lighttpd: Only require HTTPS authentication for Gitano URLs

Previously the whole of git.baserock.org was effectively inaccessible
over HTTPS, because it would require a username and password for all
HTTPS requests. This was done to ensure that we don't make Trove
"insecure by default" by allowing access to hidden repos over anonymous
HTTPS.

Firstly, we only need to require auth for the actual Gitano URLs. The
other ones (cgit, lc-status.html, releases) are identical over HTTP and
HTTPS anyway, so there's no point in hiding them on one protocol but not
the other.

Also, I have now verified that Gitano's CGI scripts authenticate based
on the REMOTE_USER variable set by mod_auth, and if this isn't set they
treat the request as anonymous and correctly deny any requests that
the anonymous user doesn't have permissions for. This is noted in a
comment.

The behaviour of Gitano-over-HTTPS in Trove should be completely
unchanged by this commit, however.

Change-Id: Ie5dbc3bd3ab8d37ef3e5c08c9541c571944e1f58

0 files changed, 0 insertions, 0 deletions