Page MenuHomePhabricator

lighttpd: starting a webserver logs "WARNING: unknown config-key: server.dir-listing (ignored)" to error.log
Open, LowPublicBUG REPORT

Description

Steps to replicate the issue (include links if applicable):

  • start a webserver with a command such as webservice php8.4 start or webservice restart
  • check ~/error.log

What happens?:

2026-04-12 00:36:58: (server.c.1974) server started (lighttpd/1.4.79)
2026-04-12 00:36:58: (configfile.c.1400) WARNING: unknown config-key: server.dir-listing (ignored)
2026-04-12 00:39:06: (server.c.1974) server started (lighttpd/1.4.79)
2026-04-12 00:39:06: (configfile.c.1400) WARNING: unknown config-key: server.dir-listing (ignored)

What should have happened instead?:

  • no warning in error.log

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):

Other information (browser name/version, screenshots, etc.):

  • accounts where I was able to reproduce this: refill, novem-bot
  • do we need to remove server.dir-listing from the default .lighttpd.conf file?

Related Objects

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

The config in question comes from https://gerrit.wikimedia.org/r/plugins/gitiles/operations/docker-images/toollabs-images/+/2c64e77e9cd420755f38195ece012e5139a9785c/shared/lighttpd/webservice-runner#38. This hasn't changed since rODITe299db6e3481: Add php82 images where we first moved the lighttpd config logic from webservice into the shell script implementation.

I would assume that what has happened here is that a newer version of lighttpd has removed the setting. The main thing we should determine before removing it is if any of the actively supported lighttpd versions we have need it still. It probably would be good to check what the replacement is upstream and if we need to add that to the defaults instead/additionally.

Reading https://redmine.lighttpd.net/projects/lighttpd/wiki/Mod_dirlisting it looks like the modern setting is dir-listing.activate = "disable" which is also listed as the default.

NOTE: looking up things about lighttpd can be confusing online because the lighttpd 2.x docs at https://doc.lighttpd.net/lighttpd2/ often have better SEO than the lighttpd 1.x docs at https://redmine.lighttpd.net/projects/lighttpd. Per the upstream "Lighttpd 2.0 is work in progress" and Debian is still shipping the 1.x series (bullseye: 1.4.59-1+deb11u2, bookworm: 1.4.69-1, trixie: 1.4.79-2, testing & unstable: 1.4.82-2)
aputhin subscribed.

Tagging as "Low" prio for now as it doesn't seem to be blocking (only a Warning).