Changeset f574435 in Klonkt

Timestamp:

07/21/2026 03:45:36 AM (7 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

e2ea5c4

Parents:

4590e66

git-author:

Robin <roboburr@…> (07/21/2026 03:45:33 AM)

git-committer:

Robin <roboburr@…> (07/21/2026 03:45:36 AM)

Message:

Docs: README + .env.example for paid posts and auto-generated keys

Tell users how the paid-posts key works: no env editing needed, it's
generated on first use like SESSION_SECRET already is. Plus a general pass
for missing features.

Changed files:
README.md

• "What it does": Paid posts (own Patreon, passkey unlock, no visitor account/cookie, patron identity never stored)
• Configuration table: PAID_SECRET (auto) + KLONKT_PREMIUM_ENABLED; SESSION_SECRET marked auto (matches .env.example, not "required")
• new "Auto-generated secrets & backups" section: where the keys live, why PAID_SECRET is outside the DB, and to back up storage/ as a whole
• Stack: link to FEDERATION.md

.env.example

• PAID_SECRET block (auto-generate, or openssl rand -base64 32)
• paid posts added to the premium-extras list

-robo
Co-Authored-By: Claude Opus 4.8 <noreply@…>

Files:

• .env.example (modified) (2 diffs)
• README.md (modified) (3 diffs)

.env.example

@@ -11 +11 @@
 # restarts/updates). Or set your own: openssl rand -hex 32
 SESSION_SECRET=
+# Encrypts the stored Patreon secrets for paid posts. Same deal: leave EMPTY to
+# auto-generate on first use (saved to storage/.paid-secret, kept outside the DB
+# so a database dump alone stays useless). Or set your own: openssl rand -base64 32
+PAID_SECRET=
 DATABASE_PATH=./storage/database.sqlite
 MEDIA_PATH=./storage/media
@@ -52 +56 @@
 # The core app, all updates and Cirkels are free. A handful of extras
 # (newsletter, statistics, EPK, link-in-bio, embeddable player, show agenda,
-# release planning, download-for-email) are unlocked by a one-time Patreon
-# supporter link — that's what funds the project:
+# release planning, download-for-email, paid posts) are unlocked by a one-time
+# Patreon supporter link — that's what funds the project:
 # klonkt.com / patreon.com/c/roboburr. Leave this on.
 KLONKT_PREMIUM_ENABLED=on

README.md

@@ -15 +15 @@
 - **Grow**: newsletter, download-for-email, EPK/press kit, link-in-bio,
   show calendar, and **cookie-free statistics**.
+- **Paid posts** — put a post behind your **own Patreon**. Supporters unlock it
+  with a **passkey**: no account on your site, no cookie, and a patron's identity
+  (name/email) is never stored — only a pseudonymous, expiring entitlement. You
+  connect your Patreon once in the admin and pick a minimum amount per post.
 - **Circles** — a curated feed of the makers you choose: feature accounts (other Klonkt
   sites, Mastodon, PeerTube — any fediverse server) and their public posts appear in your
@@ -161 +165 @@
 | Variable | Required | What |
 |---|---|---|
-| `SESSION_SECRET` | ✅ | Random string of ≥32 characters |
+| `SESSION_SECRET` | auto | Signs login sessions. Leave empty to auto-generate (`storage/.session-secret`), or set a random ≥32-char string. |
 | `PUBLIC_BASE_URL` | ✅ | Canonical URL (e.g. `https://yourdomain.com`) |
+| `PAID_SECRET` | auto | Encrypts the stored Patreon secrets for **paid posts**. Leave empty to auto-generate on first use (`storage/.paid-secret`), or set your own ≥16-char string. |
 | `SMTP_HOST` / `_PORT` / `_USER` / `_PASS` / `_FROM` | — | Email for password reset + newsletter |
 | `KLONKT_DEFAULT_LANG` | — | Default language for visitors (`en`/`nl`/`de`) |
 | `KLONKT_AUDIO` | — | `off` = lite mode (no audio/ffmpeg) |
+| `KLONKT_PREMIUM_ENABLED` | — | `on` (default) enables the Patreon-unlocked extras (incl. paid posts) |
 | `HSTS_STRICT` | — | `1` = stricter HTTPS header (`includeSubDomains` + `preload`). Only set this if Klonkt owns the **whole** domain and all its subdomains are HTTPS — it forces every subdomain to HTTPS and can bake your domain into browsers near-permanently. Leave unset otherwise; the default is already safe. |
+
+### Auto-generated secrets & backups
+
+You never have to hand-edit the env for these: Klonkt generates them on first use
+and keeps them stable across restarts and updates.
+
+- `SESSION_SECRET` → `storage/.session-secret` (signs login sessions)
+- `PAID_SECRET` → `storage/.paid-secret` (encrypts the stored Patreon secrets for
+  paid posts)
+
+The paid-posts key lives **outside** the database on purpose: encrypting the
+Patreon secrets would be pointless if the key sat in the same file a database
+dump would leak. Set either variable in `.env` to override the generated one.
+
+**Back up the whole `storage/` directory** (database, media *and* these key
+files). Restoring the database without `storage/.paid-secret` leaves the stored
+Patreon secrets unreadable — you'd have to reconnect Patreon.
 
 ## Stack
@@ -175 +198 @@
 - **Templates:** EJS (server-rendered) + **htmx 1.9** (vendored, no build step)
 - **Audio:** ffmpeg-static (bundled)
-- **Fediverse / Circles:** ActivityPub (HTTP Signatures) — federates with Mastodon, PeerTube and other Klonkt sites
+- **Fediverse / Circles:** ActivityPub (HTTP Signatures) — federates with Mastodon, PeerTube and other Klonkt sites. See [FEDERATION.md](FEDERATION.md) for the supported activities and FEPs.
 - **Fonts:** self-hosted variable woff2 (Fraunces / Plus Jakarta Sans)