How this site has been created

👤 Rafał Rusin 📆 2025-02-01 22:01 🏷️ pelican apache httpd

Playful Cat

Preparing Tools and Templates

For generating the webpage, I chose to use Pelican, a fast and well-organized static website generator. Most importantly, it supports Jinja for creating templates, which is quite popular and efficient. The only missing ingredient was a modern HTML5 template, which I found in a separate project: HTML5 UP. Most of my efforts went into learning how to adjust Pelican to generate content in a way that fit my custom HTML5 template.

Removing unnecessary parts from Html 5 template

There was some nice features in HTML5 UP Editorial template which could be easly trimmed without losing much.

  • Removed Awesome Font: This only removed brand icons 😅, while other characters like menu icons, emojis, and more remained available in the standard Unicode palette. This reduced content size by 2MB.
  • Removed Roboto Font: This font was unnecessary and only slowed down site loading. Since it could be easily replaced with system fonts, there was no loss.

After these optimizations, the entire website (with one article) became extremely lightweight—below 250KB of compressed files.

Setting Up the Apache HTTPD Server

To ensure security and performance, I configured the HTTP server with key optimizations:

  • TLS 1.3 & CHACHA20 Cipher: Since my CPU lacks AES-256 hardware encryption support, CHACHA20 is significantly faster.
  • Gzip Compression: Only compressed content is served—no uncompressed files exist on the server.
  • Cache Control: The Cache-Control header is set to 8 hours, reducing unnecessary re-downloads while allowing for twice-daily content updates.

Apache HTTPD Configuration

Here is the key configuration setup for the server:

LoadModule mpm_event_module modules/mod_mpm_event.so
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_core_module modules/mod_authn_core.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_core_module modules/mod_authz_core.so
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
LoadModule reqtimeout_module modules/mod_reqtimeout.so
LoadModule include_module modules/mod_include.so
LoadModule filter_module modules/mod_filter.so
LoadModule mime_module modules/mod_mime.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule env_module modules/mod_env.so
LoadModule headers_module modules/mod_headers.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
LoadModule ssl_module modules/mod_ssl.so
LoadModule http2_module modules/mod_http2.so
LoadModule unixd_module modules/mod_unixd.so
LoadModule systemd_module modules/mod_systemd.so
LoadModule vhost_alias_module modules/mod_vhost_alias.so
LoadModule dir_module modules/mod_dir.so
LoadModule alias_module modules/mod_alias.so
LoadModule rewrite_module modules/mod_rewrite.so

<IfModule unixd_module>
   User http
   Group http
</IfModule>

ServerRoot "/etc/httpd"
Listen 80
Protocols h2 http/1.1
ServerTokens Prod
AddDefaultCharset UTF-8
EnableMMAP on
EnableSendfile on
ServerName rafal.rusin.eu.org
Timeout 60
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 5
UseCanonicalName Off
AccessFileName .htaccess
ServerTokens Prod
ServerSignature Off
HostnameLookups Off

<Directory />
    AllowOverride none
    Require all denied
</Directory>

DocumentRoot "/srv/http"
<Directory "/srv/http">
    Options Indexes
    AllowOverride None
    Require all granted
</Directory>

<IfModule dir_module>
    DirectoryIndex index.html
</IfModule>

<Files ".ht*">
    Require all denied
</Files>

ErrorLog syslog:local1
LogLevel warn

<IfModule log_config_module>
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common
    <IfModule logio_module>
      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    </IfModule>
    CustomLog "|/bin/logger -t httpd_access -p user.info" "%h %l %u %D \"%r\" %p %>s %b \"%{Referer}i\" \"%{User-agent}i\" %q"
</IfModule>

<IfModule headers_module>
    RequestHeader unset Proxy early
</IfModule>

<IfModule mime_module>
    TypesConfig conf/mime.types
    AddEncoding x-gzip .gz .tgz
    AddType text/html html.gz htm.gz
    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz
</IfModule>

<IfModule mpm_event_module>
    StartServers             3
    MinSpareThreads         75
    MaxSpareThreads        250
    ThreadsPerChild         25
    MaxRequestWorkers      400
    MaxConnectionsPerChild   0
</IfModule>

<VirtualHost *:80>
    ServerName rafal.rusin.eu.org
    # Allow /robots.txt without redirect
    # Redirect all other requests to HTTPS
    # robots.txt must be permitted because
    # Bing trying access it that way
    <FilesMatch "^/robots\.txt$">
        Require all granted
    </FilesMatch>
    RedirectMatch 301 ^/(?!robots\.txt$) https://rafal.rusin.eu.org/
</VirtualHost>

<IfModule reqtimeout_module>
    RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500
</IfModule>

Listen 443 https
SSLCipherSuite TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
SSLProxyCipherSuite TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
SSLHonorCipherOrder on 
SSLProtocol TLSv1.3
SSLProxyProtocol TLSv1.3
SSLSessionCache "shmcb:/run/httpd/ssl_scache(512000)"
SSLSessionCacheTimeout  300

<VirtualHost *:443>
   DocumentRoot "/srv/http"
   ServerName rafal.rusin.eu.org
   ErrorDocument 404 /srv/http/404.html
   SSLEngine on
   SSLCertificateFile "/etc/httpd/ssl/rafal.rusin.eu.org.crt"
   SSLCertificateKeyFile "/etc/httpd/ssl/rafal.rusin.eu.org.key"
   SSLCertificateChainFile "/etc/httpd/ssl/rafal.rusin.eu.org.chain"
    RewriteEngine On
    RewriteRule "^(.*)\.(css|js|html|st|wasm|xml|ico|svg)" "$1\.$2\.gz" [QSA]
    RewriteRule "\.css\.gz$" "-" [T=text/css,E=no-gzip:1]
    RewriteRule "\.js\.gz$"  "-" [T=text/javascript,E=no-gzip:1]
    RewriteRule "\.html\.gz$"  "-" [T=text/html,E=no-gzip:1]
    RewriteRule "\.st\.gz$"  "-" [T=application/wasm,E=no-gzip:1]
    RewriteRule "\.wasm\.gz$"  "-" [T=application/wasm,E=no-gzip:1]
    RewriteRule "\.xml\.gz$"  "-" [T=application/xml,E=no-gzip:1]
    RewriteRule "\.ico\.gz$"  "-" [T=image/x-icon,E=no-gzip:1]
    RewriteRule "\.svg\.gz$"  "-" [T=image/svg+xml,E=no-gzip:1]
   <FilesMatch "(\.js\.gz|\.css\.gz|\.html\.gz|\.st\.gz|\.wasm\.gz|\.xml\.gz|\.ico\.gz|\.svg\.gz)$">
    Header append Content-Encoding gzip
    Header append Vary Accept-Encoding
    Header set Cache-Control "max-age=28800, public"
   </FilesMatch>
</VirtualHost>

<IfModule ssl_module>
    SSLRandomSeed startup builtin
    SSLRandomSeed connect builtin
</IfModule>

Stork Search Engine for the Search Form

Another lightweight and static feature of the site is the Stork search engine, which allows users to search articles efficiently. Stork is compiled into WebAssembly and bundled statically with the generated database during content generation on the developer's machine. The integration with Pelican is achieved using the pelican-search plugin. When a user enters a query in the search form, the search is executed directly in the web browser using the client’s CPU. This approach enables fast and highly accurate searches without requiring server-side processing.

Connectivity Diagram

The connectivity setup is quite simple: web browsers directly access the web server.

Connection Diagram

By following these steps, I achieved a fast, secure, and efficient static website using Pelican and Apache HTTPD.