refactor: rename CLUSTER_API_TOKEN to BIT_RELAY_AUTH_TOKEN

Public relay runs without API auth for P2P access.
BIT_RELAY_AUTH_TOKEN is available for private relay deployments.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: mizchi

README.md

@@ -49,10 +49,10 @@ Clone side → (response resolved)
 
 ## Auth
 
-`CLUSTER_API_TOKEN` を設定すると `/api/v1/*` と `/ws` で Bearer 認証を要求します。
+`BIT_RELAY_AUTH_TOKEN` を設定すると `/api/v1/*` と `/ws` で Bearer 認証を要求します。
 
 ```bash
-export CLUSTER_API_TOKEN='secret-token'
+export BIT_RELAY_AUTH_TOKEN='secret-token'
 ```
 
 ## Signing / TOFU
@@ -123,7 +123,7 @@ optional env:
 
 - `HOST` (default: `127.0.0.1`)
 - `PORT` (default: `8788`)
-- `CLUSTER_API_TOKEN`
+- `BIT_RELAY_AUTH_TOKEN`
 - `RELAY_MAX_MESSAGES_PER_ROOM` (default: `1000`)
 - `PUBLISH_PAYLOAD_MAX_BYTES` (default: `65536`)
 - `RELAY_PUBLISH_LIMIT_PER_WINDOW` (default: `30`)

docs/host-bit-relay.md

@@ -2,6 +2,8 @@
 
 This guide explains how to deploy your own bit-relay instance on Cloudflare Workers.
 
+The public instance (`bit-relay.mizchi.workers.dev`) runs without API authentication so that anyone can participate in the P2P network. If you need a private relay for your team, deploy your own and configure `BIT_RELAY_AUTH_TOKEN`.
+
 ## Prerequisites
 
 - A [Cloudflare account](https://dash.cloudflare.com/sign-up)
@@ -62,7 +64,7 @@ All configuration is done via environment variables (set in the Cloudflare dashb
 
 | Variable | Description | Default |
 |----------|-------------|---------|
-| `CLUSTER_API_TOKEN` | Bearer token for API authentication | (none, open) |
+| `BIT_RELAY_AUTH_TOKEN` | Bearer token for API authentication. When set, all `/api/v1/*` and `/ws` requests require this token. Leave unset for a public relay. | (none, open) |
 
 ### Signature Verification
 
@@ -103,8 +105,8 @@ All configuration is done via environment variables (set in the Cloudflare dashb
 ## Example: Setting Secrets
 
 ```bash
-# Require authentication
-wrangler secret put CLUSTER_API_TOKEN
+# Require API authentication (for private relays)
+wrangler secret put BIT_RELAY_AUTH_TOKEN
 
 # Disable signature requirement (for testing)
 wrangler secret put RELAY_REQUIRE_SIGNATURE

src/cloudflare_worker.ts

@@ -41,7 +41,7 @@ interface DurableObjectStateLike {
 export interface RelayWorkerEnv {
   RELAY_ROOM?: DurableObjectNamespaceLike;
   GIT_SERVE_SESSION?: DurableObjectNamespaceLike;
-  CLUSTER_API_TOKEN?: string;
+  BIT_RELAY_AUTH_TOKEN?: string;
   RELAY_MAX_MESSAGES_PER_ROOM?: string;
   PUBLISH_PAYLOAD_MAX_BYTES?: string;
   RELAY_PUBLISH_LIMIT_PER_WINDOW?: string;
@@ -101,7 +101,7 @@ function parseBoolean(raw: string | undefined, fallback: boolean): boolean {
 
 function buildOptions(env: RelayWorkerEnv): MemoryRelayOptions {
   return {
-    authToken: env.CLUSTER_API_TOKEN,
+    authToken: env.BIT_RELAY_AUTH_TOKEN,
     maxMessagesPerRoom: parsePositiveInt(
       env.RELAY_MAX_MESSAGES_PER_ROOM,
       DEFAULT_MAX_MESSAGES_PER_ROOM,

src/deno_main.ts

@@ -52,7 +52,7 @@ function parseBoolean(raw: string | undefined, fallback: boolean): boolean {
 
 function optionsFromEnv(): MemoryRelayOptions {
   return {
-    authToken: Deno.env.get('CLUSTER_API_TOKEN') ?? undefined,
+    authToken: Deno.env.get('BIT_RELAY_AUTH_TOKEN') ?? undefined,
     maxMessagesPerRoom: parsePositiveInt(
       Deno.env.get('RELAY_MAX_MESSAGES_PER_ROOM') ?? undefined,
       DEFAULT_MAX_MESSAGES_PER_ROOM,