Use Cloudflare Turnstile secret env name

.env.example

@@ -22,8 +22,8 @@ JWT_SECRET=super_secret_jwt_key_123
 
 # --- CAPTCHA / Bot Protection (Optional) ---
 # Create keys in Cloudflare Turnstile and set both values in production.
-# When TURNSTILE_SECRET_KEY is empty, backend CAPTCHA enforcement is disabled.
-TURNSTILE_SECRET_KEY=
+# When TURNSTILE_SECRET is empty, backend CAPTCHA enforcement is disabled.
+TURNSTILE_SECRET=
 
 # --- Frontend Configuration (Optional) ---
 # If you need to override the API URL for the frontend

README.md

@@ -112,11 +112,11 @@ N8N_WHATSAPP_TRIGGER_URL
 ADMIN_EMAIL
 ADMIN_PASSWORD
 JWT_SECRET
-TURNSTILE_SECRET_KEY
+TURNSTILE_SECRET
 VITE_TURNSTILE_SITE_KEY
 ```
 
-`TURNSTILE_SECRET_KEY` enables backend CAPTCHA enforcement on `/api/login`.
+`TURNSTILE_SECRET` enables backend CAPTCHA enforcement on `/api/login`.
 Set `VITE_TURNSTILE_SITE_KEY` at frontend build time to show Cloudflare Turnstile
 on the login page.
 

backend/config.js

@@ -8,5 +8,5 @@ module.exports = {
     JWT_SECRET: process.env.JWT_SECRET || 'super_secret_jwt_key_123',
     DATABASE_URL: process.env.DATABASE_URL || 'postgres://graphuser:graphpassword@localhost:5432/graphdb',
     N8N_WHATSAPP_TRIGGER_URL: process.env.N8N_WHATSAPP_TRIGGER_URL || 'http://localhost:5678/webhook/whatsapp',
-    TURNSTILE_SECRET_KEY: process.env.TURNSTILE_SECRET_KEY || ''
+    TURNSTILE_SECRET: process.env.TURNSTILE_SECRET || process.env.TURNSTILE_SECRET_KEY || ''
 };

backend/routes/authRoutes.js

@@ -1,17 +1,17 @@
 const express = require('express');
 const { login } = require('../auth');
-const { TURNSTILE_SECRET_KEY } = require('../config');
+const { TURNSTILE_SECRET } = require('../config');
 
 const router = express.Router();
 const TURNSTILE_VERIFY_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
 
 const verifyCaptcha = async (captchaToken, remoteIp) => {
-    if (!TURNSTILE_SECRET_KEY) return true;
+    if (!TURNSTILE_SECRET) return true;
     if (!captchaToken || typeof captchaToken !== 'string') return false;
 
     try {
         const formData = new URLSearchParams({
-            secret: TURNSTILE_SECRET_KEY,
+            secret: TURNSTILE_SECRET,
             response: captchaToken
         });
 

docker-compose.yml

@@ -27,7 +27,7 @@ services:
       - ADMIN_PASSWORD=${ADMIN_PASSWORD:-admin123}
       - JWT_SECRET=${JWT_SECRET:-super_secret_jwt_key_123}
       - N8N_WHATSAPP_TRIGGER_URL=${N8N_WHATSAPP_TRIGGER_URL:-http://localhost:5678/webhook/whatsapp}
-      - TURNSTILE_SECRET_KEY=${TURNSTILE_SECRET_KEY:-}
+      - TURNSTILE_SECRET=${TURNSTILE_SECRET:-${TURNSTILE_SECRET_KEY:-}}
     depends_on:
       - db
     restart: unless-stopped