markgo/.env.example at main · 1mb-dev/markgo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
# MarkGo Engine Configuration
# Copy this file to .env and customize for your blog
#
# For detailed configuration documentation, see: docs/configuration.md

# =============================================================================
# CORE CONFIGURATION
# =============================================================================

# Environment: development, production, test
ENVIRONMENT=development

# Server port (1-65535)
PORT=3000

# Base URL for your blog (used for RSS feeds, sitemaps, social metadata)
# Production: https://yourdomain.com
# Development: http://localhost:3000
BASE_URL=http://localhost:3000

# =============================================================================
# PATHS & DIRECTORIES
# =============================================================================

# Path to articles directory (relative or absolute)
ARTICLES_PATH=./articles

# Path to static assets directory
STATIC_PATH=./web/static

# Body font preloaded at high priority in <head> (first-paint optimization).
# Default points at the embedded Inter face. If you overlay css/fonts.css under
# STATIC_PATH to swap the body font, repoint this at your face (matching the
# @font-face src) so the preload follows the swap — otherwise the page preloads
# a font it never renders. Set empty to disable the preload entirely. The server
# warns at startup if this URL doesn't resolve in your static assets.
FONT_PRELOAD_URL=/static/fonts/inter/inter-latin.woff2

# Path to templates directory
TEMPLATES_PATH=./web/templates

# =============================================================================
# BLOG INFORMATION
# =============================================================================

# Basic blog metadata
BLOG_TITLE=Your Blog Title
BLOG_TAGLINE=Your short tagline
BLOG_DESCRIPTION=Your blog description goes here
BLOG_AUTHOR=Your Name
BLOG_AUTHOR_EMAIL=

# Blog language (ISO 639-1 code, e.g., 'en', 'en-US')
BLOG_LANGUAGE=en

# Blog theme (default, dark, custom)
BLOG_THEME=default

# Blog style — controls CSS theme. Ships with "minimal". Custom themes:
# drop <name>.css into your STATIC_PATH overlay at css/themes/, then set
# BLOG_STYLE=<name>. Any non-empty value accepted; missing theme files
# produce a harmless browser 404 on the stylesheet link.
BLOG_STYLE=minimal

# Number of posts to display per page (1-100)
BLOG_POSTS_PER_PAGE=10

# =============================================================================
# ABOUT PAGE
# =============================================================================

# All fields are optional — the about page adapts to what's configured.
# At minimum, BLOG_AUTHOR (above) is displayed.

# Avatar image path (relative to static dir, e.g. "img/avatar.jpg")
ABOUT_AVATAR=

# One-liner tagline displayed under your name
ABOUT_TAGLINE=

# Short bio in markdown (alternative to articles/about.md)
ABOUT_BIO=

# Location (e.g. "San Francisco, CA")
ABOUT_LOCATION=

# Social links (username or full URL)
ABOUT_GITHUB=
ABOUT_TWITTER=
ABOUT_LINKEDIN=
ABOUT_MASTODON=
ABOUT_WEBSITE=

# =============================================================================
# CACHE CONFIGURATION
# =============================================================================

# Cache time-to-live (Go duration: 1h, 30m, 24h)
CACHE_TTL=1h

# Maximum number of cached items (recommended: 1000-10000)
CACHE_MAX_SIZE=1000

# Cache cleanup interval (Go duration: 10m, 1h)
CACHE_CLEANUP_INTERVAL=10m

# =============================================================================
# EMAIL CONFIGURATION (Contact Form)
# =============================================================================

# SMTP server settings (leave empty to disable email)
EMAIL_HOST=
EMAIL_PORT=587
EMAIL_USERNAME=
EMAIL_PASSWORD=
EMAIL_FROM=noreply@yourdomain.com
EMAIL_TO=your.email@example.com

# Use SSL/TLS encryption (recommended: true)
EMAIL_USE_SSL=true

# =============================================================================
# RATE LIMITING & SECURITY
# =============================================================================

# General rate limiting (requests per window)
RATE_LIMIT_GENERAL_REQUESTS=100
RATE_LIMIT_GENERAL_WINDOW=900s

# Contact form rate limiting (more restrictive)
RATE_LIMIT_CONTACT_REQUESTS=5
RATE_LIMIT_CONTACT_WINDOW=3600s

# Login rate limiting (brute-force protection; default 5 attempts per 15 min)
# Configurable so an operator who fat-fingers their own password isn't hard-locked.
RATE_LIMIT_LOGIN_REQUESTS=5
RATE_LIMIT_LOGIN_WINDOW=900s

# Trusted reverse-proxy CIDRs / IPs (comma-separated). When UNSET, loopback
# (127.0.0.0/8, ::1) is auto-trusted, so a SAME-HOST reverse proxy (e.g.
# Caddy → 127.0.0.1) keys rate limiting on the real client with no config.
# OPERATOR ACTION REQUIRED only for an OFF-HOST proxy (different machine,
# RFC1918 or public IP): set it to the proxy CIDR(s), else the limiter collapses
# to that proxy's single IP and the per-client limits go global.
#
# List EVERY proxy between the internet and markgo, in order. Bare IPs are
# accepted (widened to /32 or /128). A malformed entry fails startup.
#   TRUSTED_PROXIES=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
# Cloudflare→Caddy: trust the FULL chain (Cloudflare ranges + your Caddy host),
# else the limiter collapses to the CDN edge IP.
# TRUSTED_PROXIES=

# CORS Configuration
CORS_ALLOWED_ORIGINS=http://localhost:3000
CORS_ALLOWED_METHODS=GET,POST,PUT,DELETE,OPTIONS
CORS_ALLOWED_HEADERS=Origin,Content-Type,Accept,Authorization

# For production, use specific origins:
# CORS_ALLOWED_ORIGINS=https://yourdomain.com,https://www.yourdomain.com

# =============================================================================
# ADMIN INTERFACE
# =============================================================================

# Admin panel credentials (leave empty to disable admin interface)
ADMIN_USERNAME=
ADMIN_PASSWORD=

# Production note: Use strong credentials and consider disabling if not needed
# Sessions use cookie-based auth with 7-day expiry (cleared on server restart)

# =============================================================================
# SERVER TIMEOUTS
# =============================================================================

# HTTP server timeout settings (in duration format: 15s, 1m, etc.)
SERVER_READ_TIMEOUT=15s
SERVER_WRITE_TIMEOUT=15s
SERVER_IDLE_TIMEOUT=60s

# Graceful shutdown deadline. Lower values trigger faster rolling restarts but
# may abort longer in-flight requests; higher values give in-flight work more
# time at the cost of slower restart cycles. Cleanup of internal subsystems
# (sessions, rate-limiters, templates) runs regardless of whether this deadline
# is hit.
SHUTDOWN_TIMEOUT=30s

# =============================================================================
# AMA COPY
# =============================================================================

# Operator-controllable copy on the AMA (Ask Me Anything) submission overlay.
# All values are plaintext only — they're HTML-escaped on render, so multi-line
# values collapse to a single visual block under HTML whitespace rules. For
# multi-paragraph copy, override the template via TEMPLATES_PATH instead.

AMA_PAGE_HEADING=Ask me anything
AMA_PAGE_INTRO=Curious about something? Submit a question and I'll answer it publicly.
AMA_FORM_PLACEHOLDER=What would you like to know?
AMA_SUBMIT_LABEL=Submit Question
AMA_THANKYOU_COPY=Question submitted! It will appear once answered.

# =============================================================================
# SECURITY HEADERS
# =============================================================================

# Set CSP_DISABLE=true when an edge proxy (Caddy, nginx, Cloudflare) emits its
# own Content-Security-Policy and you want to avoid double-headers. The other
# security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy,
# Strict-Transport-Security, Permissions-Policy) always ship.
CSP_DISABLE=false

# =============================================================================
# UPLOADS
# =============================================================================

# Set ORPHAN_SWEEP_DISABLED=true to skip the post-boot orphan-upload sweep.
# Default false: once per startup, MarkGo walks <UPLOAD_PATH>/<slug>/ and
# removes files no article references (by banner frontmatter field or body
# content — markdown image, raw HTML img/src, or plain link). Set to true
# if you manage files in the uploads tree independently of article
# references — otherwise unreferenced files will be cleaned on next boot.
ORPHAN_SWEEP_DISABLED=false

# =============================================================================
# LOGGING CONFIGURATION
# =============================================================================

# Log level: debug, info, warn, error
LOG_LEVEL=info

# Log format: json, text
LOG_FORMAT=json

# Log output: stdout, stderr, file
LOG_OUTPUT=stdout

# Log file path (required if LOG_OUTPUT=file)
LOG_FILE=

# Log rotation settings (when using file output)
LOG_MAX_SIZE=100
LOG_MAX_BACKUPS=3
LOG_MAX_AGE=28
LOG_COMPRESS=true

# Add source file/line to logs (useful for debugging)
LOG_ADD_SOURCE=false

# Custom time format for text logs (Go time format)
LOG_TIME_FORMAT=2006-01-02T15:04:05Z07:00

# =============================================================================
# SEO CONFIGURATION
# =============================================================================

# Master SEO toggle
SEO_ENABLED=true

# Individual SEO feature toggles
SEO_SITEMAP_ENABLED=true
SEO_SCHEMA_ENABLED=true
SEO_OPEN_GRAPH_ENABLED=true
SEO_TWITTER_CARD_ENABLED=true

# Robots.txt configuration (comma-separated paths)
SEO_ROBOTS_ALLOWED=/
SEO_ROBOTS_DISALLOWED=/admin,/api
SEO_ROBOTS_CRAWL_DELAY=1

# Social media and verification
SEO_DEFAULT_IMAGE=
SEO_TWITTER_SITE=
SEO_TWITTER_CREATOR=
SEO_FACEBOOK_APP_ID=
SEO_GOOGLE_SITE_VERIFY=
SEO_BING_SITE_VERIFY=

# =============================================================================
# UPLOAD CONFIGURATION
# =============================================================================

# Path to upload directory (relative or absolute)
UPLOAD_PATH=./uploads

# Maximum upload file size in bytes (default: 10MB)
UPLOAD_MAX_SIZE=10485760

# =============================================================================
# PRODUCTION OPTIMIZATION TIPS
# =============================================================================

# For production deployment, consider:
# - Set ENVIRONMENT=production
# - Use HTTPS in BASE_URL
# - Increase CACHE_TTL to 24h
# - Set LOG_LEVEL=warn or error
# - Set LOG_OUTPUT=file with rotation
# - Configure specific CORS_ALLOWED_ORIGINS
# - Use strong ADMIN credentials or disable admin
# - Enable EMAIL configuration for contact form