Settings Reference

Chinaski stores its site configuration as settings: key/value pairs you edit under Settings in the admin area (/admin/settings). Every save is snapshotted, so you can see and revisit what changed on the History tab, and the app logs each save.

Settings are organized into tabs: General, Organization, Integrations, Security, Email, PWA, Deploy, Backups, Permalinks, and Workflow (plus API Keys and Environment, which are whole features with their own pages). Each tab saves independently: only the tab you submit is written, and a save automatically triggers a site rebuild when the changed values affect your public output.

General

• Site name: shown in browser titles and outgoing emails.
• Tagline: used in meta descriptions, RSS feed summaries, and the default page subtitle.
• Footer copyright: appended to the © year in the footer. Leave blank to omit.
• Noindex: disallows crawlers via robots.txt and adds noindex to every page.
• Minify HTML: collapses whitespace in built HTML. On by default; disable to keep original spacing while debugging.
• Default site image: used as the og:image fallback on pages and posts with no image of their own. Leave blank to omit.
• Active languages: comma-separated ISO 639-1 codes (e.g. en,es,pt). Codes are validated on save. You cannot remove a language that still has pages, posts, or blocks: delete or reassign that content first. Save here before changing the default language.
• Default language: fallback language for the static build; must be present in Active Languages. Silently clamped to the active list if not.
• Site timezone: an IANA name (e.g. UTC, America/New_York). Scheduled publish dates are interpreted in this zone. Invalid values fall back to UTC on save.
• Site URL: used for absolute URLs in sitemap.xml and RSS. Include the protocol; no trailing slash (one is stripped on save).
• Posts per page: number of posts on the blog index and category archives. Clamped to the range 1–100.
• URL base prefix: prefix for static build links (e.g. /prefix); leave blank for root-relative. A CHINASKI_URL_BASE environment variable overrides it.
• CMS base URL: public URL of this CMS. Lets the [form:slug​] shortcode embed a live form when the form is not part of the static build. A CHINASKI_CMS_URL environment variable overrides it.
• Blog index title: heading and page title for the blog listing; blank uses “Blog”. Each configured language can have its own override.

Integrations

• Build webhook URL / publish webhook URL / Webhook secret: outbound webhook notifications. The URL must be a public http(s) address. The secret is stored encrypted; leave it blank to keep the current value.
• GA4 ID / GTM ID: analytics snippets. Both are stripped from built pages in air-gap mode.
• Twitter site.
• Cookie notice: enable switch, notice text, cookie policy URL, and accept/decline button labels. Each configured language can override the notice text and labels.

Security

The Turnstile and SSO fields only appear when air-gap mode is off.

• Security contact: must be a mailto: address or an https:// URL, or the save is rejected.
• Security policy URL.
• Turnstile site key / secret key: Cloudflare Turnstile for the login and form pages. The secret is stored encrypted; leave blank to keep the current value.
• Failure threshold: triggers an event-log alert when logged authentication failures (including blocked attempts) within the last 10 minutes reach this count. Default 20. This is an alert threshold only; the login lockout itself is fixed: 60 seconds after 5 consecutive failures, 5 minutes after 10, and 30 minutes after 20, per IP.
• API key rate limit: requests per minute; 1–10000, default 100.
• Self-registration: allow sign-ups from the login page. Off by default.
• Password expiry: days before passwords expire; 0 disables expiry.
• SSO (OAuth): enable switch plus client ID, client secret, authorization URL, token URL, and userinfo URL. The client secret is stored encrypted; leave blank to keep it.

Email

• SMTP host, port, encryption, username: pick encryption from STARTTLS, SSL, or none (STARTTLS is the default; invalid choices are reset to it on save).
• From address: where confirmation emails are sent from.
• SMTP password: stored encrypted. Leave blank to keep the existing password; use an app password.
• Build notification email: receives a message when a build succeeds or fails. Leave blank to disable.

PWA

• Enable PWA: generates a manifest, service worker, and offline fallback page at build time.
• Short name: home-screen icon label (roughly 16 characters at most); defaults to the site name.
• Theme color / background color: CSS hex values controlling browser chrome and splash screen.
• Display mode: standalone, minimal-ui, fullscreen, or browser.
• Offline title / message: content of the offline fallback page.

Deploy

• SSH/rsync deploy: enable switch plus host, user, remote path, and SSH key path.
• S3 deploy: enable switch plus bucket, endpoint, region, access key, and secret key. The secret key is stored encrypted; leave blank to keep it.

Deploys never run in air-gap mode, regardless of these settings.

Backups

• DigitalOcean Spaces: endpoint, bucket, region (default nyc3), access key, and secret key. The secret key is stored encrypted; leave blank to keep it. Changing only Spaces credentials does not trigger a rebuild.
• Schedule: backup frequency (off by default) and time of day (default 02:00).
• Verify every backup after creation: enabled unless you explicitly turn it off.
• Local retention: keep the last N local backups and/or keep local backups for N days; 0 means unlimited.

Permalinks

• Post URL prefix: default blog. Only letters, digits, and hyphens survive a save; a blank value reverts to blog. When you change it, the old prefix is remembered so old URLs redirect automatically after the next rebuild.
• Language URL mode: how the language code appears in URLs: path, none, or subdomain. It follows your language count; a monolingual site is forced to none, a multilingual site can never be none. Defaults to path.
• Home redirect: where the domain root (/) redirects, defaulting to blog. Rebuild required after changing.
• Each configured language may also define its own post URL prefix; clearing an override falls that language back to the default.

Saving permalinks always triggers a rebuild.

Workflow

• Require approval: when enabled, non-admin users’ content changes wait for admin approval before going live.
• Review notification email: receives notifications about review workflow events.
• Promotion guard: compares each build against the last clean promote and can refuse to promote a degraded build:
  • Mode: warn (default: log the problem and promote anyway), enforce (discard staging, keep serving the previous build, and fail the build), or off. A blocked build can be promoted manually with “Promote anyway” in the dashboard or the force flag.
  • Page-count drop threshold: maximum allowed percentage drop; default 80.
  • Max broken links: increase allowed versus the last clean build; default 25.
  • Max unresolved blocks: an absolute count. This gate is unconfigured until you enter a number (including 0); clearing the field switches it back off.
  • Max accessibility issues increase: increase allowed versus the last clean build; default 10.
  • Forcing past the guard never updates the quality baselines; the next normal build still compares against the last clean promote.

Secrets and security notes

• The SMTP password, webhook secret, deploy S3 secret key, Turnstile secret key, OAuth client secret, and Spaces secret key are stored encrypted at rest and never sent back to your browser or the API in plaintext; the forms always render empty and saving a blank keeps the existing value.
• Encryption of stored secrets depends on the CHINASKI_SECRET environment variable. Rotating that variable makes previously saved encrypted values undecryptable; re-save them afterwards.

Resetting a tab

Every tab except Deploy, Permalinks, and Workflow can be reset to its defaults from its section’s reset control. Resetting wipes that section’s per-language overrides as well; the confirmation screen tells you how many values actually differ from the defaults before you commit.

In this section

• Organization Settings
• Email Settings
• Google Analytics Integration
• Google Tag Manager Integration
• X (Twitter) Handle
• Cookie Notice
• API Keys
• Permalinks
• Progressive Web App (PWA)
• Favicon