<web-site ...>
This file contains the configuration for a web-site.

cluster-island - Used when clustering the web tier between multiple Orion instances. If a cluster island id (number spawning from 1 and up) it will participate as a backend server in the specified island. If only one island is used the number is always one. An island is 2+ servers that share session failover state for replication.
display-name - The friendly name to show in GUI configuration tools when administrating this site.
host - The host/IP of this site. If [ALL] is specified then all the servers IP's are used.
log-request-info - Whether or not to log the request info (headers etc) of the incoming request if an error occurs. The default is false.
max-request-size - Sets the max request size for incoming requests. If a client submits a request larger than the specified maximum it will receive a 'request entity too large' response. The default is 15000.
port - The port of this site, the default is 80 for regular sites and 443 for secure (SSL) sites.
secure - Whether or not to use SSL. The default is false.
threading-model - Which threading model to use. The only applicable value is classic.
use-keep-alives - Whether or not to use keep-alives, the default is true. Only disable this if you know what you're doing, it will cause a major performance loss.
virtual-hosts - Optional setting useful for virtual sites sharing the same IP. The value is a comma-separated list of hostnames tied to this site.


<description>A short description.</description>
A short description of this web-site.

<frontend host="null" port="null" />
The frontend tag describes which IP, port etc that HTTP clients perceive this site to be. This is needed when acting behind a load balancer, firewall etc in order to provide the correct info to web-app code when rewriting URLs etc.

host - The host (for instance 'www.acme.com') of the frontend server.
port - The port (for instance '80') of the frontend server.


<default-web-app application="default" load-on-startup="true" max-inactivity-time="123" name="defaultWebApp" shared="true|false" />
Reference to the default web-application of this site. This application will be bound to the root of the site.

application - The name of the (enterprise-)application the web-app exists in.
load-on-startup - Optional attribute specifying whether or not to preload this web-app, if false then the app will be loaded when needed (at the first request). The default is true.
max-inactivity-time - Optional attribute specifying number of minutes of inactivity before this web-app can be shut down, if not specified no shutdown will occur.
name - The name of the web-application inside the (enterprise-)application.
shared - Whether or not multiple bindings (different sites/context roots) are to be shared. Sharing implies sharing of sessions, servlet instances, context values etc (all that makes up a web-app). This is most commonly used to share a web-app between a HTTP and HTTPS siteat the same context path. If a HTTPS app is marked as shared it's session tracking strategy reverts from SSL session tracking to cookie/URL-rewriting tracking which makes it less secure, but may work around specific issues with SSL session timeouts in various browsers not supporting it properly. The default is 'false'.


<web-app application="default" load-on-startup="false" max-inactivity-time="123" name="defaultWebApp" root="/catalog" shared="true|false" />
Reference to a web-application. This application will be bound at the location specified by the 'root' attribute.

application - The name of the (enterprise-)application the web-app exists in.
load-on-startup - Optional attribute specifying whether or not to preload this web-app, if false then the app will be loaded when needed (at the first request). The default is false.
max-inactivity-time - Optional attribute specifying number of minutes of inactivity before this web-app can be shut down, if not specified no shutdown will occur.
name - The name of the web-application inside the (enterprise-)application.
root - The path on this site to bind the application to, if for instance an app is installed at "/theapp" it is reached by the URL: "http://www.thesiteserver.com/theapp/".
shared - Whether or not multiple bindings (different sites/context roots) are to be shared. Sharing implies sharing of sessions, servlet instances, context values etc (all that makes up a web-app). This is most commonly used to share a web-app between a HTTP and HTTPS siteat the same context path. If a HTTPS app is marked as shared it's session tracking strategy reverts from SSL session tracking to cookie/URL-rewriting tracking which makes it less secure, but may work around specific issues with SSL session timeouts in various browsers not supporting it properly. The default is 'false'.


<user-web-apps max-inactivity-time="123" path="/home/*/public_html" />
When enabled user dirs/apps will be supported. Each user has his own private web-application (and connected web-application.xml file). The user apps are reached at /~username/ from the server root.

max-inactivity-time - Optional attribute specifying number of minutes of inactivity before a loaded user-web-app can be shut down, if not specified no shutdown will occur.
path - A path, including a wildcard to specify the local directory of each user application. The default UNIX mask for instance would be "/home/*". The * is replaced with the username when searching for the apps.


<access-log format="$ip - - [$time] '$request' $status $size" path="./access.log" split="none|hour|day|week|month" suffix="-n-y" />
Relative/absolute path to the access-log for this site, this is where incoming requests will be logged.

format - Optional formatting of the log entries. $ prefixes vars, the available vars are: $time, $request, $ip, $host, $path, $size, $method, $protocol, $user, $status, $referer, $time, $agent, $cookie:, $header: and $mime.
path - The path to the logfile.
split - When (if) to split the access logs, the default is NONE.
suffix - The text to append to the log if splitting is used to make up the unique name for a timezone. The format used is that of java.text.SimpleDateFormat.


<ssl-config factory="my.own.SSLServerSocketFactory" keystore="../mykeystore" keystore-password="123456" needs-client-auth="true|false" provider="com.sun.net.ssl.internal.ssl.Provider">
Specifies SSL-configuration settings. These settings are used if secure="true" is specified on the site. If a 3rd party SSLServerSocketFactory implementation is used then x property tags can be defined to send arbitary arguments to the factory.

factory - A com.evermind.server.http.SSLServerSocketFactory implementation if not using JSSE. This is usually not specified (defaults to using JSSE: com.evermind.server.JSSESSLServerSocketFactory).
keystore - The relative/absolute path to a keystore used by this site.
keystore-password - The password needed to open the keystore.
needs-client-auth - 'true'/'false' value specifying if the client needs to submit a valid auth, 'false' by default (enable this for SSL-based user auth).
provider - The provider used if using JSSE, defaults to com.sun.net.ssl.internal.ssl.Provider.


<property name="paramName" value="paramValue" />
A configuration parameter.

name - The name of the parameter.
value - The value of the parameter.