I needed a comments system for my blog (running on Cloudflare & Astro), the other options I tried didn't work out as I wanted. So Garrul was born, it uses one Cloudflare Worker with D1 + KV, in your own account. No container, no VPS, no DB server to manage or worry about! Most sites fit the free tier, I am using it for 5 lowish traffic sites with zero issues.

I wanted privacy of commenters to be primary here, along with ease of use so that was always the basis of many decisions I took along the way. For example, we never store IP addresses directly. Every IP is HMAC hashed, ipv6 is truncated first.

I have worked steadily on optimizations every chance, e.g. instead of having few separate calls for the config, session, first set of comments, subscription state etc it's all a single call. Posting costs a single call, you can even have a reaction only mode for specific pages/articles. The anti-spam call and turnstile call only happen when user actually focuses the comment posting embed. The math works out to roughly 100k pageviews/day on the free tier.

The widget embed itself is limited to 30KB gzipped, with the CI set to fail above that so we don't ship massive embeds.

One of the larger issues with trying to stick within Cloudflare free tier is the 1000 writes/day for KV. We used to have per request KV Cache, that burned me when I woke up to my first bot swarm browsing thru the site and locking out the comments for the whole day. That made me move the cache to the cache API.

Demo (anonymous posting works) : https://garrul.com/#comments

I would appreciate any feedback on improving the system. Optimization and security are my current focus, so anything anyone can help with there will be immensely appreciated.

Some of the feature highlights :

Threaded markdown enabled comments

OAuth (Google, Facebook, X, Discord, GitHub logins) or Anon posting

pinned comments, opt in reply emails, digest of posts to moderators, and a telegram bot to moderate the whole thing from telegram itself (I use this telegram bot daily).

Multiple languages, and ability to import from multiple systems like Disqus and Remark42 among others.

Licensed as Apache2.0.

So it is tied to Cloudflare for now, meaning even tho Cloudflare D1 is simply SQLite, you can't just run it anywhere other than CF. In our case your data can be exported as a plain SQLite dump (via npm run db:export) or json or CSV from the admin panel, whenever you need it. I used AI assistance heavily for this, coding, tests, and red-teaming. I review what goes in and CI catches a lot.