Comments

Self-hosted comments for your Astro sites, stored in the CMS database.

Comments, commenters (name, email, picture), likes, bans and the moderation log live in Gitupcms’s own SQLite database. Nothing goes to a third party except the commenter’s sign-in (Google or GitHub) and the emails you set up. Commenters’ emails are never sent to the site.

Install

---
import GitupcmsComments from "../components/GitupcmsComments.astro";
---
<article><slot /></article>
<GitupcmsComments />

<div data-gitupcms-comments data-site-key="…"></div>
<script async src="https://app.gitupcms.com/comments/embed.js"></script>

The widget renders in a shadow root, follows html.dark (or a forced theme), and works with Astro view transitions.

The same comments run on their own server as Gitupcms, the open-source, self-hosted version.

Commenter sign-in

Commenters sign in with Google or GitHub in a popup. They are separate from CMS users.

• Each site can add its own OAuth apps under Comments → Settings → Sign-in (stored encrypted). The callback URL is shown there.
• Otherwise the server’s apps are used: COMMENTS_GOOGLE_CLIENT_ID / _SECRET and COMMENTS_GITHUB_CLIENT_ID / _SECRET.

Where comments may come from

Settings → General sets the site domain and allowed origins (*.example.com wildcards work). Every write checks the page origin; posts are rate limited per IP.

Moderation

Editors and above get:

• an overview with 30 days of activity;
• comments by page and status, with bulk approve, spam and remove, edit and history;
• users, with ban, remove-all and email mute.

Removed comments keep their place in the thread, not their words. Settings, email, install, export and delete-all are for admins.

Email

New comments go to the address you set; replies and @mentions to their authors; likes up to a limit. Each email has an unsubscribe link. Mail goes through the site’s own SMTP server (Settings → Email, password encrypted) or the CMS’s email.

Your data

Settings → Your data exports everything as JSON, or deletes it all.