Serve /.well-known via DocumentRoot, drop svn webroot

Add Alias for /.well-known/ on git :80 so Let's Encrypt HTTP-01
challenges bypass cgit's global ScriptAlias. svn now redirects all
HTTP/HTTPS traffic to git, so its certificate is renewed via the
redirect chain through git's webroot instead of its own.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hsbt

recipes/files/etc/apache2/sites-available/git.ruby-lang.org.conf

@@ -5,6 +5,13 @@
         # for let's encrypt
         DocumentRoot /var/www/git.ruby-lang.org
 
+        Alias /.well-known/ "/var/www/git.ruby-lang.org/.well-known/"
+        <Directory "/var/www/git.ruby-lang.org/.well-known/">
+                AllowOverride None
+                Options Indexes FollowSymlinks
+                Require all granted
+        </Directory>
+
         RedirectMatch permanent ^/(?!.well-known)(.*) https://git.ruby-lang.org/$1
 </VirtualHost>
 

recipes/files/etc/apache2/sites-available/svn.ruby-lang.org.conf

@@ -2,10 +2,7 @@
         ServerName svn.ruby-lang.org
         ServerAdmin webmaster@ruby-lang.org
 
-        # for let's encrypt
-        DocumentRoot /var/www/svn.ruby-lang.org
-
-        RedirectMatch permanent ^/(?!.well-known)(.*) https://git.ruby-lang.org/$1
+        RedirectMatch permanent ^/(.*) http://git.ruby-lang.org/$1
 </VirtualHost>
 
 <VirtualHost *:443>
@@ -16,5 +13,5 @@
         SSLCertificateFile    /etc/letsencrypt/live/svn.ruby-lang.org/fullchain.pem
         SSLCertificateKeyFile /etc/letsencrypt/live/svn.ruby-lang.org/privkey.pem
 
-        RedirectMatch permanent ^/(?!.well-known)(.*) https://git.ruby-lang.org/$1
+        RedirectMatch permanent ^/(.*) https://git.ruby-lang.org/$1
 </VirtualHost>