added all for contact form, now test

Updated theme system section to use proper markdown formatting.

.env

@@ -1,2 +0,0 @@
-VITE_CONTACT_API_URL=/api/contact
-VITE_TURNSTILE_SITE_KEY=0x4AAAAAACfQya1R13nGeuOy

.gitea/workflows/deploy.yaml

@@ -7,8 +7,6 @@ on:
 jobs:
   build-and-deploy:
     runs-on: vps-host
-    env:
-      CONTACT_HEALTH_URL: https://jodyholt.com/api/health
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -46,19 +44,8 @@ jobs:
 
       - name: Restart Contact API
         run: |
-          set -euo pipefail
+          systemctl restart jody-contact-api
-          SYSTEMCTL_BIN="/usr/bin/systemctl"
+          systemctl is-active --quiet jody-contact-api
-          if [ ! -x "$SYSTEMCTL_BIN" ]; then
-            SYSTEMCTL_BIN="/bin/systemctl"
-          fi
-          sudo -n "$SYSTEMCTL_BIN" restart jody-contact-api
-          sudo -n "$SYSTEMCTL_BIN" is-active --quiet jody-contact-api
-          echo "jody-contact-api service is active"
 
       - name: Health Check Contact API
-        run: |
+        run: curl --fail --silent http://127.0.0.1:8787/health
-          curl --fail --show-error --silent \
-            --retry 8 \
-            --retry-delay 2 \
-            --retry-all-errors \
-            "$CONTACT_HEALTH_URL"

.gitignore

@@ -1,42 +1,35 @@
-# Dependencies
 node_modules/
-contact-api/node_modules/
-
-# Build artifacts
-dist/
-build/
-contact-api/dist/
-coverage/
-*.tsbuildinfo
-.vite/
-
-# Logs
-*.log
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 pnpm-debug.log*
 
-# Environment files (keep examples)
+# Build output
+dist/
+build/
+contact-api/dist/
 
+# Vite cache
+.vite/
 
-# Archives and local release bundles
+# VSCode settings
-*.tgz
-*.tar
-*.tar.gz
-
-# Tool caches
-.eslintcache
-.nyc_output/
-
-# Editor / IDE
 .vscode/
-.idea/
+
-*.swp
+# Log files
-*.swo
+*.log
-*~
+
+# Environment variables
+.env
+.env.*.local
+contact-api/.env
 
 # OS generated
 .DS_Store
 Thumbs.db
 
+# Optional: lock files (if you use one package manager)
+# Uncomment the ones you're not using
+# yarn.lock
+# package-lock.json
+# pnpm-lock.yamlw
+

LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Jody Holt
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

README.md

@@ -84,11 +84,6 @@ Create `contact-api/.env` from `contact-api/.env.example` and set your real Turn
 - systemd unit template: `ops/jody-contact-api.service`
 - Nginx reverse proxy snippet: `ops/nginx-contact-api.conf`
 
-## License
-
-This project is licensed under the MIT License.  
-See `LICENSE` for full text.
-
 ## Author
 
 ### Jody Holt

contact-api/.env

@@ -1,20 +0,0 @@
-NODE_ENV=production 
-PORT=8787 
-CONTACT_ALLOWED_ORIGIN=https://jodyholt.com,https://www.jodyholt.com
-TURNSTILE_EXPECTED_HOSTNAME=jodyholt.com,www.jodyholt.com
-TURNSTILE_SECRET_KEY=0x4AAAAAACfQyRwRzwsEMIfVtCSkjz7__Yc
-TURNSTILE_EXPECTED_ACTION=contact_form 
-SMTP_HOST=mail.jodyholt.com 
-SMTP_PORT=587 
-SMTP_SECURE=false 
-SMTP_REQUIRE_TLS=true 
-SMTP_USER=portfolio-smtp
-SMTP_PASS=portfolio124521!
-MAIL_FROM_NAME=Portfolio Contact 
-MAIL_FROM_ADDRESS=contact@jodyholt.com 
-MAIL_TO_ADDRESS=you@jodyholt.com 
-MAIL_SUBJECT_PREFIX=[Portfolio Contact] 
-RATE_LIMIT_WINDOW_MS=600000 
-RATE_LIMIT_MAX=5 
-HONEYPOT_FIELD=website 
-MIN_SUBMIT_TIME_MS=3000 

contact-api/src/config.ts

@@ -10,9 +10,7 @@ const boolFromEnv = z
 const envSchema = z.object({
   NODE_ENV: z.enum(["development", "test", "production"]).default("development"),
   PORT: z.coerce.number().int().positive().default(8787),
-  // Comma-separated list of allowed browser origins, e.g.
+  CONTACT_ALLOWED_ORIGIN: z.string().url(),
-  // https://jodyholt.com,https://www.jodyholt.com
-  CONTACT_ALLOWED_ORIGIN: z.string().min(1),
   TURNSTILE_SECRET_KEY: z.string().min(1),
   TURNSTILE_EXPECTED_HOSTNAME: z.string().min(1),
   TURNSTILE_EXPECTED_ACTION: z.string().min(1).default("contact_form"),

contact-api/src/index.ts

@@ -16,25 +16,6 @@ type ApiErrorResponse = {
 const app = express();
 app.set("trust proxy", 1);
 
-const normalizeOrigin = (value: string): string => {
-  const cleaned = value
-    .trim()
-    .replace(/^['"]|['"]$/g, "")
-    .replace(/\/+$/g, "");
-
-  // Some clients can emit explicit default ports. URL.origin normalizes them.
-  try {
-    return new URL(cleaned).origin.toLowerCase();
-  } catch {
-    return cleaned.toLowerCase();
-  }
-};
-
-const allowedOrigins = config.CONTACT_ALLOWED_ORIGIN
-  .split(",")
-  .map(normalizeOrigin)
-  .filter((value, index, all) => value.length > 0 && all.indexOf(value) === index);
-
 app.use(
   pinoHttp({
     level: config.NODE_ENV === "production" ? "info" : "debug",
@@ -49,13 +30,7 @@ app.use(helmet());
 app.use(
   cors({
     origin(origin, callback) {
-      if (!origin) {
+      if (!origin || origin === config.CONTACT_ALLOWED_ORIGIN) {
-        callback(null, true);
-        return;
-      }
-
-      const normalizedOrigin = normalizeOrigin(origin);
-      if (allowedOrigins.includes(normalizedOrigin)) {
         callback(null, true);
         return;
       }

contact-api/src/turnstile.ts

@@ -7,18 +7,6 @@ type TurnstileVerifyResponse = {
   "error-codes"?: string[];
 };
 
-const normalizeHostname = (value: string): string =>
-  value
-    .trim()
-    .replace(/^['"]|['"]$/g, "")
-    .replace(/\.+$/g, "")
-    .toLowerCase();
-
-const expectedHostnames = config.TURNSTILE_EXPECTED_HOSTNAME
-  .split(",")
-  .map(normalizeHostname)
-  .filter((value, index, all) => value.length > 0 && all.indexOf(value) === index);
-
 export async function verifyTurnstileToken(
   token: string,
   remoteIp?: string,
@@ -48,7 +36,7 @@ export async function verifyTurnstileToken(
     return { ok: false, reason: codes };
   }
 
-  if (!result.hostname || !expectedHostnames.includes(normalizeHostname(result.hostname))) {
+  if (result.hostname !== config.TURNSTILE_EXPECTED_HOSTNAME) {
     return { ok: false, reason: "hostname_mismatch" };
   }
 

src/components/Contact.tsx

@@ -297,7 +297,9 @@ export function Contact() {
 
           <div className="space-y-2">
             <div ref={turnstileContainerRef} className="min-h-[66px]" />
-            
+            {!TURNSTILE_SITE_KEY && (
+              <p className="text-xs text-contrast">Set `VITE_TURNSTILE_SITE_KEY` to enable submissions.</p>
+            )}
             {TURNSTILE_SITE_KEY && !turnstileReady && (
               <p className="text-xs text-text/65">Loading human verification...</p>
             )}