Server configuration examples

WBO reads server configuration from environment variables when the server starts. Restart the server after changing these values.

The complete source of truth is server/configuration.mjs. The examples below cover common deployment requests.

Redirect the root page to a board

Set WBO_DEFAULT_BOARD to a board name:

WBO_DEFAULT_BOARD=anonymous npm start

When this variable is set, requests to / redirect to /boards/<board>. The board name is normalized the same way user-entered board names are normalized, so uppercase letters become lowercase and unsupported characters become dashes.

Add trusted HTML to the page head

Set WBO_HTML_HEAD_SNIPPET_PATH to a file containing the exact HTML you want WBO to inject before </head>:

WBO_HTML_HEAD_SNIPPET_PATH=/etc/wbo/head-snippet.html npm start

The snippet is inserted into rendered HTML pages, including the landing page and board pages. The file is read once at startup. Relative paths are resolved from the server working directory.

Only use a file controlled by the server administrator. The snippet is inserted as raw HTML, so it can run scripts or change page behavior.

Google Analytics example

Create /etc/wbo/head-snippet.html with your own measurement ID:

<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag("js", new Date());
  gtag("config", "G-XXXXXXXXXX");
</script>

Then start WBO with:

WBO_HTML_HEAD_SNIPPET_PATH=/etc/wbo/head-snippet.html npm start

Self-hosted deployments should make sure this is acceptable for their privacy policy and local legal requirements.

Add a legal notice, custom meta tag, or stylesheet

The same head snippet can add links or metadata:

<link rel="me" href="https://example.com/legal-notice">
<link rel="stylesheet" href="/custom-wbo.css">

This is intended for deployment-owned additions. It is not a theme engine and it does not replace WBO templates.

Enable JWT board access

Set AUTH_SECRET_KEY to require JWTs for opening boards:

AUTH_SECRET_KEY="replace-with-a-long-random-secret" npm start

Clients pass a token with ?token=.... Token roles can grant:

• reader: can open the board but cannot edit.
• editor: can open and edit.
• moderator: can open, edit, and clear.

Roles can be scoped to a board name, for example reader:class-a or moderator:class-a.

See the repository README for the current JWT payload examples.