added env for gittea

.env

@@ -0,0 +1,2 @@
+VITE_CONTACT_API_URL=/api/contact
+VITE_TURNSTILE_SITE_KEY=0x4AAAAAACfQya1R13nGeuOy

.gitea/workflows/deploy.yaml

@@ -7,6 +7,8 @@ on:
 jobs:
   build-and-deploy:
     runs-on: vps-host
+    env:
+      CONTACT_HEALTH_URL: https://jodyholt.com/api/health
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -44,8 +46,19 @@ jobs:
 
       - name: Restart Contact API
         run: |
-          systemctl restart jody-contact-api
-          systemctl is-active --quiet jody-contact-api
+          set -euo pipefail
+          SYSTEMCTL_BIN="/usr/bin/systemctl"
+          if [ ! -x "$SYSTEMCTL_BIN" ]; then
+            SYSTEMCTL_BIN="/bin/systemctl"
+          fi
+          sudo -n "$SYSTEMCTL_BIN" restart jody-contact-api
+          sudo -n "$SYSTEMCTL_BIN" is-active --quiet jody-contact-api
+          echo "jody-contact-api service is active"
 
       - name: Health Check Contact API
-        run: curl --fail --silent http://127.0.0.1:8787/health
+        run: |
+          curl --fail --show-error --silent \
+            --retry 8 \
+            --retry-delay 2 \
+            --retry-all-errors \
+            "$CONTACT_HEALTH_URL"

.gitignore

@@ -1,35 +1,42 @@
+# Dependencies
 node_modules/
+contact-api/node_modules/
+
+# Build artifacts
+dist/
+build/
+contact-api/dist/
+coverage/
+*.tsbuildinfo
+.vite/
+
+# Logs
+*.log
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 pnpm-debug.log*
 
-# Build output
-dist/
-build/
-contact-api/dist/
+# Environment files (keep examples)
 
-# Vite cache
-.vite/
 
-# VSCode settings
+# Archives and local release bundles
+*.tgz
+*.tar
+*.tar.gz
+
+# Tool caches
+.eslintcache
+.nyc_output/
+
+# Editor / IDE
 .vscode/
-
-# Log files
-*.log
-
-# Environment variables
-.env
-.env.*.local
-contact-api/.env
+.idea/
+*.swp
+*.swo
+*~
 
 # OS generated
 .DS_Store
 Thumbs.db
 
-# Optional: lock files (if you use one package manager)
-# Uncomment the ones you're not using
-# yarn.lock
-# package-lock.json
-# pnpm-lock.yamlw
-

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jody Holt
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -84,6 +84,11 @@ Create `contact-api/.env` from `contact-api/.env.example` and set your real Turn
 - systemd unit template: `ops/jody-contact-api.service`
 - Nginx reverse proxy snippet: `ops/nginx-contact-api.conf`
 
+## License
+
+This project is licensed under the MIT License.  
+See `LICENSE` for full text.
+
 ## Author
 
 ### Jody Holt

contact-api/.env

@@ -0,0 +1,20 @@
+NODE_ENV=production 
+PORT=8787 
+CONTACT_ALLOWED_ORIGIN=https://jodyholt.com,https://www.jodyholt.com
+TURNSTILE_EXPECTED_HOSTNAME=jodyholt.com,www.jodyholt.com
+TURNSTILE_SECRET_KEY=0x4AAAAAACfQyRwRzwsEMIfVtCSkjz7__Yc
+TURNSTILE_EXPECTED_ACTION=contact_form 
+SMTP_HOST=mail.jodyholt.com 
+SMTP_PORT=587 
+SMTP_SECURE=false 
+SMTP_REQUIRE_TLS=true 
+SMTP_USER=portfolio-smtp
+SMTP_PASS=portfolio124521!
+MAIL_FROM_NAME=Portfolio Contact 
+MAIL_FROM_ADDRESS=contact@jodyholt.com 
+MAIL_TO_ADDRESS=you@jodyholt.com 
+MAIL_SUBJECT_PREFIX=[Portfolio Contact] 
+RATE_LIMIT_WINDOW_MS=600000 
+RATE_LIMIT_MAX=5 
+HONEYPOT_FIELD=website 
+MIN_SUBMIT_TIME_MS=3000 

contact-api/src/config.ts

@@ -10,7 +10,9 @@ const boolFromEnv = z
 const envSchema = z.object({
   NODE_ENV: z.enum(["development", "test", "production"]).default("development"),
   PORT: z.coerce.number().int().positive().default(8787),
-  CONTACT_ALLOWED_ORIGIN: z.string().url(),
+  // Comma-separated list of allowed browser origins, e.g.
+  // https://jodyholt.com,https://www.jodyholt.com
+  CONTACT_ALLOWED_ORIGIN: z.string().min(1),
   TURNSTILE_SECRET_KEY: z.string().min(1),
   TURNSTILE_EXPECTED_HOSTNAME: z.string().min(1),
   TURNSTILE_EXPECTED_ACTION: z.string().min(1).default("contact_form"),

contact-api/src/index.ts

@@ -16,6 +16,25 @@ type ApiErrorResponse = {
 const app = express();
 app.set("trust proxy", 1);
 
+const normalizeOrigin = (value: string): string => {
+  const cleaned = value
+    .trim()
+    .replace(/^['"]|['"]$/g, "")
+    .replace(/\/+$/g, "");
+
+  // Some clients can emit explicit default ports. URL.origin normalizes them.
+  try {
+    return new URL(cleaned).origin.toLowerCase();
+  } catch {
+    return cleaned.toLowerCase();
+  }
+};
+
+const allowedOrigins = config.CONTACT_ALLOWED_ORIGIN
+  .split(",")
+  .map(normalizeOrigin)
+  .filter((value, index, all) => value.length > 0 && all.indexOf(value) === index);
+
 app.use(
   pinoHttp({
     level: config.NODE_ENV === "production" ? "info" : "debug",
@@ -30,7 +49,13 @@ app.use(helmet());
 app.use(
   cors({
     origin(origin, callback) {
-      if (!origin || origin === config.CONTACT_ALLOWED_ORIGIN) {
+      if (!origin) {
+        callback(null, true);
+        return;
+      }
+
+      const normalizedOrigin = normalizeOrigin(origin);
+      if (allowedOrigins.includes(normalizedOrigin)) {
         callback(null, true);
         return;
       }

contact-api/src/turnstile.ts

@@ -7,6 +7,18 @@ type TurnstileVerifyResponse = {
   "error-codes"?: string[];
 };
 
+const normalizeHostname = (value: string): string =>
+  value
+    .trim()
+    .replace(/^['"]|['"]$/g, "")
+    .replace(/\.+$/g, "")
+    .toLowerCase();
+
+const expectedHostnames = config.TURNSTILE_EXPECTED_HOSTNAME
+  .split(",")
+  .map(normalizeHostname)
+  .filter((value, index, all) => value.length > 0 && all.indexOf(value) === index);
+
 export async function verifyTurnstileToken(
   token: string,
   remoteIp?: string,
@@ -36,7 +48,7 @@ export async function verifyTurnstileToken(
     return { ok: false, reason: codes };
   }
 
-  if (result.hostname !== config.TURNSTILE_EXPECTED_HOSTNAME) {
+  if (!result.hostname || !expectedHostnames.includes(normalizeHostname(result.hostname))) {
     return { ok: false, reason: "hostname_mismatch" };
   }
 

src/components/Contact.tsx

@@ -297,9 +297,7 @@ export function Contact() {
 
           <div className="space-y-2">
             <div ref={turnstileContainerRef} className="min-h-[66px]" />
-            {!TURNSTILE_SITE_KEY && (
-              <p className="text-xs text-contrast">Set `VITE_TURNSTILE_SITE_KEY` to enable submissions.</p>
-            )}
+            
             {TURNSTILE_SITE_KEY && !turnstileReady && (
               <p className="text-xs text-text/65">Loading human verification...</p>
             )}