Add Turnstile protection to user actions

2026-09-18 00:39:14 +02:00
parent 79cd7f7475
commit 1970be29e7
25 changed files with 406 additions and 39 deletions
@@ -39,6 +39,14 @@ CRON_SECRET=replace-with-a-long-random-secret
 # links inside emails. Set this to the real domain in production.
 NEXT_PUBLIC_SERVER_URL=http://localhost:3000

+# Cloudflare Turnstile. The site key is public and is passed to the client
+# from the server; the secret is used only by the server-side Siteverify call.
+TURNSTILE_SITE_KEY=0x4AAAAAAE7AqgHiQF9DffQO
+TURNSTILE_SECRET_KEY=
+# Local development value. Production must contain only the public hostname:
+# TURNSTILE_HOSTNAMES=anouma.org
+TURNSTILE_HOSTNAMES=localhost,127.0.0.1
+
 # Port the app container publishes on the host (behind a reverse proxy this
 # usually doesn't need to be reachable directly - see DEPLOYMENT.md).
 APP_PORT=3000