In terms of functionality, the small Lighttpd [1] web server need not shy away from comparison with more prominent competitors. Among other features, it supports virtual host strategies and can change its configuration to reflect incoming requests. If necessary, further functions can be added with the use of modules. For example, access to individual websites can be restricted, connections can be secured by TLS, and scripting languages can be integrated over the FastCGI interface, which also has a built-in load balancer that distributes incoming requests to multiple PHP servers.

By the way, the web server's name is pronounced "Lighty"; some websites even use this phonetic spelling as a synonym of the official name. Lighttpd supports HTTP 1.0/1.1 and encrypted connections over HTTPS. Versions 1.4.56 or later support the newer HTTP/2. Because of its small footprint, Lighttpd is often used on smaller or less powerful systems. For example, it is the engine for the popular Pi-hole [2] network filter and ad blocker. The easy-to-understand configuration file allows lightning-fast setup.

Quick Installation

Most distributions have Lighttpd in their repositories. On Ubuntu, you can install it with the command:

$ sudo apt install lighttpd lighttpd-doc

Some distributions keep only rarely needed modules in separate packages with names that often start with lighttpd- . In Ubuntu's case, lighttpd-webdav retrofits a WebDAV interface, for example. For your first steps with the web server, though, you will not normally need these modules.

To build Lighttpd from the source code, you need at least a C compiler, Make, the pcre-config tool, and the developer packages for Zlib and Bzip2. On Ubuntu, the command

$ sudo apt install build-essential libpcre3-dev zlib1g-dev libbz2-dev

retrieves everything you need. The numerous dependencies for all optional Lighttpd modules are listed in the Lighttpd wiki [3]. You can compile the Lighttpd source code from the project website with the familiar three-step process:

$ configure
$ make
$ sudo make install

In the doc/systemd/ source code directory, you will find matching configuration files for systemd.

Quick Setup

All of the settings for the web server are grouped in the lighttpd.conf file, which is located by default in the /etc/lighttpd/ directory (see also the "File Split" box). As a starting point for your own lighttpd.conf, I would recommend the simple configuration shown in Listing 1. On each line, you have the name of a setting on the left, followed by the associated value on the right, separated by an equals sign. Lighttpd ignores lines that start with the hash symbol (#).

var.dir = "/var/www"
# Define basic settings:
server.document-root = var.dir + "/html"
server.port = 80
server.username = "www-data"
server.groupname = "www-data"
server.errorlog = "/var/log/lighttpd/error.log"
mimetype.assign = (
  ".html" => "text/html",
  ".txt" => "text/plain",
  ".jpg" => "image/jpeg",
  ".png" => "image/png"
)
static-file.exclude-extensions = ( ".fcgi", ".php", "~", ".inc" )
index-file.names = ( "index.html" )

include "/etc/lighttpd/conf.d/*"
include "/etc/lighttpd/vhosts.d/*"

In more complex configurations, some domain names, directories, or URL components appear in several places. To save typing, you should define variables for such information to use as placeholders later. Listing 1 makes use of this possibility right at the beginning. The /var/www directory is assigned to the var.dir variable.

Another advantage of variables becomes apparent if the directory changes at some point: All you need to do is adjust the var.dir variable. The variable name must begin with var. but can be freely chosen otherwise. The only exceptions are var.PID with the process ID of the running Lighttpd and var.CWD with the current working directory.

The server.document-root setting is followed by the directory where all the web pages are stored (the document root). Note that the var.dir variable is used here with /html appended to its value. In general, the + operator allows any two strings to be concatenated. In the example, this specifies a folder named /var/www/html.

The web server later listens on the port that follows server.port. To access port 80, Lighttpd must be launched with root privileges. To avoid vulnerabilities, the server in Listing 1 automatically switches to the www-data account in a group of the same name (i.e., to the user account provided by Debian and Ubuntu for this purpose).

Food for Talk

The server.errorlog parameter specifies the text file in which Lighttpd logs its messages and will also contain all the warnings and notices. Adding server.errorlog-use-syslog = "enable" would tell the web server to write these messages to the syslog. Finally, the additional line server.use-ipv6 = "enable" would enable support for IPv6.

In its response, the web server sends along the MIME type of the transmitted data, such as text/html for an HTML document. To assign the appropriate MIME type to individual file extensions, you use mimetype.assign. The setting demonstrates the use of a list: The assignments are each placed between parentheses as a comma-separated list. In Listing 1, the individual values of the list are on a separate line, just for the sake of clarity, but the formatting is not significant.

PHP scripts should be executed by the web server and not delivered to the browser. The extensions of files to be ignored are listed in static-file.exclude-extensions. When a browser accesses a directory, Lighttpd looks for one of the files listed after index-file.names and returns it. If none of these index files exists, Lighttpd returns a 403 error message. Unlike many competitors, Lighttpd prohibits its clients from accessing directories directly – this kind of access has to be permitted explicitly with the dirlisting module.