No-TLS Deployment (EOTW)

Meant for sites that must survive with no DNS, no certificate authorities, no reverse proxies — what the project calls the end-of-the-world (EOTW) mode: the CMS serves everything itself, over plain HTTP, forever.

How it works

• install/hypnotoad.conf is pre-configured for this mode; copy it next to the application and run the daemon under the bundled hypnotoad:
  • CHINASKI_SECRET generated once and saved,
  • CHINASKI_AIRGAP=1 exported before the start.
• No reverse proxy, no TLS, no certificates needed — nothing to acquire, renew, or expire.
• The admin interface answers directly at http://<host-ip>:8080/.

Client-IP integrity without a proxy

The usual reason a proxy is needed is to detect real client IPs from forwarded headers. Without a proxy, the CMS recognizes it's the outermost server: forwarded headers from non-loopback peers are ignored and the real TCP address is used instead. Rate limiting and login lockouts work correctly with no extra configuration.

Day-to-day operation

• The process model is the standard one — start/reload or graceful-stop: hypnotoad cms.pl starts (or hot-reloads without a connection drop via kill -USR2 on the PID file), and hypnotoad -s cms.pl stops cleanly.
• Workers — 2 is the default (safe on a 1 GB machine); the config supports editing upward (e.g. 4 on a 2+ GB host) when several editors work at once.
• Scoping the interface — the daemon binds all interfaces by default (port 8080). To serve a specific network card — e.g. a machine straddling an untrusted network — set the listen address in the config to that NIC's IP.

When to choose it

When the enemy is time or distance (long-unmaintained installs, local-only networks), not convenience: this mode is a guarantee of no internet required — a deliberate feature, not a fallback for when Caddy can't be installed.