Move EXTRA_IDENTITIES from public config to secret for privacy

Relocate EXTRA_IDENTITIES from wrangler.jsonc vars to .dev.vars/.env secrets so email addresses stay out of the public repo. Update setup.mjs to read from env, add to SECRET_KEYS list, document in .dev.vars.example and README, mark optional in types.ts.

Author: AmirhosseinOlyaei

.dev.vars.example

@@ -7,3 +7,9 @@ UI_PASSWORD=change-me-strong-password
 
 # HMAC key for signing session cookies (required; any long random string)
 SESSION_SECRET=change-me-long-random-string
+
+# Extra send/receive identities beyond PRIMARY_ADDRESS (optional).
+# Kept as a secret so your addresses stay out of this public repo.
+# Format: semicolon-separated "address=Display Name" pairs (name optional).
+# Each address gets an Email Routing rule -> the worker via scripts/setup.mjs.
+# EXTRA_IDENTITIES=alias@yourdomain.com=Alias Name;alias2@yourdomain.com

README.md

@@ -62,12 +62,18 @@ Everything lives in **`wrangler.jsonc`** — worker, assets, D1, `send_email`, c
 | Var                       | Default               | Meaning                                  |
 | ------------------------- | --------------------- | ---------------------------------------- |
 | `MAIL_DOMAIN`             | `devartslab.com`      | Your domain                              |
-| `PRIMARY_ADDRESS`         | `amir@devartslab.com` | Send/receive identity                    |
+| `PRIMARY_ADDRESS`         | `amir@devartslab.com` | Primary send/receive identity            |
 | `DISPLAY_NAME`            | `Amir \| DevArts Lab` | From-name on outgoing mail               |
 | `AUTO_ACCEPT_INVITES`     | `"false"`             | Auto-accept incoming invites             |
 | `INVITE_REMINDER_MINUTES` | `"30"`                | Reminder email before events (`0` = off) |
 | `SESSION_TTL_HOURS`       | `"168"`               | UI session length                        |
 
+| Secret             | Meaning                                                                                                                                                              |
+| ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `UI_PASSWORD`      | Web UI login password                                                                                                                                                |
+| `SESSION_SECRET`   | HMAC key for session cookies                                                                                                                                         |
+| `EXTRA_IDENTITIES` | Extra send/receive addresses: `alias@domain=Name;alias2@domain` — kept secret so your addresses stay out of this repo. Each gets a routing rule via `npm run setup`. |
+
 Secrets live in `.dev.vars` locally / `wrangler secret` in prod — never committed.
 
 ## 📁 Layout

scripts/setup.mjs

@@ -72,11 +72,12 @@ const PRIMARY = vars.PRIMARY_ADDRESS;
 const DOMAIN = vars.MAIL_DOMAIN;
 
 // All addresses routed to the worker: primary + EXTRA_IDENTITIES
-// ("addr=Display Name;addr2=Name2").
+// ("addr=Display Name;addr2=Name2"). EXTRA_IDENTITIES is a secret —
+// comes from env / .dev.vars, never from the committed config.
+const EXTRA_IDENTITIES = env("EXTRA_IDENTITIES") || "";
 const ADDRESSES = [
   PRIMARY,
-  ...(vars.EXTRA_IDENTITIES || "")
-    .split(";")
+  ...EXTRA_IDENTITIES.split(";")
     .map((p) => p.split("=")[0].trim().toLowerCase())
     .filter(Boolean),
 ].filter((a, i, arr) => a && arr.indexOf(a) === i);
@@ -146,7 +147,7 @@ console.log("-> applying migrations (remote)");
 run(`npx wrangler d1 migrations apply ${D1_NAME} --remote`);
 
 // --- 3. secrets ----------------------------------------------------------------
-const SECRET_KEYS = ["UI_PASSWORD", "SESSION_SECRET"];
+const SECRET_KEYS = ["UI_PASSWORD", "SESSION_SECRET", "EXTRA_IDENTITIES"];
 for (const key of SECRET_KEYS) {
   const val = env(key);
   if (!val) {

src/types.ts

@@ -7,8 +7,8 @@ export interface Env {
   MAIL_DOMAIN: string;
   PRIMARY_ADDRESS: string;
   DISPLAY_NAME: string;
-  /** Extra send/receive identities: "addr=Display Name;addr2=Name2" */
-  EXTRA_IDENTITIES: string;
+  /** Extra send/receive identities (secret): "addr=Display Name;addr2=Name2" */
+  EXTRA_IDENTITIES?: string;
   CALENDAR_NAME: string;
   CALENDAR_TZ: string;
   AUTO_ACCEPT_INVITES: string;

wrangler.jsonc

@@ -41,9 +41,9 @@
     "MAIL_DOMAIN": "devartslab.com",
     "PRIMARY_ADDRESS": "amir@devartslab.com",
     "DISPLAY_NAME": "Amir | DevArts Lab",
-    // Additional send/receive identities: "addr=Display Name;addr2=Name2"
-    // (each gets an Email Routing rule -> this worker via scripts/setup.mjs)
-    "EXTRA_IDENTITIES": "pypi@devartslab.com=PyPI | DevArts Lab",
+    // NOTE: EXTRA_IDENTITIES is a SECRET, not a var — don't publish your
+    // addresses in this repo. Set in .dev.vars / `wrangler secret put`:
+    //   EXTRA_IDENTITIES="alias@domain=Display Name;alias2@domain=Name2"
     "CALENDAR_NAME": "DevArts Lab",
     "CALENDAR_TZ": "America/Los_Angeles",