No container, no VPS, no database server, nothing to patch. Two credentials and you're live — every comment in your own D1 database, served from your own domain, behind two lines of HTML.
Disqus, Commento, and friends own your comments. Garrul stores every thread in your own Cloudflare D1 database. Run npm run db:export, or download a full-site JSON or CSV export from the admin panel, whenever you like — no exit tax, no scraping your own comments back out.
IP addresses are hashed with HMAC-SHA-256 before they touch storage. No third-party trackers, no ad networks, no surprise PII collection. What you log is what you see.
One Cloudflare Worker per site. No per-comment billing, no per-pageview surcharges. Small blogs typically sit entirely inside Cloudflare's free tiers.
Nested replies with full markdown, reactions, edit/delete windows, and collapsible threads with configurable pagination. Readers sort by top, newest, or oldest — and you set which order a thread opens in.
Sign in with GitHub, Google, Discord, Facebook, or X — or post anonymously with Turnstile and rate-limiting.
Upvotes and downvotes, each independently switchable, plus one-tap reporting with per-network dedup. Report counts stay operator-only.
Emoji reactions on comments and on the page itself, with six opt-in kinds beyond the defaults. You choose and order the emoji per surface from the admin settings. The page-level bar can also mount alone with data-mode="reactions" — one request, no thread, no composer.
RSS feeds for any thread or the whole site, plus comment counts and stable permalinks you can link straight to.
The widget ships in twelve languages — English, German, Spanish, French, Italian, Dutch, Japanese, Portuguese, Polish, Norwegian Bokmål, Traditional Chinese, and Arabic — with full right-to-left support, real keyboard shortcuts, and relative timestamps in the reader's own timezone.
A reader ticks a box in the composer — or presses the 🔔 to follow a thread without commenting at all — confirms by double opt-in, and gets a debounced digest of new comments. Plain email; there is no webhook anywhere in that path. Needs a Resend API key.
A digest of whatever is waiting for approval or has been reported, sent to your admin addresses. Off by default — an upgrade shouldn't start sending mail unasked — and toggled from /admin/settings without a deploy.
A signed POST on every comment event, for anything custom. Pipe it into Discord, Slack, or your own service.
Moderate from your phone: approve, delete, and ban inline. Query the queue and stats with slash commands, plus an optional daily digest.
Digests carry RFC 8058 headers, so Gmail and Apple Mail show their own Unsubscribe button — no page to visit. The link in the footer also lists every other thread that address follows, with an unsubscribe-from-all.
Built-in queue, user management, banning, and bulk actions — no extra service.
Work the moderation queue from the keyboard. Private notes attach to a comment or a user, and a count badge in the queue shows there is context before you decide.
Pin a top-level comment to the top of its thread from the admin panel. The widget marks it with a pinned badge, so an announcement or a best answer stays where readers land.
Post as staff from the widget's composer, under a badge label you set. It needs a signed-in session, so the badge cannot be claimed by typing a name.
Turnstile, rate limiting, markdown sanitizing, and a honeypot are always on, and one setting extends the Turnstile challenge to signed-in commenters when someone starts scripting throwaway accounts. Akismet or a Workers AI decision model optionally stack on top — flagged comments queue, never silently dropped.
The optional AI check runs Cloudflare's Clef-flash, a decision model rather than a chat LLM. It answers one question — is this spam? — with a probability, never free text. You set the cut-off (70% by default) and see each comment's score in the admin panel. It runs on your own Workers AI binding, so the comment never leaves Cloudflare, and one check costs about 1–3 neurons — the free daily allowance covers a few thousand comments.
Marking a comment spam, holding it, or deleting it no longer takes its approved replies with it — the parent shows as an anonymous “[removed by a moderator]” placeholder. When the whole branch is spam, Spam thread marks a comment and every reply below it in one atomic step, up to 100 comments, and audits each change with its previous status.
One term per line, matched against the comment body, the author's name, and the page URL — whole words by default, with * if you want it. Maintained from /admin/settings, because this is the one filter you tune by reading your own queue.
An anonymous commenter cannot post under a name a signed-in regular already uses, or one on your reserved list. Each name from a network is its own identity, and the verified badge names the provider that vouched for it.
Answer a comment straight from the queue or its own page, with a markdown preview before you post. Saved replies — which can carry variables — prefill the box for the answers you'd otherwise type fifty times, and Save for reuse turns anything you've just written into one.
One ~22 KB gzipped script, under a 30 KB ceiling enforced in CI. The widget cannot leak styles into your page or inherit them — a class of bug the plain script-tag competitors ship with. Iframe fallback if you'd rather — its page can be served as a static asset, so it costs the same Worker requests as the script tag.
A thread loads on one API call — /bootstrap for the config, your session, and the first page of comments. The per-reader form token the anti-spam timing check needs waits until the reader focuses the composer, so readers who only read never fetch it. Down from four, or six with reactions and votes on.
Worked examples for Astro, Hugo, Jekyll, WordPress, and plain HTML — with iframe and lazy-load variants.
Bring threads over from Disqus, Remark42, Comentario or Commento, isso, or Cusdis — from the admin UI or the CLI. Moderation state carries across, gzipped exports are accepted, and re-running an import never overwrites a decision you made here.
23 --garrul-* variables under a semver stability guarantee, plus shipped minimal, soft, and contrast presets — so it looks intentional before you write a line of CSS. Build a theme against a live preview and copy the snippet.
Toggle comments, reactions, votes, and page-level engagement from the admin settings page. A saved setting beats the env var — no redeploy.
First-class metrics via Cloudflare Workers Analytics Engine. Tail logs in real time.
The admin dashboard charts today's Workers, D1, KV, and Workers AI usage against the free-tier ceilings, so you see a bill coming before it arrives.
HMAC-SHA-256 with a server-side secret. Rate limit without storing raw addresses.
Edge runtime. Garrul is a single Cloudflare Worker. Requests are served from the nearest Cloudflare data center — usually under 50 ms — without a long-running server to keep alive.
Your data, your account. Comments live in a D1 SQLite database; sessions and rate-limit counters live in KV. Both belong to you, billed to you, exportable by you.
Your domain. Bind the Worker to a custom hostname (e.g. comments.yourblog.com). The embed talks to your domain, not a third party — no CORS surprises, no tracker blocklists.
See the full architecture diagram, including the optional services.
Twenty minutes once. After that, one dry-runnable command per release.
npm run upgrade detects config drift, prints the release notes, and shows you the plan before it changes anything. There is no server to patch between those runs, because there is no server.
Once Garrul is deployed to your Cloudflare account, embedding comments on any page is two lines of HTML:
<div id="garrul" data-slug="my-post"></div>
<script async src="https://comments.example.com/embed.js"></script>The script is roughly 22 KB gzipped, loads asynchronously, and renders inside a Shadow DOM so your page styles stay isolated. Pick one of the shipped minimal, soft, or contrast presets, or override the theme variables to match your blog — either way, without a custom build.
npm run setup walks you through it and puts a working instance on a *.workers.dev URL in a few minutes. Point a custom domain at it later, once you've decided to keep it. DNS is not a prerequisite for trying this.
Two credentials: a Turnstile site key and secret key. That is the entire required list — everything else is optional or generated for you. OAuth providers, a Resend API key for email notifications, Akismet, a Telegram bot, and a custom domain are all things you add when you want them, not hurdles between you and a working comment thread.
The full path — Worker, D1, KV, and the optional extras — takes about twenty minutes end to end. The INSTALL guide on GitHub walks through every step with copy-paste commands.
Free until you're big — and then it's Cloudflare's prices, not ours. There is no Garrul tier, no per-seat count, and nothing to upgrade to.
If you start paying, it's because you're getting a lot of traffic — and the bill is still pennies per thousand comments.
Checked 1 August 2026 against Cloudflare's own docs: Workers, D1, KV, and Turnstile. Cloudflare revises these limits from time to time — check the source before you budget on them.
Disqus is a SaaS — your comments live on their servers, alongside their ad network and trackers. Garrul is something you deploy yourself. The comments live in your Cloudflare account, the embed loads from your domain, and there are no third-party scripts to block.
Garrul does not log raw IP addresses (they're HMAC-hashed before storage), does not set ad-tracking cookies, and ships no advertising or analytics trackers in the embed. You remain the data controller, so GDPR obligations are yours, but Garrul gives you the levers — full export, full delete — to honour user requests. This site's own privacy policy is a worked example you can crib from.
Plain email, not a webhook. A reader ticks a box in the composer, or presses the 🔔 in the thread toolbar to follow a thread without commenting at all. They confirm by double opt-in — nothing is ever delivered to an unconfirmed address — and from then on receive a debounced digest rather than a message per comment. A reader signed in with a provider-verified address is confirmed on the spot, since the provider already proved they control the inbox. It needs a Resend API key and nothing else.
Worth being precise about the scope: subscriptions are post-scoped. You get every new comment on a thread you subscribed to, not only the direct replies to your own comment. Per-parent-author scoping is on the backlog, not shipped. Moderators are separate — they can opt into their own digest of whatever is queued or reported, off by default.
Getting out takes four routes, and three of them need no account: the Unsubscribe button your mail client shows next to the sender, because digests carry RFC 8058 List-Unsubscribe headers; the link at the bottom of every digest; that link's landing page, which lists every other thread the address follows with a per-row unsubscribe and an unsubscribe-from-all; and, for a reader signed in with a verified address, a Manage subscriptions panel in the widget itself.
For OAuth users: provider, provider user ID, display name, avatar URL, and the email address if the provider reports it as verified. For anonymous: display name and a hashed IP. Every comment also carries a hashed IP and the browser user-agent string for spam triage. Comment bodies are stored as markdown plus rendered HTML. Rate-limit counters live in KV with short TTLs; sign-in sessions expire after 30 days. Full detail in the privacy policy.
Yes. D1 is SQLite — you can dump the database to a file at any time. The schema is documented in the repository. Getting in is covered too — Garrul imports from Disqus, Remark42, Comentario, Commento, isso, and Cusdis, so you can bring your existing threads with you. Out is covered too: the admin panel downloads every post, comment, and user as JSON or CSV.
One person: KingPin. Garrul started as a replacement for Disqus on my own site — the ads were embarrassing, and every alternative wanted a server I didn't want to run. It has been developed in the open on GitHub ever since. Issues and pull requests get read; you can also reach me at [email protected]. If it's useful to you, GitHub Sponsors and Ko-fi keep it going.
The thread doesn't update itself — there are no live updates, so a reader sees new comments on refresh rather than as they land. There are no image uploads, no @mentions, and no search within a comment thread.
One Worker serves one site; running several sites means several deploys, and proper multi-tenancy is a v2 question rather than a setting. The widget your readers see is translated and handles right-to-left layouts, but the admin UI and the Telegram bot are English-only by design.
None of these are secret — they're just easier to hear now than after you've deployed.
It has been in steady development since the first tagged release in May 2026, with new releases landing most weeks — the release history is the honest record of the pace. The deployment path is documented end-to-end (Workers, D1, KV, OAuth, Turnstile, custom domain), and the live comment section further up this page runs the same code you would deploy. Two things worth being straight about: it is maintained by one person, and it is young. Production use is encouraged; please open issues for anything that bites.
You need Cloudflare. Garrul isn't a Node app that happens to deploy to Workers — it's built on Workers directly, with comments in D1, sessions and rate limits in KV, and wrangler as the deploy tool. There's no Docker image and no VPS install path, and adding one would mean rewriting the storage layer. If you specifically want comments on a box you own outright, Commento, Isso, and Remark42 are the honest recommendations. If Cloudflare is fine by you, that same constraint is what keeps the bill near zero and the ops work near nil.
Talk to us
This is a live Garrul instance — the same code you'd deploy, running on one Worker. Post something and see for yourself. Yes, really.