svn commit: r1935184 - in httpd/httpd/trunk: changes-entries docs/manual/mod modules/md

Author: jorton
Date: Wed Jun 10 17:01:40 2026
New Revision: 1935184

Log:
* modules/md/mod_md_config.c: Flip MDServerStatus to disabled by
  default.

* docs/manual/mod/mod_md.xml: Update accordingly.

Added:
   httpd/httpd/trunk/changes-entries/md-status.txt
Modified:
   httpd/httpd/trunk/docs/manual/mod/mod_md.xml
   httpd/httpd/trunk/modules/md/mod_md_config.c

Added: httpd/httpd/trunk/changes-entries/md-status.txt
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ httpd/httpd/trunk/changes-entries/md-status.txt	Wed Jun 10 17:01:40 2026	(r1935184)
@@ -0,0 +1,3 @@
+  *) mod_md: MDServerStatus is now disabled by default.  [Joe Orton]
+
+

Modified: httpd/httpd/trunk/docs/manual/mod/mod_md.xml
==============================================================================
--- httpd/httpd/trunk/docs/manual/mod/mod_md.xml	Wed Jun 10 16:52:35 2026	(r1935183)
+++ httpd/httpd/trunk/docs/manual/mod/mod_md.xml	Wed Jun 10 17:01:40 2026	(r1935184)
@@ -1114,17 +1114,20 @@ MDMessageCmd /etc/apache/md-message
         <name>MDServerStatus</name>
         <description>Control if Managed Domain information is added to <code>server-status</code>.</description>
         <syntax>MDServerStatus on|off</syntax>
-        <default>MDServerStatus on</default>
+        <default>MDServerStatus off</default>
         <contextlist>
             <context>server config</context>
         </contextlist>
         <usage>
             <p>
-                Apaches '<code>server-status</code>' handler allows you configure a resource to monitor
-                what is going on. This includes now a section listing all Managed Domains
-                with the DNS names, renewal status, lifetimes and main properties.
+                If enabled, adds a section to the
+                <module>mod_status</module> '<code>server-status</code>' handler
+                output which lists all Managed Domains with the DNS
+                names, renewal status, lifetimes and main properties.
             </p><p>
-                You can switch that off using this directive.
+                As with '<code>md-status</code>', the '<code>server-status</code>' output
+                <strong>must</strong> be protected from public view
+                using appropriate authorization restrictions.
             </p>
         </usage>
     </directivesynopsis>

Modified: httpd/httpd/trunk/modules/md/mod_md_config.c
==============================================================================
--- httpd/httpd/trunk/modules/md/mod_md_config.c	Wed Jun 10 16:52:35 2026	(r1935183)
+++ httpd/httpd/trunk/modules/md/mod_md_config.c	Wed Jun 10 17:01:40 2026	(r1935184)
@@ -77,7 +77,7 @@ static md_mod_conf_t defmc = {
     NULL,                      /* message cmd */
     NULL,                      /* env table */
     0,                         /* dry_run flag */
-    1,                         /* server_status_enabled */
+    0,                         /* server_status_enabled */
     1,                         /* certificate_status_enabled */
     &def_ocsp_keep_window,     /* default time to keep ocsp responses */
     &def_ocsp_renew_window,    /* default time to renew ocsp responses */