olsch01
04ef642775
The calculator endpoint was open to anyone, and it has been collecting spam submissions. Add a layered guard that runs before anything is written to the DB or sent to the AI provider: - Cloudflare Turnstile CAPTCHA, verified server-side (active when TURNSTILE_* keys are configured; fails closed if unverifiable) - Honeypot field that only bots fill in - Signed, single-use form token enforcing a 4s minimum fill time - Per-IP rate limiting (5 per 10 min, 25 per 24h) Layers 2-4 need no configuration and work on their own, so submissions are throttled immediately; adding Turnstile keys upgrades it to a full challenge. Blocked submissions now stop the flow client-side instead of silently showing a result. Also sets `trust proxy` for correct client IPs behind nginx, caps the JSON body at 32kb, and fixes a latent ReferenceError in the "AI not configured" branch that called saveCalcSubmission() before the variables it closes over were declared. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
20 lines
735 B
Plaintext
20 lines
735 B
Plaintext
# Server
|
|
PORT=3000
|
|
ADMIN_KEY=your-admin-key-here
|
|
|
|
# AI ROI Estimator (OpenAI-compatible API)
|
|
AI_API_URL=https://integrate.api.nvidia.com/v1
|
|
AI_API_KEY=your_nvidia_api_key_here
|
|
AI_MODEL=qwen/qwen3.5-397b-a17b
|
|
# Set to 'true' to enable detailed AI prompt/response logging
|
|
AI_DEBUG=false
|
|
|
|
# Form abuse protection
|
|
# Cloudflare Turnstile (free): https://dash.cloudflare.com/?to=/:account/turnstile
|
|
# Leave blank to run without a visible CAPTCHA — the honeypot, signed form token
|
|
# and per-IP rate limits stay active either way.
|
|
TURNSTILE_SITE_KEY=
|
|
TURNSTILE_SECRET_KEY=
|
|
# Optional: stable secret for signing form tokens. If unset, a random one is
|
|
# generated per process (tokens simply stop validating across restarts).
|
|
FORM_TOKEN_SECRET= |