CONTENT_REPO | Git URL or local path to the content repo. Defaults to ../content (local sibling checkout) if unset. Required as a real URL for the Cloudflare Pages build, which can't see a local path — set it there too, not just here. |
CONTENT_REPO_TOKEN | Fine-grained GitHub PAT, Contents: Read-only, scoped to just the content repo. Needed when the content repo is private, so the build can clone it. Set as a Cloudflare Pages project environment variable too. |
SITE_URL | The site's real absolute origin (e.g. https://example.com) — required for sitemap.xml, canonical tags, and OG tags. Defaults to http://localhost:3000 for local dev. Must be set as a real Cloudflare Pages project environment variable for production. |
NODE_ENV | Gates draft/archived/future-dated post filtering — must be set to exactly "production" as a Cloudflare Pages project environment variable, or draft and scheduled content is served live with no filtering. Cloudflare Pages does not set this automatically. |
MCP_PUSH_TOKEN | Optional. If set, MCP server pushes (publish/preview) authenticate as this token instead of ambient git credentials. Needs "Contents: Write"; add "Pull requests: Read and write" too if you also want editorial status (in review / changes requested) for posts with an open PR. |
PUBLISH_MODE | direct (default) pushes straight to main. pr pushes the draft branch and opens a real GitHub PR instead — needs MCP_PUSH_TOKEN with "Pull requests: Write" in addition to "Contents: Write". |
CLOUDFLARE_DEPLOY_HOOK_URL | Cloudflare Pages deploy hook URL (Pages project > Settings > Builds & deployments > Deploy Hooks). Triggers a rebuild after content changes. |
CLOUDFLARE_API_TOKEN | One Account API Token shared by deploy_status and the R2 image cache's account/project lookups. Create it at My Profile > API Tokens > Create Token > Custom Token, permission Account > Cloudflare Pages > Read. Use an Account API Token, not a User API Token. |
CLOUDFLARE_BUCKET_NAME | R2-backed image cache — persists processed images across Cloudflare Pages builds, which otherwise re-encode every image from scratch each time. Optional: unset means local-only caching. Get CLOUDFLARE_S3_ACCESS_KEY_ID/CLOUDFLARE_S3_SECRET_ACCESS_KEY from R2 > Manage R2 API Tokens > Create API Token (permission: Object Read & Write, scoped to one bucket) — a separate credential pair from CLOUDFLARE_API_TOKEN above. CLOUDFLARE_BUCKET_NAME is the R2 bucket's name. |
IMAGE_CACHE_PRUNE_AFTER_DAYS | Optional, opt-in — unset means image cache entries live in R2 forever. When set, deletes cache entries unreferenced by any current post for this many days. Try 30/60/90 depending on how much churn your content sees. |
MCP_ALLOWED_HOSTNAMES | Comma-separated hostnames for DNS-rebinding protection on the MCP server. Defaults to localhost-only; set this if the server is ever exposed beyond your own machine. |
MCP_TOOL_ALLOWLIST | Comma-separated MCP tool names. Unset means every tool is registered (normal solo/interactive use). Set to restrict a server instance to a narrow subset. |
PORT | Port for the MCP server. Defaults to 3939. |
SITE_NAME | Site name/description used in <title>, meta tags, OG tags, the RSS feed, and llms.txt. Both optional — default to "Carapace" and a generic description. |
CLOUDFLARE_WEB_ANALYTICS | On by default (unset = on) — controls the CSP allowance for Cloudflare's own Web Analytics beacon script. Set to exactly "false" to opt out. Does not apply to Google Analytics or any other third-party analytics vendor. |
PREVIEW_WORKER_URL | The deployed Preview Worker's base URL, e.g. "https://carapace-preview.<subdomain>.workers.dev". Optional: unset means preview() still pushes the draft branch, just returns no URL. |
GITHUB_TOKEN | The Preview Worker's own GitHub credential — a fine-grained PAT, Contents: Read-only, scoped to just the content repo. Set as a Worker secret (`wrangler secret put GITHUB_TOKEN`) or in a gitignored `.dev.vars` file for local `wrangler dev`, not read from this file. |
UPLOAD_SECRET | workers/image-upload — a small standalone Worker serving a paste/drop upload page, for turning a clipboard image into a fetchable URL. Gates its /upload route: requests need Authorization: Bearer <this>. Set as a Worker secret (`wrangler secret put UPLOAD_SECRET`), not read from this file. |
GITHUB_GENERATE_TOKEN | One-off/manual use for the adopter-repo generation script. Needs a classic PAT with `repo` scope — repo creation isn't possible with a fine-grained PAT scoped to existing repos. |