add basic webserver that can do most of what i need

- serve static files, serving index.html or optionally listings for directories
- redirects
- reverse-proxy, forwarding requests to a backend

these are configurable through the config file. a domain and path regexp have to
be configured. path prefixes can be stripped.  configured domains are added to
the autotls allowlist, so acme automatically fetches certificates for them.

all webserver requests now have (access) logging, metrics, rate limiting.
on http errors, the error message prints an encrypted cid for relating with log files.

this also adds a new mechanism for example config files.

http/mtasts.go

@@ -13,7 +13,9 @@ import (
 )
 
 func mtastsPolicyHandle(w http.ResponseWriter, r *http.Request) {
-	log := xlog.WithCid(mox.Cid())
+	log := func() *mlog.Log {
+		return xlog.WithContext(r.Context())
+	}
 
 	host := strings.ToLower(r.Host)
 	if !strings.HasPrefix(host, "mta-sts.") {
@@ -28,7 +30,7 @@ func mtastsPolicyHandle(w http.ResponseWriter, r *http.Request) {
 	}
 	domain, err := dns.ParseDomain(host)
 	if err != nil {
-		log.Errorx("mtasts policy request: bad domain", err, mlog.Field("host", host))
+		log().Errorx("mtasts policy request: bad domain", err, mlog.Field("host", host))
 		http.NotFound(w, r)
 		return
 	}
@@ -49,7 +51,7 @@ func mtastsPolicyHandle(w http.ResponseWriter, r *http.Request) {
 		}
 		d, err := dns.ParseDomain(s)
 		if err != nil {
-			log.Errorx("bad domain in mtasts config", err, mlog.Field("domain", s))
+			log().Errorx("bad domain in mtasts config", err, mlog.Field("domain", s))
 			http.Error(w, "500 - internal server error - invalid domain in configuration", http.StatusInternalServerError)
 			return
 		}

http/web.go

@@ -4,27 +4,119 @@
 package http
 
 import (
+	"context"
 	"crypto/tls"
 	"fmt"
 	golog "log"
 	"net"
 	"net/http"
 	"os"
+	"path"
+	"sort"
 	"strings"
 	"time"
 
 	_ "net/http/pprof"
 
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 
 	"github.com/mjl-/mox/config"
 	"github.com/mjl-/mox/dns"
 	"github.com/mjl-/mox/mlog"
 	"github.com/mjl-/mox/mox-"
+	"github.com/mjl-/mox/ratelimit"
 )
 
 var xlog = mlog.New("http")
 
+var metricHTTPServer = promauto.NewHistogramVec(
+	prometheus.HistogramOpts{
+		Name:    "mox_httpserver_request_duration_seconds",
+		Help:    "HTTP(s) server request with handler name, protocol, method, result codes, and duration in seconds.",
+		Buckets: []float64{0.001, 0.005, 0.01, 0.05, 0.100, 0.5, 1, 5, 10, 20, 30, 60, 120},
+	},
+	[]string{
+		"handler", // Name from webhandler, can be empty.
+		"proto",   // "http" or "https"
+		"method",  // "(unknown)" and otherwise only common verbs
+		"code",
+	},
+)
+
+// http.ResponseWriter that writes access log and tracks metrics at end of response.
+type loggingWriter struct {
+	W     http.ResponseWriter // Calls are forwarded.
+	Start time.Time
+	R     *http.Request
+
+	Handler string // Set by router.
+
+	// Set by handlers.
+	Code     int
+	Size     int64
+	WriteErr error
+}
+
+func (w *loggingWriter) Header() http.Header {
+	return w.W.Header()
+}
+
+func (w *loggingWriter) Write(buf []byte) (int, error) {
+	n, err := w.W.Write(buf)
+	if n > 0 {
+		w.Size += int64(n)
+	}
+	if err != nil && w.WriteErr == nil {
+		w.WriteErr = err
+	}
+	return n, err
+}
+
+func (w *loggingWriter) WriteHeader(statusCode int) {
+	if w.Code == 0 {
+		w.Code = statusCode
+	}
+	w.W.WriteHeader(statusCode)
+}
+
+var tlsVersions = map[uint16]string{
+	tls.VersionTLS10: "tls1.0",
+	tls.VersionTLS11: "tls1.1",
+	tls.VersionTLS12: "tls1.2",
+	tls.VersionTLS13: "tls1.3",
+}
+
+func metricHTTPMethod(method string) string {
+	// https://www.iana.org/assignments/http-methods/http-methods.xhtml
+	method = strings.ToLower(method)
+	switch method {
+	case "acl", "baseline-control", "bind", "checkin", "checkout", "connect", "copy", "delete", "get", "head", "label", "link", "lock", "merge", "mkactivity", "mkcalendar", "mkcol", "mkredirectref", "mkworkspace", "move", "options", "orderpatch", "patch", "post", "pri", "propfind", "proppatch", "put", "rebind", "report", "search", "trace", "unbind", "uncheckout", "unlink", "unlock", "update", "updateredirectref", "version-control":
+		return method
+	}
+	return "(other)"
+}
+
+func (w *loggingWriter) Done() {
+	method := metricHTTPMethod(w.R.Method)
+	proto := "http"
+	if w.R.TLS != nil {
+		proto = "https"
+	}
+	metricHTTPServer.WithLabelValues(w.Handler, proto, method, fmt.Sprintf("%d", w.Code)).Observe(float64(time.Since(w.Start)) / float64(time.Second))
+
+	tlsinfo := "plain"
+	if w.R.TLS != nil {
+		if v, ok := tlsVersions[w.R.TLS.Version]; ok {
+			tlsinfo = v
+		} else {
+			tlsinfo = "(other)"
+		}
+	}
+	xlog.WithContext(w.R.Context()).Debugx("http request", w.WriteErr, mlog.Field("httpaccess", ""), mlog.Field("handler", w.Handler), mlog.Field("url", w.R.URL), mlog.Field("host", w.R.Host), mlog.Field("duration", time.Since(w.Start)), mlog.Field("size", w.Size), mlog.Field("statuscode", w.Code), mlog.Field("proto", strings.ToLower(w.R.Proto)), mlog.Field("remoteaddr", w.R.RemoteAddr), mlog.Field("tlsinfo", tlsinfo))
+}
+
 // Set some http headers that should prevent potential abuse. Better safe than sorry.
 func safeHeaders(fn http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
@@ -37,68 +129,166 @@ func safeHeaders(fn http.HandlerFunc) http.HandlerFunc {
 	}
 }
 
+// Built-in handlers, e.g. mta-sts and autoconfig.
+type pathHandler struct {
+	Name string // For logging/metrics.
+	Path string // Path to register, like on http.ServeMux.
+	Fn   http.HandlerFunc
+}
+type serve struct {
+	Kinds        []string // Type of handler and protocol (http/https).
+	TLSConfig    *tls.Config
+	PathHandlers []pathHandler // Sorted, longest first.
+	Webserver    bool          // Whether serving WebHandler. PathHandlers are always evaluated before WebHandlers.
+}
+
+// HandleFunc registers a named handler for a path. If path ends with a slash, it
+// is used as prefix match, otherwise a full path match is required.
+func (s *serve) HandleFunc(name, path string, fn http.HandlerFunc) {
+	s.PathHandlers = append(s.PathHandlers, pathHandler{name, path, fn})
+}
+
+var (
+	limiterConnectionrate = &ratelimit.Limiter{
+		WindowLimits: []ratelimit.WindowLimit{
+			{
+				Window: time.Minute,
+				Limits: [...]int64{1000, 3000, 9000},
+			},
+			{
+				Window: time.Hour,
+				Limits: [...]int64{5000, 15000, 45000},
+			},
+		},
+	}
+)
+
+// ServeHTTP is the starting point for serving HTTP requests. It dispatches to the
+// right pathHandler or WebHandler, and it generates access logs and tracks
+// metrics.
+func (s *serve) ServeHTTP(xw http.ResponseWriter, r *http.Request) {
+	now := time.Now()
+	// Rate limiting as early as possible.
+	ipstr, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		xlog.Debugx("split host:port client remoteaddr", err, mlog.Field("remoteaddr", r.RemoteAddr))
+	} else if ip := net.ParseIP(ipstr); ip == nil {
+		xlog.Debug("parsing ip for client remoteaddr", mlog.Field("remoteaddr", r.RemoteAddr))
+	} else if !limiterConnectionrate.Add(ip, now, 1) {
+		method := metricHTTPMethod(r.Method)
+		proto := "http"
+		if r.TLS != nil {
+			proto = "https"
+		}
+		metricHTTPServer.WithLabelValues("(ratelimited)", proto, method, "429").Observe(0)
+		// No logging, that's just noise.
+
+		http.Error(xw, "http 429 - too many auth attempts", http.StatusTooManyRequests)
+		return
+	}
+
+	ctx := context.WithValue(r.Context(), mlog.CidKey, mox.Cid())
+	r = r.WithContext(ctx)
+
+	nw := &loggingWriter{
+		W:     xw,
+		Start: now,
+		R:     r,
+	}
+	defer nw.Done()
+
+	// Cleanup path, removing ".." and ".". Keep any trailing slash.
+	trailingPath := strings.HasSuffix(r.URL.Path, "/")
+	if r.URL.Path == "" {
+		r.URL.Path = "/"
+	}
+	r.URL.Path = path.Clean(r.URL.Path)
+	if r.URL.Path == "." {
+		r.URL.Path = "/"
+	}
+	if trailingPath && !strings.HasSuffix(r.URL.Path, "/") {
+		r.URL.Path += "/"
+	}
+
+	for _, h := range s.PathHandlers {
+		if r.URL.Path == h.Path || strings.HasSuffix(h.Path, "/") && strings.HasPrefix(r.URL.Path, h.Path) {
+			nw.Handler = h.Name
+			h.Fn(nw, r)
+			return
+		}
+	}
+	if s.Webserver {
+		if WebHandle(nw, r) {
+			return
+		}
+	}
+	nw.Handler = "(nomatch)"
+	http.NotFound(nw, r)
+}
+
 // Listen binds to sockets for HTTP listeners, including those required for ACME to
 // generate TLS certificates. It stores the listeners so Serve can start serving them.
 func Listen() {
-	type serve struct {
-		kinds     []string
-		tlsConfig *tls.Config
-		mux       *http.ServeMux
-	}
-
 	for name, l := range mox.Conf.Static.Listeners {
-		portServe := map[int]serve{}
+		portServe := map[int]*serve{}
 
-		var ensureServe func(https bool, port int, kind string) serve
-		ensureServe = func(https bool, port int, kind string) serve {
-			s, ok := portServe[port]
-			if !ok {
-				s = serve{nil, nil, &http.ServeMux{}}
+		var ensureServe func(https bool, port int, kind string) *serve
+		ensureServe = func(https bool, port int, kind string) *serve {
+			s := portServe[port]
+			if s == nil {
+				s = &serve{nil, nil, nil, false}
+				portServe[port] = s
 			}
-			s.kinds = append(s.kinds, kind)
+			s.Kinds = append(s.Kinds, kind)
 			if https && l.TLS.ACME != "" {
-				s.tlsConfig = l.TLS.ACMEConfig
+				s.TLSConfig = l.TLS.ACMEConfig
 			} else if https {
-				s.tlsConfig = l.TLS.Config
+				s.TLSConfig = l.TLS.Config
 				if l.TLS.ACME != "" {
-					ensureServe(true, config.Port(mox.Conf.Static.ACME[l.TLS.ACME].Port, 443), "acme-tls-alpn-01")
+					tlsport := config.Port(mox.Conf.Static.ACME[l.TLS.ACME].Port, 443)
+					ensureServe(true, tlsport, "acme-tls-alpn-01")
 				}
 			}
-			portServe[port] = s
 			return s
 		}
 
 		if l.TLS != nil && l.TLS.ACME != "" && (l.SMTP.Enabled && !l.SMTP.NoSTARTTLS || l.Submissions.Enabled || l.IMAPS.Enabled) {
-			ensureServe(true, config.Port(mox.Conf.Static.ACME[l.TLS.ACME].Port, 443), "acme-tls-alpn01")
+			port := config.Port(mox.Conf.Static.ACME[l.TLS.ACME].Port, 443)
+			ensureServe(true, port, "acme-tls-alpn01")
 		}
 
 		if l.AccountHTTP.Enabled {
-			srv := ensureServe(false, config.Port(l.AccountHTTP.Port, 80), "account-http")
-			srv.mux.HandleFunc("/", safeHeaders(accountHandle))
+			port := config.Port(l.AccountHTTP.Port, 80)
+			srv := ensureServe(false, port, "account-http")
+			srv.HandleFunc("account", "/", safeHeaders(accountHandle))
 		}
 		if l.AccountHTTPS.Enabled {
-			srv := ensureServe(true, config.Port(l.AccountHTTPS.Port, 443), "account-https")
-			srv.mux.HandleFunc("/", safeHeaders(accountHandle))
+			port := config.Port(l.AccountHTTPS.Port, 443)
+			srv := ensureServe(true, port, "account-https")
+			srv.HandleFunc("account", "/", safeHeaders(accountHandle))
 		}
 
 		if l.AdminHTTP.Enabled {
-			srv := ensureServe(false, config.Port(l.AdminHTTP.Port, 80), "admin-http")
+			port := config.Port(l.AdminHTTP.Port, 80)
+			srv := ensureServe(false, port, "admin-http")
 			if !l.AccountHTTP.Enabled {
-				srv.mux.HandleFunc("/", safeHeaders(adminIndex))
+				srv.HandleFunc("admin", "/", safeHeaders(adminIndex))
 			}
-			srv.mux.HandleFunc("/admin/", safeHeaders(adminHandle))
+			srv.HandleFunc("admin", "/admin/", safeHeaders(adminHandle))
 		}
 		if l.AdminHTTPS.Enabled {
-			srv := ensureServe(true, config.Port(l.AdminHTTPS.Port, 443), "admin-https")
+			port := config.Port(l.AdminHTTPS.Port, 443)
+			srv := ensureServe(true, port, "admin-https")
 			if !l.AccountHTTPS.Enabled {
-				srv.mux.HandleFunc("/", safeHeaders(adminIndex))
+				srv.HandleFunc("admin", "/", safeHeaders(adminIndex))
 			}
-			srv.mux.HandleFunc("/admin/", safeHeaders(adminHandle))
+			srv.HandleFunc("admin", "/admin/", safeHeaders(adminHandle))
 		}
 		if l.MetricsHTTP.Enabled {
-			srv := ensureServe(false, config.Port(l.MetricsHTTP.Port, 8010), "metrics-http")
-			srv.mux.Handle("/metrics", safeHeaders(promhttp.Handler().ServeHTTP))
-			srv.mux.HandleFunc("/", safeHeaders(func(w http.ResponseWriter, r *http.Request) {
+			port := config.Port(l.MetricsHTTP.Port, 8010)
+			srv := ensureServe(false, port, "metrics-http")
+			srv.HandleFunc("metrics", "/metrics", safeHeaders(promhttp.Handler().ServeHTTP))
+			srv.HandleFunc("metrics", "/", safeHeaders(func(w http.ResponseWriter, r *http.Request) {
 				if r.URL.Path != "/" {
 					http.NotFound(w, r)
 					return
@@ -111,13 +301,15 @@ func Listen() {
 			}))
 		}
 		if l.AutoconfigHTTPS.Enabled {
-			srv := ensureServe(!l.AutoconfigHTTPS.NonTLS, config.Port(l.AutoconfigHTTPS.Port, 443), "autoconfig-https")
-			srv.mux.HandleFunc("/mail/config-v1.1.xml", safeHeaders(autoconfHandle(l)))
-			srv.mux.HandleFunc("/autodiscover/autodiscover.xml", safeHeaders(autodiscoverHandle(l)))
+			port := config.Port(l.AutoconfigHTTPS.Port, 443)
+			srv := ensureServe(!l.AutoconfigHTTPS.NonTLS, port, "autoconfig-https")
+			srv.HandleFunc("autoconfig", "/mail/config-v1.1.xml", safeHeaders(autoconfHandle(l)))
+			srv.HandleFunc("autodiscover", "/autodiscover/autodiscover.xml", safeHeaders(autodiscoverHandle(l)))
 		}
 		if l.MTASTSHTTPS.Enabled {
-			srv := ensureServe(!l.AutoconfigHTTPS.NonTLS, config.Port(l.MTASTSHTTPS.Port, 443), "mtasts-https")
-			srv.mux.HandleFunc("/.well-known/mta-sts.txt", safeHeaders(mtastsPolicyHandle))
+			port := config.Port(l.MTASTSHTTPS.Port, 443)
+			srv := ensureServe(!l.AutoconfigHTTPS.NonTLS, port, "mtasts-https")
+			srv.HandleFunc("mtasts", "/.well-known/mta-sts.txt", safeHeaders(mtastsPolicyHandle))
 		}
 		if l.PprofHTTP.Enabled {
 			// Importing net/http/pprof registers handlers on the default serve mux.
@@ -125,7 +317,19 @@ func Listen() {
 			if _, ok := portServe[port]; ok {
 				xlog.Fatal("cannot serve pprof on same endpoint as other http services")
 			}
-			portServe[port] = serve{[]string{"pprof-http"}, nil, http.DefaultServeMux}
+			srv := &serve{[]string{"pprof-http"}, nil, nil, false}
+			portServe[port] = srv
+			srv.HandleFunc("pprof", "/", http.DefaultServeMux.ServeHTTP)
+		}
+		if l.WebserverHTTP.Enabled {
+			port := config.Port(l.WebserverHTTP.Port, 80)
+			srv := ensureServe(false, port, "webserver-http")
+			srv.Webserver = true
+		}
+		if l.WebserverHTTPS.Enabled {
+			port := config.Port(l.WebserverHTTPS.Port, 443)
+			srv := ensureServe(true, port, "webserver-https")
+			srv.Webserver = true
 		}
 
 		// We'll explicitly ensure these TLS certs exist (e.g. are created with ACME)
@@ -137,10 +341,8 @@ func Listen() {
 		if l.TLS != nil && l.TLS.ACME != "" {
 			m := mox.Conf.Static.ACME[l.TLS.ACME].Manager
 
-			m.AllowHostname(mox.Conf.Static.HostnameDomain)
 			ensureHosts[mox.Conf.Static.HostnameDomain] = struct{}{}
 			if l.HostnameDomain.ASCII != "" {
-				m.AllowHostname(l.HostnameDomain)
 				ensureHosts[l.HostnameDomain] = struct{}{}
 			}
 
@@ -180,7 +382,17 @@ func Listen() {
 
 		for port, srv := range portServe {
 			for _, ip := range l.IPs {
-				listen1(ip, port, srv.tlsConfig, name, srv.kinds, srv.mux)
+				sort.Slice(srv.PathHandlers, func(i, j int) bool {
+					a := srv.PathHandlers[i].Path
+					b := srv.PathHandlers[j].Path
+					if len(a) == len(b) {
+						// For consistent order.
+						return a < b
+					}
+					// Longest paths first.
+					return len(a) > len(b)
+				})
+				listen1(ip, port, srv.TLSConfig, name, srv.Kinds, srv)
 			}
 		}
 	}
@@ -203,7 +415,7 @@ func adminIndex(w http.ResponseWriter, r *http.Request) {
 var servers []func()
 
 // listen prepares a listener, and adds it to "servers", to be launched (if not running as root) through Serve.
-func listen1(ip string, port int, tlsConfig *tls.Config, name string, kinds []string, mux *http.ServeMux) {
+func listen1(ip string, port int, tlsConfig *tls.Config, name string, kinds []string, handler http.Handler) {
 	addr := net.JoinHostPort(ip, fmt.Sprintf("%d", port))
 
 	var protocol string
@@ -231,7 +443,7 @@ func listen1(ip string, port int, tlsConfig *tls.Config, name string, kinds []st
 	}
 
 	server := &http.Server{
-		Handler:   mux,
+		Handler:   handler,
 		TLSConfig: tlsConfig,
 		ErrorLog:  golog.New(mlog.ErrWriter(xlog.Fields(mlog.Field("pkg", "net/http")), mlog.LevelInfo, protocol+" error"), "", 0),
 	}

http/webserver.go

@@ -0,0 +1,385 @@
+package http
+
+import (
+	"fmt"
+	htmltemplate "html/template"
+	"io"
+	golog "log"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/mjl-/mox/config"
+	"github.com/mjl-/mox/dns"
+	"github.com/mjl-/mox/mlog"
+	"github.com/mjl-/mox/mox-"
+	"github.com/mjl-/mox/moxio"
+)
+
+// todo: automatic gzip on responses, if client supports it, and if content looks compressible.
+
+// WebHandle serves an HTTP request by going through the list of WebHandlers,
+// check if there is a domain+path match, and running the handler if so.
+// WebHandle runs after the built-in handlers for mta-sts, autoconfig, etc.
+// If no handler matched, false is returned.
+// WebHandle sets w.Name to that of the matching handler.
+func WebHandle(w *loggingWriter, r *http.Request) (handled bool) {
+	log := func() *mlog.Log {
+		return xlog.WithContext(r.Context())
+	}
+
+	host, _, err := net.SplitHostPort(r.Host)
+	if err != nil {
+		// Common, there often is not port.
+		host = r.Host
+	}
+	dom, err := dns.ParseDomain(host)
+	if err != nil {
+		log().Debugx("parsing http request domain", err, mlog.Field("host", host))
+		http.NotFound(w, r)
+		return true
+	}
+
+	for _, h := range mox.Conf.WebHandlers() {
+		if h.DNSDomain != dom {
+			continue
+		}
+		loc := h.Path.FindStringIndex(r.URL.Path)
+		if loc == nil {
+			continue
+		}
+		s := loc[0]
+		e := loc[1]
+		path := r.URL.Path[s:e]
+
+		if r.TLS == nil && !h.DontRedirectPlainHTTP {
+			u := *r.URL
+			u.Scheme = "https"
+			u.Host = host
+			w.Handler = h.Name
+			http.Redirect(w, r, u.String(), http.StatusPermanentRedirect)
+			return true
+		}
+
+		if h.WebStatic != nil && HandleStatic(h.WebStatic, w, r) {
+			w.Handler = h.Name
+			return true
+		}
+		if h.WebRedirect != nil && HandleRedirect(h.WebRedirect, w, r) {
+			w.Handler = h.Name
+			return true
+		}
+		if h.WebForward != nil && HandleForward(h.WebForward, w, r, path) {
+			w.Handler = h.Name
+			return true
+		}
+	}
+	return false
+}
+
+var lsTemplate = htmltemplate.Must(htmltemplate.New("ls").Parse(`<!doctype html>
+<html>
+	<head>
+		<meta charset="utf-8" />
+		<meta name="viewport" content="width=device-width, initial-scale=1" />
+		<title>ls</title>
+		<style>
+body, html { padding: 1em; font-size: 16px; }
+* { font-size: inherit; font-family: ubuntu, lato, sans-serif; margin: 0; padding: 0; box-sizing: border-box; }
+h1 { margin-bottom: 1ex; font-size: 1.2rem; }
+table td, table th { padding: .2em .5em; }
+table > tbody > tr:nth-child(odd) { background-color: #f8f8f8; }
+[title] { text-decoration: underline; text-decoration-style: dotted; }
+		</style>
+	</head>
+	<body>
+		<h1>ls</h1>
+		<table>
+			<thead>
+				<tr>
+					<th>Size in MB</th>
+					<th>Modified (UTC)</th>
+					<th>Name</th>
+				</tr>
+			</thead>
+			<tbody>
+			{{ if not .Files }}
+				<tr><td colspan="3">No files.</td></tr>
+			{{ end }}
+			{{ range .Files }}
+				<tr>
+					<td title="{{ .Size }} bytes" style="text-align: right">{{ .SizeReadable }}{{ if .SizePad }}<span style="visibility:hidden">.  </span>{{ end }}</td>
+					<td>{{ .Modified }}</td>
+					<td><a style="display: block" href="{{ .Name }}">{{ .Name }}</a></td>
+				</tr>
+			{{ end }}
+			</tbody>
+		</table>
+	</body>
+</html>
+`))
+
+// HandleStatic serves static files. If a directory is requested and the URL
+// path doesn't end with a slash, a response with a redirect to the URL path with trailing
+// slash is written. If a directory is requested and an index.html exists, that
+// file is returned. Otherwise, for directories with ListFiles configured, a
+// directory listing is returned.
+func HandleStatic(h *config.WebStatic, w http.ResponseWriter, r *http.Request) (handled bool) {
+	log := func() *mlog.Log {
+		return xlog.WithContext(r.Context())
+	}
+	recvid := func() string {
+		cid := mox.CidFromCtx(r.Context())
+		if cid <= 0 {
+			return ""
+		}
+		return " (requestid " + mox.ReceivedID(cid) + ")"
+	}
+
+	if r.Method != "GET" && r.Method != "HEAD" {
+		if h.ContinueNotFound {
+			// Give another handler that is presumbly configured, for the same path, a chance.
+			// E.g. an app that may generate this file for future requests to pick up.
+			return false
+		}
+		http.Error(w, "405 - method not allowed", http.StatusMethodNotAllowed)
+		return true
+	}
+
+	var fspath string
+	if h.StripPrefix != "" {
+		if !strings.HasPrefix(r.URL.Path, h.StripPrefix) {
+			if h.ContinueNotFound {
+				// We haven't handled this request, try a next WebHandler in the list.
+				return false
+			}
+			http.NotFound(w, r)
+			return true
+		}
+		fspath = filepath.Join(h.Root, strings.TrimPrefix(r.URL.Path, h.StripPrefix))
+	} else {
+		fspath = filepath.Join(h.Root, r.URL.Path)
+	}
+
+	f, err := os.Open(fspath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			if h.ContinueNotFound {
+				// We haven't handled this request, try a next WebHandler in the list.
+				return false
+			}
+			http.NotFound(w, r)
+			return true
+		} else if os.IsPermission(err) {
+			http.Error(w, "403 - permission denied", http.StatusForbidden)
+			return true
+		}
+		log().Errorx("open file for static file serving", err, mlog.Field("url", r.URL), mlog.Field("fspath", fspath))
+		http.Error(w, "500 - internal server error"+recvid(), http.StatusInternalServerError)
+		return true
+	}
+	defer f.Close()
+
+	fi, err := f.Stat()
+	if err != nil {
+		log().Errorx("stat file for static file serving", err, mlog.Field("url", r.URL), mlog.Field("fspath", fspath))
+		http.Error(w, "500 - internal server error"+recvid(), http.StatusInternalServerError)
+		return true
+	}
+	if fi.IsDir() && !strings.HasSuffix(r.URL.Path, "/") {
+		http.Redirect(w, r, r.URL.Path+"/", http.StatusTemporaryRedirect)
+		return true
+	}
+
+	serveFile := func(name string, mtime time.Time, content *os.File) {
+		// ServeContent only sets a content-type if not already present in the response headers.
+		hdr := w.Header()
+		for k, v := range h.ResponseHeaders {
+			hdr.Add(k, v)
+		}
+		http.ServeContent(w, r, name, mtime, content)
+	}
+
+	if fi.IsDir() {
+		index, err := os.Open(filepath.Join(fspath, "index.html"))
+		if err != nil && os.IsPermission(err) || err != nil && os.IsNotExist(err) && !h.ListFiles {
+			http.Error(w, "403 - permission denied", http.StatusForbidden)
+			return true
+		} else if err == nil {
+			defer index.Close()
+			var ifi os.FileInfo
+			ifi, err = index.Stat()
+			if err == nil {
+				w.Header().Set("Content-Type", "text/html; charset=utf-8")
+				serveFile(filepath.Base(fspath), ifi.ModTime(), index)
+				return true
+			}
+		}
+		if !os.IsNotExist(err) {
+			log().Errorx("stat for static file serving", err, mlog.Field("url", r.URL), mlog.Field("fspath", fspath))
+			http.Error(w, "500 - internal server error"+recvid(), http.StatusInternalServerError)
+			return true
+		}
+
+		type File struct {
+			Name         string
+			Size         int64
+			SizeReadable string
+			SizePad      bool // Whether the size needs padding because it has no decimal point.
+			Modified     string
+		}
+		files := []File{}
+		if r.URL.Path != "/" {
+			files = append(files, File{"..", 0, "", false, ""})
+		}
+		for {
+			l, err := f.Readdir(1000)
+			for _, e := range l {
+				mb := float64(e.Size()) / (1024 * 1024)
+				var size string
+				var sizepad bool
+				if mb >= 10 {
+					size = fmt.Sprintf("%d", int64(mb))
+					sizepad = true
+				} else {
+					size = fmt.Sprintf("%.2f", mb)
+				}
+				const dateTime = "2006-01-02 15:04:05" // time.DateTime, but only since go1.20.
+				modified := e.ModTime().UTC().Format(dateTime)
+				f := File{e.Name(), e.Size(), size, sizepad, modified}
+				if e.IsDir() {
+					f.Name += "/"
+				}
+				files = append(files, f)
+			}
+			if err == io.EOF {
+				break
+			} else if err != nil {
+				log().Errorx("reading directory for file listing", err, mlog.Field("url", r.URL), mlog.Field("fspath", fspath))
+				http.Error(w, "500 - internal server error"+recvid(), http.StatusInternalServerError)
+				return true
+			}
+		}
+		sort.Slice(files, func(i, j int) bool {
+			return files[i].Name < files[j].Name
+		})
+		hdr := w.Header()
+		hdr.Set("Content-Type", "text/html; charset=utf-8")
+		for k, v := range h.ResponseHeaders {
+			if !strings.EqualFold(k, "content-type") {
+				hdr.Add(k, v)
+			}
+		}
+		err = lsTemplate.Execute(w, map[string]any{"Files": files})
+		if err != nil && !moxio.IsClosed(err) {
+			log().Errorx("executing directory listing template", err)
+		}
+		return true
+	}
+
+	serveFile(fspath, fi.ModTime(), f)
+	return true
+}
+
+// HandleRedirect writes a response with an HTTP redirect.
+func HandleRedirect(h *config.WebRedirect, w http.ResponseWriter, r *http.Request) (handled bool) {
+	var dstpath string
+	if h.OrigPath == nil {
+		// No path rewrite necessary.
+		dstpath = r.URL.Path
+	} else if !h.OrigPath.MatchString(r.URL.Path) {
+		http.NotFound(w, r)
+		return true
+	} else {
+		dstpath = h.OrigPath.ReplaceAllString(r.URL.Path, h.ReplacePath)
+	}
+
+	u := *r.URL
+	u.Opaque = ""
+	u.RawPath = ""
+	u.OmitHost = false
+	if h.URL != nil {
+		u.Scheme = h.URL.Scheme
+		u.Host = h.URL.Host
+		u.ForceQuery = h.URL.ForceQuery
+		u.RawQuery = h.URL.RawQuery
+		u.Fragment = h.URL.Fragment
+	}
+	if r.URL.RawQuery != "" {
+		if u.RawQuery != "" {
+			u.RawQuery += "&"
+		}
+		u.RawQuery += r.URL.RawQuery
+	}
+	u.Path = dstpath
+	code := http.StatusPermanentRedirect
+	if h.StatusCode != 0 {
+		code = h.StatusCode
+	}
+	http.Redirect(w, r, u.String(), code)
+	return true
+}
+
+// HandleForward handles a request by forwarding it to another webserver and
+// passing the response on. I.e. a reverse proxy.
+func HandleForward(h *config.WebForward, w http.ResponseWriter, r *http.Request, path string) (handled bool) {
+	log := func() *mlog.Log {
+		return xlog.WithContext(r.Context())
+	}
+	recvid := func() string {
+		cid := mox.CidFromCtx(r.Context())
+		if cid <= 0 {
+			return ""
+		}
+		return " (requestid " + mox.ReceivedID(cid) + ")"
+	}
+
+	xr := *r
+	r = &xr
+	if h.StripPath {
+		u := *r.URL
+		u.Path = r.URL.Path[len(path):]
+		u.RawPath = ""
+		r.URL = &u
+	}
+
+	// Remove any forwarded headers passed in by client.
+	hdr := http.Header{}
+	for k, vl := range r.Header {
+		switch k {
+		case "Forwarded", "X-Forwarded-For", "X-Forwarded-Host", "X-Forwarded-Proto":
+			continue
+		}
+		hdr[k] = vl
+	}
+	r.Header = hdr
+
+	// Add our own X-Forwarded headers. ReverseProxy will add X-Forwarded-For.
+	r.Header["X-Forwarded-Host"] = []string{r.Host}
+	proto := "http"
+	if r.TLS != nil {
+		proto = "https"
+	}
+	r.Header["X-Forwarded-Proto"] = []string{proto}
+	// todo: add Forwarded header? is anyone using it?
+
+	// ReverseProxy will append any remaining path to the configured target URL.
+	proxy := httputil.NewSingleHostReverseProxy(h.TargetURL)
+	proxy.FlushInterval = time.Duration(-1) // Flush after each write.
+	proxy.ErrorLog = golog.New(mlog.ErrWriter(mlog.New("net/http/httputil").WithContext(r.Context()), mlog.LevelDebug, "reverseproxy error"), "", 0)
+	proxy.ErrorHandler = func(w http.ResponseWriter, r *http.Request, err error) {
+		log().Errorx("forwarding request to backend webserver", err, mlog.Field("url", r.URL))
+		http.Error(w, "502 - bad gateway"+recvid(), http.StatusBadGateway)
+	}
+	whdr := w.Header()
+	for k, v := range h.ResponseHeaders {
+		whdr.Add(k, v)
+	}
+	proxy.ServeHTTP(w, r)
+	return true
+}