prospero(1)             FreeBSD General Commands Manual            prospero(1)

     Prospero - Minimal Event-Driven HTTPS/1.1 Server

     prospero -r <server-root> -f <config-file> [-i <interface> -p <port> -q <queue-size> -m <max-conns> -o <ocsp-file> -u <user> -g <group>]

     Prospero is a minimal, secure, event-driven web server.  Prospero serves
     files and performs WebSocket and SCGI forwarding for a single hostname.

     o   IPv4 and IPv6 connections.

     o   TLS encrypted connections ONLY, with:

         o   TLS >= 1.2

         o   Session resumption.

         o   Perfect forward secrecy.

         o   OCSP stapling.

     o   HEAD, GET, and POST request methods.

     o   HTTP/1.1 persistent connections.

     o   A custom pipelining extension described in caliban.8

     o   Graceful stops.

     o   WebSocket forwarding for up to 3 local or remote WebSocket servers.

     o   SCGI forwarding for up to 3 local or remote SCGI application servers.

     o   Name-based virtual hosting.

     o   HTTP/2.

     o   CGI.

     o   Access authentication.

     o   Content negotiation beyond "If-Modified-Since", "If-Unmodified-
         Since", and single "Range" requests for "bytes" of static resources.

     o   Transaction logging.

     o   Etags

     o   Directory listings.

     o   The ~user notation in URLS.

     By default, FreeBSD limits each process to a low number of maximum
     simultaneously open descriptors.  This places a limit on the number of
     connections prospero may multiplex.  Set these values at the command-line
     with the "sysctl" utility, or enable them permanently by placing these
     lines in /etc/sysctl.conf on the host machine.  Your system will complain
     about these values if it lacks resources.


     Prospero rejects HTTP/1.1 requests with "Host" header lines that do not
     specify the host for which Prospero is configured to serve content.  This
     prevents third parties from pointing their domains to your server.

     Prospero rejects HTTP/1.1 requests for files without "Referer" or
     "Origin" header lines that do not match Prospero's hostname unless the
     requested resources' filenames end in:


     Prospero will only service requests for .png files without "Referer" or
     "Origin" headers for the following filenames:


     SCGI servers must perform their own cross-origin checks.  It can be
     useful for SCGI servers to service links from other origins or from

     Prospero services requests from insecure origins when the hostname of the
     request and the hostname of the origin are Prospero's hostname.  Such
     requests are security upgrades.

     Files served by prospero reside in the directory specified by the -r
     option.  Files must be owned and readable by the user specified by the -u
     option or be in and be readable by the group specified by the -g option.
     Note that Prospero will refuse to serve a file owned by another user and
     group even if the file is world-readable.

     Only the following filename suffix mappings are recognized:

     html     text/html; charset=utf-8
     txt      text/plain; charset=utf-8
     css      text/css
     js       application/x-javascript

     woff     font/woff
     woff2    font/woff2
     ttf      font/opentype
     otf      font/opentype
     appcache text/cache-manifest

     png      image/png
     jpg      image/jpeg
     gif      image/gif
     ico      image/
     svg      image/svg+xml

     webmanifest application/manifest+json

     bz       application/x-bzip
     bz2      application/x-bzip2
     gz       application/x-gzip
     tgz      application/x-compressed
     txz      application/x-compressed
     zip      application/zip
     pdf      application/pdf

     epub     application/epub+zip
     rtf      application/rtf
     mp3      audio/mpeg
     mpeg     video/mpeg
     odp      application/vnd.oasis.opendocument.presentation
     ods      application/vnd.oasis.opendocument.spreadsheet
     odt      application/vnd.oasis.opendocument.text

     doc  application/msword
     dot  application/msword
     docx application/vnd.openxmlformats-officedocument.wordprocessingml.document
     dotx application/vnd.openxmlformats-officedocument.wordprocessingml.template
     docm application/
     dotm application/

     xls  application/
     xlt  application/
     xla  application/
     xlsx application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
     xltx application/vnd.openxmlformats-officedocument.spreadsheetml.template
     xlsm application/
     xltm application/
     xlam application/
     xlsb application/

     ppt  application/
     pot  application/
     pps  application/
     ppa  application/
     pptx application/vnd.openxmlformats-officedocument.presentationml.presentation
     potx application/vnd.openxmlformats-officedocument.presentationml.template
     ppsx application/vnd.openxmlformats-officedocument.presentationml.slideshow
     ppam application/
     pptm application/
     potm application/
     ppsm application/

     To be able to restart on signals and bind to port 443, the prospero
     executable is installed setuid root and executable by user and group.  If
     you do not run prospero in group www, you need to manually chgrp(1) the
     executable into the appropriate group.

     When waiting for a request, prospero drops connections after 10 seconds
     of inactivity.

     Prospero writes its pid into /var/run/ if it can (ie., it is
     started as root).  You stop prospero with a SIGTERM and restart it with a

     A rc.d script is installed in /usr/local/etc/rc.d/.  Add the following
     lines to /etc/rc.conf to start prospero on system boot.  Replace the
     items in brackets with values appropriate for your system.  These are the
     minimal set of options you should start with.  The available options are
     described in full at the end of this manual page.

     prospero_flags="-r <server-root> -f <config-file> -u <user> -g <group>"

     Start, stop, or restart prospero, or determine if it is running with the
     following commands.

     /usr/local/etc/rc.d/prospero start
     /usr/local/etc/rc.d/prospero stop
     /usr/local/etc/rc.d/prospero restart
     /usr/local/etc/rc.d/prospero status

     If you do not want prospero started on system start, set


     and use the following commands.

     /usr/local/etc/rc.d/prospero forcestart
     /usr/local/etc/rc.d/prospero forcestop
     /usr/local/etc/rc.d/prospero forcerestart
     /usr/local/etc/rc.d/prospero forcestatus

     In the resource names of requests, prospero converts every sequence of
     bytes consisting of a percent sign followed by two hexadecimal digits
     into the byte specified by the hexadecimal value.  Whitespace,
     semicolons, and percent signs must all be percent-escaped to be
     recognized in resource names.

     Prospero recognizes compound requests as described the caliban.8 manual
     and delivers pipelined responses to those requests.

     To enable OCSP stapling, follow the instructions in prospero_ocsp in the
     source distribution.

     The remainder of the TLS configuration is described in a text file.  The
     -f command line option must be set to the filename of the configuration
     file.  The file must contain from 4 to 10 newline-terminated lines of
     text.  The first 4 lines describe, in order:

     1.   The hostname for which Prospero serves content.  This line may be
          blank to cause the server to take the hostname from the system
          hostname.  In requests, prospero recognizes the hostname with or
          without the "www" subdomain.  Do not include the "www" subdomain in
          the hostname.  In addition to the hostname, prospero recognizes the
          IP addresses of listening interfaces.

     2.   The absolute path to the file containing the server's TLS key.

     3.   The TLS key password.  This line can be blank if there is no

     4.   The absolute path to the file containing the TLS certificate chain.

     The next 6 lines are optional, and if present, define up to 3 SCGI
     application servers and 3 WebSocket servers to which Prospero will
     forward requests.  The 5th, 7th, and 9th lines define WebSocket servers.
     The 6th, 8th, and 10th lines define SCGI application servers.

     Any of these lines can be blank to indicate that no server is defined.
     For example, if you want to define 3 WebSocket servers but no SCGI
     application servers, define the WebSocket servers on lines 5, 7, and 9,
     and leave lines 6, 8, and 10 blank.  Blank lines at the end of the
     configuration file are unnecessary, so line 10 can be ommitted.

     Note that local servers can listen on the loopback address, but this
     degrades performance by unnecessarily interposing the TCP/IP stack
     between Prospero and the servers.

     The lines defining Websocket servers consist of the absolute path to a
     UNIX socket for a local WebSocket Server or a remote server specification
     of the form <hostname or IP addr>:<port>.

     Note that connections to a remote server are not encrypted.  Connect only
     to hosts on your LAN.

     To be recognized as a WebSocket upgrade, a request must begin with 1 of
     the following paths: /websocket/, /websocket2/, or /websocket3/.
     Requests beginning with /websocket/ are forwarded to the server defined
     on line 5.  Requests beginning with /websocket2/ are forwarded to the
     server defined on line 7.  Requests beginning with /websocket3/ are
     forwarded to the server defined on line 9.

     When a client initiates a WebSocket upgrade, prospero performs the
     WebSocket handshake and then connects to the WebSocket server.  Propero
     ignores Sec-WebSocket-Protocol headers.  Clients must NOT specify a
     protocol, or handshakes may not complete successfully with all browsers.

     Prospero then sends to the WebSocket server the content of the Cookie
     header line submitted with the upgrade request.  The cookie is terminated
     with a single newline.  The cookie line is empty if the client did not
     submit a Cookie header.

     From then on, prospero transfers data back and forth between the
     WebSocket server and the client.  The client and WebSocket server are
     responsible for framing and unframing data.

     The lines defining SCGI applications servers consist of the absolute path
     to a UNIX socket for a local SCGI application server or a remote server
     specification of the form <hostname or IP addr>:<port>.

     Note that connections to remote servers are not encrypted.  Connect only
     to hosts on your LAN.

     To be recognized as a SCGI request, a request must begin with 1 of the
     following paths: /scgi/, /scgi2/, or /scgi3/.  Requests beginning with
     /scgi/ are forwarded to the server defined on line 6.  Requests beginning
     with /scgi2/ are forwarded to the server defined on line 8.  Requests
     beginning with /scgi3/ are forwarded to the server defined on line 10.

     The following environment variables are set for the SCGI server:


     Prospero does not pass on every response header line generated by the
     SCGI application.  Prospero plucks out the content of the:

     Set-Cookie x 5

     header lines and formats its own response header.  Only the "Content-
     Type" header line is necessary.  If it is missing, Prospero inserts
     "Content-Type: text/plain; charset=utf-8" into the response header.

     Responses from the SCGI server that contain a "Location" header line are
     formatted into "303 see other" responses.  Those responses must not
     contain bodies.  All other SCGI server responses are formatted into "200
     OK" responses and must contain bodies.  This means that error messages
     must be delivered to the client as HTML.

     The following options are recognized.

     -f  The -f option is mandatory and specifies the TLS configuration file.

     -r  The -r option is mandatory and specifies the server root directory.
         The root resource must be named "index.html".  Requests for paths
         that end in the directory separator are interpreted as requests for
         "index.html" in the directories specified by those paths.

     -m  The -m option specifies the maximum number of simultaneous
         connections that prospero services.  If not set, prospero maintains
         no more than 50000 simultaneous connections.

     -o  The -o option specifies the absolute filename of the file containing
         the OCSP server's response.  See the prospero_ocsp script for
         instructions on how to set up OCSP stapling.

     -p  The -p option specifies the port to listen on.  This defaults to 443.

     -i  The -i option limits prospero to accepting connections only from a
         specified interface.  Supply the IP address of the desired interface
         as argument.  By default, prospero accepts connections on all
         interfaces capable of IPv4 or IPv6.

     -q  The -q option sets the number of incoming connections queued by the
         operating system for the server.  The queue defaults to 2048
         connections.  increasing this value may help the server cope with
         high demand if the server is dropping connections.


     -g  The -u and the -g options specify the user and group of prospero
         server processes.  If not specified, both values default to "nobody".

     -x  The -x option prevents prospero from becoming a daemon.  Prospero
         runs in the foreground of the terminal where it was started and is
         stopped with signals (ie., Control-C).  When the -x option is
         present, prospero does not write its pid to /var/run/

     James Bailie <>

                                Thu Aug 8, 2019