.
+- Avoid adding `unsafe` code.
+  If it is necessary, provide an explanatory comment on any `unsafe` block explaining its rationale and why it's safe.
+- Add a descriptive message for each commit.
+  Follow [these commit message guidelines][commit-messages].
+- Document your pull requests.
+  Include the reasoning behind each change, and the testing done.
+
+[commit-messages]: https://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html
+
+## Release Process
+(This is only relevant if you are a maintainer.)
+
+1. Bump the version number appropriately. (Update `Cargo.lock` too!)
+1. Run `cargo package` to make sure everything compiles correctly.
+1. Update the changelog with the new version ranges.
+1. Update agate's homepage (`content/index.gmi`) with changes to the README and CHANGELOG
+1. Add a git tag for the version, e.g. with `git tag v2.4.1`.
+1. Push the changelog commit and tag to the repository.
+    Upon detecting the push of a tag beginning with "v", CI should start building the prebuilt binaries.
+    These binaries will be uploaded to a new draft GitHub release with the same name as the version tag. (You need push access to see it).
+1. Run `cargo publish` to publish to [crates.io](https://crates.io/crates/agate).
+1. Fill the GitHub release text with the appropriate entries from the changelog.
+1. Wait for the binary compilation to finish.
+1. Publish the GitHub release.

Cargo.toml

@@ -1,24 +1,32 @@
 [package]
 name = "agate"
-version = "1.3.1"
-authors = ["Matt Brubeck <mbrubeck@limpet.net>"]
+version = "3.3.20"
+authors = ["Matt Brubeck <mbrubeck@limpet.net>", "Johann150 <johann+agate@qwertqwefsday.eu>"]
 description = "Very simple server for the Gemini hypertext protocol"
 keywords = ["server", "gemini", "hypertext", "internet", "protocol"]
 categories = ["network-programming"]
 repository = "https://github.com/mbrubeck/agate"
 readme = "README.md"
-license = "MIT/Apache-2.0"
-edition = "2018"
+license = "MIT OR Apache-2.0"
+edition = "2024"
+exclude = ["/tools", "/.github", "/Cross.toml", "/content", "/CODE_OF_CONDUCT.md", "/CONTRIBUTING.md", "/CHANGELOG.md", "/tests"]
 
 [dependencies]
-async-tls = { version = "0.10.2", default-features = false, features = ["server"] }
-async-std = "1.5"
-mime_guess = "2.0"
-once_cell = "1.4"
-rustls = "0.19.0"
-url = "2.1"
+configparser = "3.0"
+env_logger = { version = "0.11", default-features = false, features = ["auto-color", "humantime"] }
+futures-util = "0.3"
+getopts = { version = "0.2.24", default-features = false }
+glob = "0.3"
 log = "0.4"
-env_logger = { version = "0.8", default-features = false, features = ["atty", "humantime", "termcolor"] }
+mime_guess = "2.0"
+percent-encoding = "2.3"
+rcgen = { version = "0.14.7", default-features = false, features = ["ring"] }
+tokio-rustls = { version = "0.26.4", default-features = false, features = ["logging", "ring", "tls12"] }
+tokio = { version = "1.49", features = ["fs", "io-util", "net", "rt-multi-thread", "sync"] }
+url = "2.5.8"
+
+[dev-dependencies]
+trotter = "1.0"
 
 [profile.release]
 lto = true

Cross.toml

@@ -0,0 +1,2 @@
+[target.arm-unknown-linux-gnueabihf]
+image = "zenria/cross:arm-rpi-4.9.3-linux-gnueabihf"

Dockerfile

@@ -0,0 +1,26 @@
+FROM docker.io/library/rust:alpine AS builder
+
+WORKDIR /agate
+RUN apk --no-cache add libc-dev
+
+COPY src src
+COPY Cargo.toml .
+COPY Cargo.lock .
+ARG TARGETARCH
+RUN if [ "$TARGETARCH" = "amd64" ]; then \
+      cargo install --target x86_64-unknown-linux-musl --path . ; \
+    elif [ "$TARGETARCH" = "arm64" ]; then \
+      cargo install --target aarch64-unknown-linux-musl --path . ; \
+    else \
+      echo "The architecture $TARGETARCH isn't unsupported." && exit 1; \
+    fi
+
+FROM docker.io/library/alpine:latest
+COPY --from=builder /usr/local/cargo/bin/agate /usr/bin/agate
+WORKDIR /app
+EXPOSE 1965
+VOLUME /gmi/
+VOLUME /certs/
+
+ENTRYPOINT ["agate", "--addr", "0.0.0.0:1965", "--content", "/gmi/", "--certs", "/certs/"]
+

README.md

@@ -1,52 +1,237 @@
 # Agate
 
+[![Crates.io](https://img.shields.io/crates/v/agate.svg)](https://crates.io/crates/agate)
+[![Test Status](https://github.com/mbrubeck/agate/workflows/Tests/badge.svg)](https://github.com/mbrubeck/agate/actions?workflow=Tests)
+[![Dependency Status](https://deps.rs/repo/github/mbrubeck/agate/status.svg)](https://deps.rs/repo/github/mbrubeck/agate)
+
 ## Simple Gemini server for static files
 
 Agate is a server for the [Gemini] network protocol, built with the [Rust] programming language. Agate has very few features, and can only serve static files. It uses async I/O, and should be quite efficient even when running on low-end hardware and serving many concurrent requests.
 
 ## Learn more
 
-* Home page: [gemini://gem.limpet.net/agate/][home]
+* Home page: [gemini://qwertqwefsday.eu/agate.gmi][home]
 * [Cargo package][crates.io]
 * [Source code][source]
 
-## Installation and setup
+## Installation and Setup
 
-1. Download and unpack the [pre-compiled binary](https://github.com/mbrubeck/agate/releases).
+1. Get a binary for agate. You can use any of the below ways:
 
-   Or, if you have the Rust toolchain installed, run `cargo install agate` to
-   install agate from crates.io.
+### Pre-compiled
 
-   Or download the source code and run `cargo build --release` inside the
-   source repository, then find the binary at `target/release/agate`.
+Download and unpack the [pre-compiled binary](https://github.com/mbrubeck/agate/releases).
 
-2. Generate a self-signed TLS certificate and private key.  For example, if you have OpenSSL 1.1 installed, you can use a command like the following.  (Replace the hostname with the address of your Gemini server.)
+### NixOS/Nix
 
-```
-openssl req -x509 -newkey rsa:4096 -keyout key.rsa -out cert.pem \
-    -days 3650 -nodes -subj "/CN=example.com"
+Using the nix package manager run `nix-env -i agate`
+
+### Guix System
+
+[Deploy](https://dataswamp.org/~solene/2021-06-17-guix-gemini.html) agate with GNU Guix System by adding the [agate-service-type](https://guix.gnu.org/manual/en/html_node/Web-Services.html) to your system [services](http://guix.gnu.org/manual/en/html_node/Services.html). 
+
+### Arch Linux
+
+Install the package [`agate-bin`](https://aur.archlinux.org/packages/agate-bin/)<sup>AUR</sup> for pre-compiled binary. Otherwise install the [`agate`](https://aur.archlinux.org/packages/agate/)<sup>AUR</sup> package to get agate compiled from source.
+
+### Cargo
+
+If you have the Rust toolchain installed, run `cargo install agate` to install agate from crates.io.
+
+### Docker
+
+Recent builds have also been released as OCI/Docker images on Github's Container Registry (ghcr.io). Most people will need to mount two volumes, one for your content, one for your certificates (this can be empty, they will be automatically generated if needed):
+
+```sh
+$ docker run \
+  -p 1965:1965 \
+  -v your/path/to/gmi:/gmi \
+  -v your/path/to/certs:/certs \
+  ghcr.io/mbrubeck/agate:latest \
+  --hostname example.org
 ```
 
-3. Run the server. The command line arguments are `agate <addr:port> <content_dir> <cert_file> <key_file> [<domain>]`.  For example, to listen on the standard Gemini port (1965) on all interfaces:
+This container will run without a mounted certificates directory, but new certificates will be lost when it shuts down and re-generated every time it boots, showing your site's visitors a certificate warning each time your server restarts.
+
+Each release is tagged with `major`, `major.minor`, `major.minor.patch`, as well as the full version string and "latest". This means `docker pull ghcr.io/mbrubeck/agate:3` will always retrieve the latest `v3.*` image, `…:3.3` the latest `v3.3.*` image, and `…:latest` the most recent release of any version.
+
+### Source
+
+Download the source code and run `cargo build --release` inside the source repository, then find the binary at `target/release/agate`.
+
+***
+You can use the install script in the `tools` directory for the remaining steps if there is one for your system.  
+If there is none, please consider contributing one to make it easier for less tech-savvy users!
+***
+
+2. Run the server. You can use the following arguments to specify the locations of the content directory, IP address and port to listen on, host name to expect in request URLs, and default language code to include in the MIME type for text/gemini files: (Replace the hostname `example.com` with the address of your Gemini server.)
+If you have not done it yourself, Agate will generate a private key and certificate for you on the first run, using the specified hostname(s). See the section Certificates below for more.
 
 ```
-agate 0.0.0.0:1965 path/to/content/ cert.pem key.rsa
+agate --content path/to/content/ \
+      --addr [::]:1965 \
+      --addr 0.0.0.0:1965 \
+      --hostname example.com \
+      --lang en-US
 ```
 
-Agate will check that the port part of the requested URL matches the port specified in the 1st argument.
-If `<domain>` is specified, agate will also check that the host part of the requested URL matches this domain.
+All of the command-line arguments are optional.  Run `agate --help` to see the default values used when arguments are omitted.
 
-When a client requests the URL `gemini://example.com/foo/bar`, Agate will respond with the file at `path/to/content/foo/bar`.  If there is a directory at that path, Agate will look for a file named `index.gmi` inside that directory.
+When a client requests the URL `gemini://example.com/foo/bar`, Agate will respond with the file at `path/to/content/foo/bar`. If any segment of the requested path starts with a dot, agate will respond with a status code 52, whether the file exists or not. This behaviour can be disabled with `--serve-secret` or by an entry for the specific file in the `.meta` configuration file (see Meta-Presets). If there is a directory at that path, Agate will look for a file named `index.gmi` inside that directory.
 
-Optionally, set a log level via the `AGATE_LOG` environment variable. Logging is powered by the [env_logger crate](https://crates.io/crates/env_logger):
+## Configuration
 
+### Automatic Certificate generation
+
+If the `--hostname` argument is used, Agate will generate keys and self signed certificates for each hostname specified. For Gemini it is recommended by the specification to use self signed certificates because Gemini uses the TOFU (Trust on first use) principle for certificates. Because of this, the generated certificates will also have a long expiration time of `4096-01-01`.
+
+For manual configuration of keys and certificates see the [section on certificates](#certificates) below.
+
+### TLS versions
+
+Agate by default supports TLSv1.2 and TLSv1.3. You can disable support for TLSv1.2 by using the flag `--only-tls13` (or its short version `-3`). This is *NOT RECOMMENDED* as it may break compatibility with some clients. The Gemini specification requires compatibility with TLSv1.2 "for now" because not all platforms have good support for TLSv1.3 (cf. §4.1 of the specification).
+
+### Directory listing
+
+You can enable a basic directory listing for a directory by putting a file called `.directory-listing-ok` in that directory. This does not have an effect on sub-directories.
+This file must be UTF-8 encoded text; it may be empty. Any text in the file will be prepended to the directory listing.
+The directory listing will hide files and directories whose name starts with a dot (e.g. the `.directory-listing-ok` file itself, the `.meta` configuration file, or the `..` directory).
+
+A file called `index.gmi` will always take precedence over a directory listing.
+
+### Meta-Presets
+
+You can put a file called `.meta` in any content directory. This file stores some metadata about the adjacent files which Agate will use when serving these files. The `.meta` file must be UTF-8 encoded.
+You can also enable a central configuration file with the `-C` flag (or the long version `--central-conf`). In this case Agate will always look for the `.meta` configuration file in the content root directory and will ignore `.meta` files in other directories.
+
+The `.meta` file has the following format (*1):
+* Empty lines are ignored.
+* Everything behind a `#` on the same line is a comment and will be ignored.
+* All other lines must have the form `<path>:<metadata>`, i.e. start with a file path, followed by a colon and then the metadata.
+
+`<path>` is a case sensitive file path, which may or may not exist on disk. If <path> leads to a directory, it is ignored.
+If central configuration file mode is not used, using a path that is not a file in the current directory is undefined behaviour (for example `../index.gmi` would be undefined behaviour).
+You can use Unix style patterns in existing paths. For example `content/*` will match any file within `content`, and `content/**` will additionally match any files in subdirectories of `content`.
+However, the `*` and `**` globs on their own will by default not match files or directories that start with a dot because of their special meaning.
+This behaviour can be disabled with `--serve-secret` or by explicitly matching files starting with a dot with e.g. `content/.*` or `content/**/.*` respectively.
+For more information on the patterns you can use, please see the [documentation of `glob::Pattern`](https://docs.rs/glob/0.3.0/glob/struct.Pattern.html).
+Rules can overwrite other rules, so if a file is matched by multiple rules, the last one applies.
+
+`<metadata>` can take one of four possible forms:
+1. empty  
+    Agate will not send a default language parameter, even if it was specified on the command line.
+2. starting with a semicolon followed by MIME parameters  
+    Agate will append the specified string onto the MIME type, if the file is found.
+3. starting with a gemini status code (i.e. a digit 1-6 inclusive followed by another digit) and a space  
+    Agate will send the metadata whether the file exists or not. The file will not be sent or accessed.
+4. a MIME type, may include parameters  
+    Agate will use this MIME type instead of what it would guess, if the file is found.
+    The default language parameter will not be used, even if it was specified on the command line.
+
+If a line violates the format or looks like case 3, but is incorrect, it might be ignored. You should check your logs. Please know that this configuration file is first read when a file from the respective directory is accessed. So no log messages after startup does not mean the `.meta` file is okay.
+
+Such a configuration file might look like this:
 ```
-AGATE_LOG=info 0.0.0.0:1965 path/to/content/ cert.pem key.rsa
+# This line will be ignored.
+**/*.de.gmi: ;lang=de
+nl/**/*.gmi: ;lang=nl
+index.gmi: ;lang=en-GB
+LICENSE: text/plain;charset=UTF-8
+gone.gmi: 52 This file is no longer here, sorry.
 ```
 
-[Gemini]: https://gemini.circumlunar.space/
+If this is the `.meta` file in the content root directory and the `-C` flag is used, this will result in the following response headers:
+* `/` or `/index.gmi`
+    -> `20 text/gemini;lang=en-GB`
+* `/LICENSE`
+    -> `20 text/plain;charset=UTF-8`
+* `/gone.gmi`
+    -> `52 This file is no longer here, sorry.`
+* any non-hidden file ending in `.de.gmi` (including in non-hidden subdirectories)
+    -> `20 text/gemini;lang=de`
+* any non-hidden file in the `nl` directory ending in `.gmi` (including in non-hidden subdirectories)
+    -> `20 text/gemini;lang=nl`
+
+(*1) In theory the syntax is that of a typical INI-like file and also allows for sections with `[section]` (the default section is set to `mime` in the parser), since all other sections are disregarded, this does not make a difference. This also means that you can in theory also use `=` instead of `:`. For even more information, you can visit the [documentation of `configparser`](https://docs.rs/configparser/2.0).
+
+### Logging Verbosity
+
+Agate uses the `env_logger` crate and allows you to set the logging verbosity by setting the `RUST_LOG` environment variable. To turn off all logging use `RUST_LOG=off`. For more information, please see the [documentation of `env_logger`].
+
+### Virtual Hosts
+
+Agate has basic support for virtual hosts. If you specify multiple `--hostname`s, Agate will look in a directory with the respective hostname within the content root directory.
+For example if one of the hostnames is `example.com`, and the content root directory is set to the default `./content`, and `gemini://example.com/file.gmi` is requested, then Agate will look for `./content/example.com/file.gmi`. This behaviour is only enabled if multiple `--hostname`s are specified.
+Agate also supports different certificates for different hostnames, see the section on certificates below. 
+
+If you want to serve the same content for multiple domains, you can instead disable the hostname check by not specifying `--hostname`. In this case Agate will disregard a request's hostname apart from checking that there is one.
+
+When one or more `--hostname`s are specified, Agate will check that the hostnames and port in request URLs match the specified hostnames and the listening ports. If Agate is behind a proxy on another port and receives a request with an URL specifying the proxy port, this port may not match one of Agate's listening ports and the request will be rejected: it is possible to disable the port check with `--skip-port-check`.
+
+### Certificates
+
+Agate has support for using multiple certificates with the `--certs` option. Agate will thus always require that a client uses SNI, which should not be a problem since the Gemini specification also requires SNI to be used.
+
+Certificates are by default stored in the `.certificates` directory. This is a hidden directory for the purpose that uncautious people may set the content root directory to the current directory which may also contain the certificates directory. In this case, the certificates and private keys would still be hidden. The certificates are only loaded when Agate is started and are not reloaded while running. The certificates directory may directly contain a key and certificate pair, this is the default pair used if no other matching keys are present. The certificates directory may also contain subdirectories for specific domains, for example a folder for `example.org` and `portal.example.org`. Note that the subfolders for subdomains (like `portal.example.org`) should not be inside other subfolders but directly in the certificates directory. Agate will select the certificate/key pair whose name matches most closely. For example take the following directory structure:
+
+```
+.certificates
+|-- cert.der     (1)
+|-- key.der      (1)
+|-- example.org
+|   |-- cert.der (2)
+|   `-- key.der  (2)
+`-- portal.example.org
+    |-- cert.der (3)
+    `-- key.der  (3)
+```
+
+This would be understood like this:
+* The certificate/key pair (1) would be used for the entire domain tree (exceptions below).
+* The certificate/key pair (2) would be used for the entire domain tree of `example.org`, so also including subdomains like `secret.example.org`. It overrides the pair (1) for this subtree (exceptions below).
+* The certificate/key pair (3) would be used for the entire domain tree of `portal.example.org`, so also inclduding subdomains like `test.portal.example.org`. It overrides the pairs (1) and (2) for this subtree.
+
+Using a directory named just `.` causes undefined behaviour as this would have the same meaning as the top level certificate/key pair (pair (1) in the example above).
+
+The files for a certificate/key pair have to be named `cert.der` and `key.der` respectively. The certificate has to be a X.509 certificate in a DER format file and has to include a subject alt name of the domain name. The private key has to be in DER format and must be either an RSA, ECDSA or Ed25519 key.
+
+If you have an existing certificate/key pair in PEM format, you can use these commands to convert them to the DER format:
+
+```shell
+openssl x509 -inform pem -in cert.pem -outform der -out cert.der
+openssl rsa -inform pem -in privkey.pem -outform der -out key.der
+```
+
+## Logging
+
+All requests via TCP sockets will be logged using this format:
+```
+<local ip>:<local port> <remote ip or dash> "<request>" <response status> "<response meta>"[ error:<error>]
+```
+All requests via Unix sockets will be logged using this format:
+```
+unix:[<unix socket name>] - "<request>" <response status> "<response meta>"[ error:<error>]
+```
+
+Square brackets indicate optional parts.
+
+The "error:" part will only be logged if an error occurred. This should only be used for informative purposes as the status code should provide the information that an error occurred. If the error consisted in the connection not being established (e.g. because of TLS errors), special status codes listed below may be used.
+
+By default, Agate will not log the remote IP addresses because that might be an issue because IPs are considered private data under the EU's GDPR. To enable logging of IP addresses, you can use the `--log-ip` option. Note that in this case some error conditions might still force Agate to log a dash instead of an IP address. IP addresses can also not be logged for connections via Unix sockets.
+
+There are some lines apart from these that might occur in logs depending on the selected log level. For example the initial "Listening on..." line or information about listing a particular directory.
+
+Agate uses some status codes that are not valid Gemini status codes when logging errors:
+* 00 - there was an error establishing the TLS connection
+* 01 - there was an error in fetching the peer's IP address
+
+## Security considerations
+
+If you want to run agate on a multi-user system, you should be aware that all certificate and key data is loaded into memory and stored there until the server stops. Since the memory is also not explicitly overwritten or zeroed after use, the sensitive data might stay in memory after the server has terminated.
+
+[Gemini]: https://geminiprotocol.net/
 [Rust]: https://www.rust-lang.org/
-[home]: gemini://gem.limpet.net/agate/
-[rustup]: https://www.rust-lang.org/tools/install
+[home]: gemini://qwertqwefsday.eu/agate.gmi
 [source]: https://github.com/mbrubeck/agate
 [crates.io]: https://crates.io/crates/agate
+[documentation of `env_logger`]: https://docs.rs/env_logger/0.8

SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest version of Agate is supported at any time.
+
+## Reporting a Vulnerability
+
+Please report issues that you deem to be a security issue by email to johann at qwertqwefsday.eu.
+
+You may use OpenPGP encryption with the public key available at either
+- <https://github.com/Johann150/Johann150/blob/main/johann-qwertqwefsday-eu.asc>
+- through web key discovery, e.g. `gpg --locate-keys ...`
+- or the above manually at <https://qwertqwefsday.eu/.well-known/openpgpkey/hu/spd3xecxhotzgyu1p3eqdqdp31ba6rif>
+
+All these public keys should be identical. If you wish for an encrypted response, include instructions on how to obtain your public key in the email.
+
+Please allow at least 24 hours for a response.
+If your issue is easy to fix, you might not get a response until the issue is fixed.
+Otherwise, the receipt of your report should be acknowledged.
+
+If you did not receive a reply within the above time frame, please email another maintainer listed in the `Cargo.toml` file, citing that you did not yet receive a reply.
+Only limited support may be available.
+
+## Compensation
+
+There is no bug bounty or other rewards program.
+At your option, you may be mentioned by your name or pseudonym in the changelog.

content/index.gmi

@@ -0,0 +1,571 @@
+# Agate
+
+## Simple Gemini server for static files
+
+Agate is a server for the Gemini network protocol, built with the Rust programming language. Agate has very few features, and can only serve static files. It uses async I/O, and should be quite efficient even when running on low-end hardware and serving many concurrent requests.
+
+Since Agate by default uses port 1965, you should be able to run other servers (like e.g. Apache or nginx) on the same device.
+
+## Learn more
+
+=> gemini://qwertqwefsday.eu/agate.gmi Home page
+=> https://crates.io/crates/agate Agate on crates.io
+=> https://github.com/mbrubeck/agate Source code
+
+## Installation and Setup
+
+1. Get a binary for agate. You can use any of the below ways:
+
+### Pre-compiled
+
+Download and unpack the [pre-compiled binary](https://github.com/mbrubeck/agate/releases).
+
+### NixOS/Nix
+
+Using the nix package manager run `nix-env -i agate`
+
+_Note:_ agate is currently only in the unstable channel and will reach a release channel once the next release is tagged
+
+### Guix System
+
+Deploy agate with GNU Guix System by adding the agate-service-type to your system services.
+=> https://dataswamp.org/~solene/2021-06-17-guix-gemini.html refer to this article
+
+see also
+=> https://guix.gnu.org/manual/en/html_node/Web-Services.html Guix Manual Web-Services
+=> https://guix.gnu.org/manual/en/html_node/Services.html Guix Manual Services
+
+### Arch Linux
+
+Install the package "agate-bin" from AUR for pre-compiled binary. Otherwise install the "agate" package from AUR to get agate compiled from source.
+
+### Cargo
+
+If you have the Rust toolchain installed, run `cargo install agate` to install agate from crates.io.
+
+### Source
+
+Download the source code and run `cargo build --release` inside the source repository, then find the binary at `target/release/agate`.
+
+***
+You can use the install script in the `tools` directory for the remaining steps if there is one for your system. If there is none, please consider contributing one to make it easier for less tech-savvy users!
+***
+
+2. Run the server. You can use the following arguments to specify the locations of the content directory, IP address and port to listen on, host name to expect in request URLs, and default language code to include in the MIME type for text/gemini files: (Replace the hostname `example.com` with the address of your Gemini server.)
+If you have not done it yourself, Agate will generate a private key and certificate for you on the first run, using the specified hostname(s). See the section Certificates below for more.
+
+```
+agate --content path/to/content/ \
+      --addr [::]:1965 \
+      --addr 0.0.0.0:1965 \
+      --hostname example.com \
+      --lang en-US
+```
+
+All of the command-line arguments are optional.  Run `agate --help` to see the default values used when arguments are omitted.
+
+When a client requests the URL `gemini://example.com/foo/bar`, Agate will respond with the file at `path/to/content/foo/bar`. If any segment of the requested path starts with a dot, agate will respond with a status code 52, whether the file exists or not. This behaviour can be disabled with `--serve-secret` or by an entry for the specific file in the `.meta` configuration file (see Meta-Presets). If there is a directory at that path, Agate will look for a file named `index.gmi` inside that directory.
+
+## Configuration
+
+### Automatic Certificate generation
+
+If the `--hostname` argument is used, Agate will generate keys and self signed certificates for each hostname specified. For Gemini it is recommended by the specification to use self signed certificates because Gemini uses the TOFU (Trust on first use) principle for certificates. Because of this, the generated certificates will also have a long expiration time of `4096-01-01`.
+
+For manual configuration of keys and certificates see the section on certificates below.
+
+### TLS versions
+
+Agate by default supports TLSv1.2 and TLSv1.3. You can disable support for TLSv1.2 by using the flag `--only-tls13` (or its short version `-3`). This is *NOT RECOMMENDED* as it may break compatibility with some clients. The Gemini specification requires compatibility with TLSv1.2 "for now" because not all platforms have good support for TLSv1.3 (cf. §4.1 of the specification).
+
+### Directory listing
+
+You can enable a basic directory listing for a directory by putting a file called `.directory-listing-ok` in that directory. This does not have an effect on sub-directories.
+This file must be UTF-8 encoded text; it may be empty. Any text in the file will be prepended to the directory listing.
+The directory listing will hide files and directories whose name starts with a dot (e.g. the `.directory-listing-ok` file itself, the `.meta` configuration file, or the `..` directory).
+
+A file called `index.gmi` will always take precedence over a directory listing.
+
+### Meta-Presets
+
+You can put a file called `.meta` in any content directory. This file stores some metadata about the adjacent files which Agate will use when serving these files. The `.meta` file must be UTF-8 encoded.
+You can also enable a central configuration file with the `-C` flag (or the long version `--central-conf`). In this case Agate will always look for the `.meta` configuration file in the content root directory and will ignore `.meta` files in other directories.
+
+The `.meta` file has the following format [1]:
+* Empty lines are ignored.
+* Everything behind a `#` on the same line is a comment and will be ignored.
+* All other lines must have the form `<path>:<metadata>`, i.e. start with a file path, followed by a colon and then the metadata.
+
+`<path>` is a case sensitive file path, which may or may not exist on disk. If <path> leads to a directory, it is ignored.
+If central configuration file mode is not used, using a path that is not a file in the current directory is undefined behaviour (for example `../index.gmi` would be undefined behaviour).
+You can use Unix style patterns in existing paths. For example `content/*` will match any file within `content`, and `content/**` will additionally match any files in subdirectories of `content`.
+However, the `*` and `**` globs on their own will by default not match files or directories that start with a dot because of their special meaning.
+This behaviour can be disabled with `--serve-secret` or by explicitly matching files starting with a dot with e.g. `content/.*` or `content/**/.*` respectively.
+For more information on the patterns you can use, please see the documentation of `glob::Pattern`.
+Rules can overwrite other rules, so if a file is matched by multiple rules, the last one applies.
+
+=> https://docs.rs/glob/0.3.0/glob/struct.Pattern.html Documentation of `glob::Pattern`.
+
+`<metadata>` can take one of four possible forms:
+1. empty:
+Agate will not send a default language parameter, even if it was specified on the command line.
+2. starting with a semicolon followed by MIME parameters:
+Agate will append the specified string onto the MIME type, if the file is found.
+3. starting with a gemini status code (i.e. a digit 1-6 inclusive followed by another digit) and a space:
+Agate will send the metadata whether the file exists or not. The file will not be sent or accessed.
+4. a MIME type, may include parameters:
+Agate will use this MIME type instead of what it would guess, if the file is found. The default language parameter will not be used, even if it was specified on the command line.
+
+If a line violates the format or looks like case 3, but is incorrect, it might be ignored. You should check your logs. Please know that this configuration file is first read when a file from the respective directory is accessed. So no log messages after startup does not mean the `.meta` file is okay.
+
+Such a configuration file might look like this:
+
+```
+# This line will be ignored.
+**/*.de.gmi: ;lang=de
+nl/**/*.gmi: ;lang=nl
+index.gmi: ;lang=en-GB
+LICENSE: text/plain;charset=UTF-8
+gone.gmi: 52 This file is no longer here, sorry.
+```
+
+If this is the `.meta` file in the content root directory and the `-C` flag is used, this will result in the following response headers:
+
+```
+`/` or `/index.gmi`
+    -> `20 text/gemini;lang=en-GB`
+`/LICENSE`
+    -> `20 text/plain;charset=UTF-8`
+`/gone.gmi`
+    -> `52 This file is no longer here, sorry.`
+any non-hidden file ending in `.de.gmi` (including in non-hidden subdirectories)
+    -> `20 text/gemini;lang=de`
+any non-hidden file in the `nl` directory ending in `.gmi` (including in non-hidden subdirectories)
+    -> `20 text/gemini;lang=nl`
+```
+
+[1] In theory the syntax is that of a typical INI-like file and also allows for sections with `[section]` (the default section is set to `mime` in the parser), since all other sections are disregarded, this does not make a difference. This also means that you can in theory also use `=` instead of `:`. For even more information, you can visit the documentation of `configparser`.
+=> https://docs.rs/configparser/2.0 documentation of `configparser`
+
+### Logging Verbosity
+
+Agate uses the `env_logger` crate and allows you to set the logging verbosity by setting the `RUST_LOG` environment variable. To turn off all logging use `RUST_LOG=off`. For more information, please see the documentation of `env_logger`.
+=> https://docs.rs/env_logger/0.8 documentation of `env_logger` crate
+
+### Virtual Hosts
+
+Agate has basic support for virtual hosts. If you specify multiple `--hostname`s, Agate will look in a directory with the respective hostname within the content root directory.
+For example if one of the hostnames is `example.com`, and the content root directory is set to the default `./content`, and `gemini://example.com/file.gmi` is requested, then Agate will look for `./content/example.com/file.gmi`. This behaviour is only enabled if multiple `--hostname`s are specified.
+Agate also supports different certificates for different hostnames, see the section on certificates below.
+
+If you want to serve the same content for multiple domains, you can instead disable the hostname check by not specifying `--hostname`. In this case Agate will disregard a request's hostname apart from checking that there is one.
+
+When one or more `--hostname`s are specified, Agate will check that the hostnames and port in request URLs match the specified hostnames and the listening ports. If Agate is behind a proxy on another port and receives a request with an URL specifying the proxy port, this port may not match one of Agate's listening ports and the request will be rejected: it is possible to disable the port check with `--skip-port-check`.
+
+### Certificates
+
+Agate has support for using multiple certificates with the `--certs` option. Agate will thus always require that a client uses SNI, which should not be a problem since the Gemini specification also requires SNI to be used.
+
+Certificates are by default stored in the `.certificates` directory. This is a hidden directory for the purpose that uncautious people may set the content root directory to the current directory which may also contain the certificates directory. In this case, the certificates and private keys would still be hidden. The certificates are only loaded when Agate is started and are not reloaded while running. The certificates directory may directly contain a key and certificate pair, this is the default pair used if no other matching keys are present. The certificates directory may also contain subdirectories for specific domains, for example a folder for `example.org` and `portal.example.org`. Note that the subfolders for subdomains (like `portal.example.org`) should not be inside other subfolders but directly in the certificates directory. Agate will select the certificate/key pair whose name matches most closely. For example take the following directory structure:
+
+```
+.certificates
+|-- cert.der     (1)
+|-- key.der      (1)
+|-- example.org
+|   |-- cert.der (2)
+|   `-- key.der  (2)
+`-- portal.example.org
+    |-- cert.der (3)
+    `-- key.der  (3)
+```
+
+This would be understood like this:
+* The certificate/key pair (1) would be used for the entire domain tree (exceptions below).
+* The certificate/key pair (2) would be used for the entire domain tree of `example.org`, so also including subdomains like `secret.example.org`. It overrides the pair (1) for this subtree (exceptions below).
+* The certificate/key pair (3) would be used for the entire domain tree of `portal.example.org`, so also inclduding subdomains like `test.portal.example.org`. It overrides the pairs (1) and (2) for this subtree.
+
+Using a directory named just `.` causes undefined behaviour as this would have the same meaning as the top level certificate/key pair (pair (1) in the example above).
+
+The files for a certificate/key pair have to be named `cert.der` and `key.der` respectively. The certificate has to be a X.509 certificate in a DER format file and has to include a subject alt name of the domain name. The private key has to be in DER format and must be either an RSA, ECDSA or Ed25519 key.
+
+## Logging
+
+All requests via TCP sockets will be logged using this format:
+```
+<local ip>:<local port> <remote ip or dash> "<request>" <response status> "<response meta>"[ error:<error>]
+```
+All requests via Unix sockets will be logged using this format:
+```
+unix:[<unix socket name>] - "<request>" <response status> "<response meta>"[ error:<error>]
+```
+Square brackets indicate optional parts.
+
+The "error:" part will only be logged if an error occurred. This should only be used for informative purposes as the status code should provide the information that an error occurred. If the error consisted in the connection not being established (e.g. because of TLS errors), special status codes listed below may be used.
+
+By default, Agate will not log the remote IP addresses because that might be an issue because IPs are considered private data under the EU's GDPR. To enable logging of IP addresses, you can use the `--log-ip` option. Note that in this case some error conditions might still force Agate to log a dash instead of an IP address. IP addresses can also not be logged for connections via Unix sockets.
+
+There are some lines apart from these that might occur in logs depending on the selected log level. For example the initial "Listening on..." line or information about listing a particular directory.
+
+Agate uses some status codes that are not valid Gemini status codes when logging errors:
+* 00 - there was an error establishing the TLS connection
+* 01 - there was an error in fetching the peer's IP address
+
+## Security considerations
+
+If you want to run agate on a multi-user system, you should be aware that all certificate and key data is loaded into memory and stored there until the server stops. Since the memory is also not explicitly overwritten or zeroed after use, the sensitive data might stay in memory after the server has terminated.
+
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on Keep a Changelog and this project adheres to Semantic Versioning.
+=> https://keepachangelog.com/en/1.0.0/ Keep a Changelog home page
+=> https://semver.org/spec/v2.0.0.html Semantic versioning standard v2.0.0
+
+## [3.3.1] - 2023-08-05
+Thank you to Jan Stępień and @michaelnordmeyer for contributing to this release.
+
+### Fixed
+* set permissions for generated key files so only owner can read them
+* improve documentation and tests
+
+## [3.3.0] - 2023-03-18
+Thank you to @equalsraf, @michaelnordmeyer and @wanderer1988 for contributing to this release.
+
+### Added
+* listening on unix sockets (#244)
+
+### Fixed
+* updated dependencies
+* misstyped email address in section on how to report security vulnerabilities (#239)
+* wrong language code in README (#189)
+
+## [3.2.4] - 2022-05-18
+Thank you to @06kellyjac, @albertlarsan68 and @kahays for contributing to this release.
+
+### Fixed
+* removed port collisions in tests, for the last time (#143)
+* fixed Dockerfile startup command (#169)
+* upated dependencies
+
+## [3.2.3] - 2022-02-04
+Thank you to T. Spivey for contributing to this release.
+
+### Fixed
+* improper IRIs are handled instead of crashing (bug reported via email)
+* updated dependencies
+
+## [3.2.2] - 2022-01-25
+Thank you to @Suzie97 for contributing to this release.
+
+### Added
+* CI build for `aarch64-apple-darwin` target (#137)
+
+### Fixed
+* updated dependencies
+
+## [3.2.1] - 2021-12-02
+Thank you to @MatthiasPortzel for contributing to this release.
+
+### Fixed
+* host name comparisons are now case insensitive (#115)
+* made automatic certificate generation more prominent in the README
+* updated dependencies
+
+## [3.2.0] - 2021-11-15
+Thank you to @balazsbtond and @joseph-marques for contributing to this release.
+
+### Added
+* you can add header text to a directory listing. See the updated instructions above for details. (#98)
+
+### Fixed
+* updated dependencies
+* error pages also send close_notify (#100)
+
+## [3.1.3] - 2021-10-25
+Thank you to @FoxKyong for contributing to this release.
+
+### Fixed
+* the fix for dual stack listening from 3.1.2 was executed asynchronously and would thus
+  sometimes fail. starting the listeners on different socket addresses is now synchronous
+  (#79)
+
+## [3.1.2] - 2021-10-15
+Thank you to @etam for contributing to this release.
+
+### Fixed
+* when starting up on a system that automatically listens in dual stack mode (e.g. some
+  linux distributions seem to do this), detect a second unspecified address to not cause
+  the "address in use" error with the default listening addresses
+* updated a dependency
+
+## [3.1.1] - 2021-10-14
+Thank you to @jgarte and @alvaro-cuesta for contributing to this release.
+
+### Added
+* running Agate using GNU Guix (#62)
+
+### Fixed
+* actually bind to multiple IP addresses. Despite the documentation saying so,
+  Agate would only bind to the first address that did not result in an error. (#63)
+* updated dependencies
+
+## [3.1.0] - 2021-06-08
+Thank you to Matthew Ingwersen and Oliver Simmons (@GoodClover) for contributing to this release.
+
+### Added
+* tests for symlink files (#60)
+  Symlinks were already working before.
+
+### Fixed
+* A path traversal security issue was closed: Percent encoded slashes were misunderstood.
+
+### Changed
+* Visiting a directory without `index.gmi` and `.directory-listing-ok` now returns a different error message to better show the cause of the error.
+  To retain the current behaviour of showing a `51 Not found, sorry.` error, add the following line to the respective directories' `.meta` file:
+```
+index.gmi: 51 Not found, sorry.
+```
+
+## [3.0.3] - 2021-05-24
+Thank you to @06kellyjac, @cpnfeeny, @lifelike, @skittlesvampir and @steko for contributing to this release.
+
+### Added
+* Dockerfile for compiling Agate from source (#52, #53, #56, #57)
+
+### Fixed
+* If the remote IP address can not be fetched, log an error instead of panicking.
+  The previous handling could be exploited as a DoS attack vector. (#59)
+* Two tests were running on the same port, causing them to fail nondeterministically. (#51)
+* Rephrased the changelog for 3.0.0 on continuing to use older certificates. (#55)
+* Updated dependencies.
+
+## [3.0.2] - 2021-04-08
+Thank you to @kvibber, @lifelike and @pasdechance for contributing to this release.
+
+### Changed
+* The new specfication changes are obeyed regarding rejecting request URLs that contain fragments or userinfo parts.
+* The default signature algorithm used for generating certificates has been changed to ECDSA since there were multiple complaints about Ed25519.
+
+## [3.0.1] - 2021-03-28
+Thank you to @MidAutumnMoon and @steko for contributing to this release.
+
+### Added
+* Installation instructions for Arch Linux from Arch User Repositories. (#47)
+
+### Fixed
+* The certificate file extensions in the README example. (#45)
+* The certificate directory is automatically created if it does not exist. (#44)
+
+## [3.0.0] - 2021-03-27
+Thank you to @ddevault for contributing to this release.
+
+### Added
+* Support for ECDSA and Ed25519 keys.
+* Agate now generates certificates and keys for each `--hostname` that is specified but no matching files exist. (#41)
+
+### Changed
+* The ability to specify a certificate and key with `--cert` and `--key` respectively has been replaced with the `--certs` option. (#40)
+  Certificates are now stored in a special directory. To migrate to this version, the keys should be stored in the `.certificates` directory (or any other directory you specify).
+  This enables us to use multiple certificates for multiple domains.
+  Note that if you want to continue to use your old certificates (recommended because of TOFU), they probably lack the `subjectAltName` directive so your old certificates should be placed at the top level of the certificates directory. Otherwise you will get an error similar to this: "The certificate file for example.com is malformed: unexpected error: The server certificate is not valid for the given name"
+* The certificate and key file format has been changed from PEM to DER. This simplifies loading certificate and key files without relying on unstable portions of other crates.
+  If you want to continue using your existing certificates and keys, please convert them to DER format. You should be able to use these commands if you have openssl installed:
+```
+openssl x509 -in cert.pem -out cert.der -outform DER
+openssl rsa -in key.rsa -out key.der -outform DER
+```
+  Since agate will automatically generate certificates from now on, the different format should not be a problem because users are not expected to handle certificates unless experienced enough to be able to handle DER formatting as well.
+
+### Fixed
+* Agate now requires the use of SNI by any connecting client.
+* All log lines are in the same format now:
+  `<local ip>:<local port> <remote ip or dash> "<request>" <response status> "<response meta>" [error:<error>]`
+  If the connection could not be established correctly (e.g. because of TLS errors), the status code `00` is used.
+* Messages from modules other than Agate itself are not logged by default.
+
+## [2.5.3] - 2021-02-27
+Thank you to @littleli and @06kellyjac for contributing to this release.
+
+### Added
+* Automated tests have been added so things like 2.5.2 should not happen again (#34).
+* Version information flag (`-V` or `--version` as conventional with e.g. cargo)
+
+### Changed
+* Forbid unsafe code. (There was none before, just make it harder to add some.)
+* When logging remote IP addresses, the port is now never logged, which also changes the address format.
+
+### Fixed
+* Updated `url` to newest version, which resolves a TODO.
+* The help exits successfully with `0` rather than `1` (#37).
+* The GitHub workflow has been fixed so Windows binaries are compressed correctly (#36).
+* Split out install steps to allow for more options in the future.
+* Add install notes for nix/NixOS to the README (#38).
+* Updated dependencies.
+
+## [2.5.2] - 2021-02-12
+
+### Fixed
+* Semicolons are no longer considered to be starting a comment in `.mime` files.
+
+## [2.5.1] - 2021-02-12
+Functionally equivalent to version 2.5.1, only releasing a new version to update README on crates.io.
+
+### Fixed
+* Fixed mistakes in the README.
+
+## [2.5.0] - 2021-02-12
+Agate now has an explicit code of conduct and contributing guidelines.
+Thank you to @ERnsTL, @gegeweb, @SuddenPineapple, and @Ylhp for contributing to this release.
+
+### Added
+* You can now supply multiple `--hostname`s to enable basic vhosts (#28, #31).
+* Disabling support for TLSv1.2 can now be done using the `--only-tls13` flag, but this is *NOT RECOMMENDED* (#12).
+* The tools now also contain a startup script for FreeBSD (#13).
+* Using central config mode (flag `-C`), all configuration can be done in one `.meta` file (see README.md for details).
+* The `.meta` configuration file now allows for globs to be used.
+
+### Changed
+* The `.meta` file parser now uses the `configparser` crate. The syntax does not change.
+* The changelog is now also kept in this file in addition to the GitHub releases.
+* Certificate chain and key file are now only loaded once at startup, certificate changes need a restart to take effect.
+* Hidden files are now served if there is an explicit setting in a `.meta` file for them, regardless of the `--serve-secret` flag.
+
+### Fixed
+* The Syntax for the IPv6 address in the README has been corrected.
+* Give a better error message when no keys are found in the key file instead of panicking with a range check (#33).
+
+## [2.4.1] - 2020-02-08
+### Fixed
+* Re-enabled multiple occurrences of `--addr`. This was accidentally disabled by a merge.
+
+## [2.4.0]+podman.build - 2020-02-06
+This is the same as [2.4.0], only the build process has been changed so it should accommodate a wider range of architectures and devices.
+
+## [2.4.0] - 2020-02-06
+Since there is a new maintainer (@Johann150), the range in pre-compiled binaries has changed a bit.
+
+### Added
+* Added some installation tools for Debian.
+* Added a sidecar file for specifying languages, MIME media types or complete headers on a per file basis (#16).
+
+### Changed
+* Improved logging output. Agate now also respects the `RUST_LOG` environment variable, so you can configure the log level (#22, #23).
+
+## [2.3.0] - 2020-01-17
+Thanks to @Johann150.
+
+### Changed
+* Combine address and port back into a single command-line argument (#21).
+
+## [2.2.0] - 2020-01-16
+Thank you to @gegeweb, @Johann150 and @purexo for contributing to this release.
+
+### Changed
+* Split address and port into separate command-line parameters.
+
+### Fixed
+* Listen on both IPv6 and IPv4 interfaces by default (#14, #15).
+* Do not serve files whose path contains a segment starting with a dot (#17, #20).
+* Fix redirects of URLs with query strings (#19).
+
+## [2.1.3] - 2020-01-02
+### Changed
+* Switch to the Tokio async run time.
+
+### Fixed
+* Send TLS close-notify message when closing a connection.
+* Require absolute URLs in requests.
+
+## [2.1.2] - 2020-01-01
+### Fixed
+* More complete percent-encoding of special characters in filenames.
+* Minor improvements to error logging.
+* Internal code cleanup.
+
+## [2.1.1] - 2020-12-31
+### Changed
+* List directory content in alphabetical order.
+
+### Fixed
+* Handle percent-escaped paths in URLs.
+* Percent-escape white space characters in directory listings.
+
+## [2.1.0] - 2020-12-29
+* Enabled GitHub Discussions. If you are using Agate, please feel free to leave a comment to let us know about it!
+Thank you to @Johann150 and @KilianKemps for contributing to this release.
+
+### Added
+* Optional directory listings (#8, #9).
+
+### Fixed
+* Updated dependencies.
+
+## [2.0.0] - 2020-12-23
+Thank you to @bortzmeyer, @KillianKemps, and @Ylhp for contributing to this release.
+
+### Added
+* New `--language` option to add a language tag to the MIME type for text/gemini responses (#6).
+
+### Changed
+* New format for command-line options. See the documentation or run `agate --help` for details.
+* Logging is enabled by default. Use the `--silent` flag to disable it.
+* Pre-compiled binaries are built with the [`cross`](https://github.com/rust-embedded/cross) tool, for better compatibility with older Linux systems.
+
+## [1.3.2] - 2020-12-09
+This release is functionally identical to Agate 1.3.1, and users of that version do not need to update.
+
+### Fixed
+* Update to async-tls 0.11 because the previous version was yanked.
+
+## [1.3.1] - 2020-12-08
+Thanks @dcreager for contributing this fix.
+
+### Fixed
+* Updated dependencies to fix `cargo install` (#7).
+
+## [1.3.0] - 2020-11-20
+Thank you @Johann150, @jonhiggs and @tronje for contributing to this release!
+
+### Fixed
+* verify hostname and port in request URL (#4).
+* improved logging (#2, #3).
+* Don't redirect to "/" when the path is empty (#5).
+* Update dependencies.
+
+## [1.2.2] - 2020-09-21
+Thank you to @m040601 for contributing to this release.
+
+### Changed
+* Switch from `tree_magic` to `mime_guess` for simpler MIME type guessing.
+* Built both x86_64 and ARM binaries. These binaries are built for Linux operating systems with glibc 2.28 or later, such as Debian 10 ("buster") or newer, Ubuntu 18.10 or newer, and Raspberry Pi OS 2019-06-20 or newer (#1).
+
+### Fixed
+* Update dependencies.
+* Minor internal code cleanup.
+
+## [1.2.1] - 2020-06-20
+### Fixed
+* Reduce memory usage when serving large files.
+* Update dependencies.
+
+## [1.2.0] - 2020-06-10
+### Changed
+* text/gemini filename extension from `.gemini` to `.gmi`.
+
+### Fixed
+* Handling for requests that exceed 1KB.
+* Reduce memory allocations and speed up request parsing.
+* Update dependencies.
+
+## [1.1.0] - 2020-05-22
+### Added
+* Auto-detect MIME types.
+
+## [1.0.1] - 2020-05-21
+### Added
+* Send more accurate error codes for unsupported requests.
+* Do more validation of request URLs.
+
+## [1.0.0] - 2020-05-21

src/certificates.rs

@@ -0,0 +1,229 @@
+use {
+    std::{
+        ffi::OsStr,
+        fmt::{Display, Formatter},
+        path::Path,
+        sync::Arc,
+    },
+    tokio_rustls::rustls::{
+        self,
+        crypto::ring::sign::any_supported_type,
+        pki_types::{self, CertificateDer, PrivateKeyDer},
+        server::{ClientHello, ResolvesServerCert},
+        sign::{CertifiedKey, SigningKey},
+    },
+};
+
+/// A struct that holds all loaded certificates and the respective domain
+/// names.
+#[derive(Debug)]
+pub(crate) struct CertStore {
+    /// Stores the certificates and the domains they apply to, sorted by domain
+    /// names, longest matches first
+    certs: Vec<(String, Arc<CertifiedKey>)>,
+}
+
+pub static CERT_FILE_NAME: &str = "cert.der";
+pub static KEY_FILE_NAME: &str = "key.der";
+
+#[derive(Debug)]
+pub enum CertLoadError {
+    /// could not access the certificate root directory
+    NoReadCertDir,
+    /// no certificates or keys were found
+    Empty,
+    /// the key file for the specified domain is bad (e.g. does not contain a
+    /// key or is invalid)
+    BadKey(String, rustls::Error),
+    /// the key file for the specified domain is missing (but a certificate
+    /// file was present)
+    MissingKey(String),
+    /// the certificate file for the specified domain is missing (but a key
+    /// file was present)
+    MissingCert(String),
+    /// neither a key file nor a certificate file were present for the given
+    /// domain (but a folder was present)
+    EmptyDomain(String),
+}
+
+impl Display for CertLoadError {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::NoReadCertDir => write!(f, "Could not read from certificate directory."),
+            Self::Empty => write!(
+                f,
+                "No keys or certificates were found in the given directory.\nSpecify the --hostname option to generate these automatically."
+            ),
+            Self::BadKey(domain, err) => {
+                write!(f, "The key file for {domain} is malformed: {err:?}")
+            }
+            Self::MissingKey(domain) => write!(f, "The key file for {domain} is missing."),
+            Self::MissingCert(domain) => {
+                write!(f, "The certificate file for {domain} is missing.")
+            }
+            Self::EmptyDomain(domain) => write!(
+                f,
+                "A folder for {domain} exists, but there is no certificate or key file."
+            ),
+        }
+    }
+}
+
+impl std::error::Error for CertLoadError {}
+
+fn load_domain(certs_dir: &Path, domain: String) -> Result<CertifiedKey, CertLoadError> {
+    let mut path = certs_dir.to_path_buf();
+    path.push(&domain);
+    // load certificate from file
+    path.push(CERT_FILE_NAME);
+    if !path.is_file() {
+        return Err(if !path.with_file_name(KEY_FILE_NAME).is_file() {
+            CertLoadError::EmptyDomain(domain)
+        } else {
+            CertLoadError::MissingCert(domain)
+        });
+    }
+    let cert = CertificateDer::from(
+        std::fs::read(&path).map_err(|_| CertLoadError::MissingCert(domain.clone()))?,
+    );
+
+    // load key from file
+    path.set_file_name(KEY_FILE_NAME);
+    let Ok(der) = std::fs::read(&path) else {
+        return Err(CertLoadError::MissingKey(domain));
+    };
+
+    // transform key to correct format
+    let key = der_to_private_key(&der).map_err(|e| CertLoadError::BadKey(domain.clone(), e))?;
+
+    Ok(CertifiedKey::new(vec![cert], key))
+}
+
+/// We don't know the key type of the private key DER file, so try each
+/// possible type until we find one that works.
+///
+/// We should probably stop doing this and use a PEM file instead:
+/// <https://github.com/rustls/rustls/issues/1661>
+fn der_to_private_key(der: &[u8]) -> Result<Arc<dyn SigningKey>, rustls::Error> {
+    let keys = [
+        PrivateKeyDer::Pkcs1(pki_types::PrivatePkcs1KeyDer::from(der)),
+        PrivateKeyDer::Sec1(pki_types::PrivateSec1KeyDer::from(der)),
+        PrivateKeyDer::Pkcs8(pki_types::PrivatePkcs8KeyDer::from(der)),
+    ];
+
+    let mut err = None;
+    for key in keys {
+        match any_supported_type(&key) {
+            Ok(key) => return Ok(key),
+            Err(e) => err = Some(e),
+        }
+    }
+    Err(err.unwrap())
+}
+
+impl CertStore {
+    /// Load certificates from a certificate directory.
+    /// Certificates should be stored in a folder for each hostname, for example
+    /// the certificate and key for `example.com` should be in the files
+    /// `certs_dir/example.com/{cert.der,key.der}` respectively.
+    ///
+    /// If there are `cert.der` and `key.der` directly in `certs_dir`, these
+    /// will be loaded as default certificates.
+    pub fn load_from(certs_dir: &Path) -> Result<Self, CertLoadError> {
+        // load all certificates from directories
+        let mut certs = vec![];
+
+        // Try to load fallback certificate and key directly from the top level
+        // certificate directory.
+        match load_domain(certs_dir, String::new()) {
+            Err(CertLoadError::EmptyDomain(_)) => { /* there are no fallback keys */ }
+            Err(CertLoadError::Empty) | Err(CertLoadError::NoReadCertDir) => unreachable!(),
+            Err(CertLoadError::BadKey(_, e)) => {
+                return Err(CertLoadError::BadKey("fallback".to_string(), e));
+            }
+            Err(CertLoadError::MissingKey(_)) => {
+                return Err(CertLoadError::MissingKey("fallback".to_string()));
+            }
+            Err(CertLoadError::MissingCert(_)) => {
+                return Err(CertLoadError::MissingCert("fallback".to_string()));
+            }
+            // For the fallback keys there is no domain name to verify them
+            // against, so we can skip that step and only have to do it for the
+            // other keys below.
+            Ok(key) => certs.push((String::new(), Arc::new(key))),
+        }
+
+        for file in certs_dir
+            .read_dir()
+            .or(Err(CertLoadError::NoReadCertDir))?
+            .filter_map(Result::ok)
+            .filter(|x| x.path().is_dir())
+        {
+            let path = file.path();
+
+            // the filename should be the domain name
+            let filename = path
+                .file_name()
+                .and_then(OsStr::to_str)
+                .unwrap()
+                .to_string();
+
+            let key = load_domain(certs_dir, filename.clone())?;
+
+            certs.push((filename, Arc::new(key)));
+        }
+
+        if certs.is_empty() {
+            return Err(CertLoadError::Empty);
+        }
+
+        certs.sort_unstable_by(|(a, _), (b, _)| {
+            // Try to match as many domain segments as possible. If one is a
+            // substring of the other, the `zip` will only compare the smaller
+            // length of either a or b and the for loop will not decide.
+            for (a_part, b_part) in a.split('.').rev().zip(b.split('.').rev()) {
+                if a_part != b_part {
+                    // Here we have to make sure that the empty string will
+                    // always be sorted to the end, so we reverse the usual
+                    // ordering of str.
+                    return a_part.cmp(b_part).reverse();
+                }
+            }
+            // Sort longer domains first.
+            a.len().cmp(&b.len()).reverse()
+        });
+
+        log::debug!(
+            "certs loaded for {:?}",
+            certs.iter().map(|t| &t.0).collect::<Vec<_>>()
+        );
+
+        Ok(Self { certs })
+    }
+
+    /// Checks if a certificate fitting a specific domain has been loaded.
+    /// The same rules about using a certificate at the level above apply.
+    pub fn has_domain(&self, domain: &str) -> bool {
+        self.certs.iter().any(|(s, _)| domain.ends_with(s))
+    }
+}
+
+impl ResolvesServerCert for CertStore {
+    fn resolve(&self, client_hello: ClientHello<'_>) -> Option<Arc<CertifiedKey>> {
+        if let Some(name) = client_hello.server_name() {
+            let name: &str = name;
+            // The certificate list is sorted so the longest match will always
+            // appear first. We have to find the first that is either this
+            // domain or a parent domain of the current one.
+            self.certs
+                .iter()
+                .find(|(s, _)| name.ends_with(s))
+                // only the key is interesting
+                .map(|(_, k)| k)
+                .cloned()
+        } else {
+            // This kind of resolver requires SNI.
+            None
+        }
+    }
+}

src/codes.rs

@@ -0,0 +1,12 @@
+/// The server was unable to parse the client's request, presumably due to a malformed request. (cf HTTP 400)
+pub const BAD_REQUEST: u8 = 59;
+/// The request was for a resource at a domain not served by the server and the server does not accept proxy requests.
+pub const PROXY_REQUEST_REFUSED: u8 = 53;
+/// The requested resource could not be found but may be available in the future. (cf HTTP 404)
+pub const NOT_FOUND: u8 = 51;
+/// The resource requested is no longer available and will not be available again. Search engines and similar tools should remove this resource from their indices. Content aggregators should stop requesting the resource and convey to their human users that the subscribed resource is gone. (cf HTTP 410)
+pub const GONE: u8 = 52;
+/// The requested resource should be consistently requested from the new URL provided in the future. Tools loke search engine indexers or content aggregators should update their configurations to avoid requesting the old URL, and end-user clients may automatically update bookmarks, etc. Note that clients that only pay attention to the initial digit of status codes will treat this as a temporary redirect. They will still end up at the right place, they just won't be able to make use of the knowledge that this redirect is permanent, so they'll pay a small performance penality by having to follow the redirect each time.
+pub const REDIRECT_PERMANENT: u8 = 31;
+/// The request was handled successfully and a response body will follow the response header. The <META> line is a MIME media type which applies to the response body.
+pub const SUCCESS: u8 = 20;

src/main.rs

@@ -1,189 +1,781 @@
-use async_std::{
-    io::prelude::*,
-    net::{TcpListener, TcpStream},
-    stream::StreamExt,
-    task,
-};
-use async_tls::TlsAcceptor;
-use once_cell::sync::Lazy;
-use rustls::{
-    internal::pemfile::{certs, pkcs8_private_keys},
-    NoClientAuth, ServerConfig,
-};
-use std::{error::Error, ffi::OsStr, fs::File, io::BufReader, marker::Unpin, sync::Arc};
-use url::{Host, Url};
+#![forbid(unsafe_code)]
 
-fn main() -> Result {
-    env_logger::Builder::from_env("AGATE_LOG").init();
-    task::block_on(async {
-        let listener = TcpListener::bind(&ARGS.sock_addr).await?;
-        let mut incoming = listener.incoming();
-        log::info!("Listening on {}...", ARGS.sock_addr);
-        while let Some(Ok(stream)) = incoming.next().await {
-            task::spawn(async {
-                if let Err(e) = handle_request(stream).await {
-                    log::error!("{:?}", e);
+mod certificates;
+mod codes;
+mod metadata;
+use codes::*;
+use metadata::{FileOptions, PresetMeta};
+
+use {
+    percent_encoding::{AsciiSet, CONTROLS, percent_decode_str, percent_encode},
+    rcgen::{CertificateParams, DnType, KeyPair},
+    std::{
+        borrow::Cow,
+        error::Error,
+        ffi::OsStr,
+        fmt::Write,
+        fs::{self, File},
+        io::Write as _,
+        net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr},
+        path::{self, Component, Path, PathBuf},
+        sync::{Arc, LazyLock},
+    },
+    tokio::{
+        io::{AsyncReadExt, AsyncWriteExt},
+        net::{TcpListener, TcpStream},
+        runtime::Runtime,
+        sync::Mutex,
+    },
+    tokio_rustls::{
+        TlsAcceptor,
+        rustls::{server::ServerConfig, version::TLS13},
+        server::TlsStream,
+    },
+    url::{Host, Url},
+};
+
+#[cfg(unix)]
+use {
+    std::os::unix::fs::{FileTypeExt, PermissionsExt},
+    tokio::net::{UnixListener, UnixStream},
+};
+
+static DEFAULT_PORT: u16 = 1965;
+
+fn main() {
+    env_logger::Builder::from_env(
+        // by default only turn on logging for agate
+        env_logger::Env::default().default_filter_or("agate=info"),
+    )
+    .init();
+    Runtime::new()
+        .expect("could not start tokio runtime")
+        .block_on(async {
+            let default = PresetMeta::Parameters(
+                ARGS.language
+                    .as_ref()
+                    .map_or(String::new(), |lang| format!(";lang={lang}")),
+            );
+            let mimetypes = Arc::new(Mutex::new(FileOptions::new(default)));
+
+            // some systems automatically listen in dual stack if the IPv6 unspecified
+            // address is used, so don't fail if the second unspecified address gets
+            // an error when trying to start
+            let mut listening_unspecified = false;
+
+            let mut handles = vec![];
+            for addr in &ARGS.addrs {
+                let arc = mimetypes.clone();
+
+                let listener = match TcpListener::bind(addr).await {
+                    Err(e) => {
+                        if !(addr.ip().is_unspecified() && listening_unspecified) {
+                            panic!("Failed to listen on {addr}: {e}")
+                        } else {
+                            // already listening on the other unspecified address
+                            log::warn!("Could not start listener on {addr}, but already listening on another unspecified address. Probably your system automatically listens in dual stack?");
+                            continue;
+                        }
+                    }
+                    Ok(listener) => listener,
+                };
+                listening_unspecified |= addr.ip().is_unspecified();
+
+                handles.push(tokio::spawn(async move {
+                    log::info!("Started listener on {addr}");
+
+                    loop {
+                        let (stream, _) = listener.accept().await.unwrap_or_else(|e| {
+                            panic!("could not accept new connection on {addr}: {e}")
+                        });
+                        let arc = arc.clone();
+                        tokio::spawn(async {
+                            match RequestHandle::new(stream, arc).await {
+                                Ok(handle) => match handle.handle().await {
+                                    Ok(info) => log::info!("{info}"),
+                                    Err(err) => log::warn!("{err}"),
+                                },
+                                Err(log_line) => {
+                                    log::warn!("{log_line}");
+                                }
+                            }
+                        });
+                    }
+                }))
+            };
+
+            #[cfg(unix)]
+            for socketpath in &ARGS.sockets {
+                let arc = mimetypes.clone();
+
+                if socketpath.exists() && socketpath.metadata()
+                        .expect("Failed to get existing socket metadata")
+                        .file_type()
+                        .is_socket() {
+                    log::warn!("Socket already exists, attempting to remove {}", socketpath.display());
+                    let _ = std::fs::remove_file(socketpath);
                 }
-            });
-        }
-        Ok(())
-    })
+
+                let listener = match UnixListener::bind(socketpath) {
+                    Err(e) => {
+                        panic!("Failed to listen on {}: {}", socketpath.display(), e)
+                    }
+                    Ok(listener) => listener,
+                };
+
+                handles.push(tokio::spawn(async move {
+                    log::info!("Started listener on {}", socketpath.display());
+
+                    loop {
+                        let (stream, _) = listener.accept().await.unwrap_or_else(|e| {
+                            panic!("could not accept new connection on {}: {}", socketpath.display(), e)
+                        });
+                        let arc = arc.clone();
+                        tokio::spawn(async {
+                            match RequestHandle::new_unix(stream, arc).await {
+                                Ok(handle) => match handle.handle().await {
+                                    Ok(info) => log::info!("{info}"),
+                                    Err(err) => log::warn!("{err}"),
+                                },
+                                Err(log_line) => {
+                                    log::warn!("{log_line}");
+                                }
+                            }
+                        });
+                    }
+                }))
+            };
+
+            futures_util::future::join_all(handles).await;
+        });
 }
 
-type Result<T = ()> = std::result::Result<T, Box<dyn Error + Send + Sync>>;
+type Result<T = (), E = Box<dyn Error + Send + Sync>> = std::result::Result<T, E>;
 
-static ARGS: Lazy<Args> = Lazy::new(|| {
-    args().unwrap_or_else(|| {
-        eprintln!("usage: agate <addr:port> <dir> <cert> <key> [<domain to check>]");
+static ARGS: LazyLock<Args> = LazyLock::new(|| {
+    args().unwrap_or_else(|s| {
+        eprintln!("{s}");
         std::process::exit(1);
     })
 });
 
 struct Args {
-    sock_addr: String,
-    content_dir: String,
-    cert_file: String,
-    key_file: String,
-    domain: Option<Host>,
+    addrs: Vec<SocketAddr>,
+    #[cfg(unix)]
+    sockets: Vec<PathBuf>,
+    content_dir: PathBuf,
+    certs: Arc<certificates::CertStore>,
+    hostnames: Vec<Host>,
+    language: Option<String>,
+    serve_secret: bool,
+    log_ips: bool,
+    only_tls13: bool,
+    central_config: bool,
+    skip_port_check: bool,
 }
 
-fn args() -> Option<Args> {
-    let mut args = std::env::args().skip(1);
-    Some(Args {
-        sock_addr: args.next()?,
-        content_dir: args.next()?,
-        cert_file: args.next()?,
-        key_file: args.next()?,
-        domain: args.next().and_then(|s| Host::parse(&s).ok()),
+fn args() -> Result<Args> {
+    let args: Vec<String> = std::env::args().collect();
+    let mut opts = getopts::Options::new();
+    opts.optopt(
+        "",
+        "content",
+        "Root of the content directory (default ./content/)",
+        "DIR",
+    );
+    opts.optopt(
+        "",
+        "certs",
+        "Root of the certificate directory (default ./.certificates/)",
+        "DIR",
+    );
+    opts.optmulti(
+        "",
+        "addr",
+        &format!("Address to listen on (default 0.0.0.0:{DEFAULT_PORT} and [::]:{DEFAULT_PORT}; multiple occurences means listening on multiple interfaces)"),
+        "IP:PORT",
+    );
+    #[cfg(unix)]
+    opts.optmulti(
+        "",
+        "socket",
+        "Unix socket to listen on (multiple occurences means listening on multiple sockets)",
+        "PATH",
+    );
+    opts.optmulti(
+        "",
+        "hostname",
+        "Domain name of this Gemini server, enables checking hostname and port in requests. (multiple occurences means basic vhosts)",
+        "NAME",
+    );
+    opts.optopt(
+        "",
+        "lang",
+        "RFC 4646 Language code for text/gemini documents",
+        "LANG",
+    );
+    opts.optflag("h", "help", "Print this help text and exit.");
+    opts.optflag("V", "version", "Print version information and exit.");
+    opts.optflag(
+        "3",
+        "only-tls13",
+        "Only use TLSv1.3 (default also allows TLSv1.2)",
+    );
+    opts.optflag(
+        "",
+        "serve-secret",
+        "Enable serving secret files (files/directories starting with a dot)",
+    );
+    opts.optflag("", "log-ip", "Output the remote IP address when logging.");
+    opts.optflag(
+        "C",
+        "central-conf",
+        "Use a central .meta file in the content root directory. Decentral config files will be ignored.",
+    );
+    opts.optflag(
+        "e",
+        "ed25519",
+        "Generate keys using the Ed25519 signature algorithm instead of the default ECDSA.",
+    );
+    opts.optflag(
+        "",
+        "skip-port-check",
+        "Skip URL port check even when a hostname is specified.",
+    );
+
+    let matches = opts.parse(&args[1..]).map_err(|f| f.to_string())?;
+
+    if matches.opt_present("h") {
+        eprintln!("{}", opts.usage(&format!("Usage: {} [options]", &args[0])));
+        std::process::exit(0);
+    }
+
+    if matches.opt_present("V") {
+        eprintln!("agate {}", env!("CARGO_PKG_VERSION"));
+        std::process::exit(0);
+    }
+
+    // try to open the certificate directory
+    let certs_path = matches.opt_get_default("certs", ".certificates".to_string())?;
+    let (certs, certs_path) = match check_path(certs_path.clone()) {
+        // the directory exists, try to load certificates
+        Ok(certs_path) => match certificates::CertStore::load_from(&certs_path) {
+            // all is good
+            Ok(certs) => (Some(certs), certs_path),
+            // the certificate directory did not contain certificates, but we can generate some
+            // because the hostname option was given
+            Err(certificates::CertLoadError::Empty) if matches.opt_present("hostname") => {
+                (None, certs_path)
+            }
+            // failed loading certificates or missing hostname to generate them
+            Err(e) => return Err(e.into()),
+        },
+        // the directory does not exist
+        Err(_) => {
+            // since certificate management should be automated, we are going to create the directory too
+            log::info!("The certificate directory {certs_path:?} does not exist, creating it.");
+            std::fs::create_dir(&certs_path).expect("could not create certificate directory");
+            // we just created the directory, skip loading from it
+            (None, PathBuf::from(certs_path))
+        }
+    };
+
+    // If we have not loaded any certificates yet, we have to try to reload them later.
+    // This ensures we get the right error message.
+    let mut reload_certs = certs.is_none();
+
+    let mut hostnames = vec![];
+    for s in matches.opt_strs("hostname") {
+        // normalize hostname, add punycoding if necessary
+        let hostname = Host::parse(&s)?;
+
+        // check if we have a certificate for that domain
+        if let Host::Domain(ref domain) = hostname
+            && !matches!(certs, Some(ref certs) if certs.has_domain(domain))
+        {
+            log::info!("No certificate or key found for {s:?}, generating them.");
+
+            let mut cert_params = CertificateParams::new(vec![domain.clone()])?;
+            cert_params
+                .distinguished_name
+                .push(DnType::CommonName, domain);
+
+            // <CertificateParams as Default>::default() already implements a
+            // date in the far future from the time of writing: 4096-01-01
+
+            let key_pair = if matches.opt_present("e") {
+                KeyPair::generate_for(&rcgen::PKCS_ED25519)
+            } else {
+                KeyPair::generate()
+            }?;
+
+            // generate the certificate with the configuration
+            let cert = cert_params.self_signed(&key_pair)?;
+
+            // make sure the certificate directory exists
+            let cert_dir = certs_path.join(domain);
+            fs::create_dir(&cert_dir)?;
+
+            // write certificate data to disk
+            let mut cert_file = File::create(cert_dir.join(certificates::CERT_FILE_NAME))?;
+            cert_file.write_all(cert.der())?;
+
+            // write key data to disk
+            let key_file_path = cert_dir.join(certificates::KEY_FILE_NAME);
+            let mut key_file = File::create(&key_file_path)?;
+            #[cfg(unix)]
+            {
+                // set permissions so only owner can read
+                match key_file.set_permissions(std::fs::Permissions::from_mode(0o400)) {
+                    Ok(_) => (),
+                    Err(_) => log::warn!(
+                        "could not set permissions for new key file {}",
+                        key_file_path.display()
+                    ),
+                }
+            }
+            key_file.write_all(key_pair.serialized_der())?;
+
+            reload_certs = true;
+        }
+
+        hostnames.push(hostname);
+    }
+
+    // if new certificates were generated, reload the certificate store
+    let certs = if reload_certs {
+        certificates::CertStore::load_from(&certs_path)?
+    } else {
+        // there must already have been certificates loaded
+        certs.unwrap()
+    };
+
+    // parse listening addresses
+    let mut addrs = vec![];
+    for i in matches.opt_strs("addr") {
+        addrs.push(i.parse()?);
+    }
+
+    #[cfg_attr(not(unix), allow(unused_mut))]
+    let mut empty = addrs.is_empty();
+
+    #[cfg(unix)]
+    let mut sockets = vec![];
+    #[cfg(unix)]
+    {
+        for i in matches.opt_strs("socket") {
+            sockets.push(i.parse()?);
+        }
+
+        empty &= sockets.is_empty();
+    }
+
+    if empty {
+        addrs = vec![
+            SocketAddr::new(IpAddr::V6(Ipv6Addr::UNSPECIFIED), DEFAULT_PORT),
+            SocketAddr::new(IpAddr::V4(Ipv4Addr::UNSPECIFIED), DEFAULT_PORT),
+        ];
+    }
+
+    Ok(Args {
+        addrs,
+        #[cfg(unix)]
+        sockets,
+        content_dir: check_path(matches.opt_get_default("content", "content".into())?)?,
+        certs: Arc::new(certs),
+        hostnames,
+        language: matches.opt_str("lang"),
+        serve_secret: matches.opt_present("serve-secret"),
+        log_ips: matches.opt_present("log-ip"),
+        only_tls13: matches.opt_present("only-tls13"),
+        central_config: matches.opt_present("central-conf"),
+        skip_port_check: matches.opt_present("skip-port-check"),
     })
 }
 
-/// Handle a single client session (request + response).
-async fn handle_request(stream: TcpStream) -> Result {
-    // Perform handshake.
-    static TLS: Lazy<TlsAcceptor> = Lazy::new(|| acceptor().unwrap());
-    let stream = &mut TLS.accept(stream).await?;
-
-    let url = match parse_request(stream).await {
-        Ok(url) => url,
-        Err((status, msg)) => {
-            respond(stream, &status.to_string(), &[&msg]).await?;
-            Err(msg)?
-        }
-    };
-    if let Err(e) = send_response(url, stream).await {
-        respond(stream, "51", &["Not found, sorry."]).await?;
-        Err(e)?
+fn check_path(s: String) -> Result<PathBuf, String> {
+    let p = PathBuf::from(s);
+    if p.as_path().exists() {
+        Ok(p)
+    } else {
+        Err(format!("No such file: {p:?}"))
     }
-    Ok(())
 }
 
 /// TLS configuration.
-fn acceptor() -> Result<TlsAcceptor> {
-    let cert_file = File::open(&ARGS.cert_file)?;
-    let certs = certs(&mut BufReader::new(cert_file)).or(Err("bad cert"))?;
+static TLS: LazyLock<TlsAcceptor> = LazyLock::new(acceptor);
 
-    let key_file = File::open(&ARGS.key_file)?;
-    let mut keys = pkcs8_private_keys(&mut BufReader::new(key_file)).or(Err("bad key"))?;
-
-    let mut config = ServerConfig::new(NoClientAuth::new());
-    config.set_single_cert(certs, keys.remove(0))?;
-    Ok(TlsAcceptor::from(Arc::new(config)))
-}
-
-/// Return the URL requested by the client.
-async fn parse_request<R: Read + Unpin>(
-    stream: &mut R,
-) -> std::result::Result<Url, (u8, &'static str)> {
-    // Because requests are limited to 1024 bytes (plus 2 bytes for CRLF), we
-    // can use a fixed-sized buffer on the stack, avoiding allocations and
-    // copying, and stopping bad clients from making us use too much memory.
-    let mut request = [0; 1026];
-    let mut buf = &mut request[..];
-    let mut len = 0;
-
-    // Read until CRLF, end-of-stream, or there's no buffer space left.
-    loop {
-        let bytes_read = stream
-            .read(buf)
-            .await
-            .map_err(|_| (59, "Request ended unexpectedly"))?;
-        len += bytes_read;
-        if request[..len].ends_with(b"\r\n") {
-            break;
-        } else if bytes_read == 0 {
-            return Err((59, "Request ended unexpectedly"));
-        }
-        buf = &mut request[len..];
-    }
-    let request = std::str::from_utf8(&request[..len - 2]).map_err(|_| (59, "Invalid URL"))?;
-    log::info!("Got request for {:?}", request);
-
-    // Handle scheme-relative URLs.
-    let url = if request.starts_with("//") {
-        Url::parse(&format!("gemini:{}", request)).map_err(|_| (59, "Invalid URL"))?
+fn acceptor() -> TlsAcceptor {
+    let config = if ARGS.only_tls13 {
+        ServerConfig::builder_with_protocol_versions(&[&TLS13])
     } else {
-        Url::parse(request).map_err(|_| (59, "Invalid URL"))?
-    };
-
-    // Validate the URL, host and port.
-    if url.scheme() != "gemini" {
-        return Err((53, "unsupported URL scheme"));
+        ServerConfig::builder()
     }
-    // TODO: Can be simplified by https://github.com/servo/rust-url/pull/651
-    if let (Some(Host::Domain(domain)), Some(Host::Domain(host))) = (&ARGS.domain, url.host()) {
-        if domain != host {
-            return Err((53, "proxy request refused"));
-        }
-    }
-    if let Some(port) = url.port() {
-        if !ARGS.sock_addr.ends_with(&format!(":{}", port)) {
-            return Err((53, "proxy request refused"));
-        }
-    }
-    Ok(url)
+    .with_no_client_auth()
+    .with_cert_resolver(ARGS.certs.clone());
+    TlsAcceptor::from(Arc::new(config))
 }
 
-/// Send the client the file located at the requested URL.
-async fn send_response<W: Write + Unpin>(url: Url, stream: &mut W) -> Result {
-    let mut path = std::path::PathBuf::from(&ARGS.content_dir);
-    if let Some(segments) = url.path_segments() {
-        path.extend(segments);
-    }
-    if async_std::fs::metadata(&path).await?.is_dir() {
-        if url.path().ends_with('/') || url.path().is_empty() {
-            // if the path ends with a slash or the path is empty, the links will work the same
-            // without a redirect
-            path.push("index.gmi");
+struct RequestHandle<T> {
+    stream: TlsStream<T>,
+    local_port_check: Option<u16>,
+    log_line: String,
+    metadata: Arc<Mutex<FileOptions>>,
+}
+
+impl RequestHandle<TcpStream> {
+    /// Creates a new request handle for the given stream. If establishing the TLS
+    /// session fails, returns a corresponding log line.
+    async fn new(stream: TcpStream, metadata: Arc<Mutex<FileOptions>>) -> Result<Self, String> {
+        let local_addr = stream.local_addr().unwrap().to_string();
+
+        // try to get the remote IP address if desired
+        let peer_addr = if ARGS.log_ips {
+            stream
+                .peer_addr()
+                .map_err(|_| {
+                    format!(
+                        // use nonexistent status code 01 if peer IP is unknown
+                        "{local_addr} - \"\" 01 \"IP error\" error:could not get peer address",
+                    )
+                })?
+                .ip()
+                .to_string()
         } else {
-            // if client is not redirected, links may not work as expected without trailing slash
-            return respond(stream, "31", &[url.as_str(), "/"]).await;
+            // Do not log IP address, but something else so columns still line up.
+            "-".into()
+        };
+
+        let log_line = format!("{local_addr} {peer_addr}",);
+
+        let local_port_check = if ARGS.skip_port_check {
+            None
+        } else {
+            Some(stream.local_addr().unwrap().port())
+        };
+
+        match TLS.accept(stream).await {
+            Ok(stream) => Ok(Self {
+                stream,
+                local_port_check,
+                log_line,
+                metadata,
+            }),
+            // use nonexistent status code 00 if connection was not established
+            Err(e) => Err(format!("{log_line} \"\" 00 \"TLS error\" error:{e}")),
+        }
+    }
+}
+
+#[cfg(unix)]
+impl RequestHandle<UnixStream> {
+    async fn new_unix(
+        stream: UnixStream,
+        metadata: Arc<Mutex<FileOptions>>,
+    ) -> Result<Self, String> {
+        let log_line = format!(
+            "unix:{} -",
+            stream
+                .local_addr()
+                .ok()
+                .and_then(|addr| Some(addr.as_pathname()?.to_string_lossy().into_owned()))
+                .unwrap_or_default()
+        );
+
+        match TLS.accept(stream).await {
+            Ok(stream) => Ok(Self {
+                stream,
+                // TODO add port check for unix sockets, requires extra arg for port
+                local_port_check: None,
+                log_line,
+                metadata,
+            }),
+            // use nonexistent status code 00 if connection was not established
+            Err(e) => Err(format!("{log_line} \"\" 00 \"TLS error\" error:{e}")),
+        }
+    }
+}
+
+impl<T> RequestHandle<T>
+where
+    T: AsyncWriteExt + AsyncReadExt + Unpin,
+{
+    /// Do the necessary actions to handle this request. Returns a corresponding
+    /// log line as Err or Ok, depending on if the request finished with or
+    /// without errors.
+    async fn handle(mut self) -> Result<String, String> {
+        // not already in error condition
+        let result = match self.parse_request().await {
+            Ok(url) => self.send_response(url).await,
+            Err((status, msg)) => self.send_header(status, msg).await,
+        };
+
+        let close_result = self.stream.shutdown().await;
+
+        match (result, close_result) {
+            (Err(e), _) => Err(format!("{} error:{}", self.log_line, e)),
+            (Ok(_), Err(e)) => Err(format!("{} error:{}", self.log_line, e)),
+            (Ok(_), Ok(_)) => Ok(self.log_line),
         }
     }
 
-    // Make sure the file opens successfully before sending the success header.
-    let mut file = async_std::fs::File::open(&path).await?;
+    /// Return the URL requested by the client.
+    async fn parse_request(&mut self) -> std::result::Result<Url, (u8, &'static str)> {
+        // Because requests are limited to 1024 bytes (plus 2 bytes for CRLF), we
+        // can use a fixed-sized buffer on the stack, avoiding allocations and
+        // copying, and stopping bad clients from making us use too much memory.
+        let mut request = [0; 1026];
+        let mut buf = &mut request[..];
+        let mut len = 0;
 
-    // Send header.
-    if path.extension() == Some(OsStr::new("gmi")) {
-        respond(stream, "20", &["text/gemini"]).await?;
-    } else {
-        let mime = mime_guess::from_path(&path).first_or_octet_stream();
-        respond(stream, "20", &[mime.essence_str()]).await?;
+        // Read until CRLF, end-of-stream, or there's no buffer space left.
+        //
+        // Since neither CR nor LF can be part of a URI according to
+        // ISOC-RFC 3986, we could use BufRead::read_line here, but that does
+        // not allow us to cap the number of read bytes at 1024+2.
+        let result = loop {
+            let Ok(bytes_read) = self.stream.read(buf).await else {
+                break Err((BAD_REQUEST, "Request ended unexpectedly"));
+            };
+            len += bytes_read;
+            if request[..len].ends_with(b"\r\n") {
+                break Ok(());
+            } else if bytes_read == 0 {
+                break Err((BAD_REQUEST, "Request ended unexpectedly"));
+            }
+            buf = &mut request[len..];
+        }
+        .and_then(|()| {
+            std::str::from_utf8(&request[..len - 2]).or(Err((BAD_REQUEST, "Non-UTF-8 request")))
+        });
+
+        let request = result.inspect_err(|_| {
+            // write empty request to log line for uniformity
+            write!(self.log_line, " \"\"").unwrap();
+        })?;
+
+        // log literal request (might be different from or not an actual URL)
+        write!(self.log_line, " \"{request}\"").unwrap();
+
+        let mut url = Url::parse(request).or(Err((BAD_REQUEST, "Invalid URL")))?;
+
+        // Validate the URL:
+        // correct scheme
+        if url.scheme() != "gemini" {
+            return Err((PROXY_REQUEST_REFUSED, "Unsupported URL scheme"));
+        }
+
+        // no userinfo and no fragment
+        if url.password().is_some() || !url.username().is_empty() || url.fragment().is_some() {
+            return Err((BAD_REQUEST, "URL contains fragment or userinfo"));
+        }
+
+        // correct host
+        let Some(domain) = url.domain() else {
+            return Err((BAD_REQUEST, "URL does not contain a domain"));
+        };
+        // because the gemini scheme is not special enough for WHATWG, normalize
+        // it ourselves
+        let host = Host::parse(
+            &percent_decode_str(domain)
+                .decode_utf8()
+                .or(Err((BAD_REQUEST, "Invalid URL")))?,
+        )
+        .or(Err((BAD_REQUEST, "Invalid URL")))?;
+        // TODO: simplify when <https://github.com/servo/rust-url/issues/586> resolved
+        url.set_host(Some(&host.to_string()))
+            .expect("invalid domain?");
+        // do not use "contains" here since it requires the same type and does
+        // not allow to check for Host<&str> if the vec contains Hostname<String>
+        if !ARGS.hostnames.is_empty() && !ARGS.hostnames.iter().any(|h| h == &host) {
+            return Err((PROXY_REQUEST_REFUSED, "Proxy request refused"));
+        }
+
+        // correct port
+        if let Some(expected_port) = self.local_port_check
+            && let Some(port) = url.port()
+        {
+            // Validate that the port in the URL is the same as for the stream this request
+            // came in on.
+            if port != expected_port {
+                return Err((PROXY_REQUEST_REFUSED, "Proxy request refused"));
+            }
+        }
+        Ok(url)
     }
 
-    // Send body.
-    async_std::io::copy(&mut file, stream).await?;
-    Ok(())
-}
+    /// Send the client the file located at the requested URL.
+    async fn send_response(&mut self, url: Url) -> Result {
+        let mut path = std::path::PathBuf::from(&ARGS.content_dir);
 
-async fn respond<W: Write + Unpin>(stream: &mut W, status: &str, meta: &[&str]) -> Result {
-    log::info!("Responding with status {} and meta {:?}", status, meta);
-    stream.write_all(status.as_bytes()).await?;
-    stream.write_all(b" ").await?;
-    for m in meta {
-        stream.write_all(m.as_bytes()).await?;
+        if ARGS.hostnames.len() > 1 {
+            // basic vhosts, existence of host_str was checked by parse_request already
+            path.push(url.host_str().expect("no hostname"));
+        }
+
+        if let Some(mut segments) = url.path_segments() {
+            // append percent-decoded path segments
+            for segment in segments.clone() {
+                // To prevent directory traversal attacks, we need to
+                // check that each filesystem path component in the URL
+                // path segment is a normal component (not the root
+                // directory, the parent directory, a drive label, or
+                // another special component). Furthermore, since path
+                // separators (e.g. the escaped forward slash %2F) in a
+                // single URL path segment are non-structural, the URL
+                // path segment should not contain multiple filesystem
+                // path components.
+                let decoded = percent_decode_str(segment).decode_utf8()?;
+                let mut components = Path::new(decoded.as_ref()).components();
+                // the first component must be a normal component; if
+                // so, push it onto the PathBuf
+                match components.next() {
+                    None => (),
+                    Some(Component::Normal(c)) => path.push(c),
+                    Some(_) => return self.send_header(NOT_FOUND, "Not found, sorry.").await,
+                }
+                // there must not be more than one component
+                if components.next().is_some() {
+                    return self.send_header(NOT_FOUND, "Not found, sorry.").await;
+                }
+                // even if it's one component, there may be trailing path
+                // separators at the end
+                if decoded.ends_with(path::is_separator) {
+                    return self.send_header(NOT_FOUND, "Not found, sorry.").await;
+                }
+            }
+            // check if hiding files is disabled
+            if !ARGS.serve_secret
+                // there is a configuration for this file, assume it should be served
+                && !self.metadata.lock().await.exists(&path)
+                // check if file or directory is hidden
+                && segments.any(|segment| segment.starts_with('.'))
+            {
+                return self
+                    .send_header(GONE, "If I told you, it would not be a secret.")
+                    .await;
+            }
+        }
+
+        if let Ok(metadata) = tokio::fs::metadata(&path).await
+            && metadata.is_dir()
+        {
+            if url.path().ends_with('/') || url.path().is_empty() {
+                // if the path ends with a slash or the path is empty, the links will work the same
+                // without a redirect
+                // use `push` instead of `join` because the changed path is used later
+                path.push("index.gmi");
+                if !path.exists() {
+                    path.pop();
+                    // try listing directory
+                    return self.list_directory(&path).await;
+                }
+            } else {
+                // if client is not redirected, links may not work as expected without trailing slash
+                let mut url = url;
+                url.set_path(&format!("{}/", url.path()));
+                return self.send_header(REDIRECT_PERMANENT, url.as_str()).await;
+            }
+        }
+
+        let data = self.metadata.lock().await.get(&path);
+
+        if let PresetMeta::FullHeader(status, meta) = data {
+            self.send_header(status, &meta).await?;
+            // do not try to access the file
+            return Ok(());
+        }
+
+        // Make sure the file opens successfully before sending a success header.
+        let mut file = match tokio::fs::File::open(&path).await {
+            Ok(file) => file,
+            Err(e) => {
+                self.send_header(NOT_FOUND, "Not found, sorry.").await?;
+                return Err(e.into());
+            }
+        };
+
+        // Send header.
+        let mime = match data {
+            // this was already handled before opening the file
+            PresetMeta::FullHeader(..) => unreachable!(),
+            // treat this as the full MIME type
+            PresetMeta::FullMime(mime) => mime.clone(),
+            // guess the MIME type and add the parameters
+            PresetMeta::Parameters(params) => {
+                if path.extension() == Some(OsStr::new("gmi")) {
+                    format!("text/gemini{params}")
+                } else {
+                    let mime = mime_guess::from_path(&path).first_or_octet_stream();
+                    format!("{}{}", mime.essence_str(), params)
+                }
+            }
+        };
+        self.send_header(SUCCESS, &mime).await?;
+
+        // Send body.
+        tokio::io::copy(&mut file, &mut self.stream).await?;
+        Ok(())
+    }
+
+    async fn list_directory(&mut self, path: &Path) -> Result {
+        // https://url.spec.whatwg.org/#path-percent-encode-set
+        const ENCODE_SET: AsciiSet = CONTROLS
+            .add(b' ')
+            .add(b'"')
+            .add(b'#')
+            .add(b'<')
+            .add(b'>')
+            .add(b'?')
+            .add(b'`')
+            .add(b'{')
+            .add(b'}');
+
+        // check if directory listing is enabled by getting preamble
+        let Ok(preamble) = std::fs::read_to_string(path.join(".directory-listing-ok")) else {
+            self.send_header(NOT_FOUND, "Directory index disabled.")
+                .await?;
+            return Ok(());
+        };
+
+        log::info!("Listing directory {path:?}");
+
+        self.send_header(SUCCESS, "text/gemini").await?;
+        self.stream.write_all(preamble.as_bytes()).await?;
+
+        let mut entries = tokio::fs::read_dir(path).await?;
+        let mut lines = vec![];
+        while let Some(entry) = entries.next_entry().await? {
+            let mut name = entry
+                .file_name()
+                .into_string()
+                .or(Err("Non-Unicode filename"))?;
+            if name.starts_with('.') {
+                continue;
+            }
+            if entry.file_type().await?.is_dir() {
+                name += "/";
+            }
+            let line = match percent_encode(name.as_bytes(), &ENCODE_SET).into() {
+                Cow::Owned(url) => format!("=> {url} {name}\n"),
+                Cow::Borrowed(url) => format!("=> {url}\n"), // url and name are identical
+            };
+            lines.push(line);
+        }
+        lines.sort();
+        for line in lines {
+            self.stream.write_all(line.as_bytes()).await?;
+        }
+        Ok(())
+    }
+
+    async fn send_header(&mut self, status: u8, meta: &str) -> Result {
+        // add response status and response meta
+        write!(self.log_line, " {status} \"{meta}\"")?;
+
+        self.stream
+            .write_all(format!("{status} {meta}\r\n").as_bytes())
+            .await?;
+        Ok(())
     }
-    stream.write_all(b"\r\n").await?;
-    Ok(())
 }

src/metadata.rs

@@ -0,0 +1,240 @@
+use configparser::ini::Ini;
+use glob::{MatchOptions, glob_with};
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+use std::time::SystemTime;
+
+static SIDECAR_FILENAME: &str = ".meta";
+
+/// A struct to store a string of metadata for each file retrieved from
+/// sidecar files with the name given by `SIDECAR_FILENAME`.
+///
+/// These sidecar file's lines should have the format
+/// ```text
+/// <filename>:<metadata>
+/// ```
+/// where `<filename>` is only a filename (not a path) of a file that resides
+/// in the same directory and `<metadata>` is the metadata to be stored.
+/// Lines that start with optional whitespace and `#` are ignored, as are lines
+/// that do not fit the basic format.
+/// Both parts are stripped of any leading and/or trailing whitespace.
+pub(crate) struct FileOptions {
+    /// Stores the paths of the side files and when they were last read.
+    /// By comparing this to the last write time, we can know if the file
+    /// has changed.
+    databases_read: BTreeMap<PathBuf, SystemTime>,
+    /// Stores the metadata for each file
+    file_meta: BTreeMap<PathBuf, PresetMeta>,
+    /// The default value to return
+    default: PresetMeta,
+}
+
+/// A struct to store the different alternatives that a line in the sidecar
+/// file can have.
+#[derive(Clone, Debug)]
+pub(crate) enum PresetMeta {
+    /// A line that starts with a semicolon in the sidecar file, or an
+    /// empty line (to overwrite the default language command line flag).
+    /// ```text
+    /// index.gmi: ;lang=en-GB
+    /// ```
+    /// The content is interpreted as MIME parameters and are appended to what
+    /// agate guesses as the MIME type if the respective file can be found.
+    Parameters(String),
+    /// A line that is neither a `Parameters` line nor a `FullHeader` line.
+    /// ```text
+    /// strange.file: text/plain; lang=ee
+    /// ```
+    /// Agate will send the complete line as the MIME type of the request if
+    /// the respective file can be found (i.e. a `20` status code).
+    FullMime(String),
+    /// A line that starts with a digit between 1 and 6 inclusive followed by
+    /// another digit and a space (U+0020). In the categories defined by the
+    /// Gemini specification you can pick a defined or non-defined status code.
+    /// ```text
+    /// gone.gmi: 52 This file is no longer available.
+    /// ```
+    /// Agate will send this header line, CR, LF, and nothing else. Agate will
+    /// not try to access the requested file.
+    FullHeader(u8, String),
+}
+
+impl FileOptions {
+    pub(crate) fn new(default: PresetMeta) -> Self {
+        Self {
+            databases_read: BTreeMap::new(),
+            file_meta: BTreeMap::new(),
+            default,
+        }
+    }
+
+    /// Checks wether the database for the directory of the specified file is
+    /// still up to date and re-reads it if outdated or not yet read.
+    fn update(&mut self, file: &Path) {
+        let mut db = if super::ARGS.central_config {
+            super::ARGS.content_dir.clone()
+        } else {
+            file.parent().expect("no parent directory").to_path_buf()
+        };
+        db.push(SIDECAR_FILENAME);
+
+        let should_read = if let Ok(metadata) = db.metadata() {
+            if !metadata.is_file() {
+                // it exists, but it is a directory
+                false
+            } else if let (Ok(modified), Some(last_read)) =
+                (metadata.modified(), self.databases_read.get(&db))
+            {
+                // check that it was last modified before the read
+                // if the times are the same, we might have read the old file
+                &modified >= last_read
+            } else {
+                // either the filesystem does not support last modified
+                // metadata, so we have to read it again every time; or the
+                // file exists but was not read before, so we have to read it
+                true
+            }
+        } else {
+            // the file probably does not exist
+            false
+        };
+
+        if should_read {
+            self.read_database(&db);
+        }
+    }
+
+    /// (Re)reads a specified sidecar file.
+    /// This function will allways try to read the file, even if it is current.
+    fn read_database(&mut self, db: &Path) {
+        log::debug!("reading database {db:?}");
+
+        let mut ini = Ini::new_cs();
+        ini.set_default_section("mime");
+        ini.set_comment_symbols(&['#']);
+        let map = ini
+            .load(db.to_str().expect("config path not UTF-8"))
+            .and_then(|mut sections| {
+                sections
+                    .remove("mime")
+                    .ok_or_else(|| "no \"mime\" or default section".to_string())
+            });
+        self.databases_read
+            .insert(db.to_path_buf(), SystemTime::now());
+        let files = match map {
+            Ok(section) => section,
+            Err(err) => {
+                log::error!("invalid config file {db:?}: {err}");
+                return;
+            }
+        };
+
+        for (rel_path, header) in files {
+            // treat unassigned keys as if they had an empty value
+            let header = header.unwrap_or_default();
+
+            // generate workspace-relative path
+            let mut path = db.to_path_buf();
+            path.pop();
+            path.push(rel_path);
+
+            // parse the preset
+            let preset = if header.is_empty() || header.starts_with(';') {
+                PresetMeta::Parameters(header.to_string())
+            } else if matches!(header.chars().next(), Some('1'..='6')) {
+                if header.len() < 3
+                    || !header.chars().nth(1).unwrap().is_ascii_digit()
+                    || !header.chars().nth(2).unwrap().is_whitespace()
+                {
+                    log::error!(
+                        "Line for {path:?} starts like a full header line, but it is incorrect; ignoring it."
+                    );
+                    return;
+                }
+                let separator = header.chars().nth(2).unwrap();
+                if separator != ' ' {
+                    // the Gemini specification says that the third
+                    // character has to be a space, so correct any
+                    // other whitespace to it (e.g. tabs)
+                    log::warn!(
+                        "Full Header line for {path:?} has an invalid character, treating {separator:?} as a space."
+                    );
+                }
+                let status = header
+                    .chars()
+                    .take(2)
+                    .collect::<String>()
+                    .parse::<u8>()
+                    // unwrap since we alread checked it's a number
+                    .unwrap();
+                // not taking a slice here because the separator
+                // might be a whitespace wider than a byte
+                let meta = header.chars().skip(3).collect::<String>();
+                PresetMeta::FullHeader(status, meta)
+            } else {
+                // must be a MIME type, but without status code
+                PresetMeta::FullMime(header.to_string())
+            };
+
+            let glob_options = MatchOptions {
+                case_sensitive: true,
+                // so there is a difference between "*" and "**".
+                require_literal_separator: true,
+                // security measure because entries for .hidden files
+                // would result in them being exposed.
+                require_literal_leading_dot: !crate::ARGS.serve_secret,
+            };
+
+            // process filename as glob
+            let paths = if let Some(path) = path.to_str() {
+                match glob_with(path, glob_options) {
+                    Ok(paths) => paths.collect::<Vec<_>>(),
+                    Err(err) => {
+                        log::error!("incorrect glob pattern in {path:?}: {err}");
+                        continue;
+                    }
+                }
+            } else {
+                log::error!("path is not UTF-8: {path:?}");
+                continue;
+            };
+
+            if paths.is_empty() {
+                // probably an entry for a nonexistent file, glob only works for existing files
+                self.file_meta.insert(path, preset);
+            } else {
+                for glob_result in paths {
+                    match glob_result {
+                        Ok(path) if path.is_dir() => { /* ignore */ }
+                        Ok(path) => {
+                            self.file_meta.insert(path, preset.clone());
+                        }
+                        Err(err) => {
+                            log::warn!("could not process glob path: {err}");
+                            continue;
+                        }
+                    };
+                }
+            }
+        }
+    }
+
+    /// Get the metadata for the specified file. This might need to (re)load a
+    /// single sidecar file.
+    /// The file path should consistenly be either absolute or relative to the
+    /// working/content directory. If inconsistent file paths are used, this can
+    /// lead to loading and storing sidecar files multiple times.
+    pub fn get(&mut self, file: &Path) -> PresetMeta {
+        self.update(file);
+
+        self.file_meta.get(file).unwrap_or(&self.default).clone()
+    }
+
+    /// Returns true if a configuration exists in a configuration file.
+    /// Returns false if no or only the default value exists.
+    pub fn exists(&mut self, file: &Path) -> bool {
+        self.update(file);
+
+        self.file_meta.contains_key(file)
+    }
+}

tests/LICENSE-GPL.md

@@ -0,0 +1,675 @@
+# GNU GENERAL PUBLIC LICENSE
+
+Version 3, 29 June 2007
+
+Copyright (C) 2007 Free Software Foundation, Inc.
+<https://fsf.org/>
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+## Preamble
+
+The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works. By contrast,
+the GNU General Public License is intended to guarantee your freedom
+to share and change all versions of a program--to make sure it remains
+free software for all its users. We, the Free Software Foundation, use
+the GNU General Public License for most of our software; it applies
+also to any other work released this way by its authors. You can apply
+it to your programs, too.
+
+When we speak of free software, we are referring to freedom, not
+price. Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights. Therefore, you
+have certain responsibilities if you distribute copies of the
+software, or if you modify it: responsibilities to respect the freedom
+of others.
+
+For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received. You must make sure that they, too, receive
+or can get the source code. And you must show them these terms so they
+know their rights.
+
+Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software. For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the
+manufacturer can do so. This is fundamentally incompatible with the
+aim of protecting users' freedom to change the software. The
+systematic pattern of such abuse occurs in the area of products for
+individuals to use, which is precisely where it is most unacceptable.
+Therefore, we have designed this version of the GPL to prohibit the
+practice for those products. If such problems arise substantially in
+other domains, we stand ready to extend this provision to those
+domains in future versions of the GPL, as needed to protect the
+freedom of users.
+
+Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish
+to avoid the special danger that patents applied to a free program
+could make it effectively proprietary. To prevent this, the GPL
+assures that patents cannot be used to render the program non-free.
+
+The precise terms and conditions for copying, distribution and
+modification follow.
+
+## TERMS AND CONDITIONS
+
+### 0. Definitions.
+
+"This License" refers to version 3 of the GNU General Public License.
+
+"Copyright" also means copyright-like laws that apply to other kinds
+of works, such as semiconductor masks.
+
+"The Program" refers to any copyrightable work licensed under this
+License. Each licensee is addressed as "you". "Licensees" and
+"recipients" may be individuals or organizations.
+
+To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of
+an exact copy. The resulting work is called a "modified version" of
+the earlier work or a work "based on" the earlier work.
+
+A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy. Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies. Mere interaction with a user
+through a computer network, with no transfer of a copy, is not
+conveying.
+
+An interactive user interface displays "Appropriate Legal Notices" to
+the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License. If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+### 1. Source Code.
+
+The "source code" for a work means the preferred form of the work for
+making modifications to it. "Object code" means any non-source form of
+a work.
+
+A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form. A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities. However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work. For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+The Corresponding Source need not include anything that users can
+regenerate automatically from other parts of the Corresponding Source.
+
+The Corresponding Source for a work in source code form is that same
+work.
+
+### 2. Basic Permissions.
+
+All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met. This License explicitly affirms your unlimited
+permission to run the unmodified Program. The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work. This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+You may make, run and propagate covered works that you do not convey,
+without conditions so long as your license otherwise remains in force.
+You may convey covered works to others for the sole purpose of having
+them make modifications exclusively for you, or provide you with
+facilities for running those works, provided that you comply with the
+terms of this License in conveying all material for which you do not
+control copyright. Those thus making or running the covered works for
+you must do so exclusively on your behalf, under your direction and
+control, on terms that prohibit them from making any copies of your
+copyrighted material outside their relationship with you.
+
+Conveying under any other circumstances is permitted solely under the
+conditions stated below. Sublicensing is not allowed; section 10 makes
+it unnecessary.
+
+### 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such
+circumvention is effected by exercising rights under this License with
+respect to the covered work, and you disclaim any intention to limit
+operation or modification of the work as a means of enforcing, against
+the work's users, your or third parties' legal rights to forbid
+circumvention of technological measures.
+
+### 4. Conveying Verbatim Copies.
+
+You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+### 5. Conveying Modified Source Versions.
+
+You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these
+conditions:
+
+-   a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+-   b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under
+    section 7. This requirement modifies the requirement in section 4
+    to "keep intact all notices".
+-   c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy. This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged. This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+-   d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit. Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+### 6. Conveying Non-Source Forms.
+
+You may convey a covered work in object code form under the terms of
+sections 4 and 5, provided that you also convey the machine-readable
+Corresponding Source under the terms of this License, in one of these
+ways:
+
+-   a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+-   b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the Corresponding
+    Source from a network server at no charge.
+-   c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source. This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+-   d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge. You need not require recipients to copy the
+    Corresponding Source along with the object code. If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source. Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+-   e) Convey the object code using peer-to-peer transmission,
+    provided you inform other peers where the object code and
+    Corresponding Source of the work are being offered to the general
+    public at no charge under subsection 6d.
+
+A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal,
+family, or household purposes, or (2) anything designed or sold for
+incorporation into a dwelling. In determining whether a product is a
+consumer product, doubtful cases shall be resolved in favor of
+coverage. For a particular product received by a particular user,
+"normally used" refers to a typical or common use of that class of
+product, regardless of the status of the particular user or of the way
+in which the particular user actually uses, or expects or is expected
+to use, the product. A product is a consumer product regardless of
+whether the product has substantial commercial, industrial or
+non-consumer uses, unless such uses represent the only significant
+mode of use of the product.
+
+"Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to
+install and execute modified versions of a covered work in that User
+Product from a modified version of its Corresponding Source. The
+information must suffice to ensure that the continued functioning of
+the modified object code is in no case prevented or interfered with
+solely because modification has been made.
+
+If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information. But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or
+updates for a work that has been modified or installed by the
+recipient, or for the User Product in which it has been modified or
+installed. Access to a network may be denied when the modification
+itself materially and adversely affects the operation of the network
+or violates the rules and protocols for communication across the
+network.
+
+Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+### 7. Additional Terms.
+
+"Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law. If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it. (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.) You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders
+of that material) supplement the terms of this License with terms:
+
+-   a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+-   b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+-   c) Prohibiting misrepresentation of the origin of that material,
+    or requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+-   d) Limiting the use for publicity purposes of names of licensors
+    or authors of the material; or
+-   e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+-   f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions
+    of it) with contractual assumptions of liability to the recipient,
+    for any liability that these contractual assumptions directly
+    impose on those licensors and authors.
+
+All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10. If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term. If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions; the
+above requirements apply either way.
+
+### 8. Termination.
+
+You may not propagate or modify a covered work except as expressly
+provided under this License. Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+However, if you cease all violation of this License, then your license
+from a particular copyright holder is reinstated (a) provisionally,
+unless and until the copyright holder explicitly and finally
+terminates your license, and (b) permanently, if the copyright holder
+fails to notify you of the violation by some reasonable means prior to
+60 days after the cessation.
+
+Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License. If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+### 9. Acceptance Not Required for Having Copies.
+
+You are not required to accept this License in order to receive or run
+a copy of the Program. Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance. However,
+nothing other than this License grants you permission to propagate or
+modify any covered work. These actions infringe copyright if you do
+not accept this License. Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+### 10. Automatic Licensing of Downstream Recipients.
+
+Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License. You are not responsible
+for enforcing compliance by third parties with this License.
+
+An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations. If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License. For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+### 11. Patents.
+
+A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based. The
+work thus licensed is called the contributor's "contributor version".
+
+A contributor's "essential patent claims" are all patent claims owned
+or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version. For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement). To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients. "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+A patent license is "discriminatory" if it does not include within the
+scope of its coverage, prohibits the exercise of, or is conditioned on
+the non-exercise of one or more of the rights that are specifically
+granted under this License. You may not convey a covered work if you
+are a party to an arrangement with a third party that is in the
+business of distributing software, under which you make payment to the
+third party based on the extent of your activity of conveying the
+work, and under which the third party grants, to any of the parties
+who would receive the covered work from you, a discriminatory patent
+license (a) in connection with copies of the covered work conveyed by
+you (or copies made from those copies), or (b) primarily for and in
+connection with specific products or compilations that contain the
+covered work, unless you entered into that arrangement, or that patent
+license was granted, prior to 28 March 2007.
+
+Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+### 12. No Surrender of Others' Freedom.
+
+If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License. If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under
+this License and any other pertinent obligations, then as a
+consequence you may not convey it at all. For example, if you agree to
+terms that obligate you to collect a royalty for further conveying
+from those to whom you convey the Program, the only way you could
+satisfy both those terms and this License would be to refrain entirely
+from conveying the Program.
+
+### 13. Use with the GNU Affero General Public License.
+
+Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work. The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+### 14. Revised Versions of this License.
+
+The Free Software Foundation may publish revised and/or new versions
+of the GNU General Public License from time to time. Such new versions
+will be similar in spirit to the present version, but may differ in
+detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Program
+specifies that a certain numbered version of the GNU General Public
+License "or any later version" applies to it, you have the option of
+following the terms and conditions either of that numbered version or
+of any later version published by the Free Software Foundation. If the
+Program does not specify a version number of the GNU General Public
+License, you may choose any version ever published by the Free
+Software Foundation.
+
+If the Program specifies that a proxy can decide which future versions
+of the GNU General Public License can be used, that proxy's public
+statement of acceptance of a version permanently authorizes you to
+choose that version for the Program.
+
+Later license versions may give you additional or different
+permissions. However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+### 15. Disclaimer of Warranty.
+
+THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT
+WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND
+PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE
+DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR
+CORRECTION.
+
+### 16. Limitation of Liability.
+
+IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR
+CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES
+ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT
+NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR
+LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM
+TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER
+PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+### 17. Interpretation of Sections 15 and 16.
+
+If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+END OF TERMS AND CONDITIONS
+
+## How to Apply These Terms to Your New Programs
+
+If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these
+terms.
+
+To do so, attach the following notices to the program. It is safest to
+attach them to the start of each source file to most effectively state
+the exclusion of warranty; and each file should have at least the
+"copyright" line and a pointer to where the full notice is found.
+
+        <one line to give the program's name and a brief idea of what it does.>
+        Copyright (C) <year>  <name of author>
+
+        This program is free software: you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation, either version 3 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper
+mail.
+
+If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+        <program>  Copyright (C) <year>  <name of author>
+        This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+        This is free software, and you are welcome to redistribute it
+        under certain conditions; type `show c' for details.
+
+The hypothetical commands \`show w' and \`show c' should show the
+appropriate parts of the General Public License. Of course, your
+program's commands might be different; for a GUI interface, you would
+use an "about box".
+
+You should also get your employer (if you work as a programmer) or
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary. For more information on this, and how to apply and follow
+the GNU GPL, see <https://www.gnu.org/licenses/>.
+
+The GNU General Public License does not permit incorporating your
+program into proprietary programs. If your program is a subroutine
+library, you may consider it more useful to permit linking proprietary
+applications with the library. If this is what you want to do, use the
+GNU Lesser General Public License instead of this License. But first,
+please read <https://www.gnu.org/licenses/why-not-lgpl.html>.

tests/README.md

@@ -0,0 +1,5 @@
+# Tests for the Agate gemini server
+
+This folder contains some tests and data used for these tests.
+
+Also note that you should **NEVER USE THE CERTIFICATE AND KEY DATA PROVIDED HERE** since it is public.

tests/data/content/.meta

@@ -0,0 +1,12 @@
+# test setting a mime type
+test: text/html
+# test double star globs
+**/*.nl.gmi: ;lang=nl
+# test setting multiple parameters
+test.gmi: ;lang=en ;charset=us-ascii
+# test setting data for nonexistent files
+gone.txt: 52 This file is no longer available.
+# test setting data for files in other directories
+example.com/index.gmi: ;lang=en-US
+.servable-secret: text/plain
+.well-known/servable-secret: text/plain

tests/data/content/example.com/index.gmi

@@ -0,0 +1,2 @@
+This is example.com.
+=> gemini://example.org

tests/data/content/example.org/index.gmi

@@ -0,0 +1,2 @@
+This is example.org.
+=> gemini://example.com/

tests/data/content/index.gmi

@@ -0,0 +1 @@
+This is a test index file.

tests/data/content/symlink.gmi

@@ -0,0 +1 @@
+index.gmi

tests/data/content/symlinked_dir

@@ -0,0 +1 @@
+../symlinked_dir/

tests/data/content/test.gmi

@@ -0,0 +1,2 @@
+This is a test in the root
+Suppe

tests/data/content/testdir/.meta

@@ -0,0 +1,4 @@
+# test distributed configurations
+index.gmi: 51 No index file for you.
+# test which configuration file is used
+*.nl.gmi: text/plain;lang=nl

tests/data/directory_traversal.gmi

@@ -0,0 +1 @@
+This is a test file to check for directory traversal vulnerabilities.

tests/data/dirlist-preamble/.directory-listing-ok

@@ -0,0 +1 @@
+This is a directory listing

tests/data/multicert/create_certs.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+
+mkdir -p example.com example.org
+
+for domain in "example.com" "example.org"
+do
+# create private key
+openssl genpkey -outform DER -out $domain/key.der -algorithm RSA -pkeyopt rsa_keygen_bits:4096
+
+# create config file:
+# the generated certificates must not be CA-capable, otherwise rustls complains
+cat >openssl.conf <<EOT
+[req]
+default_bits = 4096
+distinguished_name = req_distinguished_name
+req_extensions = req_ext
+prompt = no
+
+[v3_ca]
+basicConstraints = critical, CA:false
+
+[req_distinguished_name]
+commonName = $domain
+
+[req_ext]
+subjectAltName = DNS:$domain
+EOT
+
+openssl req -new -sha256 -out request.csr -key $domain/key.der -keyform DER -config openssl.conf
+
+openssl x509 -req -sha256 -days 3650 -in request.csr -outform DER -out $domain/cert.der \
+	-extensions req_ext -extfile openssl.conf -signkey $domain/key.der -keyform DER
+done
+
+# clean up
+rm openssl.conf request.csr

tests/data/symlinked_dir/file.gmi

@@ -0,0 +1 @@
+Hello from the symlink'ed directory!

tests/tests.rs

@@ -0,0 +1,653 @@
+//! Agate integration tests
+//!
+//! This program is free software: you can redistribute it and/or modify
+//! it under the terms of the GNU General Public License as published by
+//! the Free Software Foundation, either version 3 of the License, or
+//! (at your option) any later version.
+//!
+//! This program is distributed in the hope that it will be useful,
+//! but WITHOUT ANY WARRANTY; without even the implied warranty of
+//! MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//! GNU General Public License for more details.
+//!
+//! You should have received a copy of the GNU General Public License
+//! along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+use rustls::{ClientConnection, RootCertStore, pki_types::CertificateDer};
+use std::convert::TryInto;
+use std::io::{BufRead, BufReader, Read, Write};
+use std::net::{SocketAddr, TcpStream, ToSocketAddrs};
+use std::path::PathBuf;
+use std::process::{Command, Stdio};
+use std::sync::atomic::{AtomicU16, Ordering};
+use std::thread::sleep;
+use std::time::Duration;
+use tokio_rustls::rustls;
+use trotter::{Actor, Response, Status};
+use url::Url;
+
+static BINARY_PATH: &str = env!("CARGO_BIN_EXE_agate");
+
+static DEFAULT_PORT: u16 = 1965;
+/// this is our atomic port that increments for each test that needs one
+/// doing it this way avoids port collisions from manually setting ports
+static PORT: AtomicU16 = AtomicU16::new(DEFAULT_PORT);
+
+struct Server {
+    addr: SocketAddr,
+    server: std::process::Child,
+    // is set when output is collected by stop()
+    output: Option<Result<(), String>>,
+}
+
+impl Server {
+    pub fn new(args: &[&str]) -> Self {
+        use std::net::{IpAddr, Ipv4Addr};
+
+        // generate unique port/address so tests do not clash
+        let addr = (
+            IpAddr::V4(Ipv4Addr::LOCALHOST),
+            PORT.fetch_add(1, Ordering::SeqCst),
+        )
+            .to_socket_addrs()
+            .unwrap()
+            .next()
+            .unwrap();
+
+        // start the server
+        let mut server = Command::new(BINARY_PATH)
+            .stderr(Stdio::piped())
+            .current_dir(concat!(env!("CARGO_MANIFEST_DIR"), "/tests/data"))
+            // add address information
+            .args(["--addr", &addr.to_string()])
+            .args(args)
+            .env("RUST_LOG", "debug")
+            .spawn()
+            .expect("failed to start binary");
+
+        // We can be sure that agate is listening because it logs a message saying so.
+        let mut reader = BufReader::new(server.stderr.as_mut().unwrap());
+        let mut buffer = String::new();
+        while matches!(reader.read_line(&mut buffer), Ok(i) if i>0) {
+            print!("log: {buffer}");
+            if buffer.contains("Started") {
+                break;
+            }
+
+            buffer.clear();
+        }
+
+        if matches!(server.try_wait(), Ok(Some(_)) | Err(_)) {
+            panic!("Server did not start properly");
+        }
+
+        Self {
+            addr,
+            server,
+            output: None,
+        }
+    }
+
+    pub fn get_addr(&self) -> SocketAddr {
+        self.addr
+    }
+
+    pub fn stop(&mut self) -> Result<(), String> {
+        // try to stop the server
+        if let Some(output) = self.output.as_ref() {
+            return output.clone();
+        }
+
+        self.output = Some(match self.server.try_wait() {
+            Err(e) => Err(format!("cannot access orchestrated program: {e:?}")),
+            Ok(None) => {
+                // everything fine, still running as expected, kill it now
+                self.server.kill().unwrap();
+
+                let mut reader = BufReader::new(self.server.stderr.as_mut().unwrap());
+                let mut buffer = String::new();
+                while matches!(reader.read_line(&mut buffer), Ok(i) if i>0) {
+                    print!("log: {buffer}");
+                    if buffer.contains("Listening") {
+                        break;
+                    }
+                }
+                Ok(())
+            }
+            Ok(Some(_)) => {
+                let mut reader = BufReader::new(self.server.stderr.as_mut().unwrap());
+                let mut buffer = String::new();
+                while matches!(reader.read_line(&mut buffer), Ok(i) if i>0) {
+                    print!("log: {buffer}");
+                    if buffer.contains("Listening") {
+                        break;
+                    }
+                }
+                Err(buffer)
+            }
+        });
+        self.output.clone().unwrap()
+    }
+}
+
+impl Drop for Server {
+    fn drop(&mut self) {
+        if self.output.is_none() && !std::thread::panicking() {
+            // a potential error message was not yet handled
+            self.stop().unwrap();
+        } else if self.output.is_some() {
+            // server was already stopped
+        } else {
+            // we are panicking and a potential error was not handled
+            self.stop().unwrap_or_else(|e| eprintln!("{e}"));
+        }
+    }
+}
+
+fn get(args: &[&str], url: &str) -> Result<Response, String> {
+    let mut server = Server::new(args);
+
+    let url = Url::parse(url).unwrap();
+    let actor = Actor::default().proxy("localhost".into(), server.addr.port());
+    let request = actor.get(url);
+
+    let response = tokio::runtime::Runtime::new()
+        .unwrap()
+        .block_on(request)
+        .map_err(|e| e.to_string());
+    server.stop()?;
+    response
+}
+
+#[test]
+/// - serves index page for a directory
+/// - serves the correct content
+fn index_page() {
+    let page = get(&[], "gemini://localhost").expect("could not get page");
+
+    assert_eq!(page.status, Status::Success.value());
+    assert_eq!(page.meta, "text/gemini");
+
+    assert_eq!(page.content, include_bytes!("data/content/index.gmi"));
+}
+
+#[cfg(unix)]
+#[test]
+fn index_page_unix() {
+    let sock_path = std::env::temp_dir().join("agate-test-unix-socket");
+
+    // this uses multicert because those certificates are set up so rustls
+    // does not complain about them being CA certificates
+    let mut server = Server::new(&[
+        "--certs",
+        "multicert",
+        "--socket",
+        sock_path
+            .to_str()
+            .expect("could not convert temp dir path to string"),
+    ]);
+
+    // set up TLS connection via unix socket
+    let mut certs = RootCertStore::empty();
+    certs
+        .add(CertificateDer::from(
+            include_bytes!("data/multicert/example.com/cert.der").as_slice(),
+        ))
+        .unwrap();
+    let config = rustls::ClientConfig::builder()
+        .with_root_certificates(certs)
+        .with_no_client_auth();
+    let mut session = ClientConnection::new(
+        std::sync::Arc::new(config),
+        "example.com".try_into().unwrap(),
+    )
+    .unwrap();
+
+    let mut unix = loop {
+        if let Ok(sock) = std::os::unix::net::UnixStream::connect(&sock_path) {
+            break sock;
+        }
+        sleep(Duration::from_millis(10));
+    };
+    let mut tls = rustls::Stream::new(&mut session, &mut unix);
+
+    write!(tls, "gemini://example.com\r\n").unwrap();
+
+    let mut buf = [0; 16];
+    let _ = tls.read(&mut buf);
+
+    assert_eq!(&buf, b"20 text/gemini\r\n");
+
+    server.stop().expect("failed to stop server");
+}
+
+#[test]
+/// - symlinked files are followed correctly
+fn symlink_page() {
+    let page = get(&[], "gemini://localhost/symlink.gmi").expect("could not get page");
+
+    assert_eq!(page.status, Status::Success.value());
+    assert_eq!(page.meta, "text/gemini");
+    assert_eq!(page.content, include_bytes!("data/content/index.gmi"));
+}
+
+#[test]
+/// - symlinked directories are followed correctly
+fn symlink_directory() {
+    let page = get(&[], "gemini://localhost/symlinked_dir/file.gmi").expect("could not get page");
+
+    assert_eq!(page.status, Status::Success.value());
+    assert_eq!(page.meta, "text/gemini");
+    assert_eq!(page.content, include_bytes!("data/symlinked_dir/file.gmi"));
+}
+
+#[test]
+/// - the `--addr` configuration works
+/// - MIME media types can be set in the configuration file
+fn meta() {
+    let page = get(&[], "gemini://localhost/test").expect("could not get page");
+    assert_eq!(page.status, Status::Success.value());
+    assert_eq!(page.meta, "text/html");
+}
+
+#[test]
+/// - MIME type is correctly guessed for `.gmi` files
+/// - MIME media type parameters can be set in the configuration file
+fn meta_param() {
+    let page = get(&[], "gemini://localhost/test.gmi").expect("could not get page");
+    assert_eq!(page.status, Status::Success.value());
+    assert_eq!(page.meta, "text/gemini;lang=en ;charset=us-ascii");
+}
+
+#[test]
+/// - globs in the configuration file work correctly
+/// - distributed configuration file is used when `-C` flag not used
+fn glob() {
+    let page = get(&[], "gemini://localhost/testdir/a.nl.gmi").expect("could not get page");
+    assert_eq!(page.status, Status::Success.value());
+    assert_eq!(page.meta, "text/plain;lang=nl");
+}
+
+#[test]
+/// - double globs (i.e. `**`) work correctly in the configuration file
+/// - central configuration file is used when `-C` flag is used
+fn doubleglob() {
+    let page = get(&["-C"], "gemini://localhost/testdir/a.nl.gmi").expect("could not get page");
+    assert_eq!(page.status, Status::Success.value());
+    assert_eq!(page.meta, "text/gemini;lang=nl");
+}
+
+#[test]
+/// - full header lines can be set in the configuration file
+fn full_header_preset() {
+    let page = get(&[], "gemini://localhost/gone.txt").expect("could not get page");
+    assert_eq!(page.status, Status::Gone.value());
+    assert_eq!(page.meta, "This file is no longer available.");
+}
+
+#[test]
+/// - URLS with fragments are rejected
+fn fragment() {
+    let page = get(
+        &["--hostname", "example.com"],
+        "gemini://example.com/#fragment",
+    )
+    .expect("could not get page");
+
+    assert_eq!(page.status, Status::BadRequest.value());
+}
+
+#[test]
+/// - URLS with username are rejected
+fn username() {
+    let page = get(&["--hostname", "example.com"], "gemini://user@example.com/")
+        .expect("could not get page");
+
+    assert_eq!(page.status, Status::BadRequest.value());
+}
+
+#[test]
+/// - URLS with invalid hostnames are rejected
+fn percent_encode() {
+    // Can't use `get` here because we are testing a URL thats invalid so
+    // the gemini fetching library can not process it.
+    let mut server = Server::new(&["--certs", "multicert"]);
+
+    let mut certs = RootCertStore::empty();
+    certs
+        .add(CertificateDer::from(
+            include_bytes!("data/multicert/example.com/cert.der").as_slice(),
+        ))
+        .unwrap();
+    let config = rustls::ClientConfig::builder()
+        .with_root_certificates(certs)
+        .with_no_client_auth();
+
+    let mut session = ClientConnection::new(
+        std::sync::Arc::new(config),
+        "example.com".try_into().unwrap(),
+    )
+    .unwrap();
+    let mut tcp = TcpStream::connect(server.get_addr()).unwrap();
+    let mut tls = rustls::Stream::new(&mut session, &mut tcp);
+
+    write!(tls, "gemini://%/\r\n").unwrap();
+
+    let mut buf = [0; 10];
+    let _ = tls.read(&mut buf);
+
+    assert_eq!(&buf[0..2], b"59");
+
+    server.stop().unwrap();
+}
+
+#[test]
+/// - URLS with password are rejected
+fn password() {
+    let page = get(
+        &["--hostname", "example.com"],
+        "gemini://:secret@example.com/",
+    )
+    .expect("could not get page");
+
+    assert_eq!(page.status, Status::BadRequest.value());
+}
+
+#[test]
+/// - hostname is checked when provided
+/// - status for wrong host is "proxy request refused"
+fn hostname_check() {
+    let page =
+        get(&["--hostname", "example.org"], "gemini://example.com/").expect("could not get page");
+
+    assert_eq!(page.status, Status::ProxyRequestRefused.value());
+}
+
+#[test]
+/// - port is checked when hostname is provided
+/// - status for wrong port is "proxy request refused"
+fn port_check() {
+    let page =
+        get(&["--hostname", "example.org"], "gemini://example.org:1/").expect("could not get page");
+
+    assert_eq!(page.status, Status::ProxyRequestRefused.value());
+}
+
+#[test]
+/// - port is not checked if the skip option is passed.
+fn port_check_skipped() {
+    let page = get(
+        &["--hostname", "example.org", "--skip-port-check"],
+        "gemini://example.org:1/",
+    )
+    .expect("could not get page");
+
+    assert_eq!(page.status, Status::Success.value());
+}
+
+#[test]
+/// - status for paths with hidden segments is "gone" if file does not exist
+fn secret_nonexistent() {
+    let page = get(&[], "gemini://localhost/.non-existing-secret").expect("could not get page");
+
+    assert_eq!(page.status, Status::Gone.value());
+}
+
+#[test]
+/// - status for paths with hidden segments is "gone" if file exists
+fn secret_exists() {
+    let page = get(&[], "gemini://localhost/.meta").expect("could not get page");
+
+    assert_eq!(page.status, Status::Gone.value());
+}
+
+#[test]
+/// - status for paths with hidden segments is "gone" if the respective segment is not the last
+fn secret_subdir() {
+    let page =
+        get(&["-C"], "gemini://localhost/.well-known/hidden-file").expect("could not get page");
+
+    assert_eq!(page.status, Status::Gone.value());
+}
+
+#[test]
+/// - secret file served if `--serve-secret` is enabled
+fn serve_secret() {
+    let page = get(&["--serve-secret"], "gemini://localhost/.meta").expect("could not get page");
+
+    assert_eq!(page.status, Status::Success.value());
+}
+
+#[test]
+/// - secret file served if path is in sidecar
+fn serve_secret_meta_config() {
+    let page = get(&[], "gemini://localhost/.servable-secret").expect("could not get page");
+
+    assert_eq!(page.status, Status::Success.value());
+}
+
+#[test]
+/// - secret file served if path with subdir is in sidecar
+fn serve_secret_meta_config_subdir() {
+    let page =
+        get(&["-C"], "gemini://localhost/.well-known/servable-secret").expect("could not get page");
+
+    assert_eq!(page.status, Status::Success.value());
+}
+
+#[test]
+/// - directory traversal attacks using percent-encoded path separators
+///   fail (this addresses a previous vulnerability)
+fn directory_traversal_regression() {
+    let base = Url::parse("gemini://localhost/").unwrap();
+
+    let mut absolute = base.clone();
+    absolute
+        .path_segments_mut()
+        .unwrap()
+        .push(env!("CARGO_MANIFEST_DIR")) // separators will be percent-encoded
+        .push("tests")
+        .push("data")
+        .push("directory_traversal.gmi");
+
+    let mut relative_escape_path = PathBuf::new();
+    relative_escape_path.push("testdir");
+    relative_escape_path.push("..");
+    relative_escape_path.push("..");
+    let mut relative = base;
+    relative
+        .path_segments_mut()
+        .unwrap()
+        .push(relative_escape_path.to_str().unwrap()) // separators will be percent-encoded
+        .push("directory_traversal.gmi");
+
+    let urls = [absolute, relative];
+    for url in urls.iter() {
+        let page = get(&[], url.as_str()).expect("could not get page");
+        assert_eq!(page.status, Status::NotFound.value());
+    }
+}
+
+#[test]
+/// - if TLSv1.3 is selected, does not accept TLSv1.2 connections
+///   (lower versions do not have to be tested because rustls does not even
+///   support them, making agate incapable of accepting them)
+fn explicit_tls_version() {
+    let server = Server::new(&["-3"]);
+
+    // try to connect using only TLS 1.2
+    let config = rustls::ClientConfig::builder_with_protocol_versions(&[&rustls::version::TLS12])
+        .with_root_certificates(RootCertStore::empty())
+        .with_no_client_auth();
+
+    let mut session =
+        ClientConnection::new(std::sync::Arc::new(config), "localhost".try_into().unwrap())
+            .unwrap();
+    let mut tcp = TcpStream::connect(server.get_addr()).unwrap();
+    let mut tls = rustls::Stream::new(&mut session, &mut tcp);
+
+    let mut buf = [0; 10];
+    assert_eq!(
+        *tls.read(&mut buf)
+            .unwrap_err()
+            .into_inner()
+            .unwrap()
+            .downcast::<rustls::Error>()
+            .unwrap(),
+        rustls::Error::AlertReceived(rustls::AlertDescription::ProtocolVersion)
+    )
+}
+
+mod vhosts {
+    use super::*;
+
+    #[test]
+    /// - simple vhosts are enabled when multiple hostnames are supplied
+    /// - the vhosts access the correct files
+    /// - the hostname comparison is case insensitive
+    /// - the hostname is converted to lower case to access certificates
+    fn example_com() {
+        let page = get(
+            &["--hostname", "example.com", "--hostname", "example.org"],
+            "gemini://Example.com/",
+        )
+        .expect("could not get page");
+
+        assert_eq!(page.status, Status::Success.value());
+        assert_eq!(
+            page.content,
+            include_bytes!("data/content/example.com/index.gmi")
+        );
+    }
+
+    #[test]
+    /// - the vhosts access the correct files
+    fn example_org() {
+        let page = get(
+            &["--hostname", "example.com", "--hostname", "example.org"],
+            "gemini://example.org/",
+        )
+        .expect("could not get page");
+
+        assert_eq!(page.status, Status::Success.value());
+        assert_eq!(
+            page.content,
+            include_bytes!("data/content/example.org/index.gmi")
+        );
+    }
+}
+
+mod multicert {
+    use super::*;
+    use rustls::{ClientConnection, RootCertStore, pki_types::CertificateDer};
+    use std::io::Write;
+    use std::net::TcpStream;
+
+    #[test]
+    #[should_panic]
+    fn cert_missing() {
+        let mut server = Server::new(&["--certs", "cert_missing"]);
+
+        // wait for the server to stop, it should crash
+        let _ = server.server.wait();
+    }
+
+    #[test]
+    #[should_panic]
+    fn key_missing() {
+        let mut server = Server::new(&["--certs", "key_missing"]);
+
+        // wait for the server to stop, it should crash
+        let _ = server.server.wait();
+    }
+
+    #[test]
+    fn example_com() {
+        let mut server = Server::new(&["--certs", "multicert"]);
+
+        let mut certs = RootCertStore::empty();
+        certs
+            .add(CertificateDer::from(
+                include_bytes!("data/multicert/example.com/cert.der").as_slice(),
+            ))
+            .unwrap();
+        let config = rustls::ClientConfig::builder()
+            .with_root_certificates(certs)
+            .with_no_client_auth();
+
+        let mut session = ClientConnection::new(
+            std::sync::Arc::new(config),
+            "example.com".try_into().unwrap(),
+        )
+        .unwrap();
+        let mut tcp = TcpStream::connect(server.get_addr()).unwrap();
+        let mut tls = rustls::Stream::new(&mut session, &mut tcp);
+
+        write!(tls, "gemini://example.com/\r\n").unwrap();
+
+        let mut buf = [0; 10];
+        let _ = tls.read(&mut buf);
+
+        server.stop().unwrap();
+    }
+
+    #[test]
+    fn example_org() {
+        let mut server = Server::new(&["--certs", "multicert"]);
+
+        let mut certs = RootCertStore::empty();
+        certs
+            .add(CertificateDer::from(
+                include_bytes!("data/multicert/example.org/cert.der").as_slice(),
+            ))
+            .unwrap();
+        let config = rustls::ClientConfig::builder()
+            .with_root_certificates(certs)
+            .with_no_client_auth();
+
+        let mut session = ClientConnection::new(
+            std::sync::Arc::new(config),
+            "example.org".try_into().unwrap(),
+        )
+        .unwrap();
+        let mut tcp = TcpStream::connect(server.get_addr()).unwrap();
+        let mut tls = rustls::Stream::new(&mut session, &mut tcp);
+
+        write!(tls, "gemini://example.org/\r\n").unwrap();
+
+        let mut buf = [0; 10];
+        let _ = tls.read(&mut buf);
+
+        server.stop().unwrap();
+    }
+}
+
+mod directory_listing {
+    use super::*;
+
+    #[test]
+    /// - shows directory listing when enabled
+    /// - shows directory listing preamble correctly
+    /// - encodes link URLs correctly
+    fn with_preamble() {
+        let page = get(&["--content", "dirlist-preamble"], "gemini://localhost/")
+            .expect("could not get page");
+
+        assert_eq!(page.status, Status::Success.value());
+        assert_eq!(page.meta, "text/gemini");
+        assert_eq!(
+            page.content,
+            b"This is a directory listing\n=> a\n=> b\n=> wao%20spaces wao spaces\n"
+        );
+    }
+
+    #[test]
+    fn empty_preamble() {
+        let page =
+            get(&["--content", "dirlist"], "gemini://localhost/").expect("could not get page");
+
+        assert_eq!(page.status, Status::Success.value());
+        assert_eq!(page.meta, "text/gemini");
+        assert_eq!(page.content, b"=> a\n=> b\n");
+    }
+}

tools/README.md

@@ -0,0 +1,2 @@
+This directory contains some useful tools if you want to use Agate like service files or installer scripts. If you use Agate on a system not present here, your pull request is welcome!
+We also welcome pull requests for other files for tools you might find helpful to use in conjunction with Agate.

tools/debian/README.md

@@ -0,0 +1,30 @@
+If you want to run agate on a pretty much standard Debian install, this
+directory contains some additional materials that may help you.
+
+Please keep in mind that there is no warranty whatsoever provided for this
+software as specified in the disclaimer in the MIT license or section 7 of
+the Apache license respectively.
+
+To run Agate as a service with systemd, put the `gemini.service` file
+in the directory `/etc/systemd/system/` (copy or move it there).
+
+This service file has some comments you may want to look at before using it!
+
+If you use the service file and want the agate logs in a separate file,
+using the gemini.conf file and putting it in the directory
+`/etc/rsyslog.d/` will make the agate log messages appear in a file
+called `/var/log/gemini.log`.
+
+If you use Debians `logrotate` and want to automatically rotate these log files,
+you can use the `geminilogs` file and put it in `/etc/logrotate.d/`.
+
+You can also use the `install.sh` file which will check if these systems
+are installed (but not if they are running) and copy the files to their
+described locations. Please ensure your systems hostname is set correctly
+(i.e. `uname -n` should give your domain name).
+
+You will have to run this with elevated privileges, i.e. `sudo ./install.sh`
+to work correctly. This install script will also create the necessary content
+directories and the certificate and private key in the `/srv/gemini/`
+directory. After the script is done sucessfully, you can start by putting
+content in `/srv/gemini/content/`, the server is running already!

tools/debian/gemini.conf

@@ -0,0 +1,2 @@
+if $programname == 'gemini' then /var/log/gemini.log
+& stop

tools/debian/gemini.service

@@ -0,0 +1,28 @@
+# This file is part of the Agate software and licensed under either the
+# MIT license or Apache license at your option.
+#
+# Please keep in mind that there is no warranty whatsoever provided for this
+# software as specified in the disclaimer in the MIT license or section 7 of
+# the Apache license respectively.
+
+[Unit]
+Description=Agate gemini server
+
+[Service]
+# you should place the certificate and key file in this directory
+# and place the contents to be displayed in /srv/gemini/content
+WorkingDirectory=/srv/gemini/
+# assumes the device hostname is set correctly
+ExecStart=/bin/sh -c "agate --hostname $(uname -n) --lang en"
+
+Restart=always
+RestartSec=1
+
+StandardOutput=syslog
+StandardError=syslog
+# adds a syslog identifier so you can have these logs filtered into
+# a separate file
+SyslogIdentifier=gemini
+
+[Install]
+WantedBy=multi-user.target

tools/debian/geminilogs

@@ -0,0 +1,10 @@
+/var/log/gemini.log {
+	daily
+	missingok
+	rotate 14
+	compress
+	delaycompress
+	notifempty
+	create 0640 root adm
+	sharedscripts
+}

tools/debian/install.sh

@@ -0,0 +1,81 @@
+#!/bin/bash
+# This file is part of the Agate software and licensed under either the
+# MIT license or Apache license at your option.
+#
+# Please keep in mind that there is not warranty whatsoever provided for this
+# software as specified in the disclaimer in the MIT license or section 7 of
+# the Apache license respectively.
+
+echo -n "checking:agate......."
+if command -v agate >/dev/null
+then
+	echo "found"
+else
+	echo "FAILED"
+	echo "Agate is probably not in your PATH variable."
+	echo "If you installed it with cargo, try linking the binary to /usr/local/bin with something like this:"
+	echo "    ln -s $HOME/.cargo/bin/agate /usr/local/bin/agate"
+	echo "or what seems reasonable to you."
+	exit 1
+fi
+
+echo -n "checking:systemd....."
+if [[ "$(cat /proc/1/comm)" != "systemd" ]]
+then
+	echo "NOT THE INIT PROCESS"
+	echo "Your system seems to not use systemd, sorry. Aborting."
+	exit 1
+else
+	echo "installed and running"
+fi
+
+echo -n "checking:rsyslogd...."
+if command -v rsyslogd >/dev/null
+then
+	echo -n "installed"
+	if ps cax | grep -q "rsyslogd"
+	then
+		echo " and running"
+	else
+		echo " but not running!"
+		echo "You should enable rsyslogd to use this functionality."
+	fi
+else
+	echo "NOT INSTALLED!"
+	echo "Aborting."
+	exit 1
+fi
+
+echo -n "checking:logrotate..."
+if type logrotate >/dev/null 2>&1
+then
+	echo "installed, but I cannot check if it is enabled"
+else
+	echo "NOT INSTALLED!"
+	echo "Aborting."
+	exit 1
+fi
+
+# immediately exit if one of the following commands fails
+set -e
+
+echo "copying config files..."
+cp gemini.service /etc/systemd/system/
+cp gemini.conf /etc/rsyslog.d/
+cp geminilogs /etc/logrotate.d/
+
+echo "setting up content files..."
+mkdir -p /srv/gemini/content
+mkdir -p /srv/gemini/.certificates
+# agate will generate certificates on first run
+
+echo "starting service..."
+systemctl daemon-reload
+systemctl restart rsyslog
+systemctl enable gemini
+systemctl start gemini
+
+echo "setup done, checking..."
+# wait until the restarts would have timed out
+sleep 10
+systemctl status gemini

tools/debian/uninstall.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# This file is part of the Agate software and licensed under either the
+# MIT license or Apache license at your option.
+#
+# Please keep in mind that there is not warranty whatsoever provided for this
+# software as specified in the disclaimer in the MIT license or section 7 of
+# the Apache license respectively.
+
+echo "stopping and disabling service..."
+systemctl stop gemini
+systemctl disable gemini
+
+echo "removing config files..."
+rm -f /etc/systemd/system/gemini.service /etc/rsyslog.d/gemini.conf /etc/logrotate.d/geminilogs
+
+echo "deleting certificates..."
+rm -rf /srv/gemini/.certificates
+# do not delete content files, user might want to use them still or can delete them manually
+echo "NOTE: content files at /srv/gemini/content not deleted"
+# cannot uninstall executable since we did not install it
+echo "NOTE: agate executable at $(which agate) not uninstalled"

tools/freebsd/startup.sh

@@ -0,0 +1,53 @@
+#!/bin/sh
+
+# $FreeBSD$
+#
+# PROVIDE: agate
+# REQUIRE: LOGIN
+# KEYWORD: shutdown
+#
+# Add these lines to /etc/rc.conf.local or /etc/rc.conf
+# to enable this service:
+#
+# agate_enable (bool):  Set to NO by default.
+#                       Set it to YES to enable agate.
+# agate_user:           default www
+# agate_content:        default /usr/local/www/gemini
+# agate_key:            default /usr/local/etc/gemini/ssl/key.der
+# agate_cert:           default /usr/local/etc/gemini/ssl/cert.der
+# agate_hostname:       e.g., gemini.example.tld, default hostname
+# agate_addr:           default [::], listen on IPV4 and IPV6
+# agate_port:           default 1965
+# agate_lang:           default en_US
+# agate_logfile:        default /var/log/gemini/agate.log
+
+. /etc/rc.subr
+
+desc="Agate Gemini server"
+name=agate
+rcvar=$name_enable
+
+load_rc_config $name
+
+: ${agate_enable:="NO"}
+: ${agate_user:="www"}
+: ${agate_content:="/usr/local/www/gemini/"}
+: ${agate_key:="/usr/local/etc/gemini/ssl/key.der"}
+: ${agate_cert:="/usr/local/etc/gemini/ssl/cert.der"}
+: ${agate_hostname:=`uname -n`}
+: ${agate_addr:="[::]"}
+: ${agate_port:="1965"}
+: ${agate_lang:="en-US"}
+: ${agate_logfile:="/var/log/gemini/agate.log"}
+
+agate_user=${agate_user}
+
+command="/usr/local/bin/agate"
+command_args="--content ${agate_content} \
+       --key ${agate_key} \
+       --cert ${agate_cert} \
+       --addr ${agate_addr}:${agate_port} \
+       --hostname ${agate_hostname} \
+       --lang ${agate_lang} >> ${agate_logfile} 2>&1 &"
+
+run_rc_command "$1"