From b72b23ed1c38225f590203ddfe1cb921716e1c6c Mon Sep 17 00:00:00 2001
From: svemagie <869694+svemagie@users.noreply.github.com>
Date: Sun, 8 Mar 2026 03:51:33 +0100
Subject: [PATCH] prod

---
 indiekit.config.mjs | 4 +++-
 start.example.sh    | 5 ++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/indiekit.config.mjs b/indiekit.config.mjs
index 64c9ac7a..f9e8ed1b 100644
--- a/indiekit.config.mjs
+++ b/indiekit.config.mjs
@@ -37,6 +37,8 @@ const publicationBaseUrl = (
 const adminBaseUrl = (process.env.INDIEKIT_ADMIN_URL || "")
   .trim()
   .replace(/\/+$/, "");
+const nodeEnv = (process.env.NODE_ENV || "production").toLowerCase();
+const debugEnabled = process.env.INDIEKIT_DEBUG === "1" || nodeEnv !== "production";
 
 let webmentionDomain = process.env.WEBMENTION_IO_DOMAIN;
 if (!webmentionDomain) {
@@ -48,7 +50,7 @@ if (!webmentionDomain) {
 }
 
 export default {
-  debug: "indiekit:*",
+  ...(debugEnabled && { debug: process.env.DEBUG || "indiekit:*" }),
   application: {
     name: "Indiekit",
     mongodbUrl: mongoUrl,
diff --git a/start.example.sh b/start.example.sh
index 846fb487..4f1eca9a 100644
--- a/start.example.sh
+++ b/start.example.sh
@@ -32,7 +32,10 @@ if [ -z "${GH_CONTENT_TOKEN:-}" ] && [ -z "${GITHUB_TOKEN:-}" ]; then
   exit 1
 fi
 
-export NODE_ENV="${NODE_ENV:-production}"
+# Force production runtime and keep debug logging disabled.
+export NODE_ENV="production"
+export INDIEKIT_DEBUG="0"
+unset DEBUG
 
 # Verify MongoDB credentials/connectivity before launching server.
 /usr/local/bin/node scripts/preflight-mongo-connection.mjs