Static configuration
How to configure your Comentario server
The Comentario server’s static (start-up) configuration can be defined in three ways, in order of precedence:
- YAML configuration file
- Command-line options
- Environment variables
All three methods are functionally equivalent, but precedence applies: values in the configuration file override command-line options, which in turn override environment variables. Availability of each method depends on the specific setting.
When in doubt, use a YAML configuration file for your Comentario instance. It is the most complete and convenient option, offering a declarative format that works well with version control systems. In this case, the only required setting is specifying the file with the -c <file_name.yaml> command-line option (or the equivalent $CONFIG_FILE environment variable).
The easiest way to get started with a YAML-based config is allowing Comentario to write out its current settings using the following command:
comentario --config-write-to=/path/to/file.yaml
Then you can modify all settings to your taste.
Command-line help
You can also get a complete list of supported command-line options and variables by running:
./comentario -h
Synopsis
comentario [OPTIONS]
Options
Below is a list of available configuration settings (options).
| YAML config | Command-line | Environment variable | Default value | Description |
|---|---|---|---|---|
-h--help | Show help message (option summary) and exit. | |||
-c VALUE--config=VALUE | $CONFIG_FILE | Path to a YAML file to load the configuration from. | ||
--config-write-to=VALUE | When specified, causes Comentario to save its current config to given YAML file and exit. | |||
secrets | --secrets=VALUE | $SECRETS_FILE | Path to YAML file with secrets. | |
scheme | --scheme=VALUE | $SCHEME | http | Scheme of the listener: http, https, or unix. See Listener below. |
host | --host=VALUE | $HOST | localhost | The IP to listen on. If you want to accept connections from any network interface, use value 0.0.0.0. Only used with the http and https schemes. |
port | --port=VALUE | $PORT | 8080 | The port to listen on. Only used with the http and https schemes. |
socketPath | --socket-path=VALUE | $SOCKET_PATH | /var/run/comentario.sock | Path of the Unix domain socket to listen on. Only used with the unix scheme; at most 107 bytes long. |
socketPerms | --socket-perms=VALUE | $SOCKET_PERMS | 0660 | Octal permission bits to apply to the Unix domain socket. Only used with the unix scheme. |
maxListen | --max-listen=VALUE | 0 | Maximum number of outstanding requests. 0 means no limit. | |
cleanupTimeout | --cleanup-timeout=VALUE | 10s | Grace period for which to wait before killing idle connections. | |
gracefulTimeout | --graceful-timeout=VALUE | 15s | Grace period for which to wait before shutting down the server. | |
maxHeaderSize | --max-header-size=VALUE | 1MiB | Maximum number of bytes to read for request header (not request body). | |
keepAlive | --keep-alive=VALUE | 3m | TCP keepalive timeout on accepted connections. | |
readTimeout | --read-timeout=VALUE | 30s | Maximum duration before request read times out. | |
writeTimeout | --write-timeout=VALUE | 60s | Maximum duration before response write times out. | |
baseUrl | --base-url=VALUE | $BASE_URL | http://localhost:8080 | Server’s own base URL. |
baseDocsUrl | --base-docs-url=VALUE | $BASE_DOCS_URL | https://docs.comentario.app | Base documentation URL. Comentario provides numerous links to various docpages in the Admin UI and the embedded part. By default, points to Comentario production documentation. |
tosUrl | --tos-url=VALUE | $TOS_URL | <baseDocsUrl>/en/legal/tos/ | URL of the Terms of Service page. |
privacyPolicyUrl | --privacy-policy-url=VALUE | $PRIVACY_POLICY_URL | <baseDocsUrl>/en/legal/privacy/ | URL of the Privacy Policy page. |
cdnUrl | --cdn-url=VALUE | $CDN_URL | The base URL | Static file CDN URL. |
staticPath | --static-path=VALUE | $STATIC_PATH | . | Path to static (frontend) files. |
superuser | --superuser=VALUE | $SUPERUSER | UUID or email of a user to become a superuser. | |
homeContentUrl | --home-content-url=VALUE | $HOME_CONTENT_URL | URL of a HTML page to display on Comentario homepage. If not specified, the home page wil redirect the user to the login page. | |
maxImportFileSize | --max-import-file-size | $MAX_IMPORT_FILE_SIZE | 10MiB | Maximum import file size. This can be either a number of bytes, or a number followed by a unit (B=bytes, KB=kilobytes, MB=megabytes etc.). |
| Logging options | ||||
-v, --verbose | Verbose logging (use -vv for debug logging). If specified, overrides --log.level. | |||
log.level | --log.level=VALUE | $LOG_LEVEL | warning | Log verbosity level. Will be overridden to info if -v is given, or to debug if -vv is given on the command line. |
log.noColor | --log.no-color | $LOG_NO_COLOR | Disable log colouring with ANSI control sequences. | |
log.fullIPs | --log.full-ips | $LOG_FULL_IPS | Log IP addresses in full. When omitted, only first two bytes of IP addresses will be stored in fields such as user’s signup IP. Applies to both IPv4 (172.168.x.x) and IPv6 (692e:eace:x:x:x:x:x:x) addresses. | |
| Database options | ||||
db.maxIdleConns | --db.max-idle-conns=VALUE | $DB_MAX_IDLE_CONNS | 10 | Maximum number of idle DB connections. |
db.debug | --db.debug | Enable database debug logging (meant for development purposes). | ||
| TLS options | Only used with the https scheme. The address and the timeouts of the TLS listener are those of the server itself, configured with the options above. | |||
tls.certificate | --tls.certificate=VALUE | $TLS_CERTIFICATE | Path to the certificate file to use for TLS. Required with the https scheme. | |
tls.certificateKey | --tls.certificate-key=VALUE | $TLS_CERTIFICATE_KEY | Path to the certificate private key file to use for TLS. Required with the https scheme. | |
tls.ca | --tls.ca=VALUE | $TLS_CA | Path to the certificate authority file, for mutual TLS authentication. | |
| Statistics options | ||||
stats.disablePageViews | --stats.disable-page-views | $STATS_DISABLE_PAGE_VIEWS | Disable page view statistics gathering and reporting. | |
stats.maxDays | --stats.max-days | $STATS_MAX_DAYS | 30 | Statistics retention and reporting period, in days. |
| Live update options | ||||
liveUpdate.disable | --lu.disable | $NO_LIVE_UPDATE | Disable live updates via WebSockets. | |
liveUpdate.maxClients | --lu.max-clients=VALUE | $WS_MAX_CLIENTS | 10000 | Maximum number of WebSocket clients available for Live update. |
| Webhook options | ||||
webhooks.disable | --wh.disable | $WH_DISABLE | Disable outbound webhooks entirely. Existing webhooks stay visible and removable, but no event is queued or delivered. | |
webhooks.workers | --wh.workers=VALUE | $WH_WORKERS | 4 | Number of concurrently attempted webhook deliveries. |
webhooks.timeout | --wh.timeout=VALUE | $WH_TIMEOUT | 10s | Timeout of a single webhook delivery attempt. |
webhooks.maxAttempts | --wh.max-attempts=VALUE | $WH_MAX_ATTEMPTS | 5 | Maximum number of delivery attempts, the first one included. Lowering it truncates the retry schedule. |
webhooks.pollInterval | --wh.poll-interval=VALUE | $WH_POLL_INTERVAL | 15s | Interval of polling the database for due webhook deliveries. New events are dispatched right away; this is the fallback that picks up retries and deliveries left behind by another instance. |
webhooks.maxPerDomain | --wh.max-per-domain=VALUE | $WH_MAX_PER_DOMAIN | 10 | Maximum number of webhooks that can be registered on a single domain. |
webhooks.maxPerMinute | --wh.max-per-minute=VALUE | $WH_MAX_PER_MINUTE | 120 | Maximum number of webhook deliveries per domain per minute; the ones beyond it are dropped. Counted per instance. 0 switches the limit off. |
webhooks.maxFailStreak | --wh.max-fail-streak=VALUE | $WH_MAX_FAIL_STREAK | 20 | Number of consecutive failed deliveries after which a webhook is switched off automatically. 0 switches the rule off. |
webhooks.maxFailDays | --wh.max-fail-days=VALUE | $WH_MAX_FAIL_DAYS | 7 | Number of days of unbroken delivery failure after which a webhook is switched off automatically. 0 switches the rule off. |
webhooks.logRetentionDays | --wh.log-retention-days=VALUE | $WH_LOG_RETENTION_DAYS | 30 | Number of days a finished webhook delivery is kept in the delivery log for. |
webhooks.allowInsecure | --wh.allow-insecure | $WH_ALLOW_INSECURE | Allow insecure (plain http) webhook target URLs. Off by default: a payload is signed, but not encrypted. | |
webhooks.allowPrivateTargets | --wh.allow-private-targets | $WH_ALLOW_PRIVATE_TARGETS | Allow webhook target URLs resolving to private, loopback, link-local, multicast, or CGNAT addresses. Off by default; see Target validation. | |
| Development options | ||||
dev.disableXSRF | --dev.disable-xsrf | Disable XSRF protection. This option is meant for development purposes only; each production environment should have XSRF protection activated. | ||
dev.swaggerUI | --dev.swagger-ui | Enable Swagger UI at /api/docs. | ||
dev.e2e | --dev.e2e | Start server in the end-to-end testing mode. This option is meant for development purposes only. |
Listener
Comentario serves a single listener, whose kind is chosen with the scheme option:
http(the default) — plain HTTP onhost:port.https— HTTPS onhost:port, usingtls.certificateandtls.certificateKey.unix— HTTP over the Unix domain socket atsocketPath.
Plain HTTP is the right choice whenever Comentario runs behind a reverse proxy, an ingress controller, or a load balancer: that component terminates TLS, and Comentario only has to be reachable from it.
Use https only if there’s no TLS-terminating proxy in front of Comentario, since certificate renewal then becomes your responsibility. The certificate is read once, at startup, so the server needs a restart to pick up a renewed one.
The unix scheme is handy when the reverse proxy runs on the same host: no TCP port is occupied, and access is governed by the socket’s file permissions (socketPerms, 0660 by default — the proxy has to run as a user that these permissions grant access to). For example, to serve over a socket that the proxy’s group can access:
scheme: unix
socketPath: /run/comentario/comentario.sock
socketPerms: "0660"
or, on the command line:
comentario --scheme=unix --socket-path=/run/comentario/comentario.sock --socket-perms=0660
A socket left behind by a server that terminated uncleanly is removed on the next startup. If another process is still listening on it, Comentario refuses to start instead.
Legal pages
Comentario provides users with links to the following legal policy pages in a number of places:
- Terms of Service, which defaults to
<baseDocsUrl>/en/legal/tos/ - Privacy Policy, which defaults to
<baseDocsUrl>/en/legal/privacy/
Apart from being required by law in many countries, such a page is often mandatory when configuring federated authentication via an external service. By default, the above URLs on the documentation website are used.
If you apply your own policies, you should reconfigure Comentario to using your own URLs. Such pages have to be hosted elsewhere as Comentario provides no means for storing them at the moment.
Dynamic configuration defaults
Comentario YAML config also allows to redefine default values for dynamic configuration items.
In order to do that define corresponding overrides under the key dynamicConfigDefaults, for example:
dynamicConfigDefaults:
auth:
signup:
confirm:
commenter: false
user: true
domain.defaults:
comments:
text:
maxLength: 417
enableVoting: true
editing:
author: true
moderator: false
You can find the key name on the item page, under the heading. Allowed value datatypes are string, number, and boolean.
