Form Update

.env.example

@@ -19,20 +19,30 @@ SITE_URL=https://gregkilmer.com
 # neither is set, the API returns 503 so you can wire delivery later.
 
 # SMTP (nodemailer). CONTACT_TO is the inbox that receives submissions.
-# SMTP_HOST=
-# SMTP_PORT=587
-# SMTP_USER=
-# SMTP_PASS=
-# CONTACT_TO=greg@gregkilmer.com
-# SMTP_FROM="Greg's Site <no-reply@gregkilmer.com>"
+# Point this at your homelab SMTP relay (Postfix/Mailcow/etc.). The relay must
+# have SPF/DKIM/DMARC configured or mail will land in spam. Leave SMTP_HOST blank
+# to disable delivery (the API returns 503 until this is set).
+SMTP_HOST=
+SMTP_PORT=587
+SMTP_USER=
+SMTP_PASS=
+CONTACT_TO=contact@gregkilmer.com
+SMTP_FROM="Greg's Site <no-reply@gregkilmer.com>"
 
-# Optional webhook fallback (JSON POST).
+# Optional webhook fallback (JSON POST). Only used if SMTP_HOST is unset.
 # CONTACT_WEBHOOK_URL=
 
 # Honeypot / basic abuse control. Maximum submissions per IP per window.
 CONTACT_RATE_LIMIT=5
 CONTACT_RATE_WINDOW_MIN=15
 
+# --- Cloudflare Turnstile (bot protection) ----------------------------------
+# Get free keys at: https://dash.cloudflare.com/?to=/:account/turnstile
+# SITE_KEY is public (ships to the client); SECRET_KEY is server-only.
+# Leave both blank to skip Turnstile entirely (e.g. local dev).
+TURNSTILE_SITE_KEY=
+TURNSTILE_SECRET_KEY=
+
 # --- Gaming box-art tool ----------------------------------------------------
 # Used by scripts/fetch-box-art.mjs to download box/banner art for Gaming Hall
 # of Fame entries via the RAWG API. Get a free key at: