Setup checklist
This page lists each step of setting up the website with the club’s own accounts, and checks each one against the live website. Our webmaster takes these steps.
- Each step is marked Done, Not yet or Can’t check, with what the website saw.
- Secrets show only whether they are set, never their values.
- How to do it opens the instructions, and Check again checks every step again now.
- Once every step is done, an admin can turn off Setup checklist under Club setup › Features. This page then shows only the health watch, for our webmasters.
The steps below need the club's own accounts at Cloudflare, GitHub, Google and Resend. Our webmaster takes them; this page checks each one on the website as it runs now.
The website's settings in Cloudflare
-
The databaseChecking
The attendance database, bound to the site as DB, with its tables. Without it nobody can log in.
-
The session secretChecking
SESSION_SECRET keeps each login safe on its phone or computer. Changing it logs everyone out.
-
The webmasters' emergency loginChecking
ADMIN_EMAIL names [email protected] and [email protected], so that the webmasters can always log in as an admin, even when no other admin can.
-
Codes by emailChecking
RESEND_API_KEY and EMAIL_FROM send login codes from kmceagles.org through Resend, once the domain is confirmed there.
-
Continue with GoogleChecking
GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET let members log in with their Google account.
-
Continue with GitHubChecking
GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET let members log in with their GitHub account.
-
Saving changes on the websiteChecking
GITHUB_TOKEN lets our coaches and admins change events, rosters and profiles here. With the permission Actions: Read-only, it also lets this page read the GitHub workflows below.
-
Building changes togetherChecking
CF_PAGES_DEPLOY_HOOK, the address of a Pages deploy hook kept as a secret, lets the website build a whole run of changes at once, ten minutes after the last, rather than one build for each. The hook for Production builds main; the one for Preview builds attendance-preview.
-
Notification keysChecking
The keys that sign notifications (VAPID). The site makes its own the first time it needs them; keys of your own in Cloudflare take their place.
-
The reminders' secretChecking
CRON_SECRET lets the reminders timer and the reminders workflow start the reminder run at once. The same value goes in GitHub as a repository secret.
-
The spam check on formsChecking
TURNSTILE_SITE_KEY shows Cloudflare's spam check on the contact and sign-up forms, and TURNSTILE_SECRET verifies it. Only a test message through the contact form shows that the keys work and that kmceagles.org is among the check's hostnames.
-
The contact formChecking
The club's Web3Forms access key delivers messages from the contact and sign-up forms to the club's inbox; the visitor's browser sends them. Only a test message through the contact form shows that the key works.
-
Google Search ConsoleChecking
GOOGLE_SITE_VERIFICATION confirms the site to Google with a tag in each page. It isn't needed once kmceagles.org is confirmed as a Domain property, by a DNS record.
-
The Cloudflare planChecking
The website runs on Cloudflare's free plans and keeps within their limits. If the club moves to the Workers Paid plan, the plain variable WORKERS_PLAN, set to paid, lets the website send more notifications at once. Nothing else needs to change.
-
Files in the websiteChecking
Cloudflare takes at most 20,000 files in one deployment on the free plan, and 100,000 on a paid plan with the build variable PAGES_WRANGLER_MAJOR_VERSION set to 4. Each season's events add files.
The address, kmceagles.org
-
kmceagles.org serves the siteChecking
The domain is connected to the site, so that the calendars, the login emails and shared links all use it.
-
Shared links use kmceagles.orgChecking
SHARE_URL is the address in the links members share on WhatsApp and elsewhere. Set it once the domain works.
-
Preview pictures load from kmceagles.orgChecking
MEDIA_URL is where WhatsApp and other apps load the pictures of shared links.
-
Reminders call kmceagles.orgChecking
The repository variable REMINDERS_SITE tells the reminders timer and the reminders workflow which address to call.
Reminders and backups
-
The reminder runChecking
Sends the reminders and notifications that are due. It should run every few minutes, and at least once an hour.
-
The reminders timerChecking
A small Cloudflare Worker that starts the reminder run every five minutes. It needs CRON_SECRET, and the Cloudflare token's permission to deploy it.
-
The reminders workflowChecking
GitHub starts the reminder run every six hours too, as a backstop to the clock (Actions › Attendance reminders).
-
The weekly database backupChecking
Every Monday night GitHub copies the attendance database, encrypted, and opens the copy again to prove it works. The first copy of each month stays 400 days, the others 90. It needs three repository secrets.
-
Cloudflare's daily figuresChecking
Once a day the workflow “Daily rebuild” asks Cloudflare for the database rows and requests of the day before, against the free limits, and when its token expires. For them, the token needs the permission Account › Account Analytics › Read.
Health
Once an hour, the website checks that it is working properly: the timer that sends reminders, the latest update to the website and the live site after it, the backups, email, the website’s access keys to GitHub and Cloudflare before they expire, and the free usage limits of the services the website runs on. It never counts visits or people.
- Each part reads OK, Warning, Problem, Can’t check or Not set up, with what the website saw.
- Our two webmasters get each problem in their Inbox, at most once a day, and Back to normal when it’s fixed.
- The failures that stop notifications, and any that lasts more than a day, also come to them by email.
The website checks these once an hour, and tells our two webmasters when one goes wrong and again when it's back to normal.
Problems in the last 30 days
None in the last 30 days.
The club's details
-
Every member's email addressChecking
Members log in with the email address we have for them. Our admins add it under Rosters › Everyone, or a team's coach approves it from the team's join link.
-
The cost of iceChecking
Enter what an hour of ice costs at each rink where we practice, so that the Attendance page's Costs view can show what practices cost.
Enter the costs
-
A way for staff to confirm it's themChecking
Coaches, admins, team managers and the treasurer confirm it's them before they download contact details, change a member's email or role, delete a member or delete a team. They need a passkey of their own, or one of codes by email, Google or GitHub set up here, with the email we have for them. If they have none of these, we can't ask them to confirm, so their changes go through without it.