From 4f49b16079b27d7ce633619e4cddfdf2bffbc952 Mon Sep 17 00:00:00 2001 From: cashmere Date: Fri, 4 Sep 2026 09:05:24 +0200 Subject: initial commit --- www/server/windows/cgi-bin-perm.png | Bin 0 -> 15784 bytes www/server/windows/cgi-exec-perm.png | Bin 0 -> 6789 bytes www/server/windows/cgi-install-iis.png | Bin 0 -> 34422 bytes www/server/windows/cgi-script-map.png | Bin 0 -> 7456 bytes www/server/windows/cgi.md | 115 ++++++++++++++++++++++++ www/server/windows/iis.md | 134 ++++++++++++++++++++++++++++ www/server/windows/index.md | 8 ++ www/server/windows/none.md | 69 +++++++++++++++ www/server/windows/service.md | 120 +++++++++++++++++++++++++ www/server/windows/stunnel.md | 156 +++++++++++++++++++++++++++++++++ 10 files changed, 602 insertions(+) create mode 100644 www/server/windows/cgi-bin-perm.png create mode 100644 www/server/windows/cgi-exec-perm.png create mode 100644 www/server/windows/cgi-install-iis.png create mode 100644 www/server/windows/cgi-script-map.png create mode 100644 www/server/windows/cgi.md create mode 100644 www/server/windows/iis.md create mode 100644 www/server/windows/index.md create mode 100644 www/server/windows/none.md create mode 100644 www/server/windows/service.md create mode 100644 www/server/windows/stunnel.md (limited to 'www/server/windows') diff --git a/www/server/windows/cgi-bin-perm.png b/www/server/windows/cgi-bin-perm.png new file mode 100644 index 0000000..92ec090 Binary files /dev/null and b/www/server/windows/cgi-bin-perm.png differ diff --git a/www/server/windows/cgi-exec-perm.png b/www/server/windows/cgi-exec-perm.png new file mode 100644 index 0000000..5cfc2e3 Binary files /dev/null and b/www/server/windows/cgi-exec-perm.png differ diff --git a/www/server/windows/cgi-install-iis.png b/www/server/windows/cgi-install-iis.png new file mode 100644 index 0000000..ef6eb67 Binary files /dev/null and b/www/server/windows/cgi-install-iis.png differ diff --git a/www/server/windows/cgi-script-map.png b/www/server/windows/cgi-script-map.png new file mode 100644 index 0000000..bccc2fb Binary files /dev/null and b/www/server/windows/cgi-script-map.png differ diff --git a/www/server/windows/cgi.md b/www/server/windows/cgi.md new file mode 100644 index 0000000..768c76f --- /dev/null +++ b/www/server/windows/cgi.md @@ -0,0 +1,115 @@ +# Serving via IIS + CGI + +## This Is Not the Method You Are Looking For + +Setting up CGI service under IIS is surprisingly complicated compared to +running Fossil as a CGI under most other operating systems. We recommend +that you use the simpler [reverse proxying method](./iis.md) instead +unless there is some compelling reason why that method cannot work for +you, such as its dependence on non-stock IIS extensions. (Keep in mind +that both extensions it requires are by Microsoft, not third parties!) + +Once you’ve got this scheme working, it gives the same benefits as those +listed at the top of the linked-to document. + +There is a small benefit you get from using CGI over reverse proxying on +other OSes, which is that the Fossil program only runs briefly in order +to serve each HTTP hit. Once the request is done, that Fossil instance +shuts back down, releasing all of its resources. You don’t need to keep +a background Fossil HTTP server running full-time to provide CGI-based +Fossil service. + +You lose a lot of that benefit on Windows: + +1. It only matters to start with on servers that are highly RAM + constrained. (Roughly ≤ 128 MiB.) Our configuration steps below + assume you’re using the Windows and IIS GUIs, which have RAM + requirements well in excess of this, making Fossil’s resource + requirements a drop in the bucket next to them. On the [Azure + B1s][b1s] virtual machine I used to prepare these instructions, the + Windows Server Manager GUI kept filling the VM’s 1 GiB of RAM + during feature installation and crashing. I had to upgrade the VM’s + RAM to 2 GiB just to get useful work done! + +2. Process creation on Windows is [much more expensive][cp] than on the + other OSes Fossil runs on, so the benefits of firing up a Fossil + executable to process each HTTP request are partially swamped by the + overhead of doing so. + +Therefore, unless you’re willing to replace all of the GUI configuration +steps below with command line equivalents, or shut the GUI down entirely +after configuring IIS, CGI is a much less compelling option on Windows. + +**WARNING:** The following tutorial appears to fail with the current +(2019-08-17) version of Fossil, [apparently][fbug] due to an inability +of Fossil to detect that it’s being run in CGI mode. + +[b1s]: https://azure.microsoft.com/en-us/blog/introducing-b-series-our-new-burstable-vm-size/ +[cp]: https://stackoverflow.com/a/48244/142454 +[fbug]: https://fossil-scm.org/forum/forumpost/de18dc32c0 + + +## Install IIS with CGI Support + +The steps for this are identical to those for the [reverse proxying IIS +setup](./iis.md#install) except that you need to enable CGI in the last +step, since it isn’t installed by default. For Windows Server, the path +is: + +![Install CGI in IIS](./cgi-install-iis.png) + +The path is similar on the consumer-focused versions of Windows, once +you get to that last step. + + +## Setup + +1. Install the Fossil executable to `c:\inetpub\wwwroot\bin` on the web + server. We can’t use an executable you might already have because IIS + runs under a separate user account, so we need to give that + executable special permissions, and that’s easiest to do under the + IIS tree: + + ![IIS fossil.exe execute permission](./cgi-bin-perm.png) + +2. In IIS Manager (a.k.a. `INETMGR`) drill down into the Sites folder + in the left-side pane and right-click your web site’s + configuration. (e.g. “Default Web Site”) + +3. On that menu say “Add Virtual Directory.” Give it the alias “`cgi`” + and point it at a suitable directory, such as + “`c:\inetpub\wwwroot\cgi`”. + +4. Double-click the “Handler Mappings” icon, then in the right-side + pane, click “Add Script Map...” Apply the following settings: + + ![IIS script map dialog](./cgi-script-map.png) + + The Executable path must point to the path we set up in step 1, not + to some other `fossil.exe` you may have elsewhere on your system. + You will need to change the default “`*.dll`” filter in the Open + dialog to “`*.exe`” in order to see it when browsing via the “`...`” + button. + +5. Create a file called `repo.fslcgi` within the CGI directory you + chose in step 3, with a single line like this: + + repository: c:\Users\SOMEONE\museum\repo.fossil + + Give the actual path to the repository, of course. + +6. Up at the top level of IIS Manager, double-click the “ISAPI and CGI + Restrictions” icon, then click “Add...” in the right-side pane. + Give the script you just created permission to execute: + + ![IIS CGI execute permission](./cgi-exec-perm.png) + +7. In the right-side pane, click “Restart” to apply this configuration, + then test it by visiting the newly-available URL in a browser: + + http://localhost/cgi/repo.fslcgi + +For more complicated setups such as “directory” mode, see [the generic +CGI instructions](../any/cgi.md). + +*[Return to the top-level Fossil server article.](../)* diff --git a/www/server/windows/iis.md b/www/server/windows/iis.md new file mode 100644 index 0000000..9107da1 --- /dev/null +++ b/www/server/windows/iis.md @@ -0,0 +1,134 @@ +# Serving via IIS + +## Why Bother? + +The first part of the scheme below sets Fossil up as an HTTP server, so +you might be wondering why you wouldn’t just modify that to make it +listen on all network interfaces on TCP port 80, so you can avoid the +need for IIS entirely. For simple use cases, you can indeed do without +IIS, but there are several use cases where adding it is helpful: + +1. Proxying Fossil with IIS lets you [add TLS encryption][tls], which + [Fossil does not currently speak](../../ssl.wiki) in its server role. + +2. The URL rewriting we do below allows Fossil to be part of a larger + site already being served with IIS. + +3. You can have a mixed-mode site, with Fossil acting as a powerful + dynamic content management service and IIS as a fast static content + server. The pure-Fossil alternative requires that you check all of + your static content into Fossil as versioned or unversioned + artifacts. + +This article shows how you can get any combination of those benefits by +using IIS as a reverse proxy for `fossil server`. + +There are other ways to use IIS to serve Fossil, such as [via +CGI](./cgi.md). + + +## Background Fossil Service Setup + +You will need to have the Fossil HTTP server running in the background, +serving some local repository, bound to localhost on a fixed +high-numbered TCP port. For the purposes of testing, simply start it by +hand in your command shell of choice: + + fossil serve --port 9000 --localhost repo.fossil + +That command assumes you’ve got `fossil.exe` in your `%PATH%` and you’re +in a directory holding `repo.fossil`. See [the platform-independent +instructions](../any/none.md) for further details. + +For a more robust setup, we recommend that you [install Fossil as a +Windows service](./service.md), which will allow Fossil to start at +system boot, before anyone has logged in interactively. + + +## Install IIS + +IIS might not be installed in your system yet, so follow the path +appropriate to your host OS. We’ve tested only the latest Microsoft +OSes as of the time of this writing, but the basic process should be +similar on older OSes. + + +### Windows Server 2019 + +1. Start “Server Manager” +2. Tell it you want to “Add roles and features” +3. Select “Role-based or feature-based installation” +4. Select your local server +5. In the Server Roles section, enable “Web Server (IIS)” + +### Windows + +1. Open Control Panel +2. Go to “Programs” +3. Select “Turn Windows features on or off” in the left-side pane +4. In the “Windows Features” dialog, enable “Internet Information + Services” + +The default set of IIS features there will suffice for this tutorial, +but you might want to enable additional features. + + +## Setting up the Proxy + +The stock IIS setup doesn’t have reverse proxying features, but they’re +easily added through extensions. You will need to install the +[Application Request Routing][arr] and [URL Rewrite][ure] extensions. In +my testing here, URL Rewrite showed up immediately after installing it, +but I had to reboot the server to get ARR to show up. (Yay Windows.) + +You can install these things through the direct links above, or you can +do it via the Web Platform Installer feature of IIS Manager (a.k.a. +`INETMGR`). + +Set these extensions up in IIS Manager like so: + +1. Double-click the “Application Request Routing Cache” icon. + +2. Right-click in the window that results, and select “Server Proxy + Settings...” + +3. Check the “Enable Proxy” box in the dialog. Click the “Apply” text + in the right-side pane. + +4. Return to the top server-level configuration area of IIS Manager and + double-click the “URL Rewrite” icon. Alternately, you might find + “URL Rewrite” in the right-side pane from within the ARR settings. + +5. Right click in the window that results, and click “Add Rule(s)...” + Tell it you want a “Blank rule” under “Inbound rules”. + +6. In the dialog that results, create a new rule called “Fossil repo + proxy.” Set the “Pattern” to “`^(.*)$`” and “Rewrite URL” set to + “`http://localhost:9000/{R:1}`”. That tells it to take everything in + the path part of the URL and send it down to localhost:9000, where + `fossil server` is listening. + +7. Click “Apply” in the right-side pane, then get back to the top level + configuration for the server, and click “Restart” in that same pane. + +At this point, if you go to `http://localhost/` in your browser, you +should see your Fossil repository’s web interface instead of the default +IIS web site, as before you did all of the above. + +This is a very simple configuration. You can do more complicated and +interesting things with this, such as redirecting only `/code` URLs to +Fossil by setting the Pattern in step 6 to “`^/code(.*)$`”. (You would +also need to pass `--baseurl http://example.com/code` in the `fossil +server` command to make this work properly.) IIS would then directly +serve all other URLs. You could also intermix ASP.NET applications in +the URL scheme in this way. + +See the documentation on [URL Rewrite rules][urr] for more ideas. + +*[Return to the top-level Fossil server article.](../)* + + +[arr]: https://www.iis.net/downloads/microsoft/application-request-routing +[tls]: https://docs.microsoft.com/en-us/iis/manage/configuring-security/understanding-iis-url-authorization +[ure]: https://www.iis.net/downloads/microsoft/url-rewrite +[urr]: https://docs.microsoft.com/en-us/iis/extensions/url-rewrite-module/creating-rewrite-rules-for-the-url-rewrite-module diff --git a/www/server/windows/index.md b/www/server/windows/index.md new file mode 100644 index 0000000..a30b00a --- /dev/null +++ b/www/server/windows/index.md @@ -0,0 +1,8 @@ +# Using Windows as a Fossil Server + +- [Fossil server command](./none.md) +- [Fossil as CGI (IIS)](./iis.md) +- [Fossil as a Service](./service.md) +- [Using stunnel with Fossil on Windows](./stunnel.md) + +*[Return to the top-level Fossil server article.](../)* diff --git a/www/server/windows/none.md b/www/server/windows/none.md new file mode 100644 index 0000000..eab222d --- /dev/null +++ b/www/server/windows/none.md @@ -0,0 +1,69 @@ +# Serving as a Standalone Server on Windows + +On Windows, this method works more or less identically to how it’s +documented in [the generic instructions](../any/none.md). + +...but only while `fossil.exe` is actually running, which is the source +of much trouble on Windows. This problem has two halves: + + +## No App Startup Without Desktop + +The easy methods for starting a program in Windows at system start all +require an interactive desktop. There is no *easy* way to start an arbitrary +program on Windows at boot before anyone has logged in. In Unix +terms, Windows has no simple equivalent to [the `/etc/rc.local` file][rcl]. + +You can partially get around the first problem by setting your `fossil +server` call up as one of the user’s interactive startup items. Windows +10 has its own [idiosyncratic way of doing this][si10], and in older +systems you have [several alternatives to this][si7]. Regardless of the +actual mechanism, these will cause the Fossil standalone HTTP server to +start on an *interactive desktop login* only. While you’re sitting at +the Windows login screen, the Fossil server is *down*. + +[rcl]: http://nixdoc.net/man-pages/FreeBSD/man8/rc.local.8.html +[si10]: https://www.tenforums.com/tutorials/2944-add-delete-enable-disable-startup-items-windows-10-a.html +[si7]: https://www.wikihow.com/Change-Startup-Programs-in-Windows-7 + + + +## No Simple Background Mode + +Windows also lacks a direct equivalent of the Bourne shell’s “`&`” control operator to +run a program in the background, which you can give in Unix’s `rc.local` +file, which is just a normal Bourne shell script. + +By “background,” I mean +“not attached to any interactive user’s login session.” When the +`rc.local` script exits in Unix, any program it backgrounded *stays +running*. There is no simple and direct equivalent to this mechanism in +Windows. + +If you set `fossil server` to run on interactive login, as above, it +will shut right back down again when that user logs back out. + +With Windows 10, it’s especially problematic because you can no longer +make the OS put off updates arbitrarily: your Fossil server will go down +every time Windows Update decides it needs to reboot your computer, and +then Fossil service will *stay* down until someone logs back into that +machine interactively. + + +## Better Solutions + +Because of these problems, we only recommend setting `fossil server` up +on Windows this way when +you’re a solo developer or you work in a small office where everyone +arrives more or less at the same time each day, and everyone goes home +about the same time each day, so that one user can keep the Fossil +server up through the working day. + +If your needs go at all beyond this, you should expect proper “server” +behavior, which you can get on Windows by [registering Fossil as a +Windows service](./service.md), which solves the interactive startup and +shutdown problems above, at a bit of complexity over the Startup Items +method. You may also want to consider putting that service behind [an +IIS front-end proxy](./iis.md) to add additional web serving features. + +*[Return to the top-level Fossil server article.](../)* diff --git a/www/server/windows/service.md b/www/server/windows/service.md new file mode 100644 index 0000000..e2cb3f2 --- /dev/null +++ b/www/server/windows/service.md @@ -0,0 +1,120 @@ +# Fossil as a Windows Service + +If you need Fossil to start automatically on Windows, it is suggested to install +Fossil as a Windows Service. + +## Assumptions + +1. You have Administrative access to a Windows 2012r2 or above server. +2. You have PowerShell 5.1 or above installed. + +## Place Fossil on Server + +However you obtained your copy of Fossil, it is recommended that you follow +Windows conventions and place it within `\Program Files\FossilSCM`, the +proper location for the official 64-bit binary. +This way Fossil is at an expected location and you will have minimal issues with +Windows interfering in your ability to run Fossil as a service. You will need +Administrative rights to place fossil at the recommended location. If you will +only be running Fossil as a service, you do not need to add this location to the +path, though you may do so if you wish. + +## Installing Fossil as a Service + +Luckily the hard work to use Fossil as a Windows Service has been done by the +Fossil team. We simply have to install it with the proper command line options. +Fossil on Windows has a command `fossil winsrv` to allow installing Fossil as a +service on Windows. This command is only documented on the windows executable +of Fossil. You must also run the command as administrator for it to be +successful. + +### Fossil winsrv Example + +The simplest form of the command is: + +``` +fossil winsrv create --repository D:/Path/to/Repo.fossil +``` + +This will create a windows service named 'Fossil-DSCM' running under the local +system account and accessible on port 8080 by default. `fossil winsrv` can also +start, stop, and delete the service. For all available options, please execute +`fossil help winsrv` on a windows install of Fossil. + +If you wish to serve a directory of repositories, the `fossil winsrv` command +requires a slightly different set of options vs. `fossil server`: + +``` +fossil winsrv create --repository D:/Path/to/Repos --repolist +``` + +### Choice of Directory Considerations + +When the Fossil server will be used at times that files may be locked +during virus scanning, it is prudent to arrange that its directory used +for temporary files is exempted from such scanning. Ordinarily, this +will be a subdirectory named "fossil" in the temporary directory given +by the Windows GetTempPath(...) API, [namely](https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-gettemppathw#remarks) +the value of the first existing environment variable from `%TMP%`, `%TEMP%`, +`%USERPROFILE%`, and `%SystemRoot%`; you can look for their actual values in +your system by accessing the `/test-env` webpage. +Excluding this subdirectory will avoid certain rare failures where the +fossil.exe process is unable to use the directory normally during a scan. + +### Advanced service installation using PowerShell + +As great as `fossil winsrv` is, it does not have one to one reflection of all of +the `fossil server` [options](/help/server). When you need to use some of +the more advanced options, such as `--https`, `--skin`, or `--extroot`, you will +need to use PowerShell to configure and install the Windows service. + +PowerShell provides the [New-Service](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/new-service?view=powershell-5.1) +command, which we can use to install and configure Fossil as a service. The +below should all be entered as a single line in an Administrative PowerShell +console. + +```PowerShell +New-Service -Name fossil -DisplayName fossil -BinaryPathName '"C:\Program Files\FossilSCM\fossil.exe" server --port 8080 --repolist "D:/Path/to/Repos"' -StartupType Automatic +``` + +Please note the use of forward slashes in the repolist path passed to Fossil. +Windows will accept either back slashes or forward slashes in path names, but +Fossil has a preference for forward slashes. The use of `--repolist` will make +this a multiple repository server. If you want to serve only a single +repository, then leave off the `--repolist` parameter and provide the full path +to the proper repository file. Other options are listed in the +[fossil server](/help/server) documentation. + +The service will be installed by default to use the Local Service account. +Since Fossil only needs access to local files, this is fine and causes no +issues. The service will not be running once installed. You will need to start +it to proceed (the `-StartupType Automatic` parameter to `New-Service` will +result in the service auto-starting on boot). This can be done by entering + +```PowerShell +Start-Service -Name fossil +``` + +in the PowerShell console. + +Congratulations, you now have a base http accessible Fossil server running on +Windows. + +### Removing the Windows Service + +If you want to remove the Fossil service, execute the following from an +Administrative PowerShell or Command Prompt console: + +``` +sc.exe delete fossil +``` + +If you have Powershell version 6.0 or later, you can use: + +```PowerShell +Remove-Service -Name fossil +``` + +with the same effect. + +*[Return to the top-level Fossil server article.](../)* diff --git a/www/server/windows/stunnel.md b/www/server/windows/stunnel.md new file mode 100644 index 0000000..5a7e8d1 --- /dev/null +++ b/www/server/windows/stunnel.md @@ -0,0 +1,156 @@ +# Using stunnel with Fossil on Windows + +While there are many ways to configure Fossil as a server using various web +servers (Apache, IIS, nginx, etc.), this document will focus on setting up a +minimal Fossil server using only Fossil's native [server +capabilities](../any/none.md) and [stunnel](https://www.stunnel.org/) +to provide a TLS proxy. It is recommended for public repositories to go to the +extra step of configuring stunnel to provide a proper HTTPS setup. + +## Assumptions + +1. You have Administrative access to a Windows 2012r2 or above server. +2. You have PowerShell 5.1 or above installed. +3. You have acquired a certificate either from a Public CA or an Internal CA. + +## Configure Fossil Service for https + +Due to the need for the `--https` option for successfully using Fossil with +stunnel, we will use [Advanced service installation using PowerShell](./service.md#PowerShell). +We will need to change the command to install the Fossil Service to configure +it properly for use with stunnel as an https proxy. Run the following: + +```PowerShell +New-Service -Name fossil-secure -DisplayName fossil-secure -BinaryPathName '"C:\Program Files\FossilSCM\fossil.exe" server --localhost --port 9000 --https --repolist "D:/Path/to/Repos"' -StartupType Automatic +``` + +The use of `--localhost` means Fossil will only listen for traffic on the local +host on the designated port - 9000 in this case - and will not respond to +network traffic. Using `--https` will tell Fossil to generate HTTPS URLs rather +than HTTP ones. + +`New-Service` does not automatically start a service on install, so you will +need to enter the following to avoid rebooting the server: + +```PowerShell +Start-Service -Name fossil-secure +``` + +To remove the service, run the following in a Powershell or cmd console: + +``` +sc.exe delete fossil +``` + +or (in a Powershell console) + +```PowerShell +Remove-Service -Name fossil +``` + +if your version of Powershell is 6.0 or above. + +## Install stunnel 5.55 + +Download stunnel from the [downloads](https://www.stunnel.org/downloads.html) +page. Select the latest stunnel windows package (at the time of writing this is +`stunnel-5.55-win64-installer.exe`). Execute the installer and make sure you +install openSSL tools when you install stunnel. You will need this to convert +your certificate from PFX to PEM format. + +Even though the installer says it is for win64, it installs stunnel by default +to `\Program Files (x86)\stunnel`. + +## Get your certificate ready for Stunnel + +Whether you use a Public Certificate Authority or Internal Certificate +Authority, the next step is exporting the certificate from Windows into a format +useable by Stunnel. + +### Export Certificate from Windows + +If your certificate is installed via Windows Certificate Management, you will +need to export the certificate into a usable format. You can do this either +using the Windows Certificate Management Console, or PowerShell. + +#### Certificate Management Console + +Start `mmc.exe` as an Administrator. Select 'File>Add/Remove Snapin', select +'Certificates' from the list, and click 'Add'. Select 'Computer Account', +'Next', 'Local Computer', and then 'Finish'. In the Console Root, expand +'Certificates', then 'Personal', and select 'Certificates'. In the middle pane +find and select your certificate. Right click the certificate and select +'All Tasks>Export'. You want to export as PFX the Private Key, include all +certificates in the certification path, and use a password only to secure the +file. Enter a path and file name to a working directory and complete the +export. + +Continue with [Convert Certificate from PFX to PEM](#convert). + +#### PowerShell + +If you know the Friendly +Name of the Certificate this is relatively easy. Since you need to export +the private key as well, you must run the following from an Administrative +PowerShell console. + +```PowerShell +$passwd = ConvertTo-SecureString -string "yourpassword" -Force -AsPlainText + +Get-ChildItem Cert:\LocalMachine\My | Where{$_.FriendlyName -eq "FriendlyName"} | +Export-PfxCertificate -FilePath fossil-scm.pfx -Password $passwd +``` + +You will now have your certificate stored as a PFX file. + + +### Convert Certificate from PFX to PEM + +For this step you will need the openssl tools that were installed with stunnel. + +```PowerShell +# Add stunnel\bin directory to path for this session. +$env:PATH += ";${env:ProgramFiles(x86)}\stunnel\bin" +# Export Private Key +openssl.exe pkcs12 -in fossil-scm.pfx -out fossil-scm.key -nocerts -nodes +# Export the Certificate +openssl.exe pkcs12 -in fossil-scm.pfx -out fossil-scm.pem -nokeys +``` + +Now move `fossil-scm.key` and `fossil-scm.pem` to your stunnel config directory +(by default this should be located at `\Program Files (x86)\stunne\config`). + +## stunnel Configuration + +Use the reverse proxy configuration given in the generic [Serving via +stunnel document](../any/stunnel.md#proxy). On Windows, the +`stunnel.conf` file is located at `\Program Files (x86)\stunnel\config`. + +You will need to modify it to point at the PEM and key files generated +above. + +After completing the above configuration restart the stunnel service in Windows +with the following: + +```PowerShell +Restart-Service -Name stunnel +``` + +## Open up port 443 in the Windows Firewall + +The following instructions are for the [Windows Advanced +Firewall](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security). +If you are using a different Firewall, please consult your Firewall +documentation for how to open port 443 for inbound traffic. + +The following command should be entered all on one line. + +```PowerShell +New-NetFirewallRule -DisplayName "Allow Fossil Inbound" -Description "Allow Fossil inbound on port 443 using Stunnel as TLS Proxy." + -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow -Program "C:\Program Files (x86)\Stunnel\bin\stunnel.exe" +``` + +You should now be able to access your new Fossil Server via HTTPS. + + +*[Return to the top-level Fossil server article.](../)* -- cgit v1.3.1