Everything about your site is in admin/site.yaml and admin/cms.yaml. Environment variables are for the things that belong to a deployment of Emet rather than to a site: which GitHub App it signs in with, where its API proxy is, and the secrets that proxy needs.
There are two kinds. Build-time variables are read by Vite and baked into the JavaScript bundle, so changing one means rebuilding. Runtime variables are read by the Cloudflare Pages Functions on each request, never reach the browser, and can be changed without a rebuild. Secrets go in the second group.
Build-time#
| Variable | What it does |
|---|---|
VITE_GITHUB_CLIENT_ID |
Your GitHub App’s client ID, which looks like Iv23.abc123def456. Required for signing in. Not needed for npm run dev against a local site, which skips GitHub entirely. |
VITE_GITHUB_APP_SLUG |
The app’s URL name, from github.com/apps/<slug>. With it set, the repository picker lists only repositories where your app is installed and shows an Install GitHub App link when there are none. Without it, the picker lists every repository the token can see. |
VITE_GOOGLE_CLIENT_ID |
Google OAuth client ID, for signing in to Search Console. Without it the GSC login button reports that no client ID is configured. |
VITE_API_BASE_URL |
Where to send /api/* requests when the static files aren’t served by Cloudflare Pages alongside the functions. Defaults to the same origin. See Self-hosting. |
EMET_DEV_CSP |
Set to 1 to make npm run dev inject the production content security policy (plus the inline-script and websocket allowances hot reloading needs), so a font or policy problem seen in the built app can be reproduced locally. Off by default. |
DEPLOY_TARGET |
Set to cloudflare-pages to write a _routes.json into dist/ so that only /api/* is routed through functions. npm run deploy sets this for you. |
VITE_FORCE_AUTH |
Development only. Set to 1 to use GitHub sign-in in npm run dev instead of the local filesystem, with /api proxied to http://localhost:8788, which is where wrangler pages dev serves the functions. |
HUGO_ROOT |
Development and desktop builds. Absolute path to the Hugo site to work on. Without it the dev server assumes the Emet checkout is sitting at static/emetcms inside the site and looks two directories up. |
For a production build you set them when you run the build, either in the shell or in your host’s build settings:
VITE_GITHUB_CLIENT_ID=Iv23.abc123def456 VITE_GITHUB_APP_SLUG=my-cms npm run buildNote that these are read from the process environment when Vite starts, so putting them in a .env file won’t work for the VITE_* values; export them or set them in CI.
Runtime#
These are read by the functions under functions/api/, which are deployed with the site on Cloudflare Pages. Set them in the Pages project under Settings, then Environment variables, and mark the secrets as encrypted.
| Variable | What it does |
|---|---|
GITHUB_CLIENT_SECRET |
Your GitHub App’s client secret. Used by /api/github/token to exchange the sign-in code for a token and to refresh it. |
GOOGLE_CLIENT_ID |
The same Google client ID as above, needed again server-side by the /api/gsc/* functions. |
GOOGLE_CLIENT_SECRET |
The Google OAuth client secret. |
ALLOWED_ORIGINS |
Comma-separated origins allowed to call /api/* cross-origin, such as https://cms.example.com. Only needed when the CMS is served from a different origin than the functions (VITE_API_BASE_URL points here). Cross-origin requests from anywhere else get a 403. |
The GSC functions refuse with a 501 if either Google variable is missing, so if Search Console sign-in fails straight after the redirect back, check these first.
If you’re not on Cloudflare Pages there’s nothing in the repository that reads these, because there’s nothing to run them. You’ll need your own equivalent of the token exchange and VITE_API_BASE_URL pointing at it; Deployment covers the options.