add configuration notes

backend/README.md

@@ -6,6 +6,25 @@
 - Run with `SKIP_CRAWL=true` to just run the server (useful for working on the API without also crawling)
 - This project is automatically scanned for potential vulnerabilities with [Sobelow](https://sobelow.io/).
 
+## Configuration
+
+There are several environment variables you can set to configure how the crawler behaves.
+
+- `DATABASE_URL` (required) . The URL of the Postgres db.
+- `POOL_SIZE`. The size of the database pool. Default: 10
+- `PORT`. Default: 4000
+- `BACKEND_HOSTNAME` (required). The url the backend is running on.
+- `SECRET_KEY_BASE` (required). Used for signing tokens.
+- `TWILIO_ACCOUNT_SID`. Used for sending SMS alerts to the admin.
+- `TWILIO_AUTH_TOKEN`. As above.
+- `ADMIN_PHONE`. The phone number to receive alerts at.
+  - At the moment, the only alert is when there are potential new spam domains.
+- `TWILIO_PHONE`. The phone number to send alerts from.
+- `ADMIN_EMAIL`. Used for receiving alerts.
+- `FRONTEND_DOMAIN` (required). Used to generate login links for instance admins.
+  - Don't enter `https://`, this is added automatically.
+- `SENDGRID_API_KEY`. Needed to send emails to the admin, or to instance admins who want to opt in/out.
+
 ## Deployment
 
 Deployment with Docker is handled as per the [Distillery docs](https://hexdocs.pm/distillery/guides/working_with_docker.html).

backend/lib/backend/auth.ex

@@ -7,7 +7,7 @@ defmodule Backend.Auth do
   def get_login_link(domain) do
     token = Token.sign(BackendWeb.Endpoint, @salt, domain)
     frontend_domain = get_config(:frontend_domain)
-    "#{frontend_domain}/admin/verify?token=#{URI.encode(token)}"
+    "https://#{frontend_domain}/admin/verify?token=#{URI.encode(token)}"
   end
 
   def verify_token(token) do

backend/lib/mailer/user_email.ex

@@ -5,8 +5,10 @@ defmodule Backend.Mailer.UserEmail do
 
   @spec send_login_email(String.t(), String.t()) :: {:ok | :error, term}
   def send_login_email(address, domain) do
+    frontend_domain = get_config(:frontend_domain)
+
     body =
-      "Someone tried to log in to #{domain} on https://www.fediverse.space.\n\nIf it was you, click here to confirm:\n" <>
+      "Someone tried to log in to #{domain} on https://#{frontend_domain}.\n\nIf it was you, click here to confirm:\n\n" <>
         get_login_link(domain)
 
     new()