From: Graham Leggett Do this by specifying the name of the module in your
This sets the main A typical configuration for the access log might look as
follows. This defines the nickname Another commonly used format string is called the Combined
Log Format. It can be used as follows. This format is exactly the same as the Common Log Format,
with the addition of two more fields. Each of the additional
@@ -413,11 +413,11 @@ CustomLog "log/access_log" combinedLogLevel directive:LogLevel info rewrite:trace5
-
+LogLevel info rewrite:trace5
+LogLevel to info, but
turns it up to trace5 for
@@ -223,9 +223,9 @@
LogFormat "%h %l %u %t \"%r\" %>s %b" common
+
LogFormat "%h %l %u %t \"%r\" %>s %b" common
CustomLog "logs/access_log" common
-
+common and
associates it with a particular log format string. The format
@@ -363,9 +363,9 @@ CustomLog "logs/access_log" commonLogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined
+
information. The last two LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined
CustomLog "log/access_log" combined
-
+CustomLog lines show how
to mimic the effects of the ReferLog and AgentLog directives.
LogFormat "%h %l %u %t \"%r\" %>s %b" common +include or exclude requests where the environment variable is set. Some examples: -LogFormat "%h %l %u %t \"%r\" %>s %b" common CustomLog "logs/access_log" common CustomLog "logs/referer_log" "%{Referer}i -> %U" CustomLog "logs/agent_log" "%{User-agent}i"- +This example also shows that it is not necessary to define a nickname with the
LogFormatdirective. Instead, @@ -437,31 +437,31 @@ CustomLog "logs/agent_log" "%{User-agent}i"
# Mark requests from the loop-back interface +# Mark requests from the loop-back interface SetEnvIf Remote_Addr "127\.0\.0\.1" dontlog # Mark requests for the robots.txt file SetEnvIf Request_URI "^/robots\.txt$" dontlog # Log what remains CustomLog "logs/access_log" common env=!dontlog- +As another example, consider logging requests from english-speakers to one log file, and non-english speakers to a different log file.
-SetEnvIf Accept-Language "en" english +SetEnvIf Accept-Language "en" english CustomLog "logs/english_log" common env=english CustomLog "logs/non_english_log" common env=!english- +In a caching scenario one would want to know about the efficiency of the cache. A very simple method to find this out would be:
-SetEnv CACHE_MISS 1 +SetEnv CACHE_MISS 1 LogFormat "%h %l %u %t "%r " %>s %b %{CACHE_MISS}e" common-cache CustomLog "logs/access_log" common-cache- +
mod_cachewill run beforemod_envand, when successful, will deliver the @@ -471,9 +471,9 @@ CustomLog "logs/access_log" common-cacheIn addition to the
-env=syntax,LogFormatsupports logging values conditional upon the HTTP response code:LogFormat "%400,501{User-agent}i" browserlog +LogFormat "%400,501{User-agent}i" browserlog LogFormat "%!200,304,302{Referer}i" refererlog- +In the first example, the
User-agentwill be logged if the HTTP status code is 400 or 501. In other cases, a @@ -494,91 +494,99 @@ LogFormat "%!200,304,302{Referer}i" refererlogLog Rotation ¶
-On even a moderately busy server, the quantity of - information stored in the log files is very large. The access - log file typically grows 1 MB or more per 10,000 requests. It - will consequently be necessary to periodically rotate the log - files by moving or deleting the existing logs. This cannot be - done while the server is running, because Apache httpd will continue - writing to the old log file as long as it holds the file open. - Instead, the server must be restarted after the log files are - moved or deleted so that it will open new log files.
- -By using a graceful restart, the server can be - instructed to open new log files without losing any existing or - pending connections from clients. However, in order to - accomplish this, the server must continue to write to the old - log files while it finishes serving old requests. It is - therefore necessary to wait for some time after the restart - before doing any processing on the log files. A typical - scenario that simply rotates the logs and compresses the old - logs to save space is:
+On even a moderately busy server, log files grow quickly — + the access log typically grows 1 MB or more per 10,000 requests. + Without rotation, logs consume disk space indefinitely and become + unwieldy to analyze. You should set up automatic log rotation from + the start.
-+
- mv access_log access_log.old
- mv error_log error_log.old
- apachectl graceful
- sleep 600
- gzip access_log.old error_log.old -Using rotatelogs (recommended)
+ + +The simplest approach is to use httpd's built-in +
+ +rotatelogsprogram via piped + logs. This rotates logs without requiring a server restart + and without any external tools. To rotate logs every 24 hours:+ +CustomLog "|/usr/local/apache/bin/rotatelogs /var/log/httpd/access_log 86400" combined +ErrorLog "|/usr/local/apache/bin/rotatelogs /var/log/httpd/error_log 86400"+To rotate when the log reaches a certain size (e.g., 100 MB):
+ ++ +CustomLog "|/usr/local/apache/bin/rotatelogs /var/log/httpd/access_log 100M" combined+You can also use a time-based filename pattern with +
+ +strftimeformat strings:+ +CustomLog "|/usr/local/apache/bin/rotatelogs /var/log/httpd/access_log.%Y-%m-%d 86400" combined+See
+ + +rotatelogsfor the full set of options, + including offset times, file count limits, and compression.Using logrotate or system log management
+ + +Most Linux distributions include
+ +logrotate, which + can rotate, compress, and expire log files on a schedule. If your + distribution already ships an httpd logrotate configuration (check +/etc/logrotate.d/), it may already be handling rotation + for you.When using an external rotation tool like
+ +logrotate, + you need to signal httpd to reopen its log files after + the old ones are moved aside. The standard approach is a + graceful restart:-/usr/sbin/apachectl graceful+Another way to perform log rotation is using piped logs as discussed in the next - section.
+Your logrotate configuration's
+ +postrotatescript + should include this (or the equivalent +systemctl reloadcommand). httpd continues writing to + the old file handle until it receives the signal, so any post-processing + of rotated files should allow a brief delay.+Piped Logs ¶
-Apache httpd is capable of writing error and access log - files through a pipe to another process, rather than directly - to a file. This capability dramatically increases the - flexibility of logging, without adding code to the main server. - In order to write logs to a pipe, simply replace the filename - with the pipe character "
- -|", followed by the name - of the executable which should accept log entries on its - standard input. The server will start the piped-log process when - the server starts, and will restart it if it crashes while the - server is running. (This last feature is why we can refer to - this technique as "reliable piped logging".)Piped log processes are spawned by the parent Apache httpd - process, and inherit the userid of that process. This means - that piped log programs usually run as root. It is therefore - very important to keep the programs simple and secure.
- -One important use of piped logs is to allow log rotation - without having to restart the server. The Apache HTTP Server - includes a simple program called
- -rotatelogs- for this purpose. For example, to rotate the logs every 24 hours, you - can use:CustomLog "|/usr/local/apache/bin/rotatelogs /var/log/access_log 86400" common- - -Notice that quotes are used to enclose the entire command - that will be called for the pipe. Although these examples are - for the access log, the same technique can be used for the - error log.
- -As with conditional logging, piped logs are a very powerful - tool, but they should not be used where a simpler solution like - off-line post-processing is available.
- -By default the piped log process is spawned without invoking - a shell. Use "
- -|$" instead of "|" - to spawn using a shell (usually with/bin/sh -c):# Invoke "rotatelogs" using a shell -CustomLog "|$/usr/local/apache/bin/rotatelogs /var/log/access_log 86400" common- - -This was the default behavior for Apache 2.2. - Depending on the shell specifics this might lead to - an additional shell process for the lifetime of the logging - pipe program and signal handling problems during restart. - For compatibility reasons with Apache 2.2 the notation - "
+||" is also supported and equivalent to using - "|".httpd can write error and access log files through a pipe to + another process, rather than directly to a file. To use a piped + log, replace the filename with the pipe character + "
+ +|", followed by the command that should receive + log entries on its standard input:+ +CustomLog "|/usr/local/apache/bin/rotatelogs /var/log/httpd/access_log 86400" combined+httpd starts the piped-log process at server startup and + restarts it automatically if it crashes (this is sometimes called + "reliable piped logging"). The quotes enclose the entire piped + command — this syntax works for both +
+ +CustomLogand +ErrorLog.Piped log processes are spawned by the parent httpd process and + inherit its userid. This typically means they run as root, so keep + piped log programs simple and secure.
+ +By default the piped log process is spawned directly, without + invoking a shell. Use "
+ +|$" instead of + "|" to spawn via a shell (usually +/bin/sh -c):+ +CustomLog "|$/usr/local/apache/bin/rotatelogs /var/log/httpd/access_log 86400" combined+The shell variant is occasionally needed if your piped command + uses shell features like globbing or variable expansion. For most + cases, the direct (non-shell) invocation is preferred.
Windows note
Note that on Windows, you may run into problems when running many piped @@ -625,9 +633,9 @@ CustomLog "|$/usr/local/apache/bin/rotatelogs /var/log/access_log 86400" commo later split the log into individual files. For example, consider the following directives.
-LogFormat "%v %p %h %l %u %t \"%r\" %>s %b" commonvhost +LogFormat "%v %p %h %l %u %t \"%r\" %>s %b" commonvhost CustomLog "logs/access_log" commonvhost- +The
%vis used to log the name of the virtual host that is serving the request. Then a program like split-logfile can be used to diff --git a/docs/manual/mod/directives.html.de b/docs/manual/mod/directives.html.de index c176599341..7e18f5cc03 100644 --- a/docs/manual/mod/directives.html.de +++ b/docs/manual/mod/directives.html.de @@ -496,6 +496,7 @@MDDriveMode MDExternalAccountBinding MDHttpProxy +MDHttpProxyCACertificateFile MDInitialDelay MDMatchNames MDMember @@ -745,14 +746,18 @@SSIUndefinedEcho SSLCACertificateFile SSLCACertificatePath +SSLCACertificateURI SSLCADNRequestFile SSLCADNRequestPath +SSLCADNRequestURI SSLCARevocationCheck SSLCARevocationFile SSLCARevocationPath +SSLCARevocationURI SSLCertificateChainFile SSLCertificateFile SSLCertificateKeyFile +SSLCertificateURI SSLCipherSuite SSLClientHelloVars SSLCompression @@ -778,9 +783,11 @@SSLProtocol SSLProxyCACertificateFile SSLProxyCACertificatePath +SSLProxyCACertificateURI SSLProxyCARevocationCheck SSLProxyCARevocationFile SSLProxyCARevocationPath +SSLProxyCARevocationURI SSLProxyCheckPeerCN SSLProxyCheckPeerExpire SSLProxyCheckPeerName @@ -789,6 +796,7 @@SSLProxyMachineCertificateChainFile SSLProxyMachineCertificateFile SSLProxyMachineCertificatePath +SSLProxyMachineCertificateURI SSLProxyProtocol SSLProxyVerify SSLProxyVerifyDepth diff --git a/docs/manual/mod/directives.html.en.utf8 b/docs/manual/mod/directives.html.en.utf8 index f143a0753a..5ac4b190a3 100644 --- a/docs/manual/mod/directives.html.en.utf8 +++ b/docs/manual/mod/directives.html.en.utf8 @@ -497,6 +497,7 @@MDDriveMode MDExternalAccountBinding MDHttpProxy +MDHttpProxyCACertificateFile MDInitialDelay MDMatchNames MDMember @@ -746,14 +747,18 @@SSIUndefinedEcho SSLCACertificateFile SSLCACertificatePath +SSLCACertificateURI SSLCADNRequestFile SSLCADNRequestPath +SSLCADNRequestURI SSLCARevocationCheck SSLCARevocationFile SSLCARevocationPath +SSLCARevocationURI SSLCertificateChainFile SSLCertificateFile SSLCertificateKeyFile +SSLCertificateURI SSLCipherSuite SSLClientHelloVars SSLCompression @@ -779,9 +784,11 @@SSLProtocol SSLProxyCACertificateFile SSLProxyCACertificatePath +SSLProxyCACertificateURI SSLProxyCARevocationCheck SSLProxyCARevocationFile SSLProxyCARevocationPath +SSLProxyCARevocationURI SSLProxyCheckPeerCN SSLProxyCheckPeerExpire SSLProxyCheckPeerName @@ -790,6 +797,7 @@SSLProxyMachineCertificateChainFile SSLProxyMachineCertificateFile SSLProxyMachineCertificatePath +SSLProxyMachineCertificateURI SSLProxyProtocol SSLProxyVerify SSLProxyVerifyDepth diff --git a/docs/manual/mod/directives.html.es.utf8 b/docs/manual/mod/directives.html.es.utf8 index 619778da34..9116154542 100644 --- a/docs/manual/mod/directives.html.es.utf8 +++ b/docs/manual/mod/directives.html.es.utf8 @@ -499,6 +499,7 @@MDDriveMode MDExternalAccountBinding MDHttpProxy +MDHttpProxyCACertificateFile MDInitialDelay MDMatchNames MDMember @@ -748,14 +749,18 @@SSIUndefinedEcho SSLCACertificateFile SSLCACertificatePath +SSLCACertificateURI SSLCADNRequestFile SSLCADNRequestPath +SSLCADNRequestURI SSLCARevocationCheck SSLCARevocationFile SSLCARevocationPath +SSLCARevocationURI SSLCertificateChainFile SSLCertificateFile SSLCertificateKeyFile +SSLCertificateURI SSLCipherSuite SSLClientHelloVars SSLCompression @@ -781,9 +786,11 @@SSLProtocol SSLProxyCACertificateFile SSLProxyCACertificatePath +SSLProxyCACertificateURI SSLProxyCARevocationCheck SSLProxyCARevocationFile SSLProxyCARevocationPath +SSLProxyCARevocationURI SSLProxyCheckPeerCN SSLProxyCheckPeerExpire SSLProxyCheckPeerName @@ -792,6 +799,7 @@SSLProxyMachineCertificateChainFile SSLProxyMachineCertificateFile SSLProxyMachineCertificatePath +SSLProxyMachineCertificateURI SSLProxyProtocol SSLProxyVerify SSLProxyVerifyDepth diff --git a/docs/manual/mod/directives.html.fr.utf8 b/docs/manual/mod/directives.html.fr.utf8 index 93857fa4a7..f23cc42d1a 100644 --- a/docs/manual/mod/directives.html.fr.utf8 +++ b/docs/manual/mod/directives.html.fr.utf8 @@ -748,14 +748,18 @@SSIUndefinedEcho SSLCACertificateFile SSLCACertificatePath +SSLCACertificateURI SSLCADNRequestFile SSLCADNRequestPath +SSLCADNRequestURI SSLCARevocationCheck SSLCARevocationFile SSLCARevocationPath +SSLCARevocationURI SSLCertificateChainFile SSLCertificateFile SSLCertificateKeyFile +SSLCertificateURI SSLCipherSuite SSLClientHelloVars SSLCompression @@ -781,9 +785,11 @@SSLProtocol SSLProxyCACertificateFile SSLProxyCACertificatePath +SSLProxyCACertificateURI SSLProxyCARevocationCheck SSLProxyCARevocationFile SSLProxyCARevocationPath +SSLProxyCARevocationURI SSLProxyCheckPeerCN SSLProxyCheckPeerExpire SSLProxyCheckPeerName @@ -792,6 +798,7 @@SSLProxyMachineCertificateChainFile SSLProxyMachineCertificateFile SSLProxyMachineCertificatePath +SSLProxyMachineCertificateURI SSLProxyProtocol SSLProxyVerify SSLProxyVerifyDepth diff --git a/docs/manual/mod/directives.html.ja.utf8 b/docs/manual/mod/directives.html.ja.utf8 index 1e19ad60ea..6ea80fd9ca 100644 --- a/docs/manual/mod/directives.html.ja.utf8 +++ b/docs/manual/mod/directives.html.ja.utf8 @@ -494,6 +494,7 @@MDDriveMode MDExternalAccountBinding MDHttpProxy +MDHttpProxyCACertificateFile MDInitialDelay MDMatchNames MDMember @@ -743,14 +744,18 @@SSIUndefinedEcho SSLCACertificateFile SSLCACertificatePath +SSLCACertificateURI SSLCADNRequestFile SSLCADNRequestPath +SSLCADNRequestURI SSLCARevocationCheck SSLCARevocationFile SSLCARevocationPath +SSLCARevocationURI SSLCertificateChainFile SSLCertificateFile SSLCertificateKeyFile +SSLCertificateURI SSLCipherSuite SSLClientHelloVars SSLCompression @@ -776,9 +781,11 @@SSLProtocol SSLProxyCACertificateFile SSLProxyCACertificatePath +SSLProxyCACertificateURI SSLProxyCARevocationCheck SSLProxyCARevocationFile SSLProxyCARevocationPath +SSLProxyCARevocationURI SSLProxyCheckPeerCN SSLProxyCheckPeerExpire SSLProxyCheckPeerName @@ -787,6 +794,7 @@SSLProxyMachineCertificateChainFile SSLProxyMachineCertificateFile SSLProxyMachineCertificatePath +SSLProxyMachineCertificateURI SSLProxyProtocol SSLProxyVerify SSLProxyVerifyDepth diff --git a/docs/manual/mod/directives.html.ko.euc-kr b/docs/manual/mod/directives.html.ko.euc-kr index 8c74369c5d..9583d83446 100644 --- a/docs/manual/mod/directives.html.ko.euc-kr +++ b/docs/manual/mod/directives.html.ko.euc-kr @@ -494,6 +494,7 @@MDDriveMode MDExternalAccountBinding MDHttpProxy +MDHttpProxyCACertificateFile MDInitialDelay MDMatchNames MDMember @@ -743,14 +744,18 @@SSIUndefinedEcho SSLCACertificateFile SSLCACertificatePath +SSLCACertificateURI SSLCADNRequestFile SSLCADNRequestPath +SSLCADNRequestURI SSLCARevocationCheck SSLCARevocationFile SSLCARevocationPath +SSLCARevocationURI SSLCertificateChainFile SSLCertificateFile SSLCertificateKeyFile +SSLCertificateURI SSLCipherSuite SSLClientHelloVars SSLCompression @@ -776,9 +781,11 @@SSLProtocol SSLProxyCACertificateFile SSLProxyCACertificatePath +SSLProxyCACertificateURI SSLProxyCARevocationCheck SSLProxyCARevocationFile SSLProxyCARevocationPath +SSLProxyCARevocationURI SSLProxyCheckPeerCN SSLProxyCheckPeerExpire SSLProxyCheckPeerName @@ -787,6 +794,7 @@SSLProxyMachineCertificateChainFile SSLProxyMachineCertificateFile SSLProxyMachineCertificatePath +SSLProxyMachineCertificateURI SSLProxyProtocol SSLProxyVerify SSLProxyVerifyDepth diff --git a/docs/manual/mod/directives.html.tr.utf8 b/docs/manual/mod/directives.html.tr.utf8 index 8a57b216e7..673b50b697 100644 --- a/docs/manual/mod/directives.html.tr.utf8 +++ b/docs/manual/mod/directives.html.tr.utf8 @@ -493,6 +493,7 @@MDDriveMode MDExternalAccountBinding MDHttpProxy +MDHttpProxyCACertificateFile MDInitialDelay MDMatchNames MDMember @@ -742,14 +743,18 @@SSIUndefinedEcho SSLCACertificateFile SSLCACertificatePath +SSLCACertificateURI SSLCADNRequestFile SSLCADNRequestPath +SSLCADNRequestURI SSLCARevocationCheck SSLCARevocationFile SSLCARevocationPath +SSLCARevocationURI SSLCertificateChainFile SSLCertificateFile SSLCertificateKeyFile +SSLCertificateURI SSLCipherSuite SSLClientHelloVars SSLCompression @@ -775,9 +780,11 @@SSLProtocol SSLProxyCACertificateFile SSLProxyCACertificatePath +SSLProxyCACertificateURI SSLProxyCARevocationCheck SSLProxyCARevocationFile SSLProxyCARevocationPath +SSLProxyCARevocationURI SSLProxyCheckPeerCN SSLProxyCheckPeerExpire SSLProxyCheckPeerName @@ -786,6 +793,7 @@SSLProxyMachineCertificateChainFile SSLProxyMachineCertificateFile SSLProxyMachineCertificatePath +SSLProxyMachineCertificateURI SSLProxyProtocol SSLProxyVerify SSLProxyVerifyDepth diff --git a/docs/manual/mod/directives.html.zh-cn.utf8 b/docs/manual/mod/directives.html.zh-cn.utf8 index a0fa083d05..f8cdc83e1d 100644 --- a/docs/manual/mod/directives.html.zh-cn.utf8 +++ b/docs/manual/mod/directives.html.zh-cn.utf8 @@ -492,6 +492,7 @@MDDriveMode MDExternalAccountBinding MDHttpProxy +MDHttpProxyCACertificateFile MDInitialDelay MDMatchNames MDMember @@ -741,14 +742,18 @@SSIUndefinedEcho SSLCACertificateFile SSLCACertificatePath +SSLCACertificateURI SSLCADNRequestFile SSLCADNRequestPath +SSLCADNRequestURI SSLCARevocationCheck SSLCARevocationFile SSLCARevocationPath +SSLCARevocationURI SSLCertificateChainFile SSLCertificateFile SSLCertificateKeyFile +SSLCertificateURI SSLCipherSuite SSLClientHelloVars SSLCompression @@ -774,9 +779,11 @@SSLProtocol SSLProxyCACertificateFile SSLProxyCACertificatePath +SSLProxyCACertificateURI SSLProxyCARevocationCheck SSLProxyCARevocationFile SSLProxyCARevocationPath +SSLProxyCARevocationURI SSLProxyCheckPeerCN SSLProxyCheckPeerExpire SSLProxyCheckPeerName @@ -785,6 +792,7 @@SSLProxyMachineCertificateChainFile SSLProxyMachineCertificateFile SSLProxyMachineCertificatePath +SSLProxyMachineCertificateURI SSLProxyProtocol SSLProxyVerify SSLProxyVerifyDepth diff --git a/docs/manual/mod/mod_access_compat.html.en.utf8 b/docs/manual/mod/mod_access_compat.html.en.utf8 index f4a49eb60e..d09afa4b31 100644 --- a/docs/manual/mod/mod_access_compat.html.en.utf8 +++ b/docs/manual/mod/mod_access_compat.html.en.utf8 @@ -33,7 +33,7 @@
- Description: Group authorizations based on host (name or IP address) + Status: Extension Status: Deprecated Module Identifier: access_compat_module Source File: mod_access_compat.c [host|env=[!]env-variable] ... Compatibility: Available in Apache HTTP Server 2.3 as a compatibility module with @@ -110,7 +110,7 @@ server Context: directory, .htaccess - Override: Limit + Status: Extension Status: Deprecated Module: mod_access_compat The
Allowdirective affects which hosts can @@ -236,7 +236,7 @@ server [host|env=[!]env-variable] ...Context: directory, .htaccess - Override: Limit + Status: Extension Status: Deprecated Module: mod_access_compat This directive allows access to the server to be restricted @@ -255,7 +255,7 @@ evaluated.
Default: Order Deny,AllowContext: directory, .htaccess - Override: Limit + Status: Extension Status: Deprecated @@ -406,7 +406,7 @@ user authentication Module: mod_access_compat Default: Satisfy AllContext: directory, .htaccess - Override: AuthConfig + Status: Extension Status: Deprecated Module: mod_access_compat Access policy if both
AllowandRequireused. The parameter can be diff --git a/docs/manual/mod/mod_access_compat.html.es.utf8 b/docs/manual/mod/mod_access_compat.html.es.utf8 index 755ed69ea9..97fb9e9d4b 100644 --- a/docs/manual/mod/mod_access_compat.html.es.utf8 +++ b/docs/manual/mod/mod_access_compat.html.es.utf8 @@ -31,6 +31,10 @@ fr | jaEsta traducción podría estar + obsoleta. Consulte la versión en inglés de la + documentación para comprobar si se han producido cambios + recientemente.
| Descripción: | Autorizaciones de grupo basadas en el host (nombre o dirección IP) |
|---|---|
| Estado: | Extensión |
| Identificador de Módulos: | access_compat_module |
| Description: | CERN httpd metafile semantics |
|---|---|
| Status: | Extension |
| Status: | Deprecated |
| Module Identifier: | cern_meta_module |
| Source File: | mod_cern_meta.c |
MetaDir .webSpecifies the name of the directory in which Apache can find @@ -95,7 +95,7 @@ files
MetaFiles offTurns on/off Meta file processing on a per-directory basis.
@@ -110,7 +110,7 @@ meta informationMetaSuffix .metaSpecifies the file name suffix for the file containing the diff --git a/docs/manual/mod/mod_imagemap.html.en.utf8 b/docs/manual/mod/mod_imagemap.html.en.utf8 index b6aff1b645..c817a8225e 100644 --- a/docs/manual/mod/mod_imagemap.html.en.utf8 +++ b/docs/manual/mod/mod_imagemap.html.en.utf8 @@ -31,7 +31,7 @@ ko
| Description: | Server-side imagemap processing |
|---|---|
| Status: | Base |
| Status: | Deprecated |
| Module Identifier: | imagemap_module |
| Source File: | mod_imagemap.c |
ImapBase http://servername/The ImapBase directive sets the default
@@ -325,7 +325,7 @@ that are not explicitly mapped
ImapDefault nocontentThe ImapDefault directive sets the default
@@ -346,7 +346,7 @@ an imagemap
ImapMenu formattedThe ImapMenu directive determines the
diff --git a/docs/manual/mod/mod_md.html.en.utf8 b/docs/manual/mod/mod_md.html.en.utf8
index 506a2acf81..351c034928 100644
--- a/docs/manual/mod/mod_md.html.en.utf8
+++ b/docs/manual/mod/mod_md.html.en.utf8
@@ -129,7 +129,7 @@
And the `tls-alpn-01` challenge type is available. -
+
MDDriveMode
MDExternalAccountBinding
MDHttpProxy
MDHttpProxyCACertificateFile
MDInitialDelay
MDMatchNames
MDMemberThis is mainly used in test setups where the module needs to @@ -775,9 +777,39 @@
Use a http proxy to connect to the MDCertificateAuthority. Define this
- if your webserver can only reach the internet with a forward proxy.
+
+ Use the given http forward proxy URL to connect to the MDCertificateAuthority.
+ Define this if your webserver can only reach the internet with a forward proxy.
+
| Description: | Sets the root (CA) certificates to use for TLS connections to the http-proxy. |
|---|---|
| Syntax: | MDHttpProxyCACertificateFile path-to-pem-file |
| Default: | MDHttpProxyCACertificateFile none |
| Context: | server config |
| Status: | Experimental |
| Module: | mod_md |
| Compatibility: | Available in version 2.4.69 and later |
+ This is used for connections to the HTTPS forward proxy (MDHttpProxy).
+ It is needed if the certificate of the HTTPS proxy cannot be verified using the general CA root store.
+ This is sometimes the case in test setups or enterprise environments.
+
+ The certificate of the ACME server is verified with the root certificates set by
+ MDCACertificateFile, so you might need to use both settings.
+
+ Use "none" as path to disable explicitly. +
+
+ This can be configured separately for each MDomain.
| Description: | Support for Solaris privileges and for running virtual hosts under different user IDs. | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Status: | Experimental | ||||||||||||||
| Status: | Deprecated | ||||||||||||||
| Module Identifier: | privileges_module | ||||||||||||||
| Source File: | mod_privileges.c | ||||||||||||||
| Compatibility: | Available in Apache 2.3 and up, on Solaris 10 and @@ -144,7 +144,7 @@ request-processing cycle. | ||||||||||||||
| Syntax: | DTracePrivileges On|Off | ||||||||||||||
| Default: | DTracePrivileges Off | ||||||||||||||
| Context: | server config | ||||||||||||||
| Status: | Experimental | ||||||||||||||
| Status: | Deprecated | ||||||||||||||
| Module: | mod_privileges | ||||||||||||||
| Compatibility: | Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (prefork or custom MPM). | ||||||||||||||
| Syntax: | PrivilegesMode FAST|SECURE|SELECTIVE | ||||||||||||||
| Default: | PrivilegesMode FAST | ||||||||||||||
| Context: | server config, virtual host, directory | ||||||||||||||
| Status: | Experimental | ||||||||||||||
| Status: | Deprecated | ||||||||||||||
| Module: | mod_privileges | ||||||||||||||
| Compatibility: | Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (prefork or custom MPM). | ||||||||||||||
| Syntax: | VHostCGIMode On|Off|Secure | ||||||||||||||
| Default: | VHostCGIMode On | ||||||||||||||
| Context: | virtual host | ||||||||||||||
| Status: | Experimental | ||||||||||||||
| Status: | Deprecated | ||||||||||||||
| Module: | mod_privileges | ||||||||||||||
| Compatibility: | Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (prefork or custom MPM). | ||||||||||||||
| Syntax: | VHostCGIPrivs [+-]?privilege-name [[+-]?privilege-name] ... | ||||||||||||||
| Default: | None | ||||||||||||||
| Context: | virtual host | ||||||||||||||
| Status: | Experimental | ||||||||||||||
| Status: | Deprecated | ||||||||||||||
| Module: | mod_privileges | ||||||||||||||
| Compatibility: | Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (prefork or custom MPM)
@@ -268,7 +268,7 @@ and when mod_privilege
| ||||||||||||||
| Default: | None | ||||||||||||||
| Context: | virtual host | ||||||||||||||
| Status: | Experimental | ||||||||||||||
| Status: | Deprecated | ||||||||||||||
| Module: | mod_privileges | ||||||||||||||
| Compatibility: | Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (prefork or custom MPM)
@@ -337,7 +337,7 @@ for the virtualhost. | ||||||||||||||
| Syntax: | VHostSecure On|Off | ||||||||||||||
| Default: | VHostSecure On | ||||||||||||||
| Context: | virtual host | ||||||||||||||
| Status: | Experimental | ||||||||||||||
| Status: | Deprecated | ||||||||||||||
| Module: | mod_privileges | ||||||||||||||
| Compatibility: | Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (prefork or custom MPM). | Default: | Inherits the userid specified in
|
||||||||||||
| Context: | virtual host | ||||||||||||||
| Status: | Experimental | ||||||||||||||
| Status: | Deprecated | ||||||||||||||
| Module: | mod_privileges | ||||||||||||||
| Compatibility: | Available on Solaris 10 and OpenSolaris with
non-threaded MPMs (prefork or custom MPM). | ||||||||||||||
| Module: | mod_proxy |
Directives placed in <Proxy>
- sections apply only to matching proxied content. Shell-style wildcards are
+ sections apply only to matching proxied content using a simple string prefix match against the URL. Shell-style wildcards are also
allowed.
For example, the following will allow only hosts in @@ -2173,6 +2173,13 @@ ProxyRemote ftp http://ftpproxy.mydomain:8080 sent without first waiting for the remote proxy to send a Basic authentication challenge. The Proxy-Chain-Auth environment variable has no effect if this argument is used.
+ +When a forward (remote) proxy is configured, DNS resolution of
+ the origin/backend hostname is only performed on the forward proxy.
+ Any ProxyBlock rules
+ which restrict access to specific IP addresses must be configured
+ at the forward proxy.
Any host that can reach the proxy's receive port could otherwise announce
an arbitrary backend URL and cause the proxy to send client traffic to it
- (and a UDP source address is trivially spoofable). Set
- ProxyBeaconSecret to the same value on the proxy and on
- every backend so that announcements are authenticated with a keyed
- message-authentication code (MAC) and a timestamp. When a secret is
- configured the proxy drops any announcement that is not validly signed and
- recent. If no secret is configured the channel is unauthenticated
- and the proxy logs a warning at startup.
ProxyBeaconSecret is therefore required:
+ it must be set to the same value on the proxy and on every backend, and the
+ server fails to start if any participating server omits it. Announcements are
+ authenticated with a keyed message-authentication code (MAC) and a timestamp,
+ and the proxy drops any announcement that is not validly signed and recent.
+ There is no unauthenticated mode.
If ProxyBeaconSecret is set on the proxy, every
- announcement must carry a valid, recent MAC or it is rejected. If the
+
This directive is required on every server that
+ participates in the beacon channel — the proxy
+ (ProxyBeaconListen) and every backend
+ (ProxyBeaconAddress). If any such server omits it, the
+ server fails to start; there is no unauthenticated mode.
Every announcement must carry a valid, recent MAC or it is rejected. If the secrets on the proxy and a backend differ, that backend's announcements are silently rejected (and logged), which appears as the backend never joining the balancer.
-If no secret is configured the channel is unauthenticated and the proxy - emits a warning when it starts listening. Because the secret is stored in - the configuration file, restrict that file's permissions as you would for a - private key.
+Because the secret is stored in the configuration file, restrict that + file's permissions as you would for a private key.
The timestamp-based replay protection compares the announcement's time diff --git a/docs/manual/mod/mod_proxy_wstunnel.html.en.utf8 b/docs/manual/mod/mod_proxy_wstunnel.html.en.utf8 index a0c852f021..7ccf296db8 100644 --- a/docs/manual/mod/mod_proxy_wstunnel.html.en.utf8 +++ b/docs/manual/mod/mod_proxy_wstunnel.html.en.utf8 @@ -31,7 +31,7 @@
| Description: | Websockets support module for
mod_proxy |
|---|---|
| Status: | Extension |
| Status: | Deprecated |
| Module Identifier: | proxy_wstunnel_module |
| Source File: | mod_proxy_wstunnel.c |
| Compatibility: | Available in httpd 2.4.5 and later |
ProxyWebsocketAsync ON|OFFThis directive instructs the server to try to create an asynchronous tunnel. @@ -116,7 +116,7 @@ WebSocket always happens.
ProxyWebsocketAsyncDelay num[ms]ProxyWebsocketAsyncDelay 0If ProxyWebsocketAsync is enabled, this directive
@@ -136,7 +136,7 @@ WebSocket always happens.
ProxyWebsocketFallbackToProxyHttp On|OffProxyWebsocketFallbackToProxyHttp OnProxyWebsocketIdleTimeout num[ms]ProxyWebsocketIdleTimeout 0This directive imposes a maximum amount of time for the tunnel to be diff --git a/docs/manual/mod/mod_rewrite.html.en.utf8 b/docs/manual/mod/mod_rewrite.html.en.utf8 index a0737f1406..f04184e5ad 100644 --- a/docs/manual/mod/mod_rewrite.html.en.utf8 +++ b/docs/manual/mod/mod_rewrite.html.en.utf8 @@ -169,7 +169,7 @@ URLs on the fly the current state of the URI matches its pattern, and if these conditions are met.
If the CondPattern is prefixed with a ! the
- condition is determined to be true only if the the
+ condition is determined to be true only if the
CondPattern does not match.
RewriteRule directive is defined.
If the pattern is prefixed with a ! the
- substitution will be performed only if the the
+ substitution will be performed only if the
pattern does not match.
SSLCACertificateFile
SSLCACertificatePath
SSLCACertificateURI
SSLCADNRequestFile
SSLCADNRequestPath
SSLCADNRequestURI
SSLCARevocationCheck
SSLCARevocationFile
SSLCARevocationPath
SSLCARevocationURI
SSLCertificateChainFile
SSLCertificateFile
SSLCertificateKeyFile
SSLCertificateURI
SSLCipherSuite
SSLClientHelloVars
SSLCompression
SSLProtocol
SSLProxyCACertificateFile
SSLProxyCACertificatePath
SSLProxyCACertificateURI
SSLProxyCARevocationCheck
SSLProxyCARevocationFile
SSLProxyCARevocationPath
SSLProxyCARevocationURI
SSLProxyCheckPeerCN
SSLProxyCheckPeerExpire
SSLProxyCheckPeerName
SSLProxyMachineCertificateChainFile
SSLProxyMachineCertificateFile
SSLProxyMachineCertificatePath
SSLProxyMachineCertificateURI
SSLProxyProtocol
SSLProxyVerify
SSLProxyVerifyDepthroot. The files are not
re-read during normal operation; a server restart is required for changes
to take effect.
+| Description: | Server CA certificate store for Client Authentication |
|---|---|
| Syntax: | SSLCACertificateURI uri |
| Context: | server config, virtual host |
| Override: | AuthConfig |
| Status: | Extension |
| Module: | mod_ssl |
| Compatibility: | Available in httpd 2.5.1 and later, when linked with +OpenSSL v3 or later. |
+This directive sets the all-in-one URI where you can assemble the
+Certificates of Certification Authorities (CA) whose clients you deal
+with. These are used for Client Authentication. This can be used alternatively
+and/or additionally to SSLCACertificateFile
+or SSLCACertificatePath.
# trust certs in a PEM encoded certificate bundle +SSLCACertificateURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-client.crt" +# trust all certs in a typical Linux machine +SSLCACertificateURI "pkcs11:token=System%20Trust" +# trust all certs in the Windows trust store +SSLCACertificateURI "org.openssl.winstore:"+
This URI is read at server startup, while the server is still running
+as root (before privilege dropping), so it may be owned by
+and readable only by root. The URI is not re-read during
+normal operation; a server restart is required for changes to take
+effect.
If neither of the directives SSLCADNRequestPath or SSLCADNRequestFile are given, then the
+
If none of the directives SSLCADNRequestFile, SSLCADNRequestPath, or SSLCADNRequestURI are given, then the
set of acceptable CA names sent to the client is the names of all the
-CA certificates given by the SSLCACertificateFile and SSLCACertificatePath directives; in other
+CA certificates given by the SSLCACertificateFile, SSLCACertificatePath, and SSLCACertificateURI directives; in other
words, the names of the CAs which will actually be used to verify the
client certificate.
In some circumstances, it is useful to be able to send a set of
acceptable CA names which differs from the actual CAs used to verify
the client certificate - for example, if the client certificates are
-signed by intermediate CAs. In such cases, SSLCADNRequestPath and/or SSLCADNRequestFile can be used; the
+signed by intermediate CAs. In such cases, SSLCADNRequestFile, SSLCADNRequestPath, and/or SSLCADNRequestURI can be used; the
acceptable CA names are then taken from the complete set of
certificates in the directory and/or file specified by this pair of
directives.
root. The files are not
re-read during normal operation; a server restart is required for changes
to take effect.
+| Description: | certificate store of CA Certificates for defining +acceptable CA names |
|---|---|
| Syntax: | SSLCADNRequestURI uri |
| Context: | server config, virtual host |
| Status: | Extension |
| Module: | mod_ssl |
When a client certificate is requested by mod_ssl, a list of +acceptable Certificate Authority names is sent to the client +in the SSL handshake. These CA names can be used by the client to +select an appropriate client certificate out of those it has +available.
+ +If none of the directives SSLCADNRequestFile, SSLCADNRequestPath, or SSLCADNRequestURI are given, then the
+set of acceptable CA names sent to the client is the names of all the
+CA certificates given by the SSLCACertificateFile, SSLCACertificatePath, and SSLCACertificateURI directives; in other
+words, the names of the CAs which will actually be used to verify the
+client certificate.
In some circumstances, it is useful to be able to send a set of
+acceptable CA names which differs from the actual CAs used to verify
+the client certificate - for example, if the client certificates are
+signed by intermediate CAs. In such cases, SSLCADNRequestFile, SSLCADNRequestPath, and/or SSLCADNRequestURI can be used; the
+acceptable CA names are then taken from the complete set of
+certificates in the directory and/or file specified by this pair of
+directives.
SSLCADNRequestURI must
+specify an all-in-one certificate store uri containing a
+set of CA certificates.
SSLCADNRequestURI "file:///usr/local/apache2/conf/ca-names.crt"+
A file: URI pointing at a file of PEM encoded certificates
+can be used instead of SSLCADNRequestFile, and a file:
+URI pointing at a directory of PEM encoded certificates can be used
+instead of SSLCADNRequestPath.
+
This store is read at server startup, while the server is still running
+as root (before privilege dropping), so it may be owned by
+and readable only by root. The uri is not re-read during
+normal operation; a server restart is required for changes to take
+effect.
root. The files are not
re-read during normal operation; a server restart is required for changes
to take effect.
+| Description: | Server CA certificate revocation list store for Client Authentication |
|---|---|
| Syntax: | SSLCARevocationURI uri |
| Context: | server config, virtual host |
| Status: | Extension |
| Module: | mod_ssl |
+This directive sets the all-in-one file where you can
+assemble the Certificate Revocation Lists (CRL) of Certification
+Authorities (CA) whose clients you deal with. These are used
+for Client Authentication. This can be used alternatively and/or
+additionally to SSLCARevocationFile and SSLCARevocationPath.
SSLCARevocationURI "/usr/local/apache2/conf/ssl.crl/ca-bundle-client.crl"+
A file: URI pointing at a file of PEM encoded CRLs
+can be used instead of SSLCARevocationFile, and a file:
+URI pointing at a directory of PEM encoded CRLs can be used
+instead of SSLCARevocationPath.
+
This URI is read at server startup, while the server is still running
+as root (before privilege dropping), so it may be owned by
+and readable only by root. The URI is not re-read during
+normal operation; a server restart is required for changes to take
+effect.
root, since it contains the private key.
The file is not re-read during normal operation; a server restart is
required for changes to take effect.
+| Description: | Server certificate and key store |
|---|---|
| Syntax: | SSLCertificateURI uri |
| Context: | server config, virtual host |
| Status: | Extension |
| Module: | mod_ssl |
| Compatibility: | Available in httpd 2.5.1 and later, when linked with +OpenSSL v3 or later. |
+This directive points to a certificate store containing certificates, +intermediate certificates, and private keys, represented by a URI. +
++If no scheme is specified, the path will default to a file: +URI, pointing at PEM encoded data, or a PKCS12 file. Other schemes +include, but are not limited to, pkcs11: for smartcards and +HSMs, cng: for the Windows certificate store, and +handle: for TPMs. On Windows, where a file path is also a +valid URI, the file: scheme must be used. +
++The directive can be specified multiple times with tightly scoped +URIs to target specific certificates and keys, or could be specified +with a general URI like pkcs11: that considers all possible +certificates and keys. Certificates, intermediate certificates, and keys +can be defined in any order. +
+Certificates and keys are processed as follows. +
+ServerName and all
+ServerAlias directives match the
+hostname or IP address of the certificate, and if no match is found they
+are skipped.If the private key is encrypted, the pass phrase dialog is forced +at startup time.
+ +# Example using a PEM-encoded file. +SSLCertificateURI "/usr/local/apache2/conf/ssl.crt/server.crt" +# Example using a PKCS12 file. +SSLCertificateURI "/usr/local/apache2/conf/ssl.crt/server.p12" +# Example use of a certificate and private key from a PKCS#11 token: +SSLCertificateURI "pkcs11:token=My%20Token%20Name;id=45"+
These URIs are read at server startup, while the server is still running
+as root (before privilege dropping), so it may be owned by
+and readable only by root. The URI is not re-read during
+normal operation; a server restart is required for changes to take
+effect.
+You can use both SSLCertificateFile and SSLCertificateURI together, however +there is no overlap between the mechanisms. A certificate defined by +SSLCertificateFile will not be matched with a key from SSLCertificateURI. +
+SSLProxyCACertificatePath "/usr/local/apache2/conf/ssl.crt/"
| Description: | Proxy CA certificate store for Remote Server Auth |
|---|---|
| Syntax: | SSLProxyCACertificateURI uri |
| Context: | server config, virtual host, proxy section |
| Status: | Extension |
| Module: | mod_ssl |
| Compatibility: | Available in httpd 2.5.1 and later, when linked with +OpenSSL v3 or later. |
+This directive sets the all-in-one URI where you can assemble the
+Certificates of Certification Authorities (CA) whose remote servers you deal
+with. These are used for Remote Server Authentication. This can be used alternatively
+and/or additionally to
+SSLProxyCACertificateFile and
+SSLProxyCACertificatePath.
SSLProxyCACertificateURI "/usr/local/apache2/conf/ssl.crt/ca-bundle-remote-server.crt"+
SSLProxyCARevocationPath "/usr/local/apache2/conf/ssl.crl/"
| Description: | Proxy CA certificate revocation list store for Remote Server Auth |
|---|---|
| Syntax: | SSLProxyCARevocationURI uri |
| Context: | server config, virtual host, proxy section |
| Status: | Extension |
| Module: | mod_ssl |
| Compatibility: | Available in httpd 2.5.1 and later, when linked with +OpenSSL v3 or later. |
+This directive sets the all-in-one URI where you can
+assemble the Certificate Revocation Lists (CRL) of Certification
+Authorities (CA) whose remote servers you deal with. These are used
+for Remote Server Authentication. This can be
+used alternatively and/or additionally to SSLProxyCARevocationFile and SSLProxyCARevocationPath.
SSLProxyCARevocationURI "/usr/local/apache2/conf/ssl.crl/ca-bundle-remote-server.crl"+
SSLProxyMachineCertificatePath "/usr/local/apache2/conf/proxy.crt/"
| Description: | Proxy certificate and key stores |
|---|---|
| Syntax: | SSLProxyMachineCertificateURI uri |
| Context: | server config, virtual host, proxy section |
| Status: | Extension |
| Module: | mod_ssl |
| Compatibility: | Available in httpd 2.5.1 and later, when linked with +OpenSSL v3 or later. |
+This directive points to a certificate store containing certificates, +intermediate certificates, and private keys, represented by a URI, +to be used when authenticating to another proxy server. +
++If no scheme is specified, the path will default to a file: +URI, pointing at PEM encoded data, or a PKCS12 file. Other schemes +include, but are not limited to, pkcs11: for smartcards and +HSMs, cng: for the Windows certificate store, and +handle: for TPMs. On Windows, where a file path is also a +valid URI, the file: scheme must be used. +
++The directive can be specified multiple times with tightly scoped +URIs to target specific certificates and keys, or could be specified +with a general URI like pkcs11: that considers all possible +certificates and keys. Certificates, intermediate certificates, and keys +can be defined in any order. +
+Proxy certificates and keys are processed as follows. +
+If the private key is encrypted, the pass phrase dialog is forced +at startup time.
+ +# Example using a PEM-encoded file. +SSLProxyMachineCertificateURI "/usr/local/apache2/conf/ssl.crt/proxy.pem" +# Example using a PKCS12 file. +SSLProxyMachineCertificateURI "/usr/local/apache2/conf/ssl.crt/proxy.p12" +# Example use of a certificate and private key from a PKCS#11 token: +SSLProxyMachineCertificateURI "pkcs11:token=My%20Token%20Name;id=45"+
These URIs are read at server startup, while the server is still running
+as root (before privilege dropping), so it may be owned by
+and readable only by root. The URI is not re-read during
+normal operation; a server restart is required for changes to take
+effect.
When challenged to provide a client certificate by a remote server,
+the server should provide a list of acceptable certificate
+authority names in the challenge. If such a list is not
+provided, mod_ssl will use the most recently
+issued client certificate and key. If a list of CA names
+is provided, mod_ssl will iterate through
+that list, and attempt to find a configured client certificate which
+was issued either directly by that CA, or indirectly via any number of
+intermediate CA certificates.
+
If the list of CA names is provided by the remote server,
+and no matching client certificate can be found, no client
+certificate will be provided by mod_ssl, which will
+likely fail the SSL/TLS handshake (depending on the remote server
+configuration).
+You can use both SSLProxyMachineCertificateFile and +SSLProxyMachineCertificateURI together, however there is +no overlap between the mechanisms. A certificate defined by +SSLProxyMachineCertificateFile will not be matched with a +key from SSLProxyMachineCertificateURI. +
+
SSLCACertificateFile
SSLCACertificatePath
SSLCACertificateURI
SSLCADNRequestFile
SSLCADNRequestPath
SSLCADNRequestURI
SSLCARevocationCheck
SSLCARevocationFile
SSLCARevocationPath
SSLCARevocationURI
SSLCertificateChainFile
SSLCertificateFile
SSLCertificateKeyFile
SSLCertificateURI
SSLCipherSuite
SSLClientHelloVars
SSLCompression
SSLProtocol
SSLProxyCACertificateFile
SSLProxyCACertificatePath
SSLProxyCACertificateURI
SSLProxyCARevocationCheck
SSLProxyCARevocationFile
SSLProxyCARevocationPath
SSLProxyCARevocationURI
SSLProxyCheckPeerCN
SSLProxyCheckPeerExpire
SSLProxyCheckPeerName
SSLProxyMachineCertificateChainFile
SSLProxyMachineCertificateFile
SSLProxyMachineCertificatePath
SSLProxyMachineCertificateURI
SSLProxyProtocol
SSLProxyVerify
SSLProxyVerifyDepth| Descripción: | Server CA certificate store for Client Authentication |
|---|---|
| Sintaxis: | SSLCACertificateURI uri |
| Contexto: | server config, virtual host |
| Anula: | AuthConfig |
| Estado: | Extensión |
| Módulo: | mod_ssl |
| Compatibilidad: | Available in httpd 2.5.1 and later, when linked with +OpenSSL v3 or later. |
The documentation for this directive has + not been translated yet. Please have a look at the English + version.