Answer architecture round 1: 0 🔴, 2 🟡 (0 misread); CACHE_TEMPLATES also caches /public/ asset versions, the serve path hashes without a sync read
CI / full-gate (push) Successful in 3m19s
Mirror / github-mirror (push) Successful in 4s

This commit was merged in pull request #193.
This commit is contained in:
2026-10-31 10:25:19 +01:00
parent 65e2340e49
commit 72528f01ef
2 changed files with 2 additions and 2 deletions
+1 -1
View File
@@ -1198,7 +1198,7 @@ The app is **environment-agnostic**: no `NODE_ENV`, every behaviour its own expl
| --- | --- | --- |
| `APP_URL` | _unset_ (dev: `http://localhost:3000`) | the canonical public URL — the **single source** for the host this deployment lives on; set ⇒ off-host visitors are redirected here, unset ⇒ no redirect (see [Canonical host](#canonical-host-one-public-url)) |
| `PORT` | `3000` | web listen port |
| `CACHE_TEMPLATES` | `false` | cache compiled EJS templates (`true` in prod) |
| `CACHE_TEMPLATES` | `false` | cache compiled EJS templates and `/public/` asset versions (`true` in prod) |
| `SECURE_COOKIES` | `false` | mark our session/CSRF cookies `Secure` (`true` in prod https; off in dev http) |
| `REQUIRE_SECURE_SECRETS` | `false` | when `true`, `CSRF_SECRET` — and `PLUGIN_DB_SECRET` once storage is configured, and every plugin setting declared `secret` — must be supplied and differ from the dev throwaway |
| `LOG_LEVEL` | `info` | min severity logged: `error`/`warn`/`info`/`verbose`/`debug`/`silly`/`none` |