Problem with the blog engine (boston)

[spc476]

Problem with the blog engine (boston)

[spc476]

It was a bug. You are (as far as I know) the only other person using this, so there are some assumptions I've made about things. The README (which needs to be updated, but that's a separate issue) neglects to mention that you need to specify the configuration file. This can be done via the "--config" command line option, but I prefer to specify this in the environment variable BLOG_CONFIG to point to the file.

Anyway, I fixed the immediate issue so you should not get that error again.

[Retrofan98]

Oh, thank you very much. It worked... I also want to thank you for this fantastic blogging engine.
But I want now to understand a small thing... I set the environment variable BLOG_CONFIG to the sample configuration file (blog.conf), and the (boston) returned an HTML code to me. So now, how can I make Apache read it? also, what is the (boston.cgi) which is mentioned in the README?

Edit: I attempted to make a copy of (boston) in my www-directory with the name (index.cgi), but when I pointed my browser to it, it returned "Error 500 - Internal Error." I also copied the (htdocs) and (journal) directories to my www-directory

[spc476]

The boston.cgi is just the blogging engine renamed such (index.cgi can work as well). As for running under Apache, you'll have to enable one of the CGI modules (mod_cgid.so or mod_cgi.so, depending upon your Apache settings), then make sure you have AddHandler cgi-script .cgi to enable Apache to know that .cgi extensions mean "run this as CGI script." I have things set up such that "http://boston.local/" is the top level blog, and an entry would be "http://boston.local/2022/10/05.1" would be the first entry on Oct. 10, 2022. The fact that the request is run through a CGI script is hidden with the RewriteRules I have.

I have attached the Apache configuration I use for my test server as a sample.

site.txt

[Retrofan98]

I tried your configuration, but still getting error 500...

[spc476]

If you used my configuration "as is", I'm not terribly surprised it didn't work. You do need to make the appropriate changes depending on how you want it to work. Second, you might want to check the error log from Apache to see if there's anything there. Third, you might also want to check the system logs as I do log stuff via the syslog() function (and how to check that really depends upon your system setup). At this point, just saying "I got 500" doesn't help me in diagnosing the issue on your end.

It may be that my blogging engine might be a bit too complicated to get working without knowledge of how to configure Apache (mea culpa, but then again, you are only the third person to use it---the second one only used it briefly around 2002 and stopped due to not wanting to blog at all).

[Retrofan98]

I am sorry for any unclear. And no, I didn't use it "as it" I changed all directory paths to point to mine and changed all "boston.cgi" to "index.cgi". The other problem is that there is no mention of that error in the Apache error logs.
I checked syslog and found an error with the permission of the (.first) file. So I fixed it, and it semi-worked, but I faced a "too many redirects" error, which I tried to fix by leaving the (url) variable in blog.conf empty. However, another (500 internal server) error occurred, which recorded in the error log (end of script output before headers: index.cgi). And syslog with more details (I attached the syslog full error in the attachment). I think it's a bug in the blog engine...
syslog_error.txt

[spc476]

Don't be sorry---if anything, I am as I realize just how much of the environment I just assume around running my blog.

The following is more or less a stream-of-conscience as I try to troubleshoot this. If you don't understand any of paragraph, that is fine and feel free to skip. Anyway. The logs show it is a bug (line 1, "Segmentation fault"). And it's pretty early on in the execution, as it's fired somewhere in the call to BlogNew() (line 38). There are only two calls to lua_pcall() (line 36) in the entire program, and it's unclear to me why either of those two calls (both in config_read(), the first to compile the config file just loaded, and the second to execute it so we can get the values from Lua) are crashing (lua_pcall() is a "protected call" which captures all Lua exceptions) with a segfault. I would actually expect this from cmd_cgi_get_show() given the environment variables (starting with line 45) because the code assumes $PATH_INFO is set (via Apache) but the CGI specification (RFC-3875) states that $PATH_INFO is only set in certain circumstances, which I do and you don't (or didn't, by not setting the url variable). But that's not where the crash is. The configuration file should mostly be declarations, but you can construct and call arbitrary Lua code. Hmm ...

Okay, I'm back. What user owns the files? The program does need write permission to the files, so they need to be owned either by the Apache user, or you, but then the program has to be a setuid program. I run it setuid, as I run "chmod 4755 boston.cgi" when I install a new version. This is pretty much the baseurl directory, and any files in it.

Oh, and welcome to web development circa 1998.

[Retrofan98]

Thanks for the explanation. I assigned the (www-data:www-data) user and group to all files; I also made index.cgi a setuid program and set others to 777. But I am still wondering... when I set the (url) variable to my machine's ip (or a domain), I see in the access log that it redirects me over and over to (/), which causes a (too many redirects) error in the browser. So I am wondering why that is happening—is that another bug?

Also, don't worry. I am a big fan of the 90s era and retro stuff :)
Edit: I tried going to the addentery.html page or any other one, but it returns a blank page without any error in the Apache error log or syslog.

[spc476]

Okay, let me explain my setup on my public blog (https://boston.conman.org/). BLOG_CONFIG is "/home/spc/web/sites/boston.conman.org/journal/boston.cnf". In there, I have:

basedir     = "/home/spc/web/sites/boston.conman.org/journal" 
webdir      = "/home/spc/web/sites/boston.conman.org/htdocs"
url         = "https://boston.conman.org/"

templates =
{
  {
    template = "html/regular",
    output   = webdir .. "/index.html",
    items    = "7days",
    reverse  = true
  },
  -- ...
}

(I have other templates, but that's not important right now.) I copy src/main (from the build directory) to "/home/spc/web/sites/boston.conman.org/htdocs/boston.cgi" (no real reason for the name---it's just what I chose). Because all the files are under "/home/spc" they are owned by my userid, and they have normal permissions (0755 for directories, 0644 for files). I do setuid the "boston.cgi" program (04755) so that when Apache runs it, it runs as my user, not as the Apache user. This way, I can fix typos and regenerate certain static files as me (I don't have to be the Apache user) without issue, nor world-writable permissions.

I have the following configuration for Apache (a lot of extraneous information cut):

<VirtualHost 71.19.142.20:443>
  SSLEngine             on
  ServerName            boston.conman.org
  ServerAdmin           [email protected]
  DocumentRoot          /home/spc/web/sites/boston.conman.org/htdocs
  
  <Files boston.cgi>
        SetEnv BLOG_CONFIG /home/spc/web/sites/boston.conman.org/journal/boston.cnf
  </Files>
  
  <Directory /home/spc/web/sites/boston.conman.org/htdocs>
    Options             All
    AllowOverride       None
    Require             all granted
    
    AuthType            Basic
    AuthName            "Boston Diaries Editor"
    AuthUserFile        /home/spc/web/sites/boston.conman.org/users
    AuthGroupFile       /home/spc/web/sites/boston.conman.org/groups
    
    <LimitExcept GET HEAD>
      Require           valid-user
    </LimitExcept>
    
    RewriteEngine       on
    RewriteBase         /
           
    RewriteRule ^([0-9][0-9])(.*)       boston.cgi/$1$2 [L]
    RewriteRule ^archive/$              boston.cgi/archive/index.html [L]
    RewriteRule ^about/$                boston.cgi/about/index.html [L]
    RewriteRule ^about/(.*)             boston.cgi/about/$1 [L]
    RewriteRule ^refs/$                 boston.cgi/refs/index.html [L]
    RewriteRule ^refs/(.*)              boston.cgi/refs/$1 [L]
    RewriteRule ^addentry.html$         boston.cgi?cmd=new [L]
    RewriteRule ^thisday$               boston.cgi?cmd=today [L]
    RewriteRule ^(thisday)/(.*)         boston.cgi?cmd=today&path=$1&day=$2 [L]
  </Directory>
</VirtualHost>

The SSLEngine is required to run on port 443 (and a lot of the details are being handled by another module). The Files ensures that the environment variable $BLOG_CONFIG is set when "boston.cgi" is run. The Auth... directives exist to protect the web entry form so that only I (or authorized users) can POST to it. The Options and AllowOverride allow all Apache options, but not the use of ".htaccess" (which speeds things up a bit). Require all granted is needed to make Apache serve up files in the document root. I then use a bunch of RewriteRule directives to hide that I'm running my blog as a CGI program---not for security, but for "clean URL" reasons. These rules will rewrite (internally) the request URL from "https://boston.conman.org/2023/01/19.1" to "https://boston.conman.org/boston.cgi/2023/01/19.1" and thus, the request is then routed through the "boston.cgi" CGI program.

The last three RewriteRules don't require an actual file and as such, "https://boston.conman.org/addentry.html" is generated on the fly. The other rules with "archive", "about" and "refs" do refer to actual files under "/home/spc/web/sites/boston.conman.org/htdocs/" and that causes "boston.cgi" to run those files through the template system.

So, in theory, if you want the requests to be under (for example) "http://example.com/blog/", then the RewriteBase should be "/blog/" and the rest of the RewriteRules should refer to the script (which should live under the "/blog/" directory of the web document root).

I hope this clarifies some of the Apache configuration.