#######################################
# Captcha
#######################################
# Master switch. Must be true for any captcha to appear.
CAPTCHA_ENABLED=false
# Active provider: hcaptcha (default), turnstile, or cap.
CAPTCHA_DRIVER=hcaptcha

# Per-surface toggles (each also requires CAPTCHA_ENABLED=true)
CAPTCHA_ENABLED_ON_LOGIN=true
CAPTCHA_ENABLED_ON_REGISTER=true
CAPTCHA_ENABLED_ON_CURATED_REGISTER=true
CAPTCHA_ENABLED_ON_FORGOT_EMAIL=true
CAPTCHA_ENABLED_ON_FORGOT_PASSWORD=true
CAPTCHA_ENABLED_ON_PASSWORD_RESET=true

# --- hCaptcha (driver: hcaptcha) ---
CAPTCHA_H_SITEKEY=
CAPTCHA_H_SECRET=
CAPTCHA_H_TIMEOUT=5
CAPTCHA_H_FAIL_OPEN=false

# --- Cloudflare Turnstile (driver: turnstile) ---
CAPTCHA_TURNSTILE_SITEKEY=
CAPTCHA_TURNSTILE_SECRET=
CAPTCHA_TURNSTILE_TIMEOUT=5
CAPTCHA_TURNSTILE_FAIL_OPEN=false

# --- Cap (driver: cap) ---
# Base URL WITHOUT the site key
CAPTCHA_CAP_ENDPOINT=https://example.com
CAPTCHA_CAP_SITEKEY=
CAPTCHA_CAP_SECRET=
CAPTCHA_CAP_TIMEOUT=5
CAPTCHA_CAP_FAIL_OPEN=false
CAPTCHA_CAP_TOKEN_FIELD=cap-captcha-response
# @cap.js/widget version from jsDelivr; leave "latest" to track newest stable
CAPTCHA_CAP_WIDGET_VERSION=latest