Source config from dotenv everywhere.

.gitignore

@@ -5,3 +5,4 @@ package-lock.json
 coverage
 public
 yt-dlp
+.env

package.json

@@ -24,9 +24,10 @@
     "@fastify/sensible": "^5.0.0",
     "@fastify/static": "^6.4.0",
     "@nearform/sql": "^1.5.0",
-    "@siteup/cli": "^2.0.0",
+    "@siteup/cli": "^2.1.4",
     "clean-deep": "^3.4.0",
     "desm": "^1.2.0",
+    "env-schema": "^5.0.0",
     "fastify": "^4.0.1",
     "fastify-cli": "4.3.0",
     "fastify-healthcheck": "^4.0.0",
@@ -95,7 +96,8 @@
     "version:git": "git add CHANGELOG.md",
     "watch": "npm run clean && run-p watch:*",
     "watch:server": "fastify start -w --ignore-watch='node_modules .git web' -l info -P -p 3000 --options --address 0.0.0.0 app.js",
-    "watch:siteup": "npm run build:siteup -- --watch"
+    "watch:siteup": "npm run build:siteup -- --watch",
+    "create-dev-env": "node scripts/generate-default-env.js"
   },
   "standard": {
     "ignore": []

plugins/env.js

@@ -1,8 +1,11 @@
 import fp from 'fastify-plugin'
 
-const schema = {
+export const schema = {
   type: 'object',
-  required: [],
+  required: [
+    'JWT_SECRET',
+    'COOKIE_SECRET'
+  ],
   properties: {
     ENV: {
       type: 'string',
@@ -13,36 +16,27 @@ const schema = {
       default: true
     },
     JWT_SECRET: {
-      type: 'string',
-      // THIS IS JUST A DEV SECRET
-      // TODO: move these to .env file for dev, throw when missing
-      default: 'c24deaadfd768e04e833227b494d10d49a7fec4a5c6330ead080f2ffc051d33c'
+      type: 'string'
     },
     COOKIE_SECRET: {
-      type: 'string',
-      // THIS IS JUST A DEV SECRET
-      // // TODO: move these to .env file for dev, throw when missing
-      default: '08b7ee661730c8a0c8638f260a6b5e7dda40155dc27a416ad87470ad813250f9'
+      type: 'string'
     },
     COOKIE_NAME: {
       type: 'string',
       default: 'breadcrum_token'
     },
-    APP_NAME: {
-      type: 'string',
-      default: 'breadcrum'
-    },
     DATABASE_URL: {
       type: 'string',
       default: 'postgres://postgres@localhost/breadcrum'
     },
     DOMAIN: {
       type: 'string',
+      // breadcrum.net in production
       default: 'localhost'
     },
     REGISTRATION: {
-      type: 'string',
-      default: 'enabled'
+      type: 'boolean',
+      default: true
     }
   }
 }

routes/api/register.js

@@ -40,7 +40,7 @@ export default async function registerRoutes (fastify, opts) {
       }
     },
     async function (request, reply) {
-      if (fastify.config.REGISTRATION !== 'enabled') {
+      if (!fastify.config.REGISTRATION) {
         reply.code(403)
         return {
           error: 'Registration is closed. Please try again later.'

scripts/generate-default-env.js

@@ -0,0 +1,31 @@
+import sodium from 'sodium-native'
+import { writeFile } from 'fs/promises'
+import desm from 'desm'
+import { resolve } from 'path'
+import { schema } from '../plugins/env.js'
+
+const __dirname = desm(import.meta.url)
+
+// This script sets up a default .env dotenv file for use in development
+// Do not run this in production or when deploying.
+
+const varsNeedingDevKeys = [
+  'COOKIE_SECRET',
+  'JWT_SECRET'
+]
+
+const dotenv = []
+
+for (const envVar of varsNeedingDevKeys) {
+  const buf = Buffer.allocUnsafe(sodium.crypto_secretbox_KEYBYTES)
+  sodium.randombytes_buf(buf)
+  const hexString = buf.toString('hex')
+  dotenv.push(`${envVar}=${hexString}`)
+}
+
+for (const [name, opts] of Object.entries(schema.properties)) {
+  if (opts.default) dotenv.push(`${name}=${opts.default}`)
+}
+
+dotenv.push('')
+await writeFile(resolve(__dirname, '../.env'), dotenv.join('\n'))

web/components/header/index.js

@@ -46,14 +46,14 @@ export const header = Component(() => {
                 : null
             }
             ${
-              window?.location?.pathname !== '/login/' && window?.location?.pathname !== '/register/' && !state.disableRegistration
+              window?.location?.pathname !== '/login/' && window?.location?.pathname !== '/register/' && state.registration
                 ? html`
                   <div>/</div>
                 `
                 : null
             }
             ${
-              window?.location?.pathname !== '/register/' && !state.disableRegistration
+              window?.location?.pathname !== '/register/' && state.registration
                 ? html`
                   <div>
                     <a href='/register'>register</a>

web/global.vars.js

@@ -1,13 +1,24 @@
+import envSchema from 'env-schema'
 import { readFile } from 'fs/promises'
 import desm from 'desm'
 import { join } from 'path'
+import { schema } from '../plugins/env.js'
+
+const config = envSchema({
+  schema,
+  dotenv: true
+})
 
 const __dirname = desm(import.meta.url)
 
 export default async () => {
   return {
     siteName: '🥖 Breadcrum',
-    disableRegistration: true,
+    registration: config.REGISTRATION,
     version: JSON.parse(await readFile(new URL(join(__dirname, '../package.json'), import.meta.url))).version
   }
 }
+
+export const browser = {
+  'process.env.REGISTRATION': config.REGISTRATION
+}

web/lib/state.js

@@ -5,10 +5,10 @@ export const state = lsp('breadcrum', {
     user: null,
     apiUrl: '/api',
     host: 'breadcrum.net',
-    disableRegistration: true,
+    registration: process.env.REGISTRATION,
     sensitive: false
   },
-  lspReset: 1
+  lspReset: 4
 })
 
 if (typeof window !== 'undefined') {

web/register/client.js

@@ -9,8 +9,8 @@ export const page = Component(() => {
   const [submitting, setSubmitting] = useState(false)
 
   useEffect(() => {
-    if (state.disableRegistration) window.location.replace('/')
-  }, [state.disableRegistration])
+    if (!state.registration) window.location.replace('/')
+  }, [state.registration])
 
   useEffect(() => {
     if ((user && !loading)) window.location.replace('/bookmarks')