orchard
mirrorEvery site I host, in one repo, along with the Cloudflare Tunnel and Caddy that front them. It's all Go, Vite, and SQLite, and it runs on a desktop at home with nothing listening on an inbound port.
blogbuncaddycloudflare-tunneldockergogolanghomelabhtml-templatemonorepoself-hostedseosqlitestatic-sitetypstuptime-monitoringviteweb-analytics
1# `make env` from the repo root turns this into a .env. Compose reads that .env
2# from the project directory on its own, so
3# nothing has to be exported in the shell or forwarded through the Makefile.
4#
5# .env is gitignored by bare name at any depth. This is a public repository:
6# verify with `git check-ignore -v sites/status.bythewood.me/.env`.
7
8# There is no password here any more. Signing in happens on auth.bythewood.me,
9# which pushes a code to a phone, and this site asks that one whether the cookie
10# in a request is a live session.
11
12# Write-only ntfy token for publishing outage alerts, minted by
13# `make ntfy-token`. It can publish to the alert topics and can read
14# nothing, so this is the least useful secret here to steal. Unset means alerts
15# are logged and never delivered; the site still starts, because an alerter that
16# cannot deliver must never stop the checks that noticed the outage.
17NTFY_TOKEN=