feat: protect auth with Turnstile

2026-07-30 23:08:36 +02:00
parent 6382e83e28
commit 9cd2e5c2e3
7 changed files with 127 additions and 7 deletions
@@ -16,6 +16,10 @@ JOBTRACKER_CONNECTION_STRING=
 AUTH_JWT_KEY=CHANGE_ME_LONG_RANDOM_SECRET
 AUTH_ADMIN_EMAIL=admin@example.com
 AUTH_ADMIN_PASSWORD=CHANGE_ME_STRONG_PASSWORD
+# Public signup remains closed until explicitly enabled. Configure both Turnstile keys first.
+AUTH_ALLOW_REGISTRATION=false
+TURNSTILE_SITE_KEY=
+TURNSTILE_SECRET_KEY=
 AUTH_GOOGLE_CLIENT_ID=CHANGE_ME_GOOGLE_CLIENT_ID
 # Optional: enables the "Continue with Microsoft" sign-in tab (separate from the
 # MICROSOFT_CLIENT_ID below, which is for Outlook mail linking, not sign-in).