···195195| Variable | Default | Description |
196196| --------------------------- | --------------------------------- | ---------------------------------- |
197197| `PORT` | 18910 | HTTP server port |
198198-| `SERVER_PUBLIC_URL` | - | Public URL for reverse proxy |
198198+| `SERVER_PUBLIC_URL` | - | Public URL for reverse proxy (enables secure cookies when HTTPS) |
199199| `ARABICA_DB_PATH` | ~/.local/share/arabica/arabica.db | BoltDB path (sessions, registry) |
200200| `ARABICA_FEED_INDEX_PATH` | ~/.local/share/arabica/feed-index.db | Firehose index BoltDB path |
201201| `ARABICA_PROFILE_CACHE_TTL` | 1h | Profile cache duration |
202202-| `SECURE_COOKIES` | false | Set true for HTTPS |
203202| `LOG_LEVEL` | info | debug/info/warn/error |
204203| `LOG_FORMAT` | console | console/json |
205204
+15-13
BACKLOG.md
···5566---
7788+## Far Future Considerations
99+1010+- Pivot to full svelte-kit?
1111+1212+- Maybe swap from boltdb to sqlite
1313+ - Use the non-cgo library
1414+ - Is there a compelling reason to do this?
1515+ - Might be good as a sort of witness-cache type thing
1616+817## Features
91810191. LARGE: complete record styling refactor that changes from table-style to more mobile-friendly style
···29383039- Add my custom iosevka font as default font
31403232-## Far Future Considerations
3333-3434-- Pivot to full svelte-kit?
3535-3636-- Maybe swap from boltdb to sqlite
3737- - Use the non-cgo library
4141+- Improve caching of profile pictures, tangled.sh apparently does this really well
4242+ - Something with a cloudflare cdn
4343+ - Might be able to just save to the db when backfilling a profile's records
4444+ - NOTE: requires research into existing solustions (whatever tangled does is probably good)
38453946## Fixes
40474148- Migrate terms and about page text. Add links to about at top of non-authed home page
42494350- Backfill on startup should be cache invalidated if time since last backfill exceeds some amount (set in code/env var maybe?)
4444-4545-- Fix always using celcius for units, use settings (future state) or infer from number (maybe also future state)
46514752- Make rating color nicer, but on white background for selector on new/edit brew page
48534949-- Refactor: remove the `SECURE_COOKIES` env var, it should be unecessary
5050- - For dev, we should know its running in dev mode by checking the root url env var I think?
5151- - This just adds noise and feels like an antipattern
5454+- Profile page should show more details, and allow brew entries to take up more vertical space
52555353-- Fix styling of manage records page to use rounded tables like everything else
5454- - Should also use tab selectors the same way as the profile uses
5656+- Show "view" button on brews in profile page
+1-2
CLAUDE.md
···160160| Variable | Default | Description |
161161| --------------------------- | --------------------------------- | ---------------------------------- |
162162| `PORT` | 18910 | HTTP server port |
163163-| `SERVER_PUBLIC_URL` | - | Public URL for reverse proxy |
163163+| `SERVER_PUBLIC_URL` | - | Public URL for reverse proxy (enables secure cookies when HTTPS) |
164164| `ARABICA_DB_PATH` | ~/.local/share/arabica/arabica.db | BoltDB path (sessions, registry) |
165165| `ARABICA_FEED_INDEX_PATH` | ~/.local/share/arabica/feed-index.db | Firehose index BoltDB path |
166166| `ARABICA_PROFILE_CACHE_TTL` | 1h | Profile cache duration |
167167-| `SECURE_COOKIES` | false | Set true for HTTPS |
168167| `LOG_LEVEL` | info | debug/info/warn/error |
169168| `LOG_FORMAT` | console | console/json |
170169
+2-4
README.md
···5050```yaml
5151environment:
5252 - SERVER_PUBLIC_URL=https://arabica.example.com
5353- - SECURE_COOKIES=true
5453```
55545655## Configuration
···6261### Environment Variables
63626463- `PORT` - Server port (default: 18910)
6565-- `SERVER_PUBLIC_URL` - Public URL for reverse proxy deployments (e.g., https://arabica.example.com)
6464+- `SERVER_PUBLIC_URL` - Public URL for reverse proxy deployments (e.g., https://arabica.example.com). When set to an HTTPS URL, secure cookies are automatically enabled.
6665- `ARABICA_DB_PATH` - BoltDB path (default: ~/.local/share/arabica/arabica.db)
6766- `ARABICA_FEED_INDEX_PATH` - Firehose index BoltDB path (default: ~/.local/share/arabica/feed-index.db)
6867- `ARABICA_PROFILE_CACHE_TTL` - Profile cache duration (default: 1h)
6968- `OAUTH_CLIENT_ID` - OAuth client ID (optional, uses localhost mode if not set)
7069- `OAUTH_REDIRECT_URI` - OAuth redirect URI (optional)
7171-- `SECURE_COOKIES` - Set to true for HTTPS (default: false)
7270- `LOG_LEVEL` - Logging level: debug, info, warn, error (default: info)
7371- `LOG_FORMAT` - Log format: console, json (default: console)
7472···108106```bash
109107# Example with nginx reverse proxy
110108SERVER_PUBLIC_URL=https://arabica.example.com
111111-SECURE_COOKIES=true
112109PORT=18910
113110114111# The server listens on localhost:18910
115112# But OAuth callbacks use https://arabica.example.com/oauth/callback
113113+# Secure cookies are automatically enabled when SERVER_PUBLIC_URL uses HTTPS
116114```
117115118116The `SERVER_PUBLIC_URL` is used for OAuth client metadata and callback URLs, ensuring the AT Protocol OAuth flow works correctly when the server is accessed via a different URL than it's running on.
+4-3
cmd/arabica-server/main.go
···276276 defer stopCacheCleanup()
277277 log.Info().Msg("Session cache initialized with background cleanup")
278278279279- // Determine if we should use secure cookies (default: false for development)
280280- // Set SECURE_COOKIES=true in production with HTTPS
281281- secureCookies := os.Getenv("SECURE_COOKIES") == "true"
279279+ // Determine if we should use secure cookies based on the public URL scheme
280280+ // If the public URL uses HTTPS, we automatically set the Secure flag on cookies
281281+ // For local development (no SERVER_PUBLIC_URL set), secure cookies are disabled
282282+ secureCookies := strings.HasPrefix(publicURL, "https://")
282283283284 // Initialize handlers with all dependencies via constructor injection
284285 h := handlers.NewHandler(
···22 @LOG_LEVEL=debug LOG_FORMAT=console go run cmd/arabica-server/main.go -known-dids known-dids.txt
3344run-production:
55- @LOG_FORMAT=json SECURE_COOKIES=true go run cmd/arabica-server/main.go
55+ @LOG_FORMAT=json SERVER_PUBLIC_URL=https://arabica.example.com go run cmd/arabica-server/main.go
6677test:
88 @go test ./... -cover -coverprofile=cover.out
+10-29
module.nix
···2626 };
27272828 logFormat = lib.mkOption {
2929- type = lib.types.enum [ "pretty" "json" ];
2929+ type = lib.types.enum [ "console" "json" ];
3030 default = "json";
3131 description =
3232 "Log format. Use 'json' for production, 'pretty' for development.";
3333- };
3434-3535- secureCookies = lib.mkOption {
3636- type = lib.types.bool;
3737- default = true;
3838- description =
3939- "Whether to set the Secure flag on cookies. Should be true when using HTTPS.";
4033 };
4134 };
42354343- oauth = {
4444- clientId = lib.mkOption {
4545- type = lib.types.str;
4646- description = ''
4747- OAuth client ID. This should be the URL to your client-metadata.json endpoint.
4848- For example: https://arabica.example.com/client-metadata.json
4949- '';
5050- example = "https://arabica.example.com/client-metadata.json";
5151- };
5252-5353- redirectUri = lib.mkOption {
5454- type = lib.types.str;
5555- description = ''
5656- OAuth redirect URI. This is where users are redirected after authentication.
5757- For example: https://arabica.example.com/oauth/callback
5858- '';
5959- example = "https://arabica.example.com/oauth/callback";
6060- };
3636+ publicUrl = lib.mkOption {
3737+ type = lib.types.str;
3838+ description = ''
3939+ Public URL where the arabica service is accessible.
4040+ This is used for OAuth configuration and automatically enables secure cookies when using HTTPS.
4141+ For example: https://arabica.example.com
4242+ '';
4343+ example = "https://arabica.example.com";
6144 };
62456346 dataDir = lib.mkOption {
···133116 PORT = toString cfg.settings.port;
134117 LOG_LEVEL = cfg.settings.logLevel;
135118 LOG_FORMAT = cfg.settings.logFormat;
136136- SECURE_COOKIES = lib.boolToString cfg.settings.secureCookies;
137137- OAUTH_CLIENT_ID = cfg.oauth.clientId;
138138- OAUTH_REDIRECT_URI = cfg.oauth.redirectUri;
119119+ SERVER_PUBLIC_URL = cfg.publicUrl;
139120 ARABICA_DB_PATH = "${cfg.dataDir}/arabica.db";
140121 };
141122 };