Hypnotoad: The Shipped Configuration

The repo ships install/hypnotoad.conf, preconfigured for offline/EOTW/LAN deployments — the “single server, plain HTTP” mode:

listen  => ['http://0.0.0.0:8080'],
workers => 2,
graceful_timeout => 20,
pid_file         => 'hypnotoad.pid',

The config’s comments carry three important guides:

• Bind choice: 0.0.0.0:8080 is fine where the machine is the access point (LAN, point-to-point, offline installs); use a specific NIC address (e.g. 192.168.1.5:8080) to limit which network can reach the admin.
• The no-proxy security posture: the CMS reads the real TCP peer address on non-loopback connections and ignores X-Forwarded-For entirely — so rate limiting and login lockouts work unconfigured. However: there’s no TLS in this mode, so credentials are transmitted in the clear; the config explicitly recommends a VPN or firewall-scoped access on networks that aren’t trusted.
• Vars before start: CHINASKI_SECRET=<secret> and (for offline) CHINASKI_AIRGAP=1 in the environment when you start hypnotoad cms.pl.

The in-app (CHINASKI_LISTEN / CHINASKI_WORKERS) twin

The same settings are settable in the app code path: CHINASKI_LISTEN (default http://127.0.0.1:8080) sets the listen address for a hypnotoad non-file-config run, and CHINASKI_WORKERS (default 2) sets worker count. When you run without a config file (the standard EOTW recipe), these env vars are the interface.

What’s in the ship, what it does

• workers — how many page-building workers answer requests (this is a Mojolicious prefork param, distinct from the site builder’s CHINASKI_JOBS render workers).
• graceful_timeout — the draining bound on each USR2 reload.
• pid_file — where the master’s PID is stored (used for zero-downtime reloads and graceful stop).