Add environment variables for GitHub, GitLab, Gitea, and allowed hosts configuration

README.md

@@ -3,7 +3,7 @@
 A self-hosted Symfony service that merges contribution data from **GitHub**, **GitLab** and **Gitea** into a single GitHub-style heatmap SVG you can embed anywhere.
 
 ```
-https://your-host/graph.svg?github_user=you&github_token=ghp_…&gitea_user=you&gitea_token=…&gitea_url=https://git.example.com
+https://your-host/graph.svg?theme=dark
 ```
 
 ![Example graph](https://img.shields.io/badge/output-SVG%20heatmap-39d353?style=flat-square)
@@ -35,14 +35,31 @@ cd git-contribution-graph
 cp .env .env.local
 ```
 
-Edit `.env.local`:
+Edit `.env.local` with your credentials:
 
 ```dotenv
-APP_ENV=prod
-APP_DEBUG=0
 APP_SECRET=<generate with: openssl rand -hex 16>
+
+# GitHub
+GITHUB_USER=your-github-username
+GITHUB_TOKEN=ghp_…
+
+# GitLab (omit GITLAB_URL to use gitlab.com)
+GITLAB_USER=your-gitlab-username
+GITLAB_TOKEN=glpat-…
+GITLAB_URL=
+
+# Gitea
+GITEA_USER=your-gitea-username
+GITEA_TOKEN=…
+GITEA_URL=https://git.example.com
+
+# Optional: restrict to specific hostnames (comma-separated), leave empty to allow all
+ALLOWED_HOSTS=
 ```
 
+Only configure the platforms you use — unused ones are silently skipped.
+
 ### 2. Start
 
 ```bash
@@ -65,52 +82,22 @@ GET /health  →  {"status":"ok"}
 
 | Parameter | Required | Description |
 |---|---|---|
-| `github_user` | ✗ | GitHub username |
-| `github_token` | ✗ | GitHub PAT — scope: `read:user` |
-| `gitlab_user` | ✗ | GitLab username |
-| `gitlab_token` | ✗ | GitLab PAT — scope: `read_user`, `read_api` |
-| `gitlab_url` | ✗ | GitLab base URL (default: `https://gitlab.com`) |
-| `gitea_user` | ✗ | Gitea username |
-| `gitea_token` | ✗ | Gitea PAT — scope: `read:user` |
-| `gitea_url` | ✗ | Gitea instance URL, e.g. `https://git.example.com` |
 | `theme` | ✗ | `dark` (default) or `light` |
 
-All platform parameters are optional — include only the ones you use. At least one platform must be configured for a non-empty graph.
+All credentials are configured via environment variables — see [Deploy](#deploy).
 
 ---
 
 ## Embedding in a README
 
-### GitHub-only
-
 ```markdown
-![Contribution Graph](https://your-host/graph.svg?github_user=YOUR_USER&github_token=YOUR_TOKEN)
+<!-- Dark theme (default) -->
+![Contribution Graph](https://your-host/graph.svg)
+
+<!-- Light theme -->
+![Contribution Graph](https://your-host/graph.svg?theme=light)
 ```
 
-### GitHub + Gitea
-
-```markdown
-![Contribution Graph](https://your-host/graph.svg?github_user=YOUR_GH_USER&github_token=GH_TOKEN&gitea_user=YOUR_GITEA_USER&gitea_token=GITEA_TOKEN&gitea_url=https://git.arthurerlich.de)
-```
-
-### All three platforms
-
-```markdown
-![Contribution Graph](https://your-host/graph.svg?github_user=GH_USER&github_token=GH_TOKEN&gitlab_user=GL_USER&gitlab_token=GL_TOKEN&gitlab_url=https://gitlab.com&gitea_user=GITEA_USER&gitea_token=GITEA_TOKEN&gitea_url=https://git.arthurerlich.de)
-```
-
-### Dark vs Light theme
-
-```markdown
-<!-- Dark (default) -->
-![Contribution Graph](https://your-host/graph.svg?github_user=USER&github_token=TOKEN&theme=dark)
-
-<!-- Light -->
-![Contribution Graph](https://your-host/graph.svg?github_user=USER&github_token=TOKEN&theme=light)
-```
-
-> **Security note:** API tokens embedded in public Markdown URLs are visible to anyone. Use read-only fine-grained tokens with minimal scopes. For private repos or sensitive setups, proxy the request server-side and keep tokens in environment variables.
-
 ---
 
 ## Token setup
@@ -146,7 +133,7 @@ composer install
 APP_ENV=dev php -S localhost:8080 -t public
 
 # Test endpoint
-curl "http://localhost:8080/graph.svg?gitea_user=haylan&gitea_token=YOUR_TOKEN&gitea_url=https://git.arthurerlich.de" -o graph.svg
+curl "http://localhost:8080/graph.svg" -o graph.svg
 ```
 
 ---