Configuration

• environment variables for infrastructure and runtime behavior
• dashboard settings for site-level publishing behavior

Most single-site installs only need a few values:

• AUTH_SECRET
• SITE_ORIGIN when you want a fixed canonical host
• one storage setup: R2, S3, or local files

Environment Variables

Use:

• wrangler.toml for non-sensitive Cloudflare values
• .dev.vars for local Cloudflare secrets
• .env or process environment variables for Node and Docker

Required

All runtimes require this variable:

Keep AUTH_SECRET out of committed files.

• Cloudflare local development: put it in .dev.vars
• Cloudflare production: set it as a Worker secret with npx wrangler secret put AUTH_SECRET
• Node and Docker: set it in .env or the process environment

Public URLs and Subpaths

These variables matter in single-site mode:

Common patterns:

• root deploy, request-derived host: leave both unset
• fixed host: set SITE_ORIGIN=https://example.com
• subpath deploy: set SITE_PATH_PREFIX=/blog
• fixed host under subpath: set both

SITE_ORIGIN affects absolute URLs such as RSS, sitemap, exports, and auth callbacks.

SITE_PATH_PREFIX affects routing and built assets, including /_assets inside that prefix.

In host-based mode, Jant ignores both values and resolves the site from the incoming host.

Site Resolution

• single-site is the normal self-hosted mode
• host-based is for hosted multi-site setups
• in single-site mode, Node startup expects exactly one initialized site in the database

Most self-hosted users should keep single-site.

Node and Docker

On Node and Docker, Jant chooses the database runtime from DATABASE_URL:

• file: means SQLite
• postgres: or postgresql: means Postgres

Minimal SQLite example:

AUTH_SECRET=your-32-plus-character-secret
SITE_ORIGIN=https://your-jant.example
DATABASE_URL=file:./data/jant.sqlite

Minimal Postgres example:

AUTH_SECRET=your-32-plus-character-secret
SITE_ORIGIN=https://your-jant.example
DATABASE_URL=postgres://USER:PASSWORD@HOST:5432/DBNAME

Common Node and Docker variables:

The official Docker image already defaults DATA_DIR to /var/lib/jant, and Docker Compose commonly sets TRUST_PROXY=true.

Hosted Control-Plane Integration Variables

Only use these when SITE_RESOLUTION_MODE=host-based.

When host-based mode is enabled, startup fails fast if the required variables are missing. That is intentional.

Feed Defaults (Optional)

featured is the default on purpose. Jant assumes many posts should remain visible on the site without automatically becoming the canonical subscriber feed.

Pagination (Optional)

Use SEARCH_PAGE_SIZE and ARCHIVE_PAGE_SIZE only when those surfaces need a different page size from the rest of the site.

Storage

Storage depends on the runtime:

Node does not support r2.

Cloudflare does not support local.

For Node and Docker, local is the fastest way to start. s3 is usually the better long-term production choice.

Local Storage (Fastest Start on Node / Docker)

Local storage requires no extra driver configuration.

Use it when you want the simplest setup, local testing, or a small single-machine install.

Defaults:

• DATA_DIR=./data
• LOCAL_STORAGE_PATH=<DATA_DIR>/media

Override the media path when you want files elsewhere:

LOCAL_STORAGE_PATH=/absolute/path/to/jant-media

Set LOCAL_PUBLIC_URL only if another web server will serve those files directly.

R2 (Default)

Cloudflare Workers use R2 by default.

R2 itself is configured through the [[r2_buckets]] binding in wrangler.toml.

R2_PUBLIC_URL is strongly recommended. Without it, media still works, but Jant has to proxy each request through the Worker.

[vars]
R2_PUBLIC_URL = "https://media.yourdomain.com"

S3-Compatible Storage

Use S3-compatible storage when:

• you want the recommended long-term storage setup on Node or Docker
• you want the same storage backend on Cloudflare and Node
• you prefer S3, Backblaze B2, MinIO, DigitalOcean Spaces, or another compatible service
• you want browser direct uploads through presigned URLs

Example:

[vars]
STORAGE_DRIVER = "s3"
S3_ENDPOINT = "https://s3.us-east-1.amazonaws.com"
S3_BUCKET = "my-bucket"
S3_REGION = "us-east-1"
S3_PUBLIC_URL = "https://cdn.example.com"

Put the credentials in secrets storage, not in committed files.

Browser Direct Upload CORS

If you use STORAGE_DRIVER=s3, the bucket must allow CORS for the exact site origin that uploads files.

Recommended CORS policy:

[
  {
    "AllowedOrigins": ["https://your-site.example"],
    "AllowedMethods": ["GET", "HEAD", "PUT"],
    "AllowedHeaders": [
      "Content-Type",
      "Content-Disposition",
      "Cache-Control",
      "x-amz-checksum-sha256"
    ],
    "ExposeHeaders": ["ETag"],
    "MaxAgeSeconds": 3600
  }
]

If you upload from multiple origins, list each origin explicitly.

Image Transformations (Optional)

When you use Cloudflare image transformations, point this to the domain that actually serves your images, plus /cdn-cgi/image.

Examples:

[vars]
R2_PUBLIC_URL = "https://media.yourdomain.com"
IMAGE_TRANSFORM_URL = "https://media.yourdomain.com/cdn-cgi/image"

Or, when images are still proxied through the site domain:

[vars]
IMAGE_TRANSFORM_URL = "https://yourdomain.com/cdn-cgi/image"

Temporary Upload Cleanup

Jant stores in-progress uploads under a temporary storage prefix and opportunistically cleans up expired upload sessions during new upload initialization.

If you need a manual cleanup path, use the internal maintenance endpoint:

curl -X POST https://your-site.example/api/internal/uploads/cleanup \
  -H "Authorization: Bearer $INTERNAL_ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"limit": 50}'

Or the CLI wrapper:

export INTERNAL_ADMIN_TOKEN=your-internal-admin-token
npx jant uploads cleanup --url https://your-site.example --limit 50

Slugs (Optional)

Upload Limits (Optional)

Images keep their own tighter limits. This setting mainly affects video, audio, and PDF uploads.

Cross-Origin API Access (Optional)

When set to * (the default), all origins are allowed but credentials are not forwarded.

Values:

• * — allow all origins (credentials are not forwarded)
• comma-separated origins — allow only those origins, with credentials

Examples:

# Allow any origin
CORS_ORIGINS=*

# Allow a specific site and a Chrome extension
CORS_ORIGINS=https://dashboard.example.com,chrome-extension://abcdef1234567890

Content Summary and RSS Limits (Optional)

Dashboard Settings

These settings can be changed in the Jant dashboard after setup. Some of them can also be seeded from environment variables.

Color theme, font theme, custom CSS, avatar, and other appearance details are also managed in the dashboard.

Reserved Paths

These top-level paths are reserved and cannot be used as post or custom page slugs:

featured, latest, collections, signin, signout, setup, settings, posts, dash,
api, feed, search, archive, media, pages, reset, compose, static, assets,
_assets, health

Configuration Files

wrangler.toml

Use wrangler.toml for non-sensitive Cloudflare configuration:

name = "my-jant-site"
main = "index.js"

[vars]
SITE_ORIGIN = "https://myblog.com"
# SITE_PATH_PREFIX = "/blog"
# R2_PUBLIC_URL = "https://media.myblog.com"
# IMAGE_TRANSFORM_URL = "https://media.myblog.com/cdn-cgi/image"

[[d1_databases]]
binding = "DB"
database_name = "my-jant-site-db"
database_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

[[r2_buckets]]
binding = "R2"
bucket_name = "my-jant-site-media"

.env (Node and Docker)

Use .env or your process manager's environment injection for Node and Docker:

AUTH_SECRET=your-32-plus-character-secret
SITE_ORIGIN=https://your-jant.example
DATABASE_URL=file:./data/jant.sqlite
# SITE_PATH_PREFIX=/blog
# TRUST_PROXY=true

Useful templates:

• repo-level Docker and Node example: .env.example
• package-local Node example: packages/core/.env.node.example

.dev.vars (Local Development)

Use .dev.vars for local Cloudflare secrets:

AUTH_SECRET=your-32-plus-character-secret
DEV_API_TOKEN=local-debug-token
[email protected]
DEMO_PASSWORD=jant-dev-debug-login
DEMO_MODE=false

DEV_API_TOKEN, DEMO_EMAIL, and DEMO_PASSWORD are local debugging helpers. They are not part of a normal production setup.

Demo Mode

Set DEMO_MODE=true only for a public shared demo environment.

Effects:

• forces noindex
• disables account deletion, password changes, and some account-management actions
• does not activate merely because DEMO_EMAIL or DEMO_PASSWORD are set

Production Secrets

For Cloudflare production, set secrets with Wrangler or in the dashboard:

openssl rand -base64 32
npx wrangler secret put AUTH_SECRET