Update dependencies

Bumps [env_logger](https://github.com/rust-cli/env_logger) from 0.11.8 to 0.11.9.
- [Release notes](https://github.com/rust-cli/env_logger/releases)
- [Changelog](https://github.com/rust-cli/env_logger/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rust-cli/env_logger/compare/v0.11.8...v0.11.9)

---
updated-dependencies:
- dependency-name: env_logger
  dependency-version: 0.11.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.dockerignore

@@ -0,0 +1,7 @@
+**
+
+!src/**
+!tools/docker/**
+!Cross.toml
+!Cargo.toml
+!Cargo.lock

.github/dependabot.yml

@@ -0,0 +1,21 @@
+---
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: chore
+      include: scope
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    allow:
+      - dependency-type: "direct"
+    commit-message:
+      prefix: chore
+      include: scope

.github/workflows/cargo-audit.yml

@@ -0,0 +1,19 @@
+name: Cargo Audit Scanning
+on:
+  push:
+    paths:
+      - "**/Cargo.toml"
+      - "**/Cargo.lock"
+  schedule:
+    - cron: "0 14 * * *" # 14:00 UTC
+jobs:
+  cargo-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions-rs/audit-check@v1
+        # Don't run on dependabot PRs or forks
+        # https://github.com/actions-rs/clippy-check/issues/2#issuecomment-807852653
+        if: github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.sh

@@ -3,6 +3,7 @@
 # Since this is not supervised, abort if anything does not work.
 set -e
 
+sudo apt update
 # Cross-compiling needs a linker for the respective platforms. If you are on a Debian-based x86_64 Linux,
 # you can install them with:
 sudo apt -y install podman gcc-arm-linux-gnueabihf gcc-aarch64-linux-gnu

.github/workflows/release.yml

@@ -1,6 +1,6 @@
 name: Release Builds
 
-on: 
+on:
   push:
     tags:
       - 'v*' # on every version tag
@@ -12,100 +12,108 @@ jobs:
     steps:
     - name: create release
       id: create_release
-      uses: actions/create-release@v1
+      uses: ncipollo/release-action@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        tag_name: ${{ github.ref }}
-        release_name: ${{ github.ref }}
-        # only draft the release so changelog can be edited
-        draft: true
-        prerelease: false
-    outputs:
-      upload_url: ${{ steps.create_release.outputs.upload_url }}
 
   build_ubuntu:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     needs: create_release
     steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v6
     - name: build
-      run: bash release.sh
+      run: bash .github/workflows/release.sh
-    - name: upload release asset x86_64
+    - name: upload release assets linux
-      uses: actions/upload-release-asset@v1
+      uses: AButler/upload-release-assets@v3.0
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
-        upload_url: ${{ needs.create_release.outputs.upload_url }}
+        files: 'agate.*.gz'
-        asset_path: ./agate.x86_64-unknown-linux-gnu.gz
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        asset_name: agate.x86_64-unknown-linux-gnu.gz
+        release-tag: ${{ github.ref_name }}
-        asset_content_type: application/gzip
-    - name: upload release asset arm
-      uses: actions/upload-release-asset@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        upload_url: ${{ needs.create_release.outputs.upload_url }}
-        asset_path: ./agate.arm-unknown-linux-gnueabihf.gz
-        asset_name: agate.arm-unknown-linux-gnueabihf.gz
-        asset_content_type: application/gzip
-    - name: upload release asset armv7
-      uses: actions/upload-release-asset@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        upload_url: ${{ needs.create_release.outputs.upload_url }}
-        asset_path: ./agate.armv7-unknown-linux-gnueabihf.gz
-        asset_name: agate.armv7-unknown-linux-gnueabihf.gz
-        asset_content_type: application/gzip
-    - name: upload release asset aarch64
-      uses: actions/upload-release-asset@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        upload_url: ${{ needs.create_release.outputs.upload_url }}
-        asset_path: ./agate.aarch64-unknown-linux-gnu.gz
-        asset_name: agate.aarch64-unknown-linux-gnu.gz
-        asset_content_type: application/gzip
 
   build_windows:
     runs-on: windows-latest
     needs: create_release
     steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v6
     - name: Build
       run: cargo build --verbose --release
     - name: strip names
       run: strip target/release/agate.exe
     - name: compress
-      run: Compress-Archive -LiteralPath target/release/agate.exe -DestinationPath agate.zip
+      run: Compress-Archive -LiteralPath target/release/agate.exe -DestinationPath agate.x86_64-pc-windows-msvc.zip
     - name: upload release asset win
-      uses: actions/upload-release-asset@v1
+      uses: AButler/upload-release-assets@v3.0
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
-        upload_url: ${{ needs.create_release.outputs.upload_url }}
+        files: agate.x86_64-pc-windows-msvc.zip
-        asset_name: agate.x86_64-pc-windows-msvc.zip
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        asset_path: agate.zip
+        release-tag: ${{ github.ref_name }}
-        asset_content_type: application/zip
 
-  build_macos:
+  build_macos_x86_64:
     runs-on: macos-latest
     needs: create_release
     steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v6
-    - name: Build
+    - name: install toolchain
+      run: rustup target add aarch64-apple-darwin
+    - name: Build x86_64
       run: cargo build --verbose --release
-    - name: strip names
+    - name: strip names x86
       run: strip target/release/agate
-    - name: compress
+    - name: compress x86
-      run: gzip -c target/release/agate > ./agate.gz
+      run: gzip -c target/release/agate > ./agate.x86_64-apple-darwin.gz
-    - name: upload release asset darwin
+    - name: Build ARM
-      uses: actions/upload-release-asset@v1
+      run: SDKROOT=$(xcrun -sdk macosx --show-sdk-path) MACOSX_DEPLOYMENT_TARGET=$(xcrun -sdk macosx --show-sdk-platform-version) cargo build --verbose --release --target=aarch64-apple-darwin
-      env:
+    - name: strip names ARM
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: strip target/aarch64-apple-darwin/release/agate
+    - name: compress ARM
+      run: gzip -c target/aarch64-apple-darwin/release/agate > ./agate.aarch64-apple-darwin.gz
+    - name: upload release assets darwin
+      uses: AButler/upload-release-assets@v3.0
       with:
-        upload_url: ${{ needs.create_release.outputs.upload_url }}
+        files: 'agate.*.gz'
-        asset_path: ./agate.gz
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        asset_name: agate.x86_64-apple-darwin.gz
+        release-tag: ${{ github.ref_name }}
-        asset_content_type: application/gzip
+
+  build_docker:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Log into GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Extract metadata for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          # Because this workflow only runs on commits tagged `v*` (i n semver format) this section ensures that
+          # a docker build tagged `v1.2.3+podman.build` is tagged with `1`, `1.2`, `1.2.3` and `1.2.3+podman.build`
+          # as well as being tagged with `latest`. For each of these, a subsequent build that has the same tag will
+          # replace it. This means that pulling `ghcr.io/mbrubeck/agate:1` will always get the most recent image
+          # released with a v1 tag, container, `ghcr.io/mbrubeck/agate:1.2` will get the latest v1.2 tag, and so on.
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}.{{patch}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/test.yml

@@ -2,23 +2,35 @@ name: Tests
 
 on:
   push:
+    branches-ignore:
+      - dependabot/*
   pull_request:
     branches:
       - master
 
 jobs:
-  build:
+  clippy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
-      - uses: actions-rs/clippy-check@v1
+      - name: Run clippy action to produce annotations
+        # Don't run on dependabot PRs
+        # https://github.com/actions-rs/clippy-check/issues/2#issuecomment-807852653
+        if: github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'
+        uses: actions-rs/clippy-check@v1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           args: --all-features
+      - name: Run clippy manually without annotations
+        if: github.event.pull_request.head.repo.full_name != github.repository || github.actor == 'dependabot[bot]'
+        uses: actions-rs/cargo@v1
+        with:
+          command: clippy
+          args: --all-targets -- -D warnings
   formatting:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
       - name: Formatting
         uses: actions-rs/cargo@v1
         with:
@@ -27,7 +39,7 @@ jobs:
   tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v6
       - uses: actions-rs/cargo@v1
         with:
           command: test

.gitignore

@@ -1 +1,2 @@
 /target
+/.certificates

.mailmap

@@ -0,0 +1,3 @@
+<johann.galle@protonmail.com> <johann@qwertqwefsday.eu>
+<johann.galle@protonmail.com> <20990607+Johann150@users.noreply.github.com>
+j-k <dev@j-k.io>

CHANGELOG.md

@@ -5,8 +5,162 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+Updates to dependencies are not considered notable changes for the purpose of this changelog.
+This may lead to no listed changes for a version.
+
 ## [Unreleased]
 
+## [3.3.19] - 2025-09-18
+
+### Fixed
+* Update dependencies.
+* Document commands for converting PEM to DER.
+
+## [3.3.18] - 2025-08-05
+## [3.3.17] - 2025-06-27
+## [3.3.16] - 2025-05-06
+
+### Changed
+* Build release artifacts with Ubuntu 22.04, because Ubuntu 20.04 is no longer supported
+	* pre-built binaries may no longer run on Linux distributions older than Ubuntu 22.04 (glibc 2.35)
+	* users with older glibc versions will need to build from source
+
+## [3.3.15] - 2025-05-06
+## [3.3.14] - 2025-03-24
+## [3.3.13] - 2025-02-24
+Thank you to @luineth for contributing to this release.
+
+### Added
+* aarch64 support for Docker image (#376)
+
+## [3.3.12] - 2025-02-18
+## [3.3.11] - 2024-11-29
+Thank you to @geraldwuhoo and @jphastings for contributing to this release.
+
+### Added
+* Automatically publish docker images to GHCR (#366)
+
+### Fixed
+* Refactor Dockerfile for multi-stage build (#144)
+
+## [3.3.10] - 2024-11-04
+## [3.3.9] - 2024-09-10
+## [3.3.8] - 2024-07-24
+## [3.3.7] - 2024-04-01
+## [3.3.6] - 2024-03-22
+## [3.3.5] - 2024-03-15
+
+### Fixed
+* updated and simplified dependencies
+* fix syntax of license field in Cargo manifest
+
+## [3.3.4] - 2024-01-16
+
+### Fixed
+* cleaned up documentation
+
+## [3.3.3] - 2023-12-27
+
+### Fixed
+* fixed release automation
+
+## [3.3.2] - 2023-12-27
+## [3.3.1] - 2023-08-05
+Thank you to Jan Stępień and @michaelnordmeyer for contributing to this release.
+
+### Fixed
+* set permissions for generated key files so only owner can read them
+* improve documentation and tests
+
+## [3.3.0] - 2023-03-18
+Thank you to @equalsraf, @michaelnordmeyer and @wanderer1988 for contributing to this release.
+
+### Added
+* listening on unix sockets (#244)
+
+### Fixed
+* misstyped email address in section on how to report security vulnerabilities (#239)
+* wrong language code in README (#189)
+
+## [3.2.4] - 2022-05-18
+Thank you to @06kellyjac, @albertlarsan68 and @kahays for contributing to this release.
+
+### Fixed
+* removed port collisions in tests, for the last time (#143)
+* fixed Dockerfile startup command (#169)
+
+## [3.2.3] - 2022-02-04
+Thank you to T. Spivey for contributing to this release.
+
+### Fixed
+* improper IRIs are handled instead of crashing (bug reported via email)
+
+## [3.2.2] - 2022-01-25
+Thank you to @Suzie97 for contributing to this release.
+
+### Added
+* CI build for `aarch64-apple-darwin` target (#137)
+
+## [3.2.1] - 2021-12-02
+Thank you to @MatthiasPortzel for contributing to this release.
+
+### Fixed
+* host name comparisons are now case insensitive (#115)
+* made automatic certificate configuration more prominent in the README
+
+## [3.2.0] - 2021-11-15
+Thank you to @balazsbtond and @joseph-marques for contributing to this release.
+
+### Added
+* you can add header text to a directory listing. See the updated readme for details. (#98)
+
+### Fixed
+* error pages also send close_notify (#100)
+
+## [3.1.3] - 2021-10-25
+Thank you to @FoxKyong for contributing to this release.
+
+### Fixed
+* the fix for dual stack listening from 3.1.2 was executed asynchronously and would thus
+  sometimes fail. starting the listeners on different socket addresses is now synchronous
+  (#79)
+
+## [3.1.2] - 2021-10-15
+Thank you to @etam for contributing to this release.
+
+### Fixed
+* when starting up on a system that automatically listens in dual stack mode (e.g. some
+  linux distributions seem to do this), detect a second unspecified address to not cause
+  the "address in use" error with the default listening addresses (#79)
+* updated a dependency
+
+## [3.1.1] - 2021-10-14
+Thank you to @jgarte and @alvaro-cuesta for contributing to this release.
+
+### Added
+* running Agate using GNU Guix (#62)
+
+### Fixed
+* actually bind to multiple IP addresses. Despite the documentation saying so,
+  Agate would only bind to the first address that did not result in an error. (#63)
+
+## [3.1.0] - 2021-06-08
+Thank you to Matthew Ingwersen and Oliver Simmons (@GoodClover) for contributing to this release.
+
+### Added
+* tests for symlink files (#60)
+  Symlinks were already working before.
+
+### Fixed
+* A path traversal security issue was closed: Percent-encoded slashes were misunderstood.
+
+### Changed
+* Visiting a directory without `index.gmi` and `.directory-listing-ok` now returns a different error message to better show the cause of the error.
+  To retain the current behaviour of showing a `51 Not found, sorry.` error, add the following line to the respective directories' `.meta` file:
+```
+index.gmi: 51 Not found, sorry.
+```
+
 ## [3.0.3] - 2021-05-24
 Thank you to @06kellyjac, @cpnfeeny, @lifelike, @skittlesvampir and @steko for contributing to this release.
 
@@ -18,7 +172,6 @@ Thank you to @06kellyjac, @cpnfeeny, @lifelike, @skittlesvampir and @steko for c
   The previous handling could be exploited as a DoS attack vector. (#59)
 * Two tests were running on the same port, causing them to fail nondeterministically. (#51)
 * Rephrased the changelog for 3.0.0 on continuing to use older certificates. (#55)
-* Updated dependencies.
 
 ## [3.0.2] - 2021-04-08
 Thank you to @kvibber, @lifelike and @pasdechance for contributing to this release.
@@ -81,7 +234,6 @@ Thank you to @littleli and @06kellyjac for contributing to this release.
 * The GitHub workflow has been fixed so Windows binaries are compressed correctly (#36).
 * Split out install steps to allow for more options in the future.
 * Add install notes for nix/NixOS to the README (#38).
-* Updated dependencies.
 
 ## [2.5.2] - 2021-02-12
 
@@ -178,9 +330,6 @@ Thank you to @Johann150 and @KilianKemps for contributing to this release.
 ### Added
 * Optional directory listings (#8, #9).
 
-### Fixed
-* Updated dependencies.
-
 ## [2.0.0] - 2020-12-23
 Thank you to @bortzmeyer, @KillianKemps, and @Ylhp for contributing to this release.
 
@@ -211,7 +360,6 @@ Thank you @Johann150, @jonhiggs and @tronje for contributing to this release!
 * verify hostname and port in request URL (#4).
 * improved logging (#2, #3).
 * Don't redirect to "/" when the path is empty (#5).
-* Update dependencies.
 
 ## [1.2.2] - 2020-09-21
 Thank you to @m040601 for contributing to this release.
@@ -221,13 +369,11 @@ Thank you to @m040601 for contributing to this release.
 * Built both x86_64 and ARM binaries. These binaries are built for Linux operating systems with glibc 2.28 or later, such as Debian 10 ("buster") or newer, Ubuntu 18.10 or newer, and Raspberry Pi OS 2019-06-20 or newer (#1).
 
 ### Fixed
-* Update dependencies.
 * Minor internal code cleanup.
 
 ## [1.2.1] - 2020-06-20
 ### Fixed
 * Reduce memory usage when serving large files.
-* Update dependencies.
 
 ## [1.2.0] - 2020-06-10
 ### Changed
@@ -236,7 +382,6 @@ Thank you to @m040601 for contributing to this release.
 ### Fixed
 * Handling for requests that exceed 1KB.
 * Reduce memory allocations and speed up request parsing.
-* Update dependencies.
 
 ## [1.1.0] - 2020-05-22
 ### Added
@@ -249,7 +394,35 @@ Thank you to @m040601 for contributing to this release.
 
 ## [1.0.0] - 2020-05-21
 
-[Unreleased]: https://github.com/mbrubeck/agate/compare/v3.0.3...HEAD
+[Unreleased]: https://github.com/mbrubeck/agate/compare/v3.3.18...HEAD
+[3.3.18]: https://github.com/mbrubeck/agate/compare/v3.3.17...v3.3.18
+[3.3.17]: https://github.com/mbrubeck/agate/compare/v3.3.16...v3.3.17
+[3.3.16]: https://github.com/mbrubeck/agate/compare/v3.3.15...v3.3.16
+[3.3.15]: https://github.com/mbrubeck/agate/compare/v3.3.14...v3.3.15
+[3.3.14]: https://github.com/mbrubeck/agate/compare/v3.3.13...v3.3.14
+[3.3.13]: https://github.com/mbrubeck/agate/compare/v3.3.12...v3.3.13
+[3.3.12]: https://github.com/mbrubeck/agate/compare/v3.3.11...v3.3.12
+[3.3.11]: https://github.com/mbrubeck/agate/compare/v3.3.10...v3.3.11
+[3.3.10]: https://github.com/mbrubeck/agate/compare/v3.3.9...v3.3.10
+[3.3.9]: https://github.com/mbrubeck/agate/compare/v3.3.8...v3.3.9
+[3.3.8]: https://github.com/mbrubeck/agate/compare/v3.3.7...v3.3.8
+[3.3.7]: https://github.com/mbrubeck/agate/compare/v3.3.6...v3.3.7
+[3.3.6]: https://github.com/mbrubeck/agate/compare/v3.3.5...v3.3.6
+[3.3.5]: https://github.com/mbrubeck/agate/compare/v3.3.4...v3.3.5
+[3.3.4]: https://github.com/mbrubeck/agate/compare/v3.3.3...v3.3.4
+[3.3.3]: https://github.com/mbrubeck/agate/compare/v3.3.2...v3.3.3
+[3.3.2]: https://github.com/mbrubeck/agate/compare/v3.3.1...v3.3.2
+[3.3.1]: https://github.com/mbrubeck/agate/compare/v3.3.0...v3.3.1
+[3.3.0]: https://github.com/mbrubeck/agate/compare/v3.2.4...v3.3.0
+[3.2.4]: https://github.com/mbrubeck/agate/compare/v3.2.3...v3.2.4
+[3.2.3]: https://github.com/mbrubeck/agate/compare/v3.2.2...v3.2.3
+[3.2.2]: https://github.com/mbrubeck/agate/compare/v3.2.1...v3.2.2
+[3.2.1]: https://github.com/mbrubeck/agate/compare/v3.2.0...v3.2.1
+[3.2.0]: https://github.com/mbrubeck/agate/compare/v3.1.3...v3.2.0
+[3.1.3]: https://github.com/mbrubeck/agate/compare/v3.1.2...v3.1.3
+[3.1.2]: https://github.com/mbrubeck/agate/compare/v3.1.1...v3.1.2
+[3.1.1]: https://github.com/mbrubeck/agate/compare/v3.1.0...v3.1.1
+[3.1.0]: https://github.com/mbrubeck/agate/compare/v3.0.3...v3.1.0
 [3.0.3]: https://github.com/mbrubeck/agate/compare/v3.0.2...v3.0.3
 [3.0.2]: https://github.com/mbrubeck/agate/compare/v3.0.1...v3.0.2
 [3.0.1]: https://github.com/mbrubeck/agate/compare/v3.0.0...v3.0.1

CONTRIBUTING.md

@@ -23,6 +23,14 @@ We look forward to working with you!
 Please note that this project is released with a [Code of Conduct](./CODE_OF_CONDUCT.md).
 By participating in this project you agree to abide by its terms.
 
+## Reporting security issues
+
+If you find a security issue, please disclose it to Johann150 privately, e.g. per [email](mailto:johann+agate@qwertqwefsday.eu). If you know how to fix the issue, please follow the contribution workflow as if you do not use GitHub, regardless of if you actually use it. I.e. patches should also be submitted privately.
+
+An effort will be made to respond to such issues quickly, at least responding with a "read receipt". If you do not hear back anything regarding the security issue within three days, try contacting other maintainers listed in the Cargo.toml file or on crates.io for this crate.
+
+There are no bug bounties. You can not expect any compensation apart from attribution in the changelog and/or for any patches you supply.
+
 ## Reporting Bugs and Suggesting Improvements
 
 Bugs (unwanted behaviour) and suggested improvements are tracked as [GitHub issues][github-issues].
@@ -43,12 +51,24 @@ This will help developers and maintainers to resolve your issue. Some things you
 * Describe how the problem can be reproduced.
 * Explain what exactly is the problem and what you expect instead.
 
-[github-issues]: https://github.com/brendanzab/codespan/issues
+[github-issues]: https://github.com/mbrubeck/agate/issues
 
 ## Contribution Workflow
 
 Follow these steps to contribute to the project:
 
+### If you use git but not GitHub:
+
+1. Clone the repository where you want.
+1. Make the appropriate changes, meeting all [contribution quality standards](#quality-standards).
+1. Update the changelog with any added, removed, changed, or fixed functionality. Adhere to the changelog format.
+1. Mail the patches or a pull request to [Johann150](mailto:johann+agate@qwertqwefsday.eu).
+    - Patches are prefered for small changes.
+    - Pull requests have to contain the repository URL and branch name.
+1. You will be notified of any further actions (e.g. requested changes, merged) by the same address you sent from. So please make sure you can receive mail on that address.
+
+### If you use GitHub:
+
 1. Make a fork of the [Agate repository][agate-repo].
 1. Within your fork, create a branch for your contribution. Use a meaningful name.
 1. Create your contribution, meeting all [contribution quality standards](#quality-standards).

Cargo.toml

@@ -1,35 +1,32 @@
 [package]
 name = "agate"
-version = "3.0.3"
+version = "3.3.20"
 authors = ["Matt Brubeck <mbrubeck@limpet.net>", "Johann150 <johann+agate@qwertqwefsday.eu>"]
 description = "Very simple server for the Gemini hypertext protocol"
 keywords = ["server", "gemini", "hypertext", "internet", "protocol"]
 categories = ["network-programming"]
 repository = "https://github.com/mbrubeck/agate"
 readme = "README.md"
-license = "MIT/Apache-2.0"
+license = "MIT OR Apache-2.0"
-edition = "2018"
+edition = "2024"
-exclude = ["/tools", "/.github", "/release.sh", "/Cross.toml", "/content", "/CODE_OF_CONDUCT.md", "/CONTRIBUTING.md", "/CHANGELOG.md"]
+exclude = ["/tools", "/.github", "/Cross.toml", "/content", "/CODE_OF_CONDUCT.md", "/CONTRIBUTING.md", "/CHANGELOG.md", "/tests"]
 
 [dependencies]
-configparser = "2.0"
+configparser = "3.0"
-env_logger = { version = "0.8", default-features = false, features = ["atty", "humantime", "termcolor"] }
+env_logger = { version = "0.11", default-features = false, features = ["auto-color", "humantime"] }
-getopts = "0.2.21"
+futures-util = "0.3"
+getopts = { version = "0.2.24", default-features = false }
 glob = "0.3"
 log = "0.4"
 mime_guess = "2.0"
-once_cell = "1.5"
+percent-encoding = "2.3"
-percent-encoding = "2.1"
+rcgen = { version = "0.14.7", default-features = false, features = ["ring"] }
-rcgen = { version = "0.8.9" }
+tokio-rustls = { version = "0.26.4", default-features = false, features = ["logging", "ring", "tls12"] }
-rustls = "0.19.0"
+tokio = { version = "1.49", features = ["fs", "io-util", "net", "rt-multi-thread", "sync"] }
-tokio-rustls = "0.22.0"
+url = "2.5.8"
-tokio = { version = "1.2", features = ["fs", "io-util", "net", "rt-multi-thread", "sync"] }
-url = "2.2.1"
-webpki = "0.21.4"
 
 [dev-dependencies]
-anyhow = "1.0"
+trotter = "1.0"
-gemini-fetch = "0.2.1"
 
 [profile.release]
 lto = true

Dockerfile

@@ -0,0 +1,26 @@
+FROM docker.io/library/rust:alpine AS builder
+
+WORKDIR /agate
+RUN apk --no-cache add libc-dev
+
+COPY src src
+COPY Cargo.toml .
+COPY Cargo.lock .
+ARG TARGETARCH
+RUN if [ "$TARGETARCH" = "amd64" ]; then \
+      cargo install --target x86_64-unknown-linux-musl --path . ; \
+    elif [ "$TARGETARCH" = "arm64" ]; then \
+      cargo install --target aarch64-unknown-linux-musl --path . ; \
+    else \
+      echo "The architecture $TARGETARCH isn't unsupported." && exit 1; \
+    fi
+
+FROM docker.io/library/alpine:latest
+COPY --from=builder /usr/local/cargo/bin/agate /usr/bin/agate
+WORKDIR /app
+EXPOSE 1965
+VOLUME /gmi/
+VOLUME /certs/
+
+ENTRYPOINT ["agate", "--addr", "0.0.0.0:1965", "--content", "/gmi/", "--certs", "/certs/"]
+

README.md

@@ -1,11 +1,13 @@
 # Agate
 
+[![Crates.io](https://img.shields.io/crates/v/agate.svg)](https://crates.io/crates/agate)
+[![Test Status](https://github.com/mbrubeck/agate/workflows/Tests/badge.svg)](https://github.com/mbrubeck/agate/actions?workflow=Tests)
+[![Dependency Status](https://deps.rs/repo/github/mbrubeck/agate/status.svg)](https://deps.rs/repo/github/mbrubeck/agate)
+
 ## Simple Gemini server for static files
 
 Agate is a server for the [Gemini] network protocol, built with the [Rust] programming language. Agate has very few features, and can only serve static files. It uses async I/O, and should be quite efficient even when running on low-end hardware and serving many concurrent requests.
 
-Since Agate by default uses port 1965, you should be able to run other servers (like e.g. Apache or nginx) on the same device.
-
 ## Learn more
 
 * Home page: [gemini://qwertqwefsday.eu/agate.gmi][home]
@@ -24,7 +26,9 @@ Download and unpack the [pre-compiled binary](https://github.com/mbrubeck/agate/
 
 Using the nix package manager run `nix-env -i agate`
 
-_Note:_ agate is currently only in the unstable channel and will reach a release channel once the next release is tagged
+### Guix System
+
+[Deploy](https://dataswamp.org/~solene/2021-06-17-guix-gemini.html) agate with GNU Guix System by adding the [agate-service-type](https://guix.gnu.org/manual/en/html_node/Web-Services.html) to your system [services](http://guix.gnu.org/manual/en/html_node/Services.html). 
 
 ### Arch Linux
 
@@ -34,6 +38,23 @@ Install the package [`agate-bin`](https://aur.archlinux.org/packages/agate-bin/)
 
 If you have the Rust toolchain installed, run `cargo install agate` to install agate from crates.io.
 
+### Docker
+
+Recent builds have also been released as OCI/Docker images on Github's Container Registry (ghcr.io). Most people will need to mount two volumes, one for your content, one for your certificates (this can be empty, they will be automatically generated if needed):
+
+```sh
+$ docker run \
+  -p 1965:1965 \
+  -v your/path/to/gmi:/gmi \
+  -v your/path/to/certs:/certs \
+  ghcr.io/mbrubeck/agate:latest \
+  --hostname example.org
+```
+
+This container will run without a mounted certificates directory, but new certificates will be lost when it shuts down and re-generated every time it boots, showing your site's visitors a certificate warning each time your server restarts.
+
+Each release is tagged with `major`, `major.minor`, `major.minor.patch`, as well as the full version string and "latest". This means `docker pull ghcr.io/mbrubeck/agate:3` will always retrieve the latest `v3.*` image, `…:3.3` the latest `v3.3.*` image, and `…:latest` the most recent release of any version.
+
 ### Source
 
 Download the source code and run `cargo build --release` inside the source repository, then find the binary at `target/release/agate`.
@@ -60,6 +81,12 @@ When a client requests the URL `gemini://example.com/foo/bar`, Agate will respon
 
 ## Configuration
 
+### Automatic Certificate generation
+
+If the `--hostname` argument is used, Agate will generate keys and self signed certificates for each hostname specified. For Gemini it is recommended by the specification to use self signed certificates because Gemini uses the TOFU (Trust on first use) principle for certificates. Because of this, the generated certificates will also have a long expiration time of `4096-01-01`.
+
+For manual configuration of keys and certificates see the [section on certificates](#certificates) below.
+
 ### TLS versions
 
 Agate by default supports TLSv1.2 and TLSv1.3. You can disable support for TLSv1.2 by using the flag `--only-tls13` (or its short version `-3`). This is *NOT RECOMMENDED* as it may break compatibility with some clients. The Gemini specification requires compatibility with TLSv1.2 "for now" because not all platforms have good support for TLSv1.3 (cf. §4.1 of the specification).
@@ -67,7 +94,8 @@ Agate by default supports TLSv1.2 and TLSv1.3. You can disable support for TLSv1
 ### Directory listing
 
 You can enable a basic directory listing for a directory by putting a file called `.directory-listing-ok` in that directory. This does not have an effect on sub-directories.
-The directory listing will hide files and directories whose name starts with a dot (e.g. the `.directory-listing-ok` file itself or also the `.meta` configuration file).
+This file must be UTF-8 encoded text; it may be empty. Any text in the file will be prepended to the directory listing.
+The directory listing will hide files and directories whose name starts with a dot (e.g. the `.directory-listing-ok` file itself, the `.meta` configuration file, or the `..` directory).
 
 A file called `index.gmi` will always take precedence over a directory listing.
 
@@ -107,14 +135,14 @@ Such a configuration file might look like this:
 # This line will be ignored.
 **/*.de.gmi: ;lang=de
 nl/**/*.gmi: ;lang=nl
-index.gmi: ;lang=en-UK
+index.gmi: ;lang=en-GB
 LICENSE: text/plain;charset=UTF-8
 gone.gmi: 52 This file is no longer here, sorry.
 ```
 
 If this is the `.meta` file in the content root directory and the `-C` flag is used, this will result in the following response headers:
 * `/` or `/index.gmi`
-    -> `20 text/gemini;lang=en-UK`
+    -> `20 text/gemini;lang=en-GB`
 * `/LICENSE`
     -> `20 text/plain;charset=UTF-8`
 * `/gone.gmi`
@@ -138,6 +166,8 @@ Agate also supports different certificates for different hostnames, see the sect
 
 If you want to serve the same content for multiple domains, you can instead disable the hostname check by not specifying `--hostname`. In this case Agate will disregard a request's hostname apart from checking that there is one.
 
+When one or more `--hostname`s are specified, Agate will check that the hostnames and port in request URLs match the specified hostnames and the listening ports. If Agate is behind a proxy on another port and receives a request with an URL specifying the proxy port, this port may not match one of Agate's listening ports and the request will be rejected: it is possible to disable the port check with `--skip-port-check`.
+
 ### Certificates
 
 Agate has support for using multiple certificates with the `--certs` option. Agate will thus always require that a client uses SNI, which should not be a problem since the Gemini specification also requires SNI to be used.
@@ -164,17 +194,30 @@ This would be understood like this:
 Using a directory named just `.` causes undefined behaviour as this would have the same meaning as the top level certificate/key pair (pair (1) in the example above).
 
 The files for a certificate/key pair have to be named `cert.der` and `key.der` respectively. The certificate has to be a X.509 certificate in a DER format file and has to include a subject alt name of the domain name. The private key has to be in DER format and must be either an RSA, ECDSA or Ed25519 key.
-If the `--hostname` argument is used, Agate will generate certificates and Ed25519 certificates for each hostname specified.
+
+If you have an existing certificate/key pair in PEM format, you can use these commands to convert them to the DER format:
+
+```shell
+openssl x509 -inform pem -in cert.pem -outform der -out cert.der
+openssl rsa -inform pem -in privkey.pem -outform der -out key.der
+```
 
 ## Logging
 
-All requests will be logged using this format:
+All requests via TCP sockets will be logged using this format:
 ```
 <local ip>:<local port> <remote ip or dash> "<request>" <response status> "<response meta>"[ error:<error>]
 ```
-The "error:" part will only be logged if an error occurred. This should only be used for informative purposes as the status code should provide the information that an error occurred. If the error consisted in the connection not being established (e.g. because of TLS errors), the status code `00` will be used.
+All requests via Unix sockets will be logged using this format:
+```
+unix:[<unix socket name>] - "<request>" <response status> "<response meta>"[ error:<error>]
+```
 
-By default, Agate will not log the remote IP addresses because that might be an issue because IPs are considered private data under the EU's GDPR. To enable logging of IP addresses, you can use the `--log-ip` option. Note that in this case some error conditions might still force Agate to log a dash instead of an IP address.
+Square brackets indicate optional parts.
+
+The "error:" part will only be logged if an error occurred. This should only be used for informative purposes as the status code should provide the information that an error occurred. If the error consisted in the connection not being established (e.g. because of TLS errors), special status codes listed below may be used.
+
+By default, Agate will not log the remote IP addresses because that might be an issue because IPs are considered private data under the EU's GDPR. To enable logging of IP addresses, you can use the `--log-ip` option. Note that in this case some error conditions might still force Agate to log a dash instead of an IP address. IP addresses can also not be logged for connections via Unix sockets.
 
 There are some lines apart from these that might occur in logs depending on the selected log level. For example the initial "Listening on..." line or information about listing a particular directory.
 
@@ -186,7 +229,7 @@ Agate uses some status codes that are not valid Gemini status codes when logging
 
 If you want to run agate on a multi-user system, you should be aware that all certificate and key data is loaded into memory and stored there until the server stops. Since the memory is also not explicitly overwritten or zeroed after use, the sensitive data might stay in memory after the server has terminated.
 
-[Gemini]: https://gemini.circumlunar.space/
+[Gemini]: https://geminiprotocol.net/
 [Rust]: https://www.rust-lang.org/
 [home]: gemini://qwertqwefsday.eu/agate.gmi
 [source]: https://github.com/mbrubeck/agate

SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest version of Agate is supported at any time.
+
+## Reporting a Vulnerability
+
+Please report issues that you deem to be a security issue by email to johann at qwertqwefsday.eu.
+
+You may use OpenPGP encryption with the public key available at either
+- <https://github.com/Johann150/Johann150/blob/main/johann-qwertqwefsday-eu.asc>
+- through web key discovery, e.g. `gpg --locate-keys ...`
+- or the above manually at <https://qwertqwefsday.eu/.well-known/openpgpkey/hu/spd3xecxhotzgyu1p3eqdqdp31ba6rif>
+
+All these public keys should be identical. If you wish for an encrypted response, include instructions on how to obtain your public key in the email.
+
+Please allow at least 24 hours for a response.
+If your issue is easy to fix, you might not get a response until the issue is fixed.
+Otherwise, the receipt of your report should be acknowledged.
+
+If you did not receive a reply within the above time frame, please email another maintainer listed in the `Cargo.toml` file, citing that you did not yet receive a reply.
+Only limited support may be available.
+
+## Compensation
+
+There is no bug bounty or other rewards program.
+At your option, you may be mentioned by your name or pseudonym in the changelog.

content/index.gmi

@@ -26,6 +26,15 @@ Using the nix package manager run `nix-env -i agate`
 
 _Note:_ agate is currently only in the unstable channel and will reach a release channel once the next release is tagged
 
+### Guix System
+
+Deploy agate with GNU Guix System by adding the agate-service-type to your system services.
+=> https://dataswamp.org/~solene/2021-06-17-guix-gemini.html refer to this article
+
+see also
+=> https://guix.gnu.org/manual/en/html_node/Web-Services.html Guix Manual Web-Services
+=> https://guix.gnu.org/manual/en/html_node/Services.html Guix Manual Services
+
 ### Arch Linux
 
 Install the package "agate-bin" from AUR for pre-compiled binary. Otherwise install the "agate" package from AUR to get agate compiled from source.
@@ -42,7 +51,7 @@ Download the source code and run `cargo build --release` inside the source repos
 You can use the install script in the `tools` directory for the remaining steps if there is one for your system. If there is none, please consider contributing one to make it easier for less tech-savvy users!
 ***
 
-2. Run the server. You can use the following arguments to specify the locations of the content directory, IP address and port to listen on, host name to expect in request URLs, and default language code to include in the MIME type for for text/gemini files: (Replace the hostname `example.com` with the address of your Gemini server.)
+2. Run the server. You can use the following arguments to specify the locations of the content directory, IP address and port to listen on, host name to expect in request URLs, and default language code to include in the MIME type for text/gemini files: (Replace the hostname `example.com` with the address of your Gemini server.)
 If you have not done it yourself, Agate will generate a private key and certificate for you on the first run, using the specified hostname(s). See the section Certificates below for more.
 
 ```
@@ -59,6 +68,12 @@ When a client requests the URL `gemini://example.com/foo/bar`, Agate will respon
 
 ## Configuration
 
+### Automatic Certificate generation
+
+If the `--hostname` argument is used, Agate will generate keys and self signed certificates for each hostname specified. For Gemini it is recommended by the specification to use self signed certificates because Gemini uses the TOFU (Trust on first use) principle for certificates. Because of this, the generated certificates will also have a long expiration time of `4096-01-01`.
+
+For manual configuration of keys and certificates see the section on certificates below.
+
 ### TLS versions
 
 Agate by default supports TLSv1.2 and TLSv1.3. You can disable support for TLSv1.2 by using the flag `--only-tls13` (or its short version `-3`). This is *NOT RECOMMENDED* as it may break compatibility with some clients. The Gemini specification requires compatibility with TLSv1.2 "for now" because not all platforms have good support for TLSv1.3 (cf. §4.1 of the specification).
@@ -66,7 +81,8 @@ Agate by default supports TLSv1.2 and TLSv1.3. You can disable support for TLSv1
 ### Directory listing
 
 You can enable a basic directory listing for a directory by putting a file called `.directory-listing-ok` in that directory. This does not have an effect on sub-directories.
-The directory listing will hide files and directories whose name starts with a dot (e.g. the `.directory-listing-ok` file itself or also the `.meta` configuration file).
+This file must be UTF-8 encoded text; it may be empty. Any text in the file will be prepended to the directory listing.
+The directory listing will hide files and directories whose name starts with a dot (e.g. the `.directory-listing-ok` file itself, the `.meta` configuration file, or the `..` directory).
 
 A file called `index.gmi` will always take precedence over a directory listing.
 
@@ -103,19 +119,21 @@ Agate will use this MIME type instead of what it would guess, if the file is fou
 If a line violates the format or looks like case 3, but is incorrect, it might be ignored. You should check your logs. Please know that this configuration file is first read when a file from the respective directory is accessed. So no log messages after startup does not mean the `.meta` file is okay.
 
 Such a configuration file might look like this:
+
 ```
 # This line will be ignored.
 **/*.de.gmi: ;lang=de
 nl/**/*.gmi: ;lang=nl
-index.gmi: ;lang=en-UK
+index.gmi: ;lang=en-GB
 LICENSE: text/plain;charset=UTF-8
 gone.gmi: 52 This file is no longer here, sorry.
 ```
 
 If this is the `.meta` file in the content root directory and the `-C` flag is used, this will result in the following response headers:
+
 ```
 `/` or `/index.gmi`
-    -> `20 text/gemini;lang=en-UK`
+    -> `20 text/gemini;lang=en-GB`
 `/LICENSE`
     -> `20 text/plain;charset=UTF-8`
 `/gone.gmi`
@@ -131,7 +149,7 @@ any non-hidden file in the `nl` directory ending in `.gmi` (including in non-hid
 
 ### Logging Verbosity
 
-Agate uses the `env_logger` crate and allows you to set the logging verbosity by setting the default `RUST_LOG` environment variable. To turn off all logging use `RUST_LOG=off`. For more information, please see the documentation of `env_logger`.
+Agate uses the `env_logger` crate and allows you to set the logging verbosity by setting the `RUST_LOG` environment variable. To turn off all logging use `RUST_LOG=off`. For more information, please see the documentation of `env_logger`.
 => https://docs.rs/env_logger/0.8 documentation of `env_logger` crate
 
 ### Virtual Hosts
@@ -142,6 +160,8 @@ Agate also supports different certificates for different hostnames, see the sect
 
 If you want to serve the same content for multiple domains, you can instead disable the hostname check by not specifying `--hostname`. In this case Agate will disregard a request's hostname apart from checking that there is one.
 
+When one or more `--hostname`s are specified, Agate will check that the hostnames and port in request URLs match the specified hostnames and the listening ports. If Agate is behind a proxy on another port and receives a request with an URL specifying the proxy port, this port may not match one of Agate's listening ports and the request will be rejected: it is possible to disable the port check with `--skip-port-check`.
+
 ### Certificates
 
 Agate has support for using multiple certificates with the `--certs` option. Agate will thus always require that a client uses SNI, which should not be a problem since the Gemini specification also requires SNI to be used.
@@ -150,14 +170,14 @@ Certificates are by default stored in the `.certificates` directory. This is a h
 
 ```
 .certificates
-|-- cert.pem     (1)
+|-- cert.der     (1)
-|-- key.rsa      (1)
+|-- key.der      (1)
 |-- example.org
-|   |-- cert.pem (2)
+|   |-- cert.der (2)
-|   `-- key.rsa  (2)
+|   `-- key.der  (2)
 `-- portal.example.org
-    |-- cert.pem (3)
+    |-- cert.der (3)
-    `-- key.rsa  (3)
+    `-- key.der  (3)
 ```
 
 This would be understood like this:
@@ -168,17 +188,22 @@ This would be understood like this:
 Using a directory named just `.` causes undefined behaviour as this would have the same meaning as the top level certificate/key pair (pair (1) in the example above).
 
 The files for a certificate/key pair have to be named `cert.der` and `key.der` respectively. The certificate has to be a X.509 certificate in a DER format file and has to include a subject alt name of the domain name. The private key has to be in DER format and must be either an RSA, ECDSA or Ed25519 key.
-If the `--hostname` argument is used, Agate will generate certificates and Ed25519 certificates for each hostname specified.
 
 ## Logging
 
-All requests will be logged using this format:
+All requests via TCP sockets will be logged using this format:
 ```
 <local ip>:<local port> <remote ip or dash> "<request>" <response status> "<response meta>"[ error:<error>]
 ```
-The "error:" part will only be logged if an error occurred. This should only be used for informative purposes as the status code should provide the information that an error occurred. If the error consisted in the connection not being established (e.g. because of TLS errors), the status code `00` will be used.
+All requests via Unix sockets will be logged using this format:
+```
+unix:[<unix socket name>] - "<request>" <response status> "<response meta>"[ error:<error>]
+```
+Square brackets indicate optional parts.
 
-By default, Agate will not log the remote IP addresses because that might be an issue because IPs are considered private data under the EU's GDPR. To enable logging of IP addresses, you can use the `--log-ip` option. Note that in this case some error conditions might still force Agate to log a dash instead of an IP address.
+The "error:" part will only be logged if an error occurred. This should only be used for informative purposes as the status code should provide the information that an error occurred. If the error consisted in the connection not being established (e.g. because of TLS errors), special status codes listed below may be used.
+
+By default, Agate will not log the remote IP addresses because that might be an issue because IPs are considered private data under the EU's GDPR. To enable logging of IP addresses, you can use the `--log-ip` option. Note that in this case some error conditions might still force Agate to log a dash instead of an IP address. IP addresses can also not be logged for connections via Unix sockets.
 
 There are some lines apart from these that might occur in logs depending on the selected log level. For example the initial "Listening on..." line or information about listing a particular directory.
 
@@ -198,6 +223,111 @@ The format is based on Keep a Changelog and this project adheres to Semantic Ver
 => https://keepachangelog.com/en/1.0.0/ Keep a Changelog home page
 => https://semver.org/spec/v2.0.0.html Semantic versioning standard v2.0.0
 
+## [3.3.1] - 2023-08-05
+Thank you to Jan Stępień and @michaelnordmeyer for contributing to this release.
+
+### Fixed
+* set permissions for generated key files so only owner can read them
+* improve documentation and tests
+
+## [3.3.0] - 2023-03-18
+Thank you to @equalsraf, @michaelnordmeyer and @wanderer1988 for contributing to this release.
+
+### Added
+* listening on unix sockets (#244)
+
+### Fixed
+* updated dependencies
+* misstyped email address in section on how to report security vulnerabilities (#239)
+* wrong language code in README (#189)
+
+## [3.2.4] - 2022-05-18
+Thank you to @06kellyjac, @albertlarsan68 and @kahays for contributing to this release.
+
+### Fixed
+* removed port collisions in tests, for the last time (#143)
+* fixed Dockerfile startup command (#169)
+* upated dependencies
+
+## [3.2.3] - 2022-02-04
+Thank you to T. Spivey for contributing to this release.
+
+### Fixed
+* improper IRIs are handled instead of crashing (bug reported via email)
+* updated dependencies
+
+## [3.2.2] - 2022-01-25
+Thank you to @Suzie97 for contributing to this release.
+
+### Added
+* CI build for `aarch64-apple-darwin` target (#137)
+
+### Fixed
+* updated dependencies
+
+## [3.2.1] - 2021-12-02
+Thank you to @MatthiasPortzel for contributing to this release.
+
+### Fixed
+* host name comparisons are now case insensitive (#115)
+* made automatic certificate generation more prominent in the README
+* updated dependencies
+
+## [3.2.0] - 2021-11-15
+Thank you to @balazsbtond and @joseph-marques for contributing to this release.
+
+### Added
+* you can add header text to a directory listing. See the updated instructions above for details. (#98)
+
+### Fixed
+* updated dependencies
+* error pages also send close_notify (#100)
+
+## [3.1.3] - 2021-10-25
+Thank you to @FoxKyong for contributing to this release.
+
+### Fixed
+* the fix for dual stack listening from 3.1.2 was executed asynchronously and would thus
+  sometimes fail. starting the listeners on different socket addresses is now synchronous
+  (#79)
+
+## [3.1.2] - 2021-10-15
+Thank you to @etam for contributing to this release.
+
+### Fixed
+* when starting up on a system that automatically listens in dual stack mode (e.g. some
+  linux distributions seem to do this), detect a second unspecified address to not cause
+  the "address in use" error with the default listening addresses
+* updated a dependency
+
+## [3.1.1] - 2021-10-14
+Thank you to @jgarte and @alvaro-cuesta for contributing to this release.
+
+### Added
+* running Agate using GNU Guix (#62)
+
+### Fixed
+* actually bind to multiple IP addresses. Despite the documentation saying so,
+  Agate would only bind to the first address that did not result in an error. (#63)
+* updated dependencies
+
+## [3.1.0] - 2021-06-08
+Thank you to Matthew Ingwersen and Oliver Simmons (@GoodClover) for contributing to this release.
+
+### Added
+* tests for symlink files (#60)
+  Symlinks were already working before.
+
+### Fixed
+* A path traversal security issue was closed: Percent encoded slashes were misunderstood.
+
+### Changed
+* Visiting a directory without `index.gmi` and `.directory-listing-ok` now returns a different error message to better show the cause of the error.
+  To retain the current behaviour of showing a `51 Not found, sorry.` error, add the following line to the respective directories' `.meta` file:
+```
+index.gmi: 51 Not found, sorry.
+```
+
 ## [3.0.3] - 2021-05-24
 Thank you to @06kellyjac, @cpnfeeny, @lifelike, @skittlesvampir and @steko for contributing to this release.
 

src/certificates.rs

@@ -1,23 +1,26 @@
 use {
-    rustls::{
-        sign::{any_supported_type, CertifiedKey},
-        ResolvesServerCert,
-    },
     std::{
         ffi::OsStr,
         fmt::{Display, Formatter},
         path::Path,
         sync::Arc,
     },
-    webpki::DNSNameRef,
+    tokio_rustls::rustls::{
+        self,
+        crypto::ring::sign::any_supported_type,
+        pki_types::{self, CertificateDer, PrivateKeyDer},
+        server::{ClientHello, ResolvesServerCert},
+        sign::{CertifiedKey, SigningKey},
+    },
 };
 
 /// A struct that holds all loaded certificates and the respective domain
 /// names.
+#[derive(Debug)]
 pub(crate) struct CertStore {
     /// Stores the certificates and the domains they apply to, sorted by domain
     /// names, longest matches first
-    certs: Vec<(String, CertifiedKey)>,
+    certs: Vec<(String, Arc<CertifiedKey>)>,
 }
 
 pub static CERT_FILE_NAME: &str = "cert.der";
@@ -29,14 +32,9 @@ pub enum CertLoadError {
     NoReadCertDir,
     /// no certificates or keys were found
     Empty,
-    /// the specified domain name cannot be processed correctly
-    BadDomain(String),
     /// the key file for the specified domain is bad (e.g. does not contain a
     /// key or is invalid)
-    BadKey(String),
+    BadKey(String, rustls::Error),
-    /// The certificate file for the specified domain is bad (e.g. invalid)
-    /// The second parameter is the error message.
-    BadCert(String, String),
     /// the key file for the specified domain is missing (but a certificate
     /// file was present)
     MissingKey(String),
@@ -52,25 +50,20 @@ impl Display for CertLoadError {
     fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
         match self {
             Self::NoReadCertDir => write!(f, "Could not read from certificate directory."),
-            Self::Empty => write!(f, "No keys or certificates were found in the given directory.\nSpecify the --hostname option to generate these automatically."),
+            Self::Empty => write!(
-            Self::BadDomain(domain) if !domain.is_ascii() => write!(
                 f,
-                "The domain name {} cannot be processed, it must be punycoded.",
+                "No keys or certificates were found in the given directory.\nSpecify the --hostname option to generate these automatically."
-                domain
             ),
-            Self::BadDomain(domain) => write!(f, "The domain name {} cannot be processed.", domain),
+            Self::BadKey(domain, err) => {
-            Self::BadKey(domain) => write!(f, "The key file for {} is malformed.", domain),
+                write!(f, "The key file for {domain} is malformed: {err:?}")
-            Self::BadCert(domain, e) => {
-                write!(f, "The certificate file for {} is malformed: {}", domain, e)
             }
-            Self::MissingKey(domain) => write!(f, "The key file for {} is missing.", domain),
+            Self::MissingKey(domain) => write!(f, "The key file for {domain} is missing."),
             Self::MissingCert(domain) => {
-                write!(f, "The certificate file for {} is missing.", domain)
+                write!(f, "The certificate file for {domain} is missing.")
             }
             Self::EmptyDomain(domain) => write!(
                 f,
-                "A folder for {} exists, but there is no certificate or key file.",
+                "A folder for {domain} exists, but there is no certificate or key file."
-                domain
             ),
         }
     }
@@ -90,35 +83,52 @@ fn load_domain(certs_dir: &Path, domain: String) -> Result<CertifiedKey, CertLoa
             CertLoadError::MissingCert(domain)
         });
     }
-    let cert = rustls::Certificate(
+    let cert = CertificateDer::from(
         std::fs::read(&path).map_err(|_| CertLoadError::MissingCert(domain.clone()))?,
     );
 
     // load key from file
     path.set_file_name(KEY_FILE_NAME);
-    if !path.is_file() {
+    let Ok(der) = std::fs::read(&path) else {
         return Err(CertLoadError::MissingKey(domain));
-    }
+    };
-    let key = rustls::PrivateKey(
-        std::fs::read(&path).map_err(|_| CertLoadError::MissingKey(domain.clone()))?,
-    );
 
     // transform key to correct format
-    let key = match any_supported_type(&key) {
+    let key = der_to_private_key(&der).map_err(|e| CertLoadError::BadKey(domain.clone(), e))?;
-        Ok(key) => key,
+
-        Err(()) => return Err(CertLoadError::BadKey(domain)),
+    Ok(CertifiedKey::new(vec![cert], key))
-    };
+}
-    Ok(CertifiedKey::new(vec![cert], Arc::new(key)))
+
+/// We don't know the key type of the private key DER file, so try each
+/// possible type until we find one that works.
+///
+/// We should probably stop doing this and use a PEM file instead:
+/// <https://github.com/rustls/rustls/issues/1661>
+fn der_to_private_key(der: &[u8]) -> Result<Arc<dyn SigningKey>, rustls::Error> {
+    let keys = [
+        PrivateKeyDer::Pkcs1(pki_types::PrivatePkcs1KeyDer::from(der)),
+        PrivateKeyDer::Sec1(pki_types::PrivateSec1KeyDer::from(der)),
+        PrivateKeyDer::Pkcs8(pki_types::PrivatePkcs8KeyDer::from(der)),
+    ];
+
+    let mut err = None;
+    for key in keys {
+        match any_supported_type(&key) {
+            Ok(key) => return Ok(key),
+            Err(e) => err = Some(e),
+        }
+    }
+    Err(err.unwrap())
 }
 
 impl CertStore {
     /// Load certificates from a certificate directory.
     /// Certificates should be stored in a folder for each hostname, for example
     /// the certificate and key for `example.com` should be in the files
-    /// `certs_dir/example.com/{cert.pem,key.rsa}` respectively.
+    /// `certs_dir/example.com/{cert.der,key.der}` respectively.
     ///
-    /// If there are `cert.pem` and `key.rsa` directly in certs_dir, these will be
+    /// If there are `cert.der` and `key.der` directly in `certs_dir`, these
-    /// loaded as default certificates.
+    /// will be loaded as default certificates.
     pub fn load_from(certs_dir: &Path) -> Result<Self, CertLoadError> {
         // load all certificates from directories
         let mut certs = vec![];
@@ -127,25 +137,20 @@ impl CertStore {
         // certificate directory.
         match load_domain(certs_dir, String::new()) {
             Err(CertLoadError::EmptyDomain(_)) => { /* there are no fallback keys */ }
-            Err(CertLoadError::Empty)
+            Err(CertLoadError::Empty) | Err(CertLoadError::NoReadCertDir) => unreachable!(),
-            | Err(CertLoadError::NoReadCertDir)
+            Err(CertLoadError::BadKey(_, e)) => {
-            | Err(CertLoadError::BadDomain(_)) => unreachable!(),
+                return Err(CertLoadError::BadKey("fallback".to_string(), e));
-            Err(CertLoadError::BadKey(_)) => {
-                return Err(CertLoadError::BadKey("fallback".to_string()))
-            }
-            Err(CertLoadError::BadCert(_, e)) => {
-                return Err(CertLoadError::BadCert("fallback".to_string(), e))
             }
             Err(CertLoadError::MissingKey(_)) => {
-                return Err(CertLoadError::MissingKey("fallback".to_string()))
+                return Err(CertLoadError::MissingKey("fallback".to_string()));
             }
             Err(CertLoadError::MissingCert(_)) => {
-                return Err(CertLoadError::MissingCert("fallback".to_string()))
+                return Err(CertLoadError::MissingCert("fallback".to_string()));
             }
             // For the fallback keys there is no domain name to verify them
             // against, so we can skip that step and only have to do it for the
             // other keys below.
-            Ok(key) => certs.push((String::new(), key)),
+            Ok(key) => certs.push((String::new(), Arc::new(key))),
         }
 
         for file in certs_dir
@@ -163,16 +168,9 @@ impl CertStore {
                 .unwrap()
                 .to_string();
 
-            let dns_name = match DNSNameRef::try_from_ascii_str(&filename) {
-                Ok(name) => name,
-                Err(_) => return Err(CertLoadError::BadDomain(filename)),
-            };
-
             let key = load_domain(certs_dir, filename.clone())?;
-            key.cross_check_end_entity_cert(Some(dns_name))
-                .map_err(|e| CertLoadError::BadCert(filename.clone(), e.to_string()))?;
 
-            certs.push((filename, key));
+            certs.push((filename, Arc::new(key)));
         }
 
         if certs.is_empty() {
@@ -211,9 +209,9 @@ impl CertStore {
 }
 
 impl ResolvesServerCert for CertStore {
-    fn resolve(&self, client_hello: rustls::ClientHello<'_>) -> Option<CertifiedKey> {
+    fn resolve(&self, client_hello: ClientHello<'_>) -> Option<Arc<CertifiedKey>> {
         if let Some(name) = client_hello.server_name() {
-            let name: &str = name.into();
+            let name: &str = name;
             // The certificate list is sorted so the longest match will always
             // appear first. We have to find the first that is either this
             // domain or a parent domain of the current one.

src/codes.rs

@@ -0,0 +1,12 @@
+/// The server was unable to parse the client's request, presumably due to a malformed request. (cf HTTP 400)
+pub const BAD_REQUEST: u8 = 59;
+/// The request was for a resource at a domain not served by the server and the server does not accept proxy requests.
+pub const PROXY_REQUEST_REFUSED: u8 = 53;
+/// The requested resource could not be found but may be available in the future. (cf HTTP 404)
+pub const NOT_FOUND: u8 = 51;
+/// The resource requested is no longer available and will not be available again. Search engines and similar tools should remove this resource from their indices. Content aggregators should stop requesting the resource and convey to their human users that the subscribed resource is gone. (cf HTTP 410)
+pub const GONE: u8 = 52;
+/// The requested resource should be consistently requested from the new URL provided in the future. Tools loke search engine indexers or content aggregators should update their configurations to avoid requesting the old URL, and end-user clients may automatically update bookmarks, etc. Note that clients that only pay attention to the initial digit of status codes will treat this as a temporary redirect. They will still end up at the right place, they just won't be able to make use of the knowledge that this redirect is permanent, so they'll pay a small performance penality by having to follow the redirect each time.
+pub const REDIRECT_PERMANENT: u8 = 31;
+/// The request was handled successfully and a response body will follow the response header. The <META> line is a MIME media type which applies to the response body.
+pub const SUCCESS: u8 = 20;

src/main.rs

@@ -1,14 +1,14 @@
 #![forbid(unsafe_code)]
 
 mod certificates;
+mod codes;
 mod metadata;
+use codes::*;
 use metadata::{FileOptions, PresetMeta};
 
 use {
-    once_cell::sync::Lazy,
+    percent_encoding::{AsciiSet, CONTROLS, percent_decode_str, percent_encode},
-    percent_encoding::{percent_decode_str, percent_encode, AsciiSet, CONTROLS},
+    rcgen::{CertificateParams, DnType, KeyPair},
-    rcgen::{Certificate, CertificateParams, DnType},
-    rustls::{NoClientAuth, ServerConfig},
     std::{
         borrow::Cow,
         error::Error,
@@ -16,9 +16,9 @@ use {
         fmt::Write,
         fs::{self, File},
         io::Write as _,
-        net::SocketAddr,
+        net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr},
-        path::{Path, PathBuf},
+        path::{self, Component, Path, PathBuf},
-        sync::Arc,
+        sync::{Arc, LazyLock},
     },
     tokio::{
         io::{AsyncReadExt, AsyncWriteExt},
@@ -26,54 +26,143 @@ use {
         runtime::Runtime,
         sync::Mutex,
     },
-    tokio_rustls::{server::TlsStream, TlsAcceptor},
+    tokio_rustls::{
+        TlsAcceptor,
+        rustls::{server::ServerConfig, version::TLS13},
+        server::TlsStream,
+    },
     url::{Host, Url},
 };
 
-fn main() -> Result {
+#[cfg(unix)]
+use {
+    std::os::unix::fs::{FileTypeExt, PermissionsExt},
+    tokio::net::{UnixListener, UnixStream},
+};
+
+static DEFAULT_PORT: u16 = 1965;
+
+fn main() {
     env_logger::Builder::from_env(
         // by default only turn on logging for agate
         env_logger::Env::default().default_filter_or("agate=info"),
     )
     .init();
-    Runtime::new()?.block_on(async {
+    Runtime::new()
-        let default = PresetMeta::Parameters(
+        .expect("could not start tokio runtime")
-            ARGS.language
+        .block_on(async {
-                .as_ref()
+            let default = PresetMeta::Parameters(
-                .map_or(String::new(), |lang| format!(";lang={}", lang)),
+                ARGS.language
-        );
+                    .as_ref()
-        let mimetypes = Arc::new(Mutex::new(FileOptions::new(default)));
+                    .map_or(String::new(), |lang| format!(";lang={lang}")),
-        let listener = TcpListener::bind(&ARGS.addrs[..]).await?;
+            );
-        log::info!("Listening on {:?}...", ARGS.addrs);
+            let mimetypes = Arc::new(Mutex::new(FileOptions::new(default)));
-        loop {
+
-            let (stream, _) = listener.accept().await?;
+            // some systems automatically listen in dual stack if the IPv6 unspecified
-            let arc = mimetypes.clone();
+            // address is used, so don't fail if the second unspecified address gets
-            tokio::spawn(async {
+            // an error when trying to start
-                match RequestHandle::new(stream, arc).await {
+            let mut listening_unspecified = false;
-                    Ok(handle) => match handle.handle().await {
+
-                        Ok(info) => log::info!("{}", info),
+            let mut handles = vec![];
-                        Err(err) => log::warn!("{}", err),
+            for addr in &ARGS.addrs {
-                    },
+                let arc = mimetypes.clone();
-                    Err(log_line) => {
+
-                        log::warn!("{}", log_line);
+                let listener = match TcpListener::bind(addr).await {
+                    Err(e) => {
+                        if !(addr.ip().is_unspecified() && listening_unspecified) {
+                            panic!("Failed to listen on {addr}: {e}")
+                        } else {
+                            // already listening on the other unspecified address
+                            log::warn!("Could not start listener on {addr}, but already listening on another unspecified address. Probably your system automatically listens in dual stack?");
+                            continue;
+                        }
                     }
+                    Ok(listener) => listener,
+                };
+                listening_unspecified |= addr.ip().is_unspecified();
+
+                handles.push(tokio::spawn(async move {
+                    log::info!("Started listener on {addr}");
+
+                    loop {
+                        let (stream, _) = listener.accept().await.unwrap_or_else(|e| {
+                            panic!("could not accept new connection on {addr}: {e}")
+                        });
+                        let arc = arc.clone();
+                        tokio::spawn(async {
+                            match RequestHandle::new(stream, arc).await {
+                                Ok(handle) => match handle.handle().await {
+                                    Ok(info) => log::info!("{info}"),
+                                    Err(err) => log::warn!("{err}"),
+                                },
+                                Err(log_line) => {
+                                    log::warn!("{log_line}");
+                                }
+                            }
+                        });
+                    }
+                }))
+            };
+
+            #[cfg(unix)]
+            for socketpath in &ARGS.sockets {
+                let arc = mimetypes.clone();
+
+                if socketpath.exists() && socketpath.metadata()
+                        .expect("Failed to get existing socket metadata")
+                        .file_type()
+                        .is_socket() {
+                    log::warn!("Socket already exists, attempting to remove {}", socketpath.display());
+                    let _ = std::fs::remove_file(socketpath);
                 }
-            });
+
-        }
+                let listener = match UnixListener::bind(socketpath) {
-    })
+                    Err(e) => {
+                        panic!("Failed to listen on {}: {}", socketpath.display(), e)
+                    }
+                    Ok(listener) => listener,
+                };
+
+                handles.push(tokio::spawn(async move {
+                    log::info!("Started listener on {}", socketpath.display());
+
+                    loop {
+                        let (stream, _) = listener.accept().await.unwrap_or_else(|e| {
+                            panic!("could not accept new connection on {}: {}", socketpath.display(), e)
+                        });
+                        let arc = arc.clone();
+                        tokio::spawn(async {
+                            match RequestHandle::new_unix(stream, arc).await {
+                                Ok(handle) => match handle.handle().await {
+                                    Ok(info) => log::info!("{info}"),
+                                    Err(err) => log::warn!("{err}"),
+                                },
+                                Err(log_line) => {
+                                    log::warn!("{log_line}");
+                                }
+                            }
+                        });
+                    }
+                }))
+            };
+
+            futures_util::future::join_all(handles).await;
+        });
 }
 
 type Result<T = (), E = Box<dyn Error + Send + Sync>> = std::result::Result<T, E>;
 
-static ARGS: Lazy<Args> = Lazy::new(|| {
+static ARGS: LazyLock<Args> = LazyLock::new(|| {
     args().unwrap_or_else(|s| {
-        eprintln!("{}", s);
+        eprintln!("{s}");
         std::process::exit(1);
     })
 });
 
 struct Args {
     addrs: Vec<SocketAddr>,
+    #[cfg(unix)]
+    sockets: Vec<PathBuf>,
     content_dir: PathBuf,
     certs: Arc<certificates::CertStore>,
     hostnames: Vec<Host>,
@@ -82,6 +171,7 @@ struct Args {
     log_ips: bool,
     only_tls13: bool,
     central_config: bool,
+    skip_port_check: bool,
 }
 
 fn args() -> Result<Args> {
@@ -102,9 +192,16 @@ fn args() -> Result<Args> {
     opts.optmulti(
         "",
         "addr",
-        "Address to listen on (default 0.0.0.0:1965 and [::]:1965; muliple occurences means listening on multiple interfaces)",
+        &format!("Address to listen on (default 0.0.0.0:{DEFAULT_PORT} and [::]:{DEFAULT_PORT}; multiple occurences means listening on multiple interfaces)"),
         "IP:PORT",
     );
+    #[cfg(unix)]
+    opts.optmulti(
+        "",
+        "socket",
+        "Unix socket to listen on (multiple occurences means listening on multiple sockets)",
+        "PATH",
+    );
     opts.optmulti(
         "",
         "hostname",
@@ -140,6 +237,11 @@ fn args() -> Result<Args> {
         "ed25519",
         "Generate keys using the Ed25519 signature algorithm instead of the default ECDSA.",
     );
+    opts.optflag(
+        "",
+        "skip-port-check",
+        "Skip URL port check even when a hostname is specified.",
+    );
 
     let matches = opts.parse(&args[1..]).map_err(|f| f.to_string())?;
 
@@ -171,10 +273,7 @@ fn args() -> Result<Args> {
         // the directory does not exist
         Err(_) => {
             // since certificate management should be automated, we are going to create the directory too
-            log::info!(
+            log::info!("The certificate directory {certs_path:?} does not exist, creating it.");
-                "The certificate directory {:?} does not exist, creating it.",
-                certs_path
-            );
             std::fs::create_dir(&certs_path).expect("could not create certificate directory");
             // we just created the directory, skip loading from it
             (None, PathBuf::from(certs_path))
@@ -187,47 +286,57 @@ fn args() -> Result<Args> {
 
     let mut hostnames = vec![];
     for s in matches.opt_strs("hostname") {
+        // normalize hostname, add punycoding if necessary
         let hostname = Host::parse(&s)?;
 
         // check if we have a certificate for that domain
-        if let Host::Domain(ref domain) = hostname {
+        if let Host::Domain(ref domain) = hostname
-            if !matches!(certs, Some(ref certs) if certs.has_domain(domain)) {
+            && !matches!(certs, Some(ref certs) if certs.has_domain(domain))
-                log::info!("No certificate or key found for {:?}, generating them.", s);
+        {
+            log::info!("No certificate or key found for {s:?}, generating them.");
 
-                let mut cert_params = CertificateParams::new(vec![domain.clone()]);
+            let mut cert_params = CertificateParams::new(vec![domain.clone()])?;
-                cert_params
+            cert_params
-                    .distinguished_name
+                .distinguished_name
-                    .push(DnType::CommonName, domain);
+                .push(DnType::CommonName, domain);
 
-                // <CertificateParams as Default>::default() already implements a
+            // <CertificateParams as Default>::default() already implements a
-                // date in the far future from the time of writing: 4096-01-01
+            // date in the far future from the time of writing: 4096-01-01
 
-                if matches.opt_present("e") {
+            let key_pair = if matches.opt_present("e") {
-                    cert_params.alg = &rcgen::PKCS_ED25519;
+                KeyPair::generate_for(&rcgen::PKCS_ED25519)
+            } else {
+                KeyPair::generate()
+            }?;
+
+            // generate the certificate with the configuration
+            let cert = cert_params.self_signed(&key_pair)?;
+
+            // make sure the certificate directory exists
+            let cert_dir = certs_path.join(domain);
+            fs::create_dir(&cert_dir)?;
+
+            // write certificate data to disk
+            let mut cert_file = File::create(cert_dir.join(certificates::CERT_FILE_NAME))?;
+            cert_file.write_all(cert.der())?;
+
+            // write key data to disk
+            let key_file_path = cert_dir.join(certificates::KEY_FILE_NAME);
+            let mut key_file = File::create(&key_file_path)?;
+            #[cfg(unix)]
+            {
+                // set permissions so only owner can read
+                match key_file.set_permissions(std::fs::Permissions::from_mode(0o400)) {
+                    Ok(_) => (),
+                    Err(_) => log::warn!(
+                        "could not set permissions for new key file {}",
+                        key_file_path.display()
+                    ),
                 }
-
-                // generate the certificate with the configuration
-                let cert = Certificate::from_params(cert_params)?;
-
-                // make sure the certificate directory exists
-                fs::create_dir(certs_path.join(domain))?;
-                // write certificate data to disk
-                let mut cert_file = File::create(certs_path.join(format!(
-                    "{}/{}",
-                    domain,
-                    certificates::CERT_FILE_NAME
-                )))?;
-                cert_file.write_all(&cert.serialize_der()?)?;
-                // write key data to disk
-                let mut key_file = File::create(certs_path.join(format!(
-                    "{}/{}",
-                    domain,
-                    certificates::KEY_FILE_NAME
-                )))?;
-                key_file.write_all(&cert.serialize_private_key_der())?;
-
-                reload_certs = true;
             }
+            key_file.write_all(key_pair.serialized_der())?;
+
+            reload_certs = true;
         }
 
         hostnames.push(hostname);
@@ -246,15 +355,32 @@ fn args() -> Result<Args> {
     for i in matches.opt_strs("addr") {
         addrs.push(i.parse()?);
     }
-    if addrs.is_empty() {
+
+    #[cfg_attr(not(unix), allow(unused_mut))]
+    let mut empty = addrs.is_empty();
+
+    #[cfg(unix)]
+    let mut sockets = vec![];
+    #[cfg(unix)]
+    {
+        for i in matches.opt_strs("socket") {
+            sockets.push(i.parse()?);
+        }
+
+        empty &= sockets.is_empty();
+    }
+
+    if empty {
         addrs = vec![
-            "[::]:1965".parse().unwrap(),
+            SocketAddr::new(IpAddr::V6(Ipv6Addr::UNSPECIFIED), DEFAULT_PORT),
-            "0.0.0.0:1965".parse().unwrap(),
+            SocketAddr::new(IpAddr::V4(Ipv4Addr::UNSPECIFIED), DEFAULT_PORT),
         ];
     }
 
     Ok(Args {
         addrs,
+        #[cfg(unix)]
+        sockets,
         content_dir: check_path(matches.opt_get_default("content", "content".into())?)?,
         certs: Arc::new(certs),
         hostnames,
@@ -263,6 +389,7 @@ fn args() -> Result<Args> {
         log_ips: matches.opt_present("log-ip"),
         only_tls13: matches.opt_present("only-tls13"),
         central_config: matches.opt_present("central-conf"),
+        skip_port_check: matches.opt_present("skip-port-check"),
     })
 }
 
@@ -271,29 +398,32 @@ fn check_path(s: String) -> Result<PathBuf, String> {
     if p.as_path().exists() {
         Ok(p)
     } else {
-        Err(format!("No such file: {:?}", p))
+        Err(format!("No such file: {p:?}"))
     }
 }
 
 /// TLS configuration.
-static TLS: Lazy<TlsAcceptor> = Lazy::new(acceptor);
+static TLS: LazyLock<TlsAcceptor> = LazyLock::new(acceptor);
 
 fn acceptor() -> TlsAcceptor {
-    let mut config = ServerConfig::new(NoClientAuth::new());
+    let config = if ARGS.only_tls13 {
-    if ARGS.only_tls13 {
+        ServerConfig::builder_with_protocol_versions(&[&TLS13])
-        config.versions = vec![rustls::ProtocolVersion::TLSv1_3];
+    } else {
+        ServerConfig::builder()
     }
-    config.cert_resolver = ARGS.certs.clone();
+    .with_no_client_auth()
+    .with_cert_resolver(ARGS.certs.clone());
     TlsAcceptor::from(Arc::new(config))
 }
 
-struct RequestHandle {
+struct RequestHandle<T> {
-    stream: TlsStream<TcpStream>,
+    stream: TlsStream<T>,
+    local_port_check: Option<u16>,
     log_line: String,
     metadata: Arc<Mutex<FileOptions>>,
 }
 
-impl RequestHandle {
+impl RequestHandle<TcpStream> {
     /// Creates a new request handle for the given stream. If establishing the TLS
     /// session fails, returns a corresponding log line.
     async fn new(stream: TcpStream, metadata: Arc<Mutex<FileOptions>>) -> Result<Self, String> {
@@ -303,11 +433,12 @@ impl RequestHandle {
         let peer_addr = if ARGS.log_ips {
             stream
                 .peer_addr()
-                .or(Err(format!(
+                .map_err(|_| {
-                    // use nonexistent status code 01 if peer IP is unknown
+                    format!(
-                    "{} - \"\" 01 \"IP error\" error:could not get peer address",
+                        // use nonexistent status code 01 if peer IP is unknown
-                    local_addr,
+                        "{local_addr} - \"\" 01 \"IP error\" error:could not get peer address",
-                )))?
+                    )
+                })?
                 .ip()
                 .to_string()
         } else {
@@ -315,19 +446,60 @@ impl RequestHandle {
             "-".into()
         };
 
-        let log_line = format!("{} {}", local_addr, peer_addr,);
+        let log_line = format!("{local_addr} {peer_addr}",);
+
+        let local_port_check = if ARGS.skip_port_check {
+            None
+        } else {
+            Some(stream.local_addr().unwrap().port())
+        };
 
         match TLS.accept(stream).await {
             Ok(stream) => Ok(Self {
                 stream,
+                local_port_check,
                 log_line,
                 metadata,
             }),
             // use nonexistent status code 00 if connection was not established
-            Err(e) => Err(format!("{} \"\" 00 \"TLS error\" error:{}", log_line, e)),
+            Err(e) => Err(format!("{log_line} \"\" 00 \"TLS error\" error:{e}")),
         }
     }
+}
 
+#[cfg(unix)]
+impl RequestHandle<UnixStream> {
+    async fn new_unix(
+        stream: UnixStream,
+        metadata: Arc<Mutex<FileOptions>>,
+    ) -> Result<Self, String> {
+        let log_line = format!(
+            "unix:{} -",
+            stream
+                .local_addr()
+                .ok()
+                .and_then(|addr| Some(addr.as_pathname()?.to_string_lossy().into_owned()))
+                .unwrap_or_default()
+        );
+
+        match TLS.accept(stream).await {
+            Ok(stream) => Ok(Self {
+                stream,
+                // TODO add port check for unix sockets, requires extra arg for port
+                local_port_check: None,
+                log_line,
+                metadata,
+            }),
+            // use nonexistent status code 00 if connection was not established
+            Err(e) => Err(format!("{log_line} \"\" 00 \"TLS error\" error:{e}")),
+        }
+    }
+}
+
+impl<T> RequestHandle<T>
+where
+    T: AsyncWriteExt + AsyncReadExt + Unpin,
+{
     /// Do the necessary actions to handle this request. Returns a corresponding
     /// log line as Err or Ok, depending on if the request finished with or
     /// without errors.
@@ -338,12 +510,12 @@ impl RequestHandle {
             Err((status, msg)) => self.send_header(status, msg).await,
         };
 
-        if let Err(e) = result {
+        let close_result = self.stream.shutdown().await;
-            Err(format!("{} error:{}", self.log_line, e))
+
-        } else if let Err(e) = self.stream.shutdown().await {
+        match (result, close_result) {
-            Err(format!("{} error:{}", self.log_line, e))
+            (Err(e), _) => Err(format!("{} error:{}", self.log_line, e)),
-        } else {
+            (Ok(_), Err(e)) => Err(format!("{} error:{}", self.log_line, e)),
-            Ok(self.log_line)
+            (Ok(_), Ok(_)) => Ok(self.log_line),
         }
     }
 
@@ -362,59 +534,71 @@ impl RequestHandle {
         // ISOC-RFC 3986, we could use BufRead::read_line here, but that does
         // not allow us to cap the number of read bytes at 1024+2.
         let result = loop {
-            let bytes_read = if let Ok(read) = self.stream.read(buf).await {
+            let Ok(bytes_read) = self.stream.read(buf).await else {
-                read
+                break Err((BAD_REQUEST, "Request ended unexpectedly"));
-            } else {
-                break Err((59, "Request ended unexpectedly"));
             };
             len += bytes_read;
             if request[..len].ends_with(b"\r\n") {
                 break Ok(());
             } else if bytes_read == 0 {
-                break Err((59, "Request ended unexpectedly"));
+                break Err((BAD_REQUEST, "Request ended unexpectedly"));
             }
             buf = &mut request[len..];
         }
-        .and_then(|()| std::str::from_utf8(&request[..len - 2]).or(Err((59, "Non-UTF-8 request"))));
+        .and_then(|()| {
+            std::str::from_utf8(&request[..len - 2]).or(Err((BAD_REQUEST, "Non-UTF-8 request")))
+        });
 
-        let request = result.map_err(|e| {
+        let request = result.inspect_err(|_| {
             // write empty request to log line for uniformity
             write!(self.log_line, " \"\"").unwrap();
-            e
         })?;
 
         // log literal request (might be different from or not an actual URL)
-        write!(self.log_line, " \"{}\"", request).unwrap();
+        write!(self.log_line, " \"{request}\"").unwrap();
 
-        let url = Url::parse(request).or(Err((59, "Invalid URL")))?;
+        let mut url = Url::parse(request).or(Err((BAD_REQUEST, "Invalid URL")))?;
 
         // Validate the URL:
         // correct scheme
         if url.scheme() != "gemini" {
-            return Err((53, "Unsupported URL scheme"));
+            return Err((PROXY_REQUEST_REFUSED, "Unsupported URL scheme"));
         }
 
         // no userinfo and no fragment
         if url.password().is_some() || !url.username().is_empty() || url.fragment().is_some() {
-            return Err((59, "URL contains fragment or userinfo"));
+            return Err((BAD_REQUEST, "URL contains fragment or userinfo"));
         }
 
         // correct host
-        if let Some(host) = url.host() {
+        let Some(domain) = url.domain() else {
-            // do not use "contains" here since it requires the same type and does
+            return Err((BAD_REQUEST, "URL does not contain a domain"));
-            // not allow to check for Host<&str> if the vec contains Hostname<String>
+        };
-            if !ARGS.hostnames.is_empty() && !ARGS.hostnames.iter().any(|h| h == &host) {
+        // because the gemini scheme is not special enough for WHATWG, normalize
-                return Err((53, "Proxy request refused"));
+        // it ourselves
-            }
+        let host = Host::parse(
-        } else {
+            &percent_decode_str(domain)
-            return Err((59, "URL does not contain a host"));
+                .decode_utf8()
+                .or(Err((BAD_REQUEST, "Invalid URL")))?,
+        )
+        .or(Err((BAD_REQUEST, "Invalid URL")))?;
+        // TODO: simplify when <https://github.com/servo/rust-url/issues/586> resolved
+        url.set_host(Some(&host.to_string()))
+            .expect("invalid domain?");
+        // do not use "contains" here since it requires the same type and does
+        // not allow to check for Host<&str> if the vec contains Hostname<String>
+        if !ARGS.hostnames.is_empty() && !ARGS.hostnames.iter().any(|h| h == &host) {
+            return Err((PROXY_REQUEST_REFUSED, "Proxy request refused"));
         }
 
         // correct port
-        if let Some(port) = url.port() {
+        if let Some(expected_port) = self.local_port_check
-            // Validate that the port in the URL is the same as for the stream this request came in on.
+            && let Some(port) = url.port()
-            if port != self.stream.get_ref().0.local_addr().unwrap().port() {
+        {
-                return Err((53, "proxy request refused"));
+            // Validate that the port in the URL is the same as for the stream this request
+            // came in on.
+            if port != expected_port {
+                return Err((PROXY_REQUEST_REFUSED, "Proxy request refused"));
             }
         }
         Ok(url)
@@ -431,12 +615,35 @@ impl RequestHandle {
 
         if let Some(mut segments) = url.path_segments() {
             // append percent-decoded path segments
-            path.extend(
+            for segment in segments.clone() {
-                segments
+                // To prevent directory traversal attacks, we need to
-                    .clone()
+                // check that each filesystem path component in the URL
-                    .map(|segment| Ok(percent_decode_str(segment).decode_utf8()?.into_owned()))
+                // path segment is a normal component (not the root
-                    .collect::<Result<Vec<_>>>()?,
+                // directory, the parent directory, a drive label, or
-            );
+                // another special component). Furthermore, since path
+                // separators (e.g. the escaped forward slash %2F) in a
+                // single URL path segment are non-structural, the URL
+                // path segment should not contain multiple filesystem
+                // path components.
+                let decoded = percent_decode_str(segment).decode_utf8()?;
+                let mut components = Path::new(decoded.as_ref()).components();
+                // the first component must be a normal component; if
+                // so, push it onto the PathBuf
+                match components.next() {
+                    None => (),
+                    Some(Component::Normal(c)) => path.push(c),
+                    Some(_) => return self.send_header(NOT_FOUND, "Not found, sorry.").await,
+                }
+                // there must not be more than one component
+                if components.next().is_some() {
+                    return self.send_header(NOT_FOUND, "Not found, sorry.").await;
+                }
+                // even if it's one component, there may be trailing path
+                // separators at the end
+                if decoded.ends_with(path::is_separator) {
+                    return self.send_header(NOT_FOUND, "Not found, sorry.").await;
+                }
+            }
             // check if hiding files is disabled
             if !ARGS.serve_secret
                 // there is a configuration for this file, assume it should be served
@@ -445,27 +652,29 @@ impl RequestHandle {
                 && segments.any(|segment| segment.starts_with('.'))
             {
                 return self
-                    .send_header(52, "If I told you, it would not be a secret.")
+                    .send_header(GONE, "If I told you, it would not be a secret.")
                     .await;
             }
         }
 
-        if let Ok(metadata) = tokio::fs::metadata(&path).await {
+        if let Ok(metadata) = tokio::fs::metadata(&path).await
-            if metadata.is_dir() {
+            && metadata.is_dir()
-                if url.path().ends_with('/') || url.path().is_empty() {
+        {
-                    // if the path ends with a slash or the path is empty, the links will work the same
+            if url.path().ends_with('/') || url.path().is_empty() {
-                    // without a redirect
+                // if the path ends with a slash or the path is empty, the links will work the same
-                    path.push("index.gmi");
+                // without a redirect
-                    if !path.exists() && path.with_file_name(".directory-listing-ok").exists() {
+                // use `push` instead of `join` because the changed path is used later
-                        path.pop();
+                path.push("index.gmi");
-                        return self.list_directory(&path).await;
+                if !path.exists() {
-                    }
+                    path.pop();
-                } else {
+                    // try listing directory
-                    // if client is not redirected, links may not work as expected without trailing slash
+                    return self.list_directory(&path).await;
-                    let mut url = url;
-                    url.set_path(&format!("{}/", url.path()));
-                    return self.send_header(31, url.as_str()).await;
                 }
+            } else {
+                // if client is not redirected, links may not work as expected without trailing slash
+                let mut url = url;
+                url.set_path(&format!("{}/", url.path()));
+                return self.send_header(REDIRECT_PERMANENT, url.as_str()).await;
             }
         }
 
@@ -481,7 +690,7 @@ impl RequestHandle {
         let mut file = match tokio::fs::File::open(&path).await {
             Ok(file) => file,
             Err(e) => {
-                self.send_header(51, "Not found, sorry.").await?;
+                self.send_header(NOT_FOUND, "Not found, sorry.").await?;
                 return Err(e.into());
             }
         };
@@ -495,14 +704,14 @@ impl RequestHandle {
             // guess the MIME type and add the parameters
             PresetMeta::Parameters(params) => {
                 if path.extension() == Some(OsStr::new("gmi")) {
-                    format!("text/gemini{}", params)
+                    format!("text/gemini{params}")
                 } else {
                     let mime = mime_guess::from_path(&path).first_or_octet_stream();
                     format!("{}{}", mime.essence_str(), params)
                 }
             }
         };
-        self.send_header(20, &mime).await?;
+        self.send_header(SUCCESS, &mime).await?;
 
         // Send body.
         tokio::io::copy(&mut file, &mut self.stream).await?;
@@ -522,8 +731,18 @@ impl RequestHandle {
             .add(b'{')
             .add(b'}');
 
-        log::info!("Listing directory {:?}", path);
+        // check if directory listing is enabled by getting preamble
-        self.send_header(20, "text/gemini").await?;
+        let Ok(preamble) = std::fs::read_to_string(path.join(".directory-listing-ok")) else {
+            self.send_header(NOT_FOUND, "Directory index disabled.")
+                .await?;
+            return Ok(());
+        };
+
+        log::info!("Listing directory {path:?}");
+
+        self.send_header(SUCCESS, "text/gemini").await?;
+        self.stream.write_all(preamble.as_bytes()).await?;
+
         let mut entries = tokio::fs::read_dir(path).await?;
         let mut lines = vec![];
         while let Some(entry) = entries.next_entry().await? {
@@ -538,8 +757,8 @@ impl RequestHandle {
                 name += "/";
             }
             let line = match percent_encode(name.as_bytes(), &ENCODE_SET).into() {
-                Cow::Owned(url) => format!("=> {} {}\n", url, name),
+                Cow::Owned(url) => format!("=> {url} {name}\n"),
-                Cow::Borrowed(url) => format!("=> {}\n", url), // url and name are identical
+                Cow::Borrowed(url) => format!("=> {url}\n"), // url and name are identical
             };
             lines.push(line);
         }
@@ -552,10 +771,10 @@ impl RequestHandle {
 
     async fn send_header(&mut self, status: u8, meta: &str) -> Result {
         // add response status and response meta
-        write!(self.log_line, " {} \"{}\"", status, meta)?;
+        write!(self.log_line, " {status} \"{meta}\"")?;
 
         self.stream
-            .write_all(format!("{} {}\r\n", status, meta).as_bytes())
+            .write_all(format!("{status} {meta}\r\n").as_bytes())
             .await?;
         Ok(())
     }

src/metadata.rs

@@ -1,5 +1,5 @@
 use configparser::ini::Ini;
-use glob::{glob_with, MatchOptions};
+use glob::{MatchOptions, glob_with};
 use std::collections::BTreeMap;
 use std::path::{Path, PathBuf};
 use std::time::SystemTime;
@@ -7,7 +7,7 @@ use std::time::SystemTime;
 static SIDECAR_FILENAME: &str = ".meta";
 
 /// A struct to store a string of metadata for each file retrieved from
-/// sidecar files called `.lang`.
+/// sidecar files with the name given by `SIDECAR_FILENAME`.
 ///
 /// These sidecar file's lines should have the format
 /// ```text
@@ -107,7 +107,7 @@ impl FileOptions {
     /// (Re)reads a specified sidecar file.
     /// This function will allways try to read the file, even if it is current.
     fn read_database(&mut self, db: &Path) {
-        log::debug!("reading database {:?}", db);
+        log::debug!("reading database {db:?}");
 
         let mut ini = Ini::new_cs();
         ini.set_default_section("mime");
@@ -124,7 +124,7 @@ impl FileOptions {
         let files = match map {
             Ok(section) => section,
             Err(err) => {
-                log::error!("invalid config file {:?}: {}", db, err);
+                log::error!("invalid config file {db:?}: {err}");
                 return;
             }
         };
@@ -146,7 +146,9 @@ impl FileOptions {
                     || !header.chars().nth(1).unwrap().is_ascii_digit()
                     || !header.chars().nth(2).unwrap().is_whitespace()
                 {
-                    log::error!("Line for {:?} starts like a full header line, but it is incorrect; ignoring it.", path);
+                    log::error!(
+                        "Line for {path:?} starts like a full header line, but it is incorrect; ignoring it."
+                    );
                     return;
                 }
                 let separator = header.chars().nth(2).unwrap();
@@ -154,7 +156,9 @@ impl FileOptions {
                     // the Gemini specification says that the third
                     // character has to be a space, so correct any
                     // other whitespace to it (e.g. tabs)
-                    log::warn!("Full Header line for {:?} has an invalid character, treating {:?} as a space.", path, separator);
+                    log::warn!(
+                        "Full Header line for {path:?} has an invalid character, treating {separator:?} as a space."
+                    );
                 }
                 let status = header
                     .chars()
@@ -186,12 +190,12 @@ impl FileOptions {
                 match glob_with(path, glob_options) {
                     Ok(paths) => paths.collect::<Vec<_>>(),
                     Err(err) => {
-                        log::error!("incorrect glob pattern in {:?}: {}", path, err);
+                        log::error!("incorrect glob pattern in {path:?}: {err}");
                         continue;
                     }
                 }
             } else {
-                log::error!("path is not UTF-8: {:?}", path);
+                log::error!("path is not UTF-8: {path:?}");
                 continue;
             };
 
@@ -206,7 +210,7 @@ impl FileOptions {
                             self.file_meta.insert(path, preset.clone());
                         }
                         Err(err) => {
-                            log::warn!("could not process glob path: {}", err);
+                            log::warn!("could not process glob path: {err}");
                             continue;
                         }
                     };
@@ -218,7 +222,7 @@ impl FileOptions {
     /// Get the metadata for the specified file. This might need to (re)load a
     /// single sidecar file.
     /// The file path should consistenly be either absolute or relative to the
-    /// working/content directory. If inconsisten file paths are used, this can
+    /// working/content directory. If inconsistent file paths are used, this can
     /// lead to loading and storing sidecar files multiple times.
     pub fn get(&mut self, file: &Path) -> PresetMeta {
         self.update(file);

tests/LICENSE-GPL.md

@@ -0,0 +1,675 @@
+# GNU GENERAL PUBLIC LICENSE
+
+Version 3, 29 June 2007
+
+Copyright (C) 2007 Free Software Foundation, Inc.
+<https://fsf.org/>
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+## Preamble
+
+The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works. By contrast,
+the GNU General Public License is intended to guarantee your freedom
+to share and change all versions of a program--to make sure it remains
+free software for all its users. We, the Free Software Foundation, use
+the GNU General Public License for most of our software; it applies
+also to any other work released this way by its authors. You can apply
+it to your programs, too.
+
+When we speak of free software, we are referring to freedom, not
+price. Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights. Therefore, you
+have certain responsibilities if you distribute copies of the
+software, or if you modify it: responsibilities to respect the freedom
+of others.
+
+For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received. You must make sure that they, too, receive
+or can get the source code. And you must show them these terms so they
+know their rights.
+
+Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software. For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the
+manufacturer can do so. This is fundamentally incompatible with the
+aim of protecting users' freedom to change the software. The
+systematic pattern of such abuse occurs in the area of products for
+individuals to use, which is precisely where it is most unacceptable.
+Therefore, we have designed this version of the GPL to prohibit the
+practice for those products. If such problems arise substantially in
+other domains, we stand ready to extend this provision to those
+domains in future versions of the GPL, as needed to protect the
+freedom of users.
+
+Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish
+to avoid the special danger that patents applied to a free program
+could make it effectively proprietary. To prevent this, the GPL
+assures that patents cannot be used to render the program non-free.
+
+The precise terms and conditions for copying, distribution and
+modification follow.
+
+## TERMS AND CONDITIONS
+
+### 0. Definitions.
+
+"This License" refers to version 3 of the GNU General Public License.
+
+"Copyright" also means copyright-like laws that apply to other kinds
+of works, such as semiconductor masks.
+
+"The Program" refers to any copyrightable work licensed under this
+License. Each licensee is addressed as "you". "Licensees" and
+"recipients" may be individuals or organizations.
+
+To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of
+an exact copy. The resulting work is called a "modified version" of
+the earlier work or a work "based on" the earlier work.
+
+A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy. Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies. Mere interaction with a user
+through a computer network, with no transfer of a copy, is not
+conveying.
+
+An interactive user interface displays "Appropriate Legal Notices" to
+the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License. If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+### 1. Source Code.
+
+The "source code" for a work means the preferred form of the work for
+making modifications to it. "Object code" means any non-source form of
+a work.
+
+A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form. A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities. However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work. For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+The Corresponding Source need not include anything that users can
+regenerate automatically from other parts of the Corresponding Source.
+
+The Corresponding Source for a work in source code form is that same
+work.
+
+### 2. Basic Permissions.
+
+All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met. This License explicitly affirms your unlimited
+permission to run the unmodified Program. The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work. This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+You may make, run and propagate covered works that you do not convey,
+without conditions so long as your license otherwise remains in force.
+You may convey covered works to others for the sole purpose of having
+them make modifications exclusively for you, or provide you with
+facilities for running those works, provided that you comply with the
+terms of this License in conveying all material for which you do not
+control copyright. Those thus making or running the covered works for
+you must do so exclusively on your behalf, under your direction and
+control, on terms that prohibit them from making any copies of your
+copyrighted material outside their relationship with you.
+
+Conveying under any other circumstances is permitted solely under the
+conditions stated below. Sublicensing is not allowed; section 10 makes
+it unnecessary.
+
+### 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such
+circumvention is effected by exercising rights under this License with
+respect to the covered work, and you disclaim any intention to limit
+operation or modification of the work as a means of enforcing, against
+the work's users, your or third parties' legal rights to forbid
+circumvention of technological measures.
+
+### 4. Conveying Verbatim Copies.
+
+You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+### 5. Conveying Modified Source Versions.
+
+You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these
+conditions:
+
+-   a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+-   b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under
+    section 7. This requirement modifies the requirement in section 4
+    to "keep intact all notices".
+-   c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy. This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged. This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+-   d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit. Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+### 6. Conveying Non-Source Forms.
+
+You may convey a covered work in object code form under the terms of
+sections 4 and 5, provided that you also convey the machine-readable
+Corresponding Source under the terms of this License, in one of these
+ways:
+
+-   a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+-   b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the Corresponding
+    Source from a network server at no charge.
+-   c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source. This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+-   d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge. You need not require recipients to copy the
+    Corresponding Source along with the object code. If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source. Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+-   e) Convey the object code using peer-to-peer transmission,
+    provided you inform other peers where the object code and
+    Corresponding Source of the work are being offered to the general
+    public at no charge under subsection 6d.
+
+A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal,
+family, or household purposes, or (2) anything designed or sold for
+incorporation into a dwelling. In determining whether a product is a
+consumer product, doubtful cases shall be resolved in favor of
+coverage. For a particular product received by a particular user,
+"normally used" refers to a typical or common use of that class of
+product, regardless of the status of the particular user or of the way
+in which the particular user actually uses, or expects or is expected
+to use, the product. A product is a consumer product regardless of
+whether the product has substantial commercial, industrial or
+non-consumer uses, unless such uses represent the only significant
+mode of use of the product.
+
+"Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to
+install and execute modified versions of a covered work in that User
+Product from a modified version of its Corresponding Source. The
+information must suffice to ensure that the continued functioning of
+the modified object code is in no case prevented or interfered with
+solely because modification has been made.
+
+If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information. But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or
+updates for a work that has been modified or installed by the
+recipient, or for the User Product in which it has been modified or
+installed. Access to a network may be denied when the modification
+itself materially and adversely affects the operation of the network
+or violates the rules and protocols for communication across the
+network.
+
+Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+### 7. Additional Terms.
+
+"Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law. If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it. (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.) You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders
+of that material) supplement the terms of this License with terms:
+
+-   a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+-   b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+-   c) Prohibiting misrepresentation of the origin of that material,
+    or requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+-   d) Limiting the use for publicity purposes of names of licensors
+    or authors of the material; or
+-   e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+-   f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions
+    of it) with contractual assumptions of liability to the recipient,
+    for any liability that these contractual assumptions directly
+    impose on those licensors and authors.
+
+All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10. If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term. If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions; the
+above requirements apply either way.
+
+### 8. Termination.
+
+You may not propagate or modify a covered work except as expressly
+provided under this License. Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+However, if you cease all violation of this License, then your license
+from a particular copyright holder is reinstated (a) provisionally,
+unless and until the copyright holder explicitly and finally
+terminates your license, and (b) permanently, if the copyright holder
+fails to notify you of the violation by some reasonable means prior to
+60 days after the cessation.
+
+Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License. If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+### 9. Acceptance Not Required for Having Copies.
+
+You are not required to accept this License in order to receive or run
+a copy of the Program. Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance. However,
+nothing other than this License grants you permission to propagate or
+modify any covered work. These actions infringe copyright if you do
+not accept this License. Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+### 10. Automatic Licensing of Downstream Recipients.
+
+Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License. You are not responsible
+for enforcing compliance by third parties with this License.
+
+An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations. If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License. For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+### 11. Patents.
+
+A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based. The
+work thus licensed is called the contributor's "contributor version".
+
+A contributor's "essential patent claims" are all patent claims owned
+or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version. For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement). To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients. "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+A patent license is "discriminatory" if it does not include within the
+scope of its coverage, prohibits the exercise of, or is conditioned on
+the non-exercise of one or more of the rights that are specifically
+granted under this License. You may not convey a covered work if you
+are a party to an arrangement with a third party that is in the
+business of distributing software, under which you make payment to the
+third party based on the extent of your activity of conveying the
+work, and under which the third party grants, to any of the parties
+who would receive the covered work from you, a discriminatory patent
+license (a) in connection with copies of the covered work conveyed by
+you (or copies made from those copies), or (b) primarily for and in
+connection with specific products or compilations that contain the
+covered work, unless you entered into that arrangement, or that patent
+license was granted, prior to 28 March 2007.
+
+Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+### 12. No Surrender of Others' Freedom.
+
+If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License. If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under
+this License and any other pertinent obligations, then as a
+consequence you may not convey it at all. For example, if you agree to
+terms that obligate you to collect a royalty for further conveying
+from those to whom you convey the Program, the only way you could
+satisfy both those terms and this License would be to refrain entirely
+from conveying the Program.
+
+### 13. Use with the GNU Affero General Public License.
+
+Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work. The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+### 14. Revised Versions of this License.
+
+The Free Software Foundation may publish revised and/or new versions
+of the GNU General Public License from time to time. Such new versions
+will be similar in spirit to the present version, but may differ in
+detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Program
+specifies that a certain numbered version of the GNU General Public
+License "or any later version" applies to it, you have the option of
+following the terms and conditions either of that numbered version or
+of any later version published by the Free Software Foundation. If the
+Program does not specify a version number of the GNU General Public
+License, you may choose any version ever published by the Free
+Software Foundation.
+
+If the Program specifies that a proxy can decide which future versions
+of the GNU General Public License can be used, that proxy's public
+statement of acceptance of a version permanently authorizes you to
+choose that version for the Program.
+
+Later license versions may give you additional or different
+permissions. However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+### 15. Disclaimer of Warranty.
+
+THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT
+WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND
+PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE
+DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR
+CORRECTION.
+
+### 16. Limitation of Liability.
+
+IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR
+CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES
+ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT
+NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR
+LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM
+TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER
+PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+### 17. Interpretation of Sections 15 and 16.
+
+If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+END OF TERMS AND CONDITIONS
+
+## How to Apply These Terms to Your New Programs
+
+If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these
+terms.
+
+To do so, attach the following notices to the program. It is safest to
+attach them to the start of each source file to most effectively state
+the exclusion of warranty; and each file should have at least the
+"copyright" line and a pointer to where the full notice is found.
+
+        <one line to give the program's name and a brief idea of what it does.>
+        Copyright (C) <year>  <name of author>
+
+        This program is free software: you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation, either version 3 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper
+mail.
+
+If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+        <program>  Copyright (C) <year>  <name of author>
+        This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+        This is free software, and you are welcome to redistribute it
+        under certain conditions; type `show c' for details.
+
+The hypothetical commands \`show w' and \`show c' should show the
+appropriate parts of the General Public License. Of course, your
+program's commands might be different; for a GUI interface, you would
+use an "about box".
+
+You should also get your employer (if you work as a programmer) or
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary. For more information on this, and how to apply and follow
+the GNU GPL, see <https://www.gnu.org/licenses/>.
+
+The GNU General Public License does not permit incorporating your
+program into proprietary programs. If your program is a subroutine
+library, you may consider it more useful to permit linking proprietary
+applications with the library. If this is what you want to do, use the
+GNU Lesser General Public License instead of this License. But first,
+please read <https://www.gnu.org/licenses/why-not-lgpl.html>.

tests/README.md

@@ -1,5 +1,5 @@
 # Tests for the Agate gemini server
 
-This folder contains some tests and data used for these tests. Although care is taken to remove any interdependencies between these tests, these may happen. If you want to be on the safe side you could use `cargo test -- --test-threads=1` to run the tests sequentially.
+This folder contains some tests and data used for these tests.
 
 Also note that you should **NEVER USE THE CERTIFICATE AND KEY DATA PROVIDED HERE** since it is public.

tests/data/content/.meta

@@ -8,3 +8,5 @@ test.gmi: ;lang=en ;charset=us-ascii
 gone.txt: 52 This file is no longer available.
 # test setting data for files in other directories
 example.com/index.gmi: ;lang=en-US
+.servable-secret: text/plain
+.well-known/servable-secret: text/plain

tests/data/content/symlink.gmi

@@ -0,0 +1 @@
+index.gmi

tests/data/content/symlinked_dir

@@ -0,0 +1 @@
+../symlinked_dir/

tests/data/directory_traversal.gmi

@@ -0,0 +1 @@
+This is a test file to check for directory traversal vulnerabilities.

tests/data/dirlist-preamble/.directory-listing-ok

@@ -0,0 +1 @@
+This is a directory listing

tests/data/symlinked_dir/file.gmi

@@ -0,0 +1 @@
+Hello from the symlink'ed directory!

tests/tests.rs

@@ -1,23 +1,40 @@
-use anyhow::anyhow;
+//! Agate integration tests
-use gemini_fetch::{Header, Page, Status};
+//!
-use std::io::{BufRead, BufReader, Read};
+//! This program is free software: you can redistribute it and/or modify
-use std::net::{SocketAddr, ToSocketAddrs};
+//! it under the terms of the GNU General Public License as published by
+//! the Free Software Foundation, either version 3 of the License, or
+//! (at your option) any later version.
+//!
+//! This program is distributed in the hope that it will be useful,
+//! but WITHOUT ANY WARRANTY; without even the implied warranty of
+//! MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//! GNU General Public License for more details.
+//!
+//! You should have received a copy of the GNU General Public License
+//! along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+use rustls::{ClientConnection, RootCertStore, pki_types::CertificateDer};
+use std::convert::TryInto;
+use std::io::{BufRead, BufReader, Read, Write};
+use std::net::{SocketAddr, TcpStream, ToSocketAddrs};
+use std::path::PathBuf;
 use std::process::{Command, Stdio};
+use std::sync::atomic::{AtomicU16, Ordering};
+use std::thread::sleep;
+use std::time::Duration;
+use tokio_rustls::rustls;
+use trotter::{Actor, Response, Status};
 use url::Url;
 
 static BINARY_PATH: &str = env!("CARGO_BIN_EXE_agate");
 
-fn addr(port: u16) -> SocketAddr {
+static DEFAULT_PORT: u16 = 1965;
-    use std::net::{IpAddr, Ipv4Addr};
+/// this is our atomic port that increments for each test that needs one
-
+/// doing it this way avoids port collisions from manually setting ports
-    (IpAddr::V4(Ipv4Addr::LOCALHOST), port)
+static PORT: AtomicU16 = AtomicU16::new(DEFAULT_PORT);
-        .to_socket_addrs()
-        .unwrap()
-        .next()
-        .unwrap()
-}
 
 struct Server {
+    addr: SocketAddr,
     server: std::process::Child,
     // is set when output is collected by stop()
     output: Option<Result<(), String>>,
@@ -25,10 +42,24 @@ struct Server {
 
 impl Server {
     pub fn new(args: &[&str]) -> Self {
+        use std::net::{IpAddr, Ipv4Addr};
+
+        // generate unique port/address so tests do not clash
+        let addr = (
+            IpAddr::V4(Ipv4Addr::LOCALHOST),
+            PORT.fetch_add(1, Ordering::SeqCst),
+        )
+            .to_socket_addrs()
+            .unwrap()
+            .next()
+            .unwrap();
+
         // start the server
         let mut server = Command::new(BINARY_PATH)
             .stderr(Stdio::piped())
             .current_dir(concat!(env!("CARGO_MANIFEST_DIR"), "/tests/data"))
+            // add address information
+            .args(["--addr", &addr.to_string()])
             .args(args)
             .env("RUST_LOG", "debug")
             .spawn()
@@ -38,8 +69,8 @@ impl Server {
         let mut reader = BufReader::new(server.stderr.as_mut().unwrap());
         let mut buffer = String::new();
         while matches!(reader.read_line(&mut buffer), Ok(i) if i>0) {
-            print!("log: {}", buffer);
+            print!("log: {buffer}");
-            if buffer.contains("Listening") {
+            if buffer.contains("Started") {
                 break;
             }
 
@@ -51,11 +82,16 @@ impl Server {
         }
 
         Self {
+            addr,
             server,
             output: None,
         }
     }
 
+    pub fn get_addr(&self) -> SocketAddr {
+        self.addr
+    }
+
     pub fn stop(&mut self) -> Result<(), String> {
         // try to stop the server
         if let Some(output) = self.output.as_ref() {
@@ -63,7 +99,7 @@ impl Server {
         }
 
         self.output = Some(match self.server.try_wait() {
-            Err(e) => Err(format!("cannot access orchestrated program: {:?}", e)),
+            Err(e) => Err(format!("cannot access orchestrated program: {e:?}")),
             Ok(None) => {
                 // everything fine, still running as expected, kill it now
                 self.server.kill().unwrap();
@@ -71,7 +107,7 @@ impl Server {
                 let mut reader = BufReader::new(self.server.stderr.as_mut().unwrap());
                 let mut buffer = String::new();
                 while matches!(reader.read_line(&mut buffer), Ok(i) if i>0) {
-                    print!("log: {}", buffer);
+                    print!("log: {buffer}");
                     if buffer.contains("Listening") {
                         break;
                     }
@@ -82,7 +118,7 @@ impl Server {
                 let mut reader = BufReader::new(self.server.stderr.as_mut().unwrap());
                 let mut buffer = String::new();
                 while matches!(reader.read_line(&mut buffer), Ok(i) if i>0) {
-                    print!("log: {}", buffer);
+                    print!("log: {buffer}");
                     if buffer.contains("Listening") {
                         break;
                     }
@@ -103,251 +139,333 @@ impl Drop for Server {
             // server was already stopped
         } else {
             // we are panicking and a potential error was not handled
-            self.stop().unwrap_or_else(|e| eprintln!("{}", e));
+            self.stop().unwrap_or_else(|e| eprintln!("{e}"));
         }
     }
 }
 
-fn get(args: &[&str], addr: SocketAddr, url: &str) -> Result<Page, anyhow::Error> {
+fn get(args: &[&str], url: &str) -> Result<Response, String> {
     let mut server = Server::new(args);
 
-    // actually perform the request
+    let url = Url::parse(url).unwrap();
-    let page = tokio::runtime::Runtime::new()
+    let actor = Actor::default().proxy("localhost".into(), server.addr.port());
-        .unwrap()
+    let request = actor.get(url);
-        .block_on(async { Page::fetch_from(&Url::parse(url).unwrap(), addr, None).await });
 
-    server.stop().map_err(|e| anyhow!(e)).and(page)
+    let response = tokio::runtime::Runtime::new()
+        .unwrap()
+        .block_on(request)
+        .map_err(|e| e.to_string());
+    server.stop()?;
+    response
 }
 
 #[test]
 /// - serves index page for a directory
 /// - serves the correct content
 fn index_page() {
-    let page = get(&[], addr(1965), "gemini://localhost").expect("could not get page");
+    let page = get(&[], "gemini://localhost").expect("could not get page");
 
-    assert_eq!(
+    assert_eq!(page.status, Status::Success.value());
-        page.header,
+    assert_eq!(page.meta, "text/gemini");
-        Header {
+
-            status: Status::Success,
+    assert_eq!(page.content, include_bytes!("data/content/index.gmi"));
-            meta: "text/gemini".to_string(),
+}
+
+#[cfg(unix)]
+#[test]
+fn index_page_unix() {
+    let sock_path = std::env::temp_dir().join("agate-test-unix-socket");
+
+    // this uses multicert because those certificates are set up so rustls
+    // does not complain about them being CA certificates
+    let mut server = Server::new(&[
+        "--certs",
+        "multicert",
+        "--socket",
+        sock_path
+            .to_str()
+            .expect("could not convert temp dir path to string"),
+    ]);
+
+    // set up TLS connection via unix socket
+    let mut certs = RootCertStore::empty();
+    certs
+        .add(CertificateDer::from(
+            include_bytes!("data/multicert/example.com/cert.der").as_slice(),
+        ))
+        .unwrap();
+    let config = rustls::ClientConfig::builder()
+        .with_root_certificates(certs)
+        .with_no_client_auth();
+    let mut session = ClientConnection::new(
+        std::sync::Arc::new(config),
+        "example.com".try_into().unwrap(),
+    )
+    .unwrap();
+
+    let mut unix = loop {
+        if let Ok(sock) = std::os::unix::net::UnixStream::connect(&sock_path) {
+            break sock;
         }
-    );
+        sleep(Duration::from_millis(10));
+    };
+    let mut tls = rustls::Stream::new(&mut session, &mut unix);
 
-    assert_eq!(
+    write!(tls, "gemini://example.com\r\n").unwrap();
-        page.body,
+
-        Some(
+    let mut buf = [0; 16];
-            std::fs::read_to_string(concat!(
+    let _ = tls.read(&mut buf);
-                env!("CARGO_MANIFEST_DIR"),
+
-                "/tests/data/content/index.gmi"
+    assert_eq!(&buf, b"20 text/gemini\r\n");
-            ))
+
-            .unwrap()
+    server.stop().expect("failed to stop server");
-        )
+}
-    );
+
+#[test]
+/// - symlinked files are followed correctly
+fn symlink_page() {
+    let page = get(&[], "gemini://localhost/symlink.gmi").expect("could not get page");
+
+    assert_eq!(page.status, Status::Success.value());
+    assert_eq!(page.meta, "text/gemini");
+    assert_eq!(page.content, include_bytes!("data/content/index.gmi"));
+}
+
+#[test]
+/// - symlinked directories are followed correctly
+fn symlink_directory() {
+    let page = get(&[], "gemini://localhost/symlinked_dir/file.gmi").expect("could not get page");
+
+    assert_eq!(page.status, Status::Success.value());
+    assert_eq!(page.meta, "text/gemini");
+    assert_eq!(page.content, include_bytes!("data/symlinked_dir/file.gmi"));
 }
 
 #[test]
 /// - the `--addr` configuration works
 /// - MIME media types can be set in the configuration file
 fn meta() {
-    let page = get(
+    let page = get(&[], "gemini://localhost/test").expect("could not get page");
-        &["--addr", "[::]:1966"],
+    assert_eq!(page.status, Status::Success.value());
-        addr(1966),
+    assert_eq!(page.meta, "text/html");
-        "gemini://localhost/test",
-    )
-    .expect("could not get page");
-
-    assert_eq!(
-        page.header,
-        Header {
-            status: Status::Success,
-            meta: "text/html".to_string(),
-        }
-    );
 }
 
 #[test]
 /// - MIME type is correctly guessed for `.gmi` files
 /// - MIME media type parameters can be set in the configuration file
 fn meta_param() {
-    let page = get(
+    let page = get(&[], "gemini://localhost/test.gmi").expect("could not get page");
-        &["--addr", "[::]:1967"],
+    assert_eq!(page.status, Status::Success.value());
-        addr(1967),
+    assert_eq!(page.meta, "text/gemini;lang=en ;charset=us-ascii");
-        "gemini://localhost/test.gmi",
-    )
-    .expect("could not get page");
-
-    assert_eq!(
-        page.header,
-        Header {
-            status: Status::Success,
-            meta: "text/gemini;lang=en ;charset=us-ascii".to_string(),
-        }
-    );
 }
 
 #[test]
 /// - globs in the configuration file work correctly
 /// - distributed configuration file is used when `-C` flag not used
 fn glob() {
-    let page = get(
+    let page = get(&[], "gemini://localhost/testdir/a.nl.gmi").expect("could not get page");
-        &["--addr", "[::]:1968"],
+    assert_eq!(page.status, Status::Success.value());
-        addr(1968),
+    assert_eq!(page.meta, "text/plain;lang=nl");
-        "gemini://localhost/testdir/a.nl.gmi",
-    )
-    .expect("could not get page");
-
-    assert_eq!(
-        page.header,
-        Header {
-            status: Status::Success,
-            meta: "text/plain;lang=nl".to_string(),
-        }
-    );
 }
 
 #[test]
 /// - double globs (i.e. `**`) work correctly in the configuration file
 /// - central configuration file is used when `-C` flag is used
 fn doubleglob() {
-    let page = get(
+    let page = get(&["-C"], "gemini://localhost/testdir/a.nl.gmi").expect("could not get page");
-        &["--addr", "[::]:1969", "-C"],
+    assert_eq!(page.status, Status::Success.value());
-        addr(1969),
+    assert_eq!(page.meta, "text/gemini;lang=nl");
-        "gemini://localhost/testdir/a.nl.gmi",
-    )
-    .expect("could not get page");
-
-    assert_eq!(
-        page.header,
-        Header {
-            status: Status::Success,
-            meta: "text/gemini;lang=nl".to_string(),
-        }
-    );
 }
 
 #[test]
 /// - full header lines can be set in the configuration file
 fn full_header_preset() {
-    let page = get(
+    let page = get(&[], "gemini://localhost/gone.txt").expect("could not get page");
-        &["--addr", "[::]:1970"],
+    assert_eq!(page.status, Status::Gone.value());
-        addr(1970),
+    assert_eq!(page.meta, "This file is no longer available.");
-        "gemini://localhost/gone.txt",
-    )
-    .expect("could not get page");
-
-    assert_eq!(
-        page.header,
-        Header {
-            status: Status::Gone,
-            meta: "This file is no longer available.".to_string(),
-        }
-    );
 }
 
 #[test]
 /// - URLS with fragments are rejected
 fn fragment() {
     let page = get(
-        &["--addr", "[::]:1983", "--hostname", "example.com"],
+        &["--hostname", "example.com"],
-        addr(1983),
         "gemini://example.com/#fragment",
     )
     .expect("could not get page");
 
-    assert_eq!(page.header.status, Status::BadRequest);
+    assert_eq!(page.status, Status::BadRequest.value());
 }
 
 #[test]
 /// - URLS with username are rejected
 fn username() {
-    let page = get(
+    let page = get(&["--hostname", "example.com"], "gemini://user@example.com/")
-        &["--addr", "[::]:1984", "--hostname", "example.com"],
+        .expect("could not get page");
-        addr(1984),
-        "gemini://user@example.com/",
-    )
-    .expect("could not get page");
 
-    assert_eq!(page.header.status, Status::BadRequest);
+    assert_eq!(page.status, Status::BadRequest.value());
+}
+
+#[test]
+/// - URLS with invalid hostnames are rejected
+fn percent_encode() {
+    // Can't use `get` here because we are testing a URL thats invalid so
+    // the gemini fetching library can not process it.
+    let mut server = Server::new(&["--certs", "multicert"]);
+
+    let mut certs = RootCertStore::empty();
+    certs
+        .add(CertificateDer::from(
+            include_bytes!("data/multicert/example.com/cert.der").as_slice(),
+        ))
+        .unwrap();
+    let config = rustls::ClientConfig::builder()
+        .with_root_certificates(certs)
+        .with_no_client_auth();
+
+    let mut session = ClientConnection::new(
+        std::sync::Arc::new(config),
+        "example.com".try_into().unwrap(),
+    )
+    .unwrap();
+    let mut tcp = TcpStream::connect(server.get_addr()).unwrap();
+    let mut tls = rustls::Stream::new(&mut session, &mut tcp);
+
+    write!(tls, "gemini://%/\r\n").unwrap();
+
+    let mut buf = [0; 10];
+    let _ = tls.read(&mut buf);
+
+    assert_eq!(&buf[0..2], b"59");
+
+    server.stop().unwrap();
 }
 
 #[test]
 /// - URLS with password are rejected
 fn password() {
     let page = get(
-        &["--addr", "[::]:1985", "--hostname", "example.com"],
+        &["--hostname", "example.com"],
-        addr(1985),
         "gemini://:secret@example.com/",
     )
     .expect("could not get page");
 
-    assert_eq!(page.header.status, Status::BadRequest);
+    assert_eq!(page.status, Status::BadRequest.value());
 }
 
 #[test]
 /// - hostname is checked when provided
 /// - status for wrong host is "proxy request refused"
 fn hostname_check() {
-    let page = get(
+    let page =
-        &["--addr", "[::]:1971", "--hostname", "example.org"],
+        get(&["--hostname", "example.org"], "gemini://example.com/").expect("could not get page");
-        addr(1971),
-        "gemini://example.com/",
-    )
-    .expect("could not get page");
 
-    assert_eq!(page.header.status, Status::ProxyRequestRefused);
+    assert_eq!(page.status, Status::ProxyRequestRefused.value());
 }
 
 #[test]
 /// - port is checked when hostname is provided
 /// - status for wrong port is "proxy request refused"
 fn port_check() {
+    let page =
+        get(&["--hostname", "example.org"], "gemini://example.org:1/").expect("could not get page");
+
+    assert_eq!(page.status, Status::ProxyRequestRefused.value());
+}
+
+#[test]
+/// - port is not checked if the skip option is passed.
+fn port_check_skipped() {
     let page = get(
-        &["--addr", "[::]:1972", "--hostname", "example.org"],
+        &["--hostname", "example.org", "--skip-port-check"],
-        addr(1972),
+        "gemini://example.org:1/",
-        "gemini://example.org:1971/",
     )
     .expect("could not get page");
 
-    assert_eq!(page.header.status, Status::ProxyRequestRefused);
+    assert_eq!(page.status, Status::Success.value());
 }
 
 #[test]
 /// - status for paths with hidden segments is "gone" if file does not exist
 fn secret_nonexistent() {
-    let page = get(
+    let page = get(&[], "gemini://localhost/.non-existing-secret").expect("could not get page");
-        &["--addr", "[::]:1973"],
-        addr(1973),
-        "gemini://localhost/.secret",
-    )
-    .expect("could not get page");
 
-    assert_eq!(page.header.status, Status::Gone);
+    assert_eq!(page.status, Status::Gone.value());
 }
 
 #[test]
 /// - status for paths with hidden segments is "gone" if file exists
 fn secret_exists() {
-    let page = get(
+    let page = get(&[], "gemini://localhost/.meta").expect("could not get page");
-        &["--addr", "[::]:1974"],
-        addr(1974),
-        "gemini://localhost/.meta",
-    )
-    .expect("could not get page");
 
-    assert_eq!(page.header.status, Status::Gone);
+    assert_eq!(page.status, Status::Gone.value());
+}
+
+#[test]
+/// - status for paths with hidden segments is "gone" if the respective segment is not the last
+fn secret_subdir() {
+    let page =
+        get(&["-C"], "gemini://localhost/.well-known/hidden-file").expect("could not get page");
+
+    assert_eq!(page.status, Status::Gone.value());
 }
 
 #[test]
 /// - secret file served if `--serve-secret` is enabled
 fn serve_secret() {
-    let page = get(
+    let page = get(&["--serve-secret"], "gemini://localhost/.meta").expect("could not get page");
-        &["--addr", "[::]:1975", "--serve-secret"],
-        addr(1975),
-        "gemini://localhost/.meta",
-    )
-    .expect("could not get page");
 
-    assert_eq!(page.header.status, Status::Success);
+    assert_eq!(page.status, Status::Success.value());
+}
+
+#[test]
+/// - secret file served if path is in sidecar
+fn serve_secret_meta_config() {
+    let page = get(&[], "gemini://localhost/.servable-secret").expect("could not get page");
+
+    assert_eq!(page.status, Status::Success.value());
+}
+
+#[test]
+/// - secret file served if path with subdir is in sidecar
+fn serve_secret_meta_config_subdir() {
+    let page =
+        get(&["-C"], "gemini://localhost/.well-known/servable-secret").expect("could not get page");
+
+    assert_eq!(page.status, Status::Success.value());
+}
+
+#[test]
+/// - directory traversal attacks using percent-encoded path separators
+///   fail (this addresses a previous vulnerability)
+fn directory_traversal_regression() {
+    let base = Url::parse("gemini://localhost/").unwrap();
+
+    let mut absolute = base.clone();
+    absolute
+        .path_segments_mut()
+        .unwrap()
+        .push(env!("CARGO_MANIFEST_DIR")) // separators will be percent-encoded
+        .push("tests")
+        .push("data")
+        .push("directory_traversal.gmi");
+
+    let mut relative_escape_path = PathBuf::new();
+    relative_escape_path.push("testdir");
+    relative_escape_path.push("..");
+    relative_escape_path.push("..");
+    let mut relative = base;
+    relative
+        .path_segments_mut()
+        .unwrap()
+        .push(relative_escape_path.to_str().unwrap()) // separators will be percent-encoded
+        .push("directory_traversal.gmi");
+
+    let urls = [absolute, relative];
+    for url in urls.iter() {
+        let page = get(&[], url.as_str()).expect("could not get page");
+        assert_eq!(page.status, Status::NotFound.value());
+    }
 }
 
 #[test]
@@ -355,19 +473,17 @@ fn serve_secret() {
 ///   (lower versions do not have to be tested because rustls does not even
 ///   support them, making agate incapable of accepting them)
 fn explicit_tls_version() {
-    use rustls::{ClientSession, ProtocolVersion, TLSError};
+    let server = Server::new(&["-3"]);
-    use std::io::Read;
-    use std::net::TcpStream;
 
-    let _server = Server::new(&["--addr", "[::]:1976", "-3"]);
-
-    let mut config = rustls::ClientConfig::new();
     // try to connect using only TLS 1.2
-    config.versions = vec![ProtocolVersion::TLSv1_2];
+    let config = rustls::ClientConfig::builder_with_protocol_versions(&[&rustls::version::TLS12])
+        .with_root_certificates(RootCertStore::empty())
+        .with_no_client_auth();
 
-    let dns_name = webpki::DNSNameRef::try_from_ascii_str("localhost").unwrap();
+    let mut session =
-    let mut session = ClientSession::new(&std::sync::Arc::new(config), dns_name);
+        ClientConnection::new(std::sync::Arc::new(config), "localhost".try_into().unwrap())
-    let mut tcp = TcpStream::connect(addr(1976)).unwrap();
+            .unwrap();
+    let mut tcp = TcpStream::connect(server.get_addr()).unwrap();
     let mut tls = rustls::Stream::new(&mut session, &mut tcp);
 
     let mut buf = [0; 10];
@@ -376,9 +492,9 @@ fn explicit_tls_version() {
             .unwrap_err()
             .into_inner()
             .unwrap()
-            .downcast::<TLSError>()
+            .downcast::<rustls::Error>()
             .unwrap(),
-        TLSError::AlertReceived(rustls::internal::msgs::enums::AlertDescription::ProtocolVersion)
+        rustls::Error::AlertReceived(rustls::AlertDescription::ProtocolVersion)
     )
 }
 
@@ -388,32 +504,19 @@ mod vhosts {
     #[test]
     /// - simple vhosts are enabled when multiple hostnames are supplied
     /// - the vhosts access the correct files
+    /// - the hostname comparison is case insensitive
+    /// - the hostname is converted to lower case to access certificates
     fn example_com() {
         let page = get(
-            &[
+            &["--hostname", "example.com", "--hostname", "example.org"],
-                "--addr",
+            "gemini://Example.com/",
-                "[::]:1977",
-                "--hostname",
-                "example.com",
-                "--hostname",
-                "example.org",
-            ],
-            addr(1977),
-            "gemini://example.com/",
         )
         .expect("could not get page");
 
-        assert_eq!(page.header.status, Status::Success);
+        assert_eq!(page.status, Status::Success.value());
-
         assert_eq!(
-            page.body,
+            page.content,
-            Some(
+            include_bytes!("data/content/example.com/index.gmi")
-                std::fs::read_to_string(concat!(
-                    env!("CARGO_MANIFEST_DIR"),
-                    "/tests/data/content/example.com/index.gmi"
-                ))
-                .unwrap()
-            )
         );
     }
 
@@ -421,41 +524,29 @@ mod vhosts {
     /// - the vhosts access the correct files
     fn example_org() {
         let page = get(
-            &[
+            &["--hostname", "example.com", "--hostname", "example.org"],
-                "--addr",
-                "[::]:1978",
-                "--hostname",
-                "example.com",
-                "--hostname",
-                "example.org",
-            ],
-            addr(1978),
             "gemini://example.org/",
         )
         .expect("could not get page");
 
-        assert_eq!(page.header.status, Status::Success);
+        assert_eq!(page.status, Status::Success.value());
-
         assert_eq!(
-            page.body,
+            page.content,
-            Some(
+            include_bytes!("data/content/example.org/index.gmi")
-                std::fs::read_to_string(concat!(
-                    env!("CARGO_MANIFEST_DIR"),
-                    "/tests/data/content/example.org/index.gmi"
-                ))
-                .unwrap()
-            )
         );
     }
 }
 
 mod multicert {
     use super::*;
+    use rustls::{ClientConnection, RootCertStore, pki_types::CertificateDer};
+    use std::io::Write;
+    use std::net::TcpStream;
 
     #[test]
     #[should_panic]
     fn cert_missing() {
-        let mut server = Server::new(&["--addr", "[::]:1979", "--certs", "cert_missing"]);
+        let mut server = Server::new(&["--certs", "cert_missing"]);
 
         // wait for the server to stop, it should crash
         let _ = server.server.wait();
@@ -464,7 +555,7 @@ mod multicert {
     #[test]
     #[should_panic]
     fn key_missing() {
-        let mut server = Server::new(&["--addr", "[::]:1980", "--certs", "key_missing"]);
+        let mut server = Server::new(&["--certs", "key_missing"]);
 
         // wait for the server to stop, it should crash
         let _ = server.server.wait();
@@ -472,27 +563,24 @@ mod multicert {
 
     #[test]
     fn example_com() {
-        use rustls::{Certificate, ClientSession};
+        let mut server = Server::new(&["--certs", "multicert"]);
-        use std::io::Write;
-        use std::net::TcpStream;
 
-        let mut server = Server::new(&["--addr", "[::]:1981", "--certs", "multicert"]);
+        let mut certs = RootCertStore::empty();
-
+        certs
-        let mut config = rustls::ClientConfig::new();
+            .add(CertificateDer::from(
-        config
+                include_bytes!("data/multicert/example.com/cert.der").as_slice(),
-            .root_store
-            .add(&Certificate(
-                include_bytes!(concat!(
-                    env!("CARGO_MANIFEST_DIR"),
-                    "/tests/data/multicert/example.com/cert.der"
-                ))
-                .to_vec(),
             ))
             .unwrap();
+        let config = rustls::ClientConfig::builder()
+            .with_root_certificates(certs)
+            .with_no_client_auth();
 
-        let dns_name = webpki::DNSNameRef::try_from_ascii_str("example.com").unwrap();
+        let mut session = ClientConnection::new(
-        let mut session = ClientSession::new(&std::sync::Arc::new(config), dns_name);
+            std::sync::Arc::new(config),
-        let mut tcp = TcpStream::connect(addr(1981)).unwrap();
+            "example.com".try_into().unwrap(),
+        )
+        .unwrap();
+        let mut tcp = TcpStream::connect(server.get_addr()).unwrap();
         let mut tls = rustls::Stream::new(&mut session, &mut tcp);
 
         write!(tls, "gemini://example.com/\r\n").unwrap();
@@ -505,27 +593,24 @@ mod multicert {
 
     #[test]
     fn example_org() {
-        use rustls::{Certificate, ClientSession};
+        let mut server = Server::new(&["--certs", "multicert"]);
-        use std::io::Write;
-        use std::net::TcpStream;
 
-        let mut server = Server::new(&["--addr", "[::]:1982", "--certs", "multicert"]);
+        let mut certs = RootCertStore::empty();
-
+        certs
-        let mut config = rustls::ClientConfig::new();
+            .add(CertificateDer::from(
-        config
+                include_bytes!("data/multicert/example.org/cert.der").as_slice(),
-            .root_store
-            .add(&Certificate(
-                include_bytes!(concat!(
-                    env!("CARGO_MANIFEST_DIR"),
-                    "/tests/data/multicert/example.org/cert.der"
-                ))
-                .to_vec(),
             ))
             .unwrap();
+        let config = rustls::ClientConfig::builder()
+            .with_root_certificates(certs)
+            .with_no_client_auth();
 
-        let dns_name = webpki::DNSNameRef::try_from_ascii_str("example.org").unwrap();
+        let mut session = ClientConnection::new(
-        let mut session = ClientSession::new(&std::sync::Arc::new(config), dns_name);
+            std::sync::Arc::new(config),
-        let mut tcp = TcpStream::connect(addr(1982)).unwrap();
+            "example.org".try_into().unwrap(),
+        )
+        .unwrap();
+        let mut tcp = TcpStream::connect(server.get_addr()).unwrap();
         let mut tls = rustls::Stream::new(&mut session, &mut tcp);
 
         write!(tls, "gemini://example.org/\r\n").unwrap();
@@ -536,3 +621,33 @@ mod multicert {
         server.stop().unwrap();
     }
 }
+
+mod directory_listing {
+    use super::*;
+
+    #[test]
+    /// - shows directory listing when enabled
+    /// - shows directory listing preamble correctly
+    /// - encodes link URLs correctly
+    fn with_preamble() {
+        let page = get(&["--content", "dirlist-preamble"], "gemini://localhost/")
+            .expect("could not get page");
+
+        assert_eq!(page.status, Status::Success.value());
+        assert_eq!(page.meta, "text/gemini");
+        assert_eq!(
+            page.content,
+            b"This is a directory listing\n=> a\n=> b\n=> wao%20spaces wao spaces\n"
+        );
+    }
+
+    #[test]
+    fn empty_preamble() {
+        let page =
+            get(&["--content", "dirlist"], "gemini://localhost/").expect("could not get page");
+
+        assert_eq!(page.status, Status::Success.value());
+        assert_eq!(page.meta, "text/gemini");
+        assert_eq!(page.content, b"=> a\n=> b\n");
+    }
+}

tools/debian/gemini.service

@@ -13,7 +13,7 @@ Description=Agate gemini server
 # and place the contents to be displayed in /srv/gemini/content
 WorkingDirectory=/srv/gemini/
 # assumes the device hostname is set correctly
-ExecStart=agate --hostname $(uname -n) --lang en
+ExecStart=/bin/sh -c "agate --hostname $(uname -n) --lang en"
 
 Restart=always
 RestartSec=1

tools/docker/Dockerfile

@@ -1,8 +0,0 @@
-FROM alpine:latest
-RUN apk add cargo && wget https://github.com/mbrubeck/agate/archive/refs/tags/v3.0.2.tar.gz && tar xzf v3.0.2.tar.gz && mv /agate-3.0.2 /agate && cd agate && cargo build --release
-RUN cp /agate/target/release/agate /usr/bin/agate
-WORKDIR /app
-COPY . /app
-ADD . .
-ENTRYPOINT ["/bin/sh", "start.sh"]
-

tools/docker/README.md

@@ -1,53 +0,0 @@
-# Install agate in a docker container
-(these instructions assume you use linux and have some experience with both docker and the command line)
-## obtain the source code
-
-There are currently no container images online so you have to build the image yourself before you can use it.
-There are two options available for this: downloading a release or cloning the repository with `git`.
-I will explain both methods but if you're unsure which method to use, I would recommend the release for new comers because it's probably more tested so you'll encounter less problems.
-
-### downloading the release tarball
-
-Download the tarball. Go to [https://github.com/mbrubeck/agate/releases/latest](https://github.com/mbrubeck/agate/releases/latest), and copy the url of the source code tarball.
-
-```
-wget URL
-```
-
-Then unpack the tarball and remove it afterwards:
-```
-tar -xzf tarball.tar.gz
-rm tarball.tar.gz
-```
-
-### clone the repository with git
-
-I assume you have git already installed. If not, please search on how to do it in the internet.
-
-```
-git clone https://github.com/mbrubeck/agate
-cd agate
-```
-
-## build the image
-Enter the `tools/docker` directory:
-
-```
-cd tools/docker
-```
-And now build the docker image:
-
-```
-docker build -t agate .
-```
-This process will take a few minutes because all the rust modules have to be compiled from source.
-
-## start the docker container
-
-```
-docker run -t -d --name agate -p 1965:1965 -v /var/www/gmi:/gmi -v /var/www/gmi/.certificates:/app/.certificates -e HOSTNAME=example.org -e LANG=en-US agate:latest
-```
-
-You have to replace `/var/www/gmi/` with the folder where you'd like to have gemtext files and `/var/www/gmi/.certificates/` with the folder where you'd like to have your certificates stored. You also have to have to replace `example.org` with your domain name and if plan to speak in a different language than english in your gemini space than you should replace `en-US` with your countries language code (for example de-DE or fr-CA).
-
-## That's it! Now have agate running in a docker container!

tools/docker/start.sh

@@ -1,6 +0,0 @@
-#!/bin/sh
-
-exec agate --content /gmi/ \
-	--hostname ${HOSTNAME} \
-	--lang ${LANG}
-

tools/freebsd/startup.sh

@@ -13,8 +13,8 @@
 #                       Set it to YES to enable agate.
 # agate_user:           default www
 # agate_content:        default /usr/local/www/gemini
-# agate_key:            default /usr/local/etc/gemini/ssl/key.rsa
+# agate_key:            default /usr/local/etc/gemini/ssl/key.der
-# agate_cert:           default /usr/local/etc/gemini/ssl/cert.pem
+# agate_cert:           default /usr/local/etc/gemini/ssl/cert.der
 # agate_hostname:       e.g., gemini.example.tld, default hostname
 # agate_addr:           default [::], listen on IPV4 and IPV6
 # agate_port:           default 1965
@@ -32,8 +32,8 @@ load_rc_config $name
 : ${agate_enable:="NO"}
 : ${agate_user:="www"}
 : ${agate_content:="/usr/local/www/gemini/"}
-: ${agate_key:="/usr/local/etc/gemini/ssl/key.rsa"}
+: ${agate_key:="/usr/local/etc/gemini/ssl/key.der"}
-: ${agate_cert:="/usr/local/etc/gemini/ssl/cert.pem"}
+: ${agate_cert:="/usr/local/etc/gemini/ssl/cert.der"}
 : ${agate_hostname:=`uname -n`}
 : ${agate_addr:="[::]"}
 : ${agate_port:="1965"}