.env.example

GHP_LISTEN=0.0.0.0:8899

# Health endpoint. Deliberately a separate listener: exposing /healthz under the
# public mount would hand an unauthenticated prober a way to confirm the service
# exists. Never publish this port.
GHP_ADMIN_LISTEN=127.0.0.1:8900

# Must match the nginx `location` exactly. Use "/" to mount at the domain root.
# Pick something unguessable: it is the first layer of "don't advertise".
GHP_PREFIX=/ivanghproxy/

# openssl rand -hex 24
GHP_TOKEN=

# Alternative: read the token from a file (Docker/systemd secrets). Takes
# precedence over GHP_TOKEN.
#GHP_TOKEN_FILE=/run/secrets/ghp_token

# Set to 1 to run with no authentication at all. Only sane when something else
# (a VPN, an IP allow list, mTLS) already restricts who can reach the listener.
#GHP_ALLOW_ANONYMOUS=0

# Restrict to specific owners/repos. Empty means "any GitHub repo".
#   octocat        every repo owned by octocat
#   octocat/hello  exactly that repo
#   */hello        any repo named hello
#GHP_ALLOW_LIST=
#GHP_DENY_LIST=

# GitHub PAT presented to GitHub (not to clients). Needed for private repos and
# useful for rate limits. Never sent to redirect targets on other hosts.
#GHP_UPSTREAM_TOKEN=
#GHP_UPSTREAM_TOKEN_FILE=/run/secrets/ghp_upstream_token

# Where that credential comes from: "env" (the two settings above) or "gh",
# which takes it from an already authenticated gh CLI instead of a PAT you mint
# and paste in. Setting both is a startup error.
#
#   gh auth login          once, as the user that runs the proxy
#   GHP_UPSTREAM_TOKEN_SOURCE=gh
#
# Two lookups, in order: `gh auth token --hostname <host>` when the binary is
# reachable, and <config dir>/hosts.yml when it is not. The second one is what
# makes this usable in Docker: the image is built on scratch and has no gh to
# run, so mount gh's config directory read-only and point GHP_GH_CONFIG_DIR at
# it (the container must run as a uid that can read the file — see README).
# If gh keeps the token in a system keyring, only the binary can read it.
#
# Consequence to be clear about: whoever holds GHP_TOKEN can then reach
# everything your GitHub account can. A PAT scoped to `contents: read` on the
# repositories you actually serve is the tighter choice; the gh source trades
# some of that for not having a second credential to rotate. Pair it with
# GHP_ALLOW_LIST.
#GHP_UPSTREAM_TOKEN_SOURCE=env
#GHP_GH_BIN=gh
#GHP_GH_HOST=github.com
#GHP_GH_CONFIG_DIR=/gh

# How often the gh credential is re-read; gh rotates OAuth tokens on its own,
# and a value read once at startup goes stale under a long-running process.
# 0 disables re-reading.
#GHP_GH_REFRESH=5m

# Hosts to try, in order, when the requested URL names no host at all, so that
#   .../TOKEN/prettyleaf/media/blob/main/logo.png
# means the same as
#   .../TOKEN/https://github.com/prettyleaf/media/blob/main/logo.png
# With the pair below, github.com shapes are tried first (blob/raw, releases,
# archives, tags, git) and a bare /owner/repo/ref/path falls through to raw.
# Only github.com, raw.githubusercontent.com and gist.githubusercontent.com (and
# their aliases) are accepted; anything else is a startup error.
#
# Empty (the default) keeps the host mandatory. Turning this on makes the mount
# point behave like a GitHub mirror: every /owner/repo/... path below it is
# proxied, so do not enable it with GHP_PREFIX=/ on a domain that serves
# anything else, or the proxy will shadow those paths. The token and the prefix
# still gate access.
#GHP_DEFAULT_HOST=github.com,raw.githubusercontent.com

# Largest body streamed inline; bigger responses get a 302 to the real GitHub
# URL instead. 0 disables the limit. Accepts a suffix: 512MB, 2GB.
#GHP_SIZE_LIMIT=0

# Hosts a GET/HEAD redirect may be followed to. Setting this REPLACES the
# built-in list of GitHub asset backends; leave it alone unless you know why.
#GHP_REDIRECT_HOSTS=
#GHP_MAX_REDIRECTS=5

###
###
###

# Permissive CORS headers, so browser fetch() can use the proxy. Off by default.
#GHP_CORS=0

# Include upstream URLs in log lines. Off by default: when the token is carried
# in the path, a logged URL is a logged credential.
#GHP_LOG_TARGETS=0

#GHP_LOG_LEVEL=info