Self-hosted comments. Yours forever.

Garrul is an open-source comment system that runs on Cloudflare Workers. Your data lives in your account, your costs stay predictable, and the embed is two lines of HTML.

Star on GitHub Install in 20 minutes

TypeScript · Cloudflare Workers + D1 + KV · ~17 KB embed

Why Garrul

No vendor lock-in

Disqus, Commento, and friends own your comments. Garrul stores every thread in your own Cloudflare D1 database. Export them, migrate them, or pull the plug whenever you want.

Privacy by default

IP addresses are hashed with HMAC-SHA-256 before they touch storage. No third-party trackers, no ad networks, no surprise PII collection. What you log is what you see.

Predictable cost

One Cloudflare Worker per site. No per-comment billing, no per-pageview surcharges. Small blogs typically sit entirely inside Cloudflare's free tiers.

Features

  • Threaded markdown

    Nested replies with full markdown, reactions, and edit/delete windows.

  • OAuth + anonymous

    Sign in with GitHub or Google, or post anonymously with Turnstile and rate-limiting.

  • Shadow-DOM embed

    One ~17 KB script. Style isolation via Shadow DOM, theme variables, iframe fallback.

  • Email digests + RSS

    Subscribers get digests; everyone gets RSS feeds, comment counts, and permalinks.

  • Admin moderation

    Built-in queue, user management, banning, and bulk actions — no extra service.

  • Webhooks

    Every comment event fires a webhook. Pipe into Discord, Slack, or your own service.

  • Hashed IPs

    HMAC-SHA-256 with a server-side secret. Rate limit without storing raw addresses.

  • Workers analytics

    First-class metrics via Cloudflare Workers Analytics Engine. Tail logs in real time.

How it works

Edge runtime. Garrul is a single Cloudflare Worker. Requests are served from the nearest Cloudflare data center — usually under 50 ms — without a long-running server to keep alive.

Your data, your account. Comments live in a D1 SQLite database; sessions and rate-limit counters live in KV. Both belong to you, billed to you, exportable by you.

Your domain. Bind the Worker to a custom hostname (e.g. comments.yourblog.com). The embed talks to your domain, not a third party — no CORS surprises, no tracker blocklists.

Quick install

Once Garrul is deployed to your Cloudflare account, embedding comments on any page is two lines of HTML:

<div id="garrul" data-slug="my-post"></div>
<script async src="https://comments.example.com/embed.js"></script>

The script is roughly 17 KB, loads asynchronously, and renders inside a Shadow DOM so your page styles stay isolated. Theme variables let you match your blog without a custom build.

Full setup — Worker, D1, KV, OAuth (GitHub and Google), Turnstile, and a custom domain — takes about 20 minutes. The INSTALL guide on GitHub walks through every step with copy-paste commands.

What it costs

Effectively free on Cloudflare's free tier for small and medium blogs.

  • Workers: 100,000 requests/day free, then $5 / 10 million requests.
  • D1: 5 GB storage and 5 million row-reads/day free.
  • KV: 100,000 reads/day and 1,000 writes/day free.
  • Turnstile: Free, unlimited.

If you start paying, it's because you're getting a lot of traffic — and the bill is still pennies per thousand comments.

FAQ

How is this different from Disqus?

Disqus is a SaaS — your comments live on their servers, alongside their ad network and trackers. Garrul is something you deploy yourself. The comments live in your Cloudflare account, the embed loads from your domain, and there are no third-party scripts to block.

Is it GDPR-friendly?

Garrul does not log raw IP addresses (they're HMAC-hashed before storage), does not set ad-tracking cookies, and does not send data to third parties. You remain the data controller, so GDPR obligations are yours, but Garrul gives you the levers — full export, full delete — to honour user requests.

What gets stored about commenters?

For OAuth users: provider, provider user ID, display name, avatar URL. For anonymous: display name and a hashed IP. Comment bodies are stored as markdown. Sessions and rate-limit counters live in KV with short TTLs.

Can I migrate away later?

Yes. D1 is SQLite — you can dump the database to a file at any time. The schema is documented in the repository. Importers and exporters for common comment formats are on the roadmap.

Who maintains Garrul?

Garrul is an open-source project maintained on GitHub. You can support development through GitHub Sponsors or Ko-fi.

Is it production-ready?

The deployment path is documented end-to-end (Workers, D1, KV, OAuth, Turnstile, custom domain) and the project is actively maintained. Production usage is encouraged; please open issues for anything that bites.

Talk to us

These comments are powered by Garrul. Yes, really.