Configuration Sources

Configuration sources and runtime activation

Sources

1. src/BlokeBot/appsettings.json contains non-secret defaults and the configuration shape.
2. appsettings.{Environment}.json overlays the base file for the active ASP.NET environment.
3. Environment variables override file values; nested keys use __.
4. Standard ASP.NET command-line configuration remains available when launching the executable directly.

Docker and the NixOS module select Production. The source workflow uses the local ASP.NET environment unless explicitly overridden.

Twitch runtime activation

The dashboard can start without Twitch credentials. The bot runtime remains offline until all four identity values are nonblank:

TwitchBot:Identity:BotUsername
TwitchBot:Identity:ClientId
TwitchBot:Identity:ClientSecret
TwitchBot:Identity:RedirectUri

Once activated, BlokeBot validates identity, runtime timing, and retry policy settings during startup. Invalid active configuration prevents startup rather than silently changing the requested values.

Recommended deployment split

• Put ordinary values in environment variables or an external production settings file.
• Put ClientSecret and any future secrets in a secret manager or protected environment file.
• Keep the token cache and database on durable private storage.

HTTPS with blokebot serve

blokebot serve --host HOST --port PORT creates an HTTP listener. To serve HTTPS directly from BlokeBot, provide a Kestrel endpoint and certificate through --config; do not pass --host or --port.

{
  "Kestrel": {
    "Endpoints": {
      "Https": {
        "Url": "https://localhost:8080",
        "Certificate": {
          "Path": "/absolute/path/to/blokebot.pfx"
        }
      }
    }
  }
}

Provide the PFX password through a protected environment variable, then start the server:

export Kestrel__Endpoints__Https__Certificate__Password='private-pfx-password'
blokebot serve --config /absolute/path/to/https.json --data-dir /absolute/path/to/state

The certificate must be valid for the address that the browser uses. A .NET development certificate is normally for localhost, so use https://localhost:8080, not https://127.0.0.1:8080. Trust the local certificate in the operating system/browser before testing it. For an Internet-facing deployment, use a publicly trusted certificate or terminate TLS at a reverse proxy.