HOWTO Let lighttpd listen to both IPv4 and IPv6 on *BSD.

Okay, I've managed to let lighttpd listen to both IPv4 and IPv6 requests without using IPv4-mapped addresses. According to an Internet draft, IPv4 mapped addresses are considered harmful (R.I.P., itojun :). This has already been turned off in *BSDs by default but not in Linux.

Anyway, I've found out that if sysctl net.inet6.ip6.v6only is set to 1, enabling IPv6 in lighttpd would cause it to listen to IPv6 only. To solve this, you need to use these settings:

server.use-ipv6 = "enable"
$SERVER["socket"]          == "0.0.0.0:80" {
}

If you need to use SSL, simply use:

server.use-ipv6 = "enable"
ssl.engine = "enable"
ssl.pemfile = "/var/etc/cert.pem"

$SERVER["socket"]          == "0.0.0.0:443" {
  ssl.engine = "enable"
  ssl.pemfile = "/var/etc/cert.pem"
}

Tada! It works:

root@soulfury:/# sockstat | grep lighttpd
root     lighttpd   23974 4  tcp6   *:443                 *:*
root     lighttpd   23974 5  tcp4   *:443                 *:*
root@soulfury:/# sysctl -a | grep v6only
net.inet6.ip6.v6only: 1

Slow lighttpd using IPv6

I've been wondering why lighttpd seems to be so slow when IPv6 is enabled. I discovered that I had to bump the minimum and maximum number of FastCGI process (min-procs/max-procs) by twice as much because it appears that lighttpd divides the available PHP processes between IPv4 and IPv6. I dunno why it does that.

pfSense HTTPS fixed

OK, I found the problem. The fix is very simple:

$SERVER["socket"] == "0.0.0.0:443" {
    ssl.engine = "enable"
    ssl.pemfile = "/var/etc/cert.pem"
}

I'll commit this change soon.

fixing pfSense' HTTPS support

lighttpd seems to have an issue when enabling both IPv4 and IPv6. With plain HTTP, enabling them both is a simple matter of adding the following lines:

server.use-ipv6            = "enable"
$SERVER["socket"]          == "0.0.0.0:80" { }

With HTTPS, however, $SERVER["socket"] == "0.0.0.0:443" doesn't seem to work. Although sockstat reports that lighttpd is indeed listening to port 443, https://<ip_address> doesn't work. http://<ip_address>:443 work, but this is just plain HTTP served on port 443. Weird. the following is sockstat's output:

root     lighttpd   53320 4  tcp6   *:443           *:*
root     lighttpd   53320 5  tcp4   *:443           *:*