Page Contents
General rules
#if not state otherwise , in this configuration example , 0 means disable or OFF and 1 means enable or ON.
#if you are manually editing the configuration file.
#please note that all the directives and values are case sensitive.
#and certain directives are need to enclosed by its parent context.
serverName
serverName test.server
A unique name for this server. If empty, server hostname will be used by default.
httpdWorkers
httpdWorkers 2
Specifies the number of httpd workers.
user nobody
user nobody
Specifies the user/group that the server process runs as
group nobody
group nobody
Specifies the user/group that the server process runs as
priority
priority 0
Specifies priority of the server processes. Value ranges from -20 to 20. A lower number means higher priority.
cpuAffinity
cpuAffinity 0
The CPU Affinity setting controls how many CPUs (cores) one server process will be associated with.
The minimum value is 0, which will disable this feature. The maximum value is the number of cores the server has.
Generally, 1 is the best setting because because it creates the strictest use of CPU affinity and thus makes the most use of CPU cache.
enableLVE
enableLVE 1
Specifies whether to enable CloudLinux’s Lightweight Virtual Environment (LVE) when it exists. You can use LiteSpeed with LVE to achieve better resource management
0 = disable
1 = LVE
2 = CageFS
3 = CageFS without suEXEC
inMemBufSize
inMemBufSize 60M
Specifies the maximum buffer size that is used to store a request body and its dynamically generated response.
When this limit is reached, the server will start to create temporary swapping files under “Swapping Directory”.
swappingDir
swappingDir /tmp/lshttpd/swap
Specifies the directory where the swapping files should be placed
autoFix503
autoFix503 1
Specifies whether to try to fix the “503 Service Unavailable” error by restarting the server gracefully.
A “503” error is usually caused by malfunctioning external applications and a web server restart can often fix the error temporarily.
enableh2c
enableh2c 0
Specifies whether to enable HTTP/2 over non-encrypted TCP connections.
gracefulRestartTimeout
gracefulRestartTimeout 300
During a graceful restart, even after the new server instance is up, the old instance will continue to handle existing requests.
This timeout defines how long the previous instance shall wait before exit.
statDir
statDir /tmp/lshttpd/
The directory where the Real-Time Stats report file will be written.
mime conf/mime.properties
mime conf/mime.properties
Specifies the file that contains the MIME settings for this server.
Filename which can be an absolute path or a relative path to $SERVER_ROOT.
disableInitLogRotation
disableInitLogRotation 1
Specifies whether to enable/disable rotation of server error log file at startup
showVersionNumber
showVersionNumber 0
Specifies whether to show the server signature and version number in the response header’s “Server” value
0 = hide version number
1 = show version number
2 = hide full header
enableIpGeo
enableIpGeo 0
Specifies whether to enable/disable IP Geolocation lookup. Can be set at server, virtual host, or context level
useIpInProxyHeader
useIpInProxyHeader 1
Specifies whether to use the IP address listed in the “X-Forwarded-For” HTTP request header for all IP address-related features,
including connection/bandwidth throttling, access control, and IP geolocation.
0 = disabled
1 = enabled
2 = trusted IP Only
3 = keep Header from trusted IP
adminEmails
adminEmails root@localhost
Specifies the server administrator’s email address(es)
errorlog
logLevel DEBUG
debugLevel 0
rollingSize 10M
enableStderrLog 1
errorlog logs/error.log {
logLevel DEBUG
debugLevel 0
rollingSize 10M
enableStderrLog 1
}
accesslog
rollingSize 10M
keepDays 30
compressArchive 0
accesslog logs/access.log {
rollingSize 10M
keepDays 30
compressArchive 0
}
indexFiles
indexFiles index.html, index.php
Specifies names of index files that will be searched sequentially when a URL is mapped to a directory.
You can customize it at the server, virtual host, and context level.
autoIndex
autoIndex 0
Specifies whether to generate a directory index on the fly when index files listed in “Index Files” are not available in a directory
0 = disable
1 = enable
autoIndexURI
autoIndexURI /_autoindex/default.php
Specifies the URI that will be used to generate the index page when index files listed in “Index Files” are not available in a directory
expires
enableExpires
expiresDefault
expiresByType
expires {
enableExpires 1
expiresDefault A604800
expiresByType image/*=A604800, text/css=A604800, application/x-javascript=A604800, application/javascript=A604800, font/*=A604800, application/x-font-ttf=A604800
}
autoLoadHtaccess
autoLoadHtaccess 1
#Autoload rewrite rules contained in a directory’s .htaccess file
#Once initially loaded, a graceful restart must be performed for any further changes to that .htaccess file to take effect.
uploadTmpDir
uploadTmpDir /tmp/lshttpd/
Temporary directory where files being uploaded to server will be stored while request body parser is working.
uploadTmpFilePermission
uploadTmpFilePermission 666
Determines file permissions used for files stored in temporary directory
3 digits octet number
uploadPassByPath
uploadPassByPath 0
Specify whether or not to pass upload file data by path
geoipdb
geoipDBName
maxMindDBEnv
geoipdb /usr/local/lsws/iplocation/GeoLite2-Country.mmdb {
#Specifies the path to MaxMind GeoIP database
geoipDBName COUNTRY_DB
#MaxMind GeoIP database name
maxMindDBEnv COUNTRY_CODE COUNTRY_DB/country/iso_code
#Assign the results of database lookups to environment variables
}
ip2locDB
ip2locDBFile
ip2locDBCache
ip2locDB {
ip2locDBFile /usr/local/lsws/iplocation/GeoLite2-Country.mmdb
#The location of a valid database file
ip2locDBCache MemoryCache
#The caching method used. The default value is Memory.
#possible values are: MemoryCache , FileIo and SharedMemoryCache
}
tuning
tuning {...}
shmDefaultDir
shmDefaultDir /dev/shm/ols/
#Changes shared memory’s default directory to the specified path
maxConnections
maxConnections 10000
#Specifies the maximum number of concurrent connections that the server can accept.
#This includes both plain TCP connections and SSL connections
maxSSLConnections
maxSSLConnections 10000
#Specifies the maximum number of concurrent SSL connections the server will accept
#Since total concurrent SSL and non-SSL connections cannot exceed the limit specified by “Max Connections”,
#the actual number of concurrent SSL connections allowed must be lower than this limit.
connTimeout
connTimeout 300
#Specifies the maximum connection idle time (seconds) allowed during processing one request
maxKeepAliveReq
maxKeepAliveReq 10000
#Specifies the maximum number of requests that can be served through a keep-alive (persistent) session
keepAliveTimeout
keepAliveTimeout 5
#Specifies the maximum idle time (seconds) between requests from a keep-alive connection.
#If no new request is received during this period of time, the connection will be closed
sndBufSize
sndBufSize 0
#The sending buffer size of each TCP socket. 512K is the maximum allowed buffer size
rcvBufSize
rcvBufSize 0
#The receiving buffer size of each TCP socket. 512K is the maximum allowed buffer size
maxReqURLLen
maxReqURLLen 32768
#Specifies the maximum size (bytes) of a request URL.
#URL is the full text address used to access a server resource including the query string.
#64K bytes is the hard limit.
maxReqHeaderSize
maxReqHeaderSize 65536
#Specifies the maximum size (bytes) of an HTTP request header including request URL
maxReqBodySize
maxReqBodySize 2047M
#Specifies the maximum size of an HTTP request body.
#For a 32Bit OS, 2GB is the hard limit. For a 64Bit OS, it is virtually unlimited
maxDynRespHeaderSize
maxDynRespHeaderSize 32768
#Specifies the maximum header size (bytes) of a dynamically generated response. Hard limit is 64KB.
maxDynRespSize
maxDynRespSize 2047M
#Specifies the maximum body size of a dynamically generated response. Hard limit is 2047MB.
maxCachedFileSize
maxCachedFileSize 4096
#Specifies the largest static file size (bytes) that will be cached in a pre-allocated memory buffer
totalInMemCacheSize
totalInMemCacheSize 20M
#Specifies the total memory that can be allocated to the buffer cache in order to cache/serve small static files.
maxMMapFileSize
maxMMapFileSize 256K
#Specifies the largest static file size (bytes) that will be memory mapped (MMAP)
totalMMapCacheSize
totalMMapCacheSize 40M
#Specifies the total memory (bytes) that can be allocated for memory- mapped cache in order to cache/serve medium sized static files.
useSendfile
useSendfile 1
#Specifies whether to use the sendfile() system call to serve static files
fileETag
fileETag 28
#Specifies whether to use a file’s inode, last-modified time, and size attributes to generate the ETag HTTP response header for static files
# 0 = None
# 4 = iNode
# 8 = Modified ime
# 12 = iNode + Modified Time
# 16 = Size
# 20 = iNODE + Size
# 24 = Modified time + Size
# 28 = iNode + Modified Time + Size
enableGzipCompress
enableGzipCompress 1
#Enables GZIP/Brotli compression for both static and dynamic responses.
compressibleTypes
compressibleTypes text/*, application/x-javascript, application/xml, application/javascript, image/svg+xml, application/rss+xml
#Specifies what MIME types are allowed to be compressed.
#MIME type list separated by commas. Wild card “*” and negate sign “!” are allowed, such as text/*, !text/js.
enableDynGzipCompress
enableDynGzipCompress 1
#Controls GZIP compression for dynamically generated responses.
#For this setting to have an effect, “Enable Compression” must be set to Yes.
gzipCompressLevel
gzipCompressLevel 6
#Specifies the level of GZIP compression applied to dynamic content. Ranges from 1 (lowest) to 9 (highest).
gzipAutoUpdateStatic
gzipAutoUpdateStatic 1
#Specifies whether to let the server automatically create/update GZIP/Brotli-compressed versions of compressible static files or not
gzipStaticCompressLevel
gzipStaticCompressLevel 6
#Specifies the level of GZIP compression applied to static files. Ranges from 1 (lowest) to 9 (highest).
brStaticCompressLevel
brStaticCompressLevel 6
#Specifies the level of Brotli compression applied to static files. Ranges from 1 (lowest) to 11 (highest).
gzipCacheDir
gzipCacheDir /tmp/lshttpd/swap
#Specifies the path of the directory used to store compressed files for static content.
gzipMaxFileSize
gzipMaxFileSize 10M
#Specifies the maximum size (bytes) of a static file for which the server will create a compressed file automatically.
gzipMinFileSize
gzipMinFileSize 300
#Specifies the minimum size (bytes) of a static file for which the server will create a corresponding compressed file.
quicEnable
quicEnable 1
#Enables the QUIC network protocol server wide. Default value is Yes.
quicShmDir
quicShmDir /dev/shm
#Specifies the directory used to save QUIC data to shared memory.
fileAccessControl
followSymbolLink
checkSymbolLink
forceStrictOwnership
requiredPermissionMask
restrictedPermissionMask
restrictedScriptPermissionMask
restrictedDirPermissionMask
fileAccessControl {
followSymbolLink 1
#Specifies the server-level default setting of following symbolic links when serving static files.
# 0 = No
# 1 = Yes
# 2 = If Owner Match
checkSymbolLink 0
#Specifies whether to check symbolic links against "Access Denied Directories" when "Follow Symbolic Link" is turned on
# 0 = disabled
# 1 = enabled
forceStrictOwnership 1
#Specifies whether to enforce strict file ownership checking.
#If it is enabled, the web server will check if the owner of the file being served is the same as the owner of the virtual host.
#If it is different, a 403 Access Denied Error will be returned
# 0 = disabled
# 1 = enabled
requiredPermissionMask 000
#Specifies the required permission mask for static files that the server will serve
#octal numbers 000
restrictedPermissionMask 000
#Specifies the restricted permission mask for static files that the server will not serve.
#For example, to prohibit serving files that are executable, set the mask to 0111.
#octal numbers 000
restrictedScriptPermissionMask 000
#Specifies the restricted permission mask for script files that the server will not serve.
#For example, to prohibit serving PHP scripts that are group and world writable, set the mask to 022
#octal numbers 000
restrictedDirPermissionMask 000
#Specifies the restricted permission mask of parent directories of script files that the server will not serve.
#octal numbers 000
}
perClientConnLimit
staticReqPerSec
dynReqPerSec
outBandwidth
inBandwidth
softLimit
hardLimit
blockBadReq
gracePeriod
banPeriod
perClientConnLimit {
staticReqPerSec 0
#Specifies the maximum number of requests to static content coming from a single IP address that can be processed in a single second.
dynReqPerSec 0
#Specifies the maximum number of requests to dynamically generated content coming from a single IP address that can be processed in each second.
outBandwidth 0
#The maximum allowed outgoing throughput to a single IP address, regardless of the number of connections established
#the unit is (bytes/sec)
inBandwidth 0
#The maximum allowed incoming throughput from a single IP address, regardless of the number of connections established
#the unit is (bytes/sec)
softLimit 10000
#Specifies the soft limit of concurrent connections allowed from one IP
#This soft limit can be exceeded temporarily during "Grace Period (sec)"
hardLimit 10000
#The maximum allowed incoming throughput from a single IP address
blockBadReq 1
#Block IPs that keep sending badly-formated HTTP requests for the "Banned Period (sec)".
gracePeriod 15
#Specifies how long new connections can be accepted after the number of connections established from one IP is over the "Connection Soft Limit"
#the unit is (sec)
banPeriod 300
#Specifies how long new connections will be rejected from an IP if,
#after the "Grace Period (sec)" has elapsed, the number of connections is still more than the "Connection Soft Limit"
#the unit is (sec)
}
accessDenyDir
accessDenyDir {
dir /
dir /etc/*
dir /dev/*
dir conf/*
dir admin/conf/*
}
#Specifies directories that should be blocked from access
accessControl
allow
deny
accessControl {
#Specifies what sub networks and/or IP addresses can access the server.
#At the server level, this setting will affect all virtual hosts.
#You can also set up access control unique to each virtual host at the virtual host level.
#Virtual host level settings will NOT override server level settings.
allow ALL
#Specifies the list of IPs or sub-networks allowed. * or ALL are accepted.
#A trailing "T" can be used to indicate a trusted IP or sub-netwo
deny 192.168.1.1
#Specifies the list of IPs or sub-networks disallowed.
#Comma delimited list of IP addresses or sub-networks. * or ALL are accepted.
}
lsrecaptcha
enabled
siteKey
secretKey
type
maxTries
allowedRobotHits
botWhiteList
regConnLimit
sslConnLimit
lsrecaptcha {
enabled 1
#Enable the reCaptcha Protection feature at the current level.
#This setting must be set to Yes at the Server level before the reCaptcha Protection feature can be used.
siteKey 123456789123456789123456789
#The site key is the public key provided by Google via its reCAPTCHA service.
#A default Site Key will be used if not set.
secretKey 123456789123456789123456789
#The secret key is the private key provided by Google via its reCAPTCHA service.
#A default Secret Key will be used if not set.
type 1
#Specify the reCAPTCHA type to use with the key pairs
# 1 = checkbox
# 2 = invisible
maxTries 3
#Max Tries specifies the maximum number of reCAPTCHA attempts permitted before denying the visitor.
allowedRobotHits 5
#Number of hits per 10 seconds to allow ‘good bots’ to pass.
#Bots will still be throttled when the server is under load.
botWhiteList {
google
#List of custom user agents to allow access
#List of user agents, one per line. Regex is supported.
}
regConnLimit 1000
#The number of concurrent connections (SSL & non-SSL) needed to activate reCAPTCHA.
#reCAPTCHA will be used until concurrent connections drop below this number.
sslConnLimit 500
#The number of concurrent SSL connections needed to activate reCAPTCHA.
#reCAPTCHA will be used until concurrent connections drop below this number.
}
extprocessor
address
maxConns
env
initTimeout
retryTimeout
persistConn
respBuffer
autoStart
path
backlog
instances
priority
memSoftLimit
memHardLimit
procSoftLimit
procHardLimit
extprocessor lsphp {
#lsphp is the name of this external app
type lsapi
#Specifies the type of external application.
#Application types are differentiated by the service they provide or the protocol they use to communicate with the server
# fcgi FastCGI: a FastCGI application with a Responder role.
# fcgiauth FastCGI Authorizer: a FastCGI application with an Authorizer role
# servlet Servlet Engine: a servlet engine with an AJPv13 connector, such as Tomcat.
# proxy Web Server: a web server or application server that supports HTTP protocol.
# lsapi LiteSpeed SAPI App: an application that communicates with the web server using LSAPI protocol.
# loadbalancer Load Balancer: a virtual application that can balance load among worker applications.
# logger Piped Logger: an application that can process access log entries received on its STDIN stream.
address uds://tmp/lshttpd/lsphp.sock
maxConns 10
env PHP_LSAPI_CHILDREN=10
env LSAPI_AVOID_FORK=200M
initTimeout 60
retryTimeout 0
persistConn 1
respBuffer 0
autoStart 1
path $SERVER_ROOT/lsphp73/bin/lsphp
backlog 100
instances 1
priority 0
memSoftLimit 2047M
memHardLimit 2047M
procSoftLimit 1400
procHardLimit 1500
}
scripthandler
scripthandler {
add lsapi:lsphp php
}
virtualhost
vhRoot
configFile
allowSymbolLink
enableScript
restrained
setUIDMode
virtualhost Example {
vhRoot Example/
configFile conf/vhosts/Example/vhconf.conf
allowSymbolLink 1
enableScript 1
restrained 1
setUIDMode 0
}
virtualhost test1.domain.com {
vhRoot /home/$VH_NAME
configFile $SERVER_ROOT/conf/vhosts/$VH_NAME/vhost.conf
allowSymbolLink 1
enableScript 1
restrained 1
}
listener
address
secure
keyFile
certFile
certChain
sslProtocol
ciphers
enableECDHE
renegProtection
sslSessionCache
enableSpdy
enableStapling
ocspRespMaxAge
map
listener Default {
address *:80
secure 0
map test1.domain.com test1.domain.com
}
listener SSL {
address *:443
secure 1
keyFile /etc/letsencrypt/live/test.domain.com/privkey.pem
certFile /etc/letsencrypt/live/test.domain.com/fullchain.pem
certChain 1
sslProtocol 24
ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES128-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA128:DHE-RSA-AES128-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA128:ECDHE-RSA-AES128-SHA384:ECDHE-RSA-AES128-SHA128:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA128:DHE-RSA-AES128-SHA128:DHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA384:AES128-GCM-SHA128:AES128-SHA128:AES128-SHA128:AES128-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4
enableECDHE 1
renegProtection 1
sslSessionCache 1
enableSpdy 15
enableStapling 1
ocspRespMaxAge 86400
map test1.domain.com test1.domain.com
}
vhTemplate centralConfigLog
vhTemplate centralConfigLog {
templateFile conf/templates/ccl.conf
listeners Default
}
vhTemplate EasyRailsWithSuEXEC
vhTemplate EasyRailsWithSuEXEC {
templateFile conf/templates/rails.conf
listeners Default
}