typress
An editorial workshop.日本語

Configuration

typress takes all configuration from environment variables. There is no config file — pass them through systemd's EnvironmentFile= directive in production.

Required

TYPRESS_MASTER_KEY

32-byte key (base64url) used to encrypt TOTP secrets at rest. The server refuses to start in production (NODE_ENV=production) without it. Generate it once per site and store it outside the data directory.

openssl rand 32 | base64 | tr '+/' '-_' | tr -d '='

Losing this key means existing TOTP secrets cannot be decrypted (users can re-enroll). Don't include it in your DB backups.

TYPRESS_PUBLIC_ORIGIN

The canonical origin of the public site. Used for the CSRF Origin check, Set-Cookie domain scoping, and absolute URLs in the feed/sitemap. Format: https://your-domain.

Optional

  • TYPRESS_PORT — listen port, default 4321
  • TYPRESS_DATA_DIR — SQLite + media root, default ./data
  • TYPRESS_ADMIN_ORIGIN — origin for the admin SPA; defaults to public origin
  • TYPRESS_MAX_UPLOAD_BYTES — media size cap, default 1 GiB, 0 means unlimited
  • TYPRESS_UPDATE_KEYS — comma-separated public keys for self-update manifest signature verification
  • NODE_ENV — production enables Cookie Secure flag, HSTS, etc.

EnvironmentFile example

# /etc/typress/typress.env  (root:typress 0640)
TYPRESS_DATA_DIR=/var/lib/typress
TYPRESS_PORT=4321
TYPRESS_PUBLIC_ORIGIN=https://your-site.example
TYPRESS_MASTER_KEY=<base64url-32-bytes>
NODE_ENV=production

Load it from the systemd unit with EnvironmentFile=/etc/typress/typress.env. See Deployment for the full unit, and Security for what the master key actually protects.