# =============================================================================
# Greg Kilmer Profile Site - Environment Variables
# =============================================================================
# Copy this file to `.env` (local dev) or pass via Cosmos container environment.
# Never commit your real `.env`. All values are optional unless noted.
# =============================================================================

# --- Server -----------------------------------------------------------------
# Port and host the Node server binds to. Cosmos reverse proxy should forward here.
PORT=4321
HOST=0.0.0.0

# Canonical site URL (used for absolute metadata URLs and API responses).
SITE_URL=https://gregkilmer.com

# --- Contact form -> /api/contact -------------------------------------------
# Two delivery modes. If SMTP is configured, email is sent. Otherwise, if a webhook
# URL is set, the payload is POSTed there (e.g. a Discord/Slack/n8n webhook). If
# neither is set, the API returns 503 so you can wire delivery later.

# SMTP (nodemailer). CONTACT_TO is the inbox that receives submissions.
# Point this at your homelab SMTP relay (Postfix/Mailcow/etc.). The relay must
# have SPF/DKIM/DMARC configured or mail will land in spam. Leave SMTP_HOST blank
# to disable delivery (the API returns 503 until this is set).
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASS=
CONTACT_TO=contact@gregkilmer.com
SMTP_FROM="Greg's Site <no-reply@gregkilmer.com>"
# Set to "true" to accept a self-signed TLS certificate on the SMTP connection.
# Only enable when the relay is on a trusted private network (e.g. the homelab
# Docker network) and presents a self-signed cert. Defaults to false (verify).
SMTP_ALLOW_SELFSIGNED=

# Optional webhook fallback (JSON POST). Only used if SMTP_HOST is unset.
# CONTACT_WEBHOOK_URL=

# --- Store order form -> /api/order -----------------------------------------
# Reuses the SMTP/relay settings above. ORDER_TO is the inbox that receives
# order requests; if blank it falls back to CONTACT_TO. No payment is taken;
# the form only collects an order request that is emailed to you. The order
# form is hard-gated by src/data/store-availability.json (ordersOpen).
ORDER_TO=orders@gregkilmer.com

# Honeypot / basic abuse control. Maximum submissions per IP per window.
CONTACT_RATE_LIMIT=5
CONTACT_RATE_WINDOW_MIN=15

# --- Cloudflare Turnstile (bot protection) ----------------------------------
# Get free keys at: https://dash.cloudflare.com/?to=/:account/turnstile
# SITE_KEY is public (ships to the client); SECRET_KEY is server-only.
# Leave both blank to skip Turnstile entirely (e.g. local dev).
TURNSTILE_SITE_KEY=
TURNSTILE_SECRET_KEY=

# --- Gaming box-art tool ----------------------------------------------------
# Used by scripts/fetch-box-art.mjs to download box/banner art for Gaming Hall
# of Fame entries via the RAWG API. Get a free key at:
#   https://rawg.io/login?forward=developer
RAWG_API_KEY=

# --- Media poster tool ------------------------------------------------------
# Used by scripts/fetch-tmdb-art.mjs to download posters for Movies and TV
# favorites via the TMDB API. Get a free key at:
#   https://www.themoviedb.org/settings/api
# (Anime and Reading cover fetchers use keyless APIs — no env needed.)
TMDB_API_KEY=