From a6a8a384a4f23d7ba19af043190263950cd0b917 Mon Sep 17 00:00:00 2001
From: ohgeecee <records@montanablotter.com>
Date: Sun, 4 Oct 2026 07:54:23 +0000
Subject: [PATCH 01/11] Add self-hosted CRM intake and service request flow

---
 .github/workflows/deploy.yml                  |  77 +++
 .gitignore                                    |   6 +
 DEPLOY.md                                     | 121 +----
 book.html                                     | 110 ++--
 build/generate.mjs                            |  76 ++-
 content/guides.json                           |  50 ++
 ...ellite-internet-slow-starlink-hughesnet.md |   1 +
 intake.js                                     |  89 +++
 ops/crm/.env.example                          |  10 +
 ops/crm/README.md                             |  55 ++
 ops/crm/compose.yaml                          |  90 ++++
 ops/crm/deploy.sh                             |  30 ++
 ops/crm/ohgeec-crm-update.service             |  12 +
 ops/crm/ohgeec-crm-update.timer               |  10 +
 privacy.html                                  |  25 +
 services/intake/Dockerfile                    |   9 +
 services/intake/package.json                  |  20 +
 services/intake/pnpm-lock.yaml                | 508 ++++++++++++++++++
 services/intake/sql/001_schema.sql            | 171 ++++++
 services/intake/sql/020-create-api-role.sh    |  10 +
 services/intake/src/server.mjs                | 122 +++++
 sitemap.xml                                   |   6 +
 .../index.html                                |  37 +-
 .../index.html                                |  37 +-
 tech-support/connectivity/index.html          |  29 +-
 .../index.html                                |  37 +-
 .../index.html                                |  37 +-
 tech-support/hardware/index.html              |  29 +-
 .../smart-tv-streaming-weak-wifi/index.html   |  37 +-
 tech-support/index.html                       |  29 +-
 tech-support/onsite-montana/index.html        | 138 +++++
 tech-support/security/index.html              |  29 +-
 .../index.html                                |  37 +-
 .../index.html                                |  37 +-
 .../clear-cache-cookies-popups/index.html     |  37 +-
 tech-support/software/index.html              |  29 +-
 .../speed-up-slow-computer/index.html         |  37 +-
 .../index.html                                |  37 +-
 38 files changed, 2006 insertions(+), 255 deletions(-)
 create mode 100644 .github/workflows/deploy.yml
 create mode 100644 intake.js
 create mode 100644 ops/crm/.env.example
 create mode 100644 ops/crm/README.md
 create mode 100644 ops/crm/compose.yaml
 create mode 100644 ops/crm/deploy.sh
 create mode 100644 ops/crm/ohgeec-crm-update.service
 create mode 100644 ops/crm/ohgeec-crm-update.timer
 create mode 100644 privacy.html
 create mode 100644 services/intake/Dockerfile
 create mode 100644 services/intake/package.json
 create mode 100644 services/intake/pnpm-lock.yaml
 create mode 100644 services/intake/sql/001_schema.sql
 create mode 100644 services/intake/sql/020-create-api-role.sh
 create mode 100644 services/intake/src/server.mjs
 create mode 100644 tech-support/onsite-montana/index.html

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..23ac51f
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,77 @@
+name: Build and deploy portfolio + intake API
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ohgeec-pages-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  site:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22
+      - name: Generate guide pages
+        run: node build/generate.mjs
+      - name: Assemble public Pages artifact
+        run: |
+          set -eu
+          mkdir -p site
+          cp index.html support.html book.html thanks.html privacy.html tech-support.html \
+            ogc-network.js intake.js portfolio.css portfolio.js fonts.css og-image.png \
+            apple-touch-icon.png robots.txt sitemap.xml CNAME site/
+          cp -R assets fonts tech-support site/
+      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
+        if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+        with:
+          path: site
+
+  deploy-pages:
+    if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+    needs: site
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
+      - id: deployment
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+
+  publish-intake:
+    if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: ./services/intake
+          push: true
+          tags: |
+            ghcr.io/ohgeeceee/network-intake:stable
+            ghcr.io/ohgeeceee/network-intake:sha-${{ github.sha }}
diff --git a/.gitignore b/.gitignore
index c304e7f..8b59a66 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,9 @@ verify2.js
 hub.js
 .DS_Store
 Thumbs.db
+
+# Local site artifact, CRM secrets, and database backups
+/site/
+/ops/crm/.env
+/ops/crm/*.dump*
+/ops/crm/*.age
diff --git a/DEPLOY.md b/DEPLOY.md
index a30bd67..f8a42fa 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -1,112 +1,41 @@
-# Deploying the ohgeeceee network hub (free)
+# Deploying ohgeec.com and the private CRM
 
-The hub is three static files — `index.html`, `support.html`, `ogc-network.js` (plus
-`CNAME`). No build step, no server. Any static host works; below is **GitHub Pages**
-(what you asked for) and one alternative worth knowing about.
+## Public portfolio
 
----
+The portfolio and support guides remain static on GitHub Pages. `.github/workflows/deploy.yml` builds the guide pages, assembles only public site files, deploys them to Pages, and builds/publishes the private intake service image to GHCR from commits to `main`. Pull requests run the static guide generator but do not publish images or deploy Pages.
 
-## Recommended: GitHub Pages
+To switch from the current branch-based Pages source to the workflow:
 
-Best fit here — it's free, gives you HTTPS on your own domain, and lives next to your
-existing `github.com/ohgeeceee` repos.
+1. In the repository, open **Settings → Pages** and change **Build and deployment → Source** to **GitHub Actions**.
+2. Check that the repository's custom domain is still `ohgeec.com` and HTTPS is enforced.
+3. Merge the workflow to `main`. Confirm the `Build and deploy portfolio + intake API` workflow succeeds and the live site loads `book.html`, `/privacy.html`, the guide hub, and `/tech-support/onsite-montana/`.
+4. The workflow excludes source content, service source, CRM operations files, and credentials from the Pages artifact. The guides and their generated HTML remain public as intended.
 
-### 1. Make the repo
+GitHub Actions uses GitHub-hosted runners only. It publishes `ghcr.io/ohgeeceee/network-intake:stable` and an immutable `sha-<commit>` image tag. The home server pulls the image; GitHub Actions never connects into the home network.
 
-1. Create a new **public** repo, e.g. `github.com/ohgeeceee/ohgeec`.
-2. Add these files to the repo root (drag-and-drop in the browser is fine):
-   - `index.html`
-   - `support.html`
-   - `ogc-network.js`
-   - `CNAME`  ← already contains `ohgeec.com`, this is what binds the domain
-3. Commit to the `main` branch.
+## DNS and public API
 
-### 2. Turn on Pages
+Keep `ohgeec.com` pointed at GitHub Pages. Add `api.ohgeec.com` as the only public home-server route, through Cloudflare Tunnel. For the tunnel's custom hostname, manage the zone in the same Cloudflare account or configure the required CNAME at the authoritative DNS provider. If moving DNS to Cloudflare, recreate the existing GitHub Pages apex A/AAAA and `www` CNAME records as DNS-only records; keep only the tunnel hostname proxied. The tunnel makes outbound connections, so no router port-forward or public home IP is needed.
 
-Repo → **Settings → Pages** → under *Build and deployment*, set **Source: Deploy from a
-branch**, **Branch: `main` / `/ (root)`** → Save. Give it a minute; it'll show a live URL.
+In Cloudflare Zero Trust, create a tunnel on the home server and configure one published application:
 
-### 3. Point ohgeec.com at GitHub
+- Hostname: `api.ohgeec.com`
+- Service: `http://intake:3000`
+- No other public hostname routes
 
-At your domain registrar's DNS, add these records for the **apex** (`ohgeec.com`):
+The public form sends JSON to `https://api.ohgeec.com/v1/intake`. The receiver validates an allowlisted schema and writes the contact, ticket, and first event in one PostgreSQL function call. CORS only allows the portfolio's exact origins; it is not treated as authentication. The form contains no shared secret.
 
-| Type | Name | Value |
-|------|------|-------|
-| A | `@` | `185.199.108.153` |
-| A | `@` | `185.199.109.153` |
-| A | `@` | `185.199.110.153` |
-| A | `@` | `185.199.111.153` |
-| AAAA | `@` | `2606:50c0:8000::153` |
-| AAAA | `@` | `2606:50c0:8001::153` |
-| AAAA | `@` | `2606:50c0:8002::153` |
-| AAAA | `@` | `2606:50c0:8003::153` |
+## Private CRM host
 
-And for the `www` version:
+Follow [ops/crm/README.md](ops/crm/README.md) on the Linux server. Directus listens on `127.0.0.1:8055`; use Tailscale Serve for the owner's tailnet access. PostgreSQL has no host port. Never create Cloudflare routes for Directus or PostgreSQL and never mount the Docker socket into application containers.
 
-| Type | Name | Value |
-|------|------|-------|
-| CNAME | `www` | `ohgeeceee.github.io` |
+The private host needs Docker Compose v2, outbound DNS/HTTPS, a Tailscale client, GHCR `read:packages` access, a protected `ops/crm/.env`, and a separate encrypted backup target. Image digests in `.env` must be set to reviewed versions before starting services. The compose stack is not live until those host-specific values, DNS, tunnel route, and initial Directus account are configured.
 
-(The four A records are the important ones; the AAAA records add IPv6 and are optional
-but recommended. Always confirm the current IPs in GitHub's docs — link at the bottom.)
+## Update flow
 
-### 4. Lock in the domain + HTTPS
+1. A merge to `main` deploys the new static site and publishes the intake container.
+2. The home server's systemd timer runs `ops/crm/deploy.sh` every five minutes.
+3. The deploy script pulls the `stable` image, restarts only the intake service, waits for its health check, and restores the previous local image tag if the new container does not become healthy.
+4. Schema changes require an encrypted backup and a reviewed forward migration before the application image is rolled out.
 
-Back in **Settings → Pages**: the *Custom domain* box should already read `ohgeec.com`
-(from the `CNAME` file). Once DNS propagates (minutes to a few hours), tick
-**Enforce HTTPS**. Done — `https://ohgeec.com` is live.
-
-### Bandwidth note
-
-GitHub Pages has a ~100 GB/month soft limit. Since every site in the network loads
-`ogc-network.js` from here, that's the one file with real traffic — but it's tiny
-(~14 KB, and browsers cache it), so you're nowhere near the limit at personal scale.
-
----
-
-## Alternative worth considering: Cloudflare Pages
-
-If you'd rather not think about bandwidth at all, **Cloudflare Pages** is the one I'd
-point you to. Same price (free), same drag-or-git deploy, but:
-
-- **Unlimited bandwidth** — nice precisely because `ogc-network.js` is served to all
-  your other domains.
-- Faster global CDN and instant cache purges.
-- Free custom domains + automatic HTTPS.
-
-Trade-off: you manage the domain's DNS inside Cloudflare (which is itself free and, if
-you move `ohgeec.com`'s nameservers there, also simplifies the DNS steps above). If your
-whole world is already on GitHub, Pages is the lower-friction pick. Both are genuinely
-fine.
-
-Netlify and Vercel are also free and excellent for static sites; they're just heavier
-than you need for three files. Any of the four will serve this correctly.
-
----
-
-## After the hub is live
-
-Add one line before `</body>` on each site so the network bar + Support button appear:
-
-```html
-<script src="https://ohgeec.com/ogc-network.js" defer></script>
-```
-
-Add `data-ogc-theme="dark"` on the dark sites (beemuu, Manners, GarageRoute):
-
-```html
-<script src="https://ohgeec.com/ogc-network.js" data-ogc-theme="dark" defer></script>
-```
-
-Because all sites load the registry from `ohgeec.com`, later changes (a new site, or
-flipping Idaho Blotter from "soon" to "live") are a one-line edit in `ogc-network.js`
-here — every site updates automatically, no redeploys elsewhere.
-
----
-
-### Quick sanity check once live
-- `https://ohgeec.com` shows the hub with all six cards.
-- `https://ohgeec.com/ogc-network.js` loads the script (not a 404).
-- On any site with the snippet, the network bar appears at the bottom.
-
-Source for the DNS values: GitHub Docs — *Managing a custom domain for your GitHub Pages site*.
+For a manual update on the host, run `ops/crm/deploy.sh`. Keep deployment credentials read-only for GHCR and do not run untrusted pull-request workflows on the home server.
diff --git a/book.html b/book.html
index bd29015..ae2ddf4 100644
--- a/book.html
+++ b/book.html
@@ -3,8 +3,8 @@
 <head>
 <meta charset="UTF-8" />
 <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-<title>Remote Tech Support — Book a Session</title>
-<meta name="description" content="Fast, friendly remote tech support. Book a session and get your computer, network, or software problems solved from anywhere." />
+<title>Remote &amp; On-Site Tech Support — ohgeeceee</title>
+<meta name="description" content="Request remote tech support or on-site home technology help in Montana." />
 <style>
   :root{
     --bg:#0b1020; --bg2:#111a33; --card:#151f3d; --line:#26345f;
@@ -70,6 +70,9 @@
   .submit{justify-self:start; margin-top:6px; padding:14px 30px; border:0; border-radius:999px; cursor:pointer;
     background:linear-gradient(120deg,var(--accent),var(--accent2)); color:#04122e; font-weight:700; font-size:1rem; box-shadow:var(--shadow)}
   .submit:hover{transform:translateY(-2px)}
+  .submit:disabled{opacity:.6;cursor:wait;transform:none}
+  .consent{display:flex;align-items:flex-start;gap:10px}
+  .consent input[type=checkbox]{width:18px;height:18px;flex:0 0 auto;margin:2px 0 0}
   .note{color:var(--muted); font-size:.82rem; margin-top:10px}
   footer{border-top:1px solid var(--line); padding:26px 0 40px; color:var(--muted); font-size:.85rem; text-align:center}
   @media(max-width:640px){ form{grid-template-columns:1fr} .book{padding:24px} }
@@ -89,9 +92,9 @@
   </header>
 
   <section class="hero">
-    <h1>Tech problems solved<br><span>without the house call.</span></h1>
-    <p>Secure remote support for your computer, network, and software — fast, friendly, and fixed from anywhere. Pick a time and I'll take it from there.</p>
-    <a class="cta" href="#book">📅 Book a session</a>
+    <h1 id="booking-hero-title">Tech problems solved<br><span>without the house call.</span></h1>
+    <p id="booking-hero-copy">Secure remote support for your computer, network, and software — fast, friendly, and fixed from anywhere. Pick a time and I'll take it from there.</p>
+    <a class="cta" id="booking-hero-cta" href="#book">📅 Request support</a>
     <div class="trust">
       <span>✅ <b>Secure</b> remote access</span>
       <span>⚡ <b>Same-day</b> appointments</span>
@@ -99,7 +102,7 @@ <h1>Tech problems solved<br><span>without the house call.</span></h1>
     </div>
   </section>
 
-  <section>
+  <section id="service-categories">
     <div class="grid">
       <div class="card">
         <div class="icon"><svg viewBox="0 0 24 24"><path d="M12 2l8 4v6c0 5-3.5 8-8 10-4.5-2-8-5-8-10V6z"/></svg></div>
@@ -134,7 +137,7 @@ <h3>One-on-one tutoring</h3>
     </div>
   </section>
 
-  <section class="pricing">
+  <section class="pricing" id="remote-pricing">
     <div class="plan">
       <h3>Quick Fix</h3>
       <div class="price">$39 <small>/ 30 min</small></div>
@@ -165,67 +168,98 @@ <h3>Premium</h3>
   </section>
 
   <section class="book" id="book">
-    <h2>Book your session</h2>
-    <p class="sub">Tell me what's going on and when works for you. You'll get a confirmation by email.</p>
+    <h2>Request tech support</h2>
+    <p class="sub">Tell me what is happening and when works for you. I will follow up using your preferred contact method.</p>
 
-    <form action="https://formsubmit.co/jon@ohgeec.com" method="POST">
-      <input type="hidden" name="_subject" value="🔧 New Remote Tech Support booking request" />
-      <input type="hidden" name="_captcha" value="false" />
-      <input type="hidden" name="_template" value="table" />
-      <input type="hidden" name="_next" value="thanks.html" />
+    <form id="service-request" data-intake-form>
+      <input type="hidden" id="request-type" name="requestType" value="website_request" />
+      <input type="hidden" id="source-page" name="sourcePage" value="/book.html" />
 
-      <!-- spam honeypot (leave empty) -->
-      <input type="text" name="_honey" style="display:none" tabindex="-1" autocomplete="off" />
+      <!-- Spam honeypot. Humans leave this field blank. -->
+      <div class="field" aria-hidden="true" style="position:absolute;left:-10000px;width:1px;height:1px;overflow:hidden">
+        <label for="website">Leave this field empty</label>
+        <input id="website" name="website" type="text" tabindex="-1" autocomplete="off" />
+      </div>
 
       <div class="field">
         <label for="name">Your name *</label>
-        <input id="name" name="name" type="text" placeholder="Jane Doe" required />
+        <input id="name" name="name" type="text" maxlength="120" placeholder="Jane Doe" autocomplete="name" required />
+      </div>
+      <div class="field">
+        <label for="email">Email</label>
+        <input id="email" name="email" type="email" maxlength="254" placeholder="jane@email.com" autocomplete="email" />
       </div>
       <div class="field">
-        <label for="email">Email *</label>
-        <input id="email" name="email" type="email" placeholder="jane@email.com" required />
+        <label for="phone">Phone</label>
+        <input id="phone" name="phone" type="tel" maxlength="32" placeholder="+1 406 555 0123" autocomplete="tel" />
+      </div>
+      <div class="field">
+        <label for="preferred-contact">Preferred contact *</label>
+        <select id="preferred-contact" name="preferredContact" required>
+          <option value="">Choose one…</option>
+          <option value="phone">Phone call</option>
+          <option value="sms">Text message</option>
+          <option value="email">Email</option>
+        </select>
       </div>
       <div class="field">
-        <label for="phone">Phone (optional)</label>
-        <input id="phone" name="phone" type="tel" placeholder="+1 555 123 4567" />
+        <label for="location">Town or county (required for on-site)</label>
+        <input id="location" name="location" type="text" maxlength="120" placeholder="Town or county; no street address yet" autocomplete="address-level2" />
       </div>
       <div class="field">
         <label for="service">What do you need? *</label>
         <select id="service" name="service" required>
           <option value="">Choose a service…</option>
-          <option>Virus &amp; malware removal</option>
-          <option>Setup &amp; optimization</option>
-          <option>Data backup &amp; recovery</option>
-          <option>Software &amp; app help</option>
-          <option>Network &amp; Wi-Fi</option>
-          <option>One-on-one tutoring</option>
-          <option>Something else</option>
+          <option value="virus_malware">Virus &amp; malware removal</option>
+          <option value="setup_optimization">Setup &amp; optimization</option>
+          <option value="data_recovery">Data backup &amp; recovery</option>
+          <option value="software_help">Software &amp; app help</option>
+          <option value="network_wifi">Network &amp; Wi-Fi</option>
+          <option value="starlink_setup">Starlink setup</option>
+          <option value="tutoring">One-on-one tutoring</option>
+          <option value="other">Something else</option>
+        </select>
+      </div>
+      <div class="field">
+        <label for="device-type">Device type</label>
+        <input id="device-type" name="deviceType" type="text" maxlength="120" placeholder="Router, Starlink, laptop…" />
+      </div>
+      <div class="field">
+        <label for="service-mode">How should we help? *</label>
+        <select id="service-mode" name="serviceMode" required>
+          <option value="undecided">Not sure yet</option>
+          <option value="remote">Remote</option>
+          <option value="onsite">On-site in Montana</option>
         </select>
       </div>
       <div class="field">
-        <label for="date">Preferred date *</label>
-        <input id="date" name="date" type="date" required />
+        <label for="date">Preferred date</label>
+        <input id="date" name="date" type="date" />
       </div>
       <div class="field">
-        <label for="time">Preferred time *</label>
-        <input id="time" name="time" type="time" required />
+        <label for="time">Preferred time</label>
+        <input id="time" name="time" type="time" />
       </div>
       <div class="field full">
-        <label for="message">What's going on? (optional)</label>
-        <textarea id="message" name="message" placeholder="Briefly describe the problem, your device, and anything you've already tried…"></textarea>
+        <label for="message">What is going on? *</label>
+        <textarea id="message" name="message" maxlength="2000" placeholder="Briefly describe the problem, device, and anything you have already tried. Do not include passwords or Wi-Fi credentials." required></textarea>
       </div>
       <div class="field full">
-        <button class="submit" type="submit">Request my session →</button>
-        <p class="note">By submitting you agree to be contacted about your request. Your details are only used to arrange support.</p>
+        <label class="consent"><input id="consent" name="consentToContact" type="checkbox" required /> I agree to be contacted about this service request.</label>
+        <p class="note">Only share what is needed to arrange support. Do not send account passwords, Wi-Fi passwords, or payment details. See the <a href="/privacy.html">privacy note</a>.</p>
+        <p id="intake-status" class="note" role="status" aria-live="polite"></p>
+        <button class="submit" id="intake-submit" type="submit" disabled>Send service request →</button>
+        <noscript><p class="note">The secure request form needs JavaScript. Please email <a href="mailto:hello@ohgeec.com">hello@ohgeec.com</a> or call/text the number listed on the support page. Do not email passwords.</p></noscript>
       </div>
     </form>
   </section>
 
   <footer>
-    Remote Tech Support · Available worldwide via secure remote connection<br>
-    Questions? Just reply to your confirmation email.
+    Remote support and on-site visits in Montana<br>
+    Questions? Email <a href="mailto:hello@ohgeec.com">hello@ohgeec.com</a>.
   </footer>
 
 </div>
+<script src="/intake.js" defer></script>
 </body>
 </html>
diff --git a/build/generate.mjs b/build/generate.mjs
index ec8bc31..c7b8a8d 100644
--- a/build/generate.mjs
+++ b/build/generate.mjs
@@ -252,6 +252,7 @@ function loadGuides() {
       service_intent: d.service_intent || 'pro_recommended',
       on_site_eligible: d.on_site_eligible === true || d.on_site_eligible === 'true',
       cta_type: d.cta_type || 'remote_booking',
+      cta_label: d.cta_label || (SERVICE_LANES[d.cta_type] ? SERVICE_LANES[d.cta_type].label : 'Book a session'),
       service_link: d.service_link || (SERVICE_LANES[d.cta_type] ? SERVICE_LANES[d.cta_type].url : BOOKING_URL),
       problem_type: d.problem_type || '', symptoms: asList(d.symptoms), quick_fix: d.quick_fix,
       prerequisites: asList(d.prerequisites), dont_need: d.dont_need || '',
@@ -396,15 +397,22 @@ function crumbs(items) {
   }).join('');
   return `<nav class="crumb" aria-label="Breadcrumb"><ol>${parts}</ol></nav>`;
 }
-function ctaBlock(heading, body, ctaLabel) {
+function ctaBlock(heading, body, ctaLabel, url = BOOKING_URL, audience = 'REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT') {
   return `<section class="cta">
   <h2 class="rv">${heading}</h2>
   <p class="rv">${body}</p>
-  <a class="btn rv" href="${BOOKING_URL}" rel="noopener">${ctaLabel} &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <a class="btn rv" href="${esc(url)}" rel="noopener">${ctaLabel} &rarr;</a>
+  <p class="fine rv">${audience}</p>
 </section>`;
 }
 
+function guideServiceUrl(g) {
+  const params = new URLSearchParams({ requestType: g.slug, sourcePage: g.urlPath });
+  const [pathAndQuery, fragment] = g.service_link.split('#', 2);
+  const separator = pathAndQuery.includes('?') ? '&' : '?';
+  return `${pathAndQuery}${separator}${params.toString()}${fragment ? `#${fragment}` : ''}`;
+}
+
 /* ------------------------------------------------------------------ *
  * 5. Guide page
  * ------------------------------------------------------------------ */
@@ -473,7 +481,7 @@ function renderGuide(g, all) {
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol>${g.escalation.map((e) => `<li>${inline(e)}</li>`).join('')}</ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="${BOOKING_URL}">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="${esc(guideServiceUrl(g))}">${esc(g.cta_label)} &rarr;</a></p>
       </div>
     </details>` : '';
   const sources = g.sources.length ? g.sources.map((s) => `<a href="${s.url}" rel="noopener">${esc(s.label)}</a>`).join('') : '';
@@ -527,7 +535,7 @@ ${topbar('tech')}
     ${escBlock}
   </div>
 
-  ${ctaBlock('Still stuck? <em>I can take it from here.</em>', 'If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.', 'Book a session')}
+  ${ctaBlock('Still stuck? <em>I can take it from here.</em>', 'If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.', g.cta_label, guideServiceUrl(g), g.cta_type === 'onsite_request' ? 'ON-SITE SERVICE IN MONTANA' : 'REMOTE SUPPORT AVAILABLE')}
 
   <div class="wrap wrap--narrow">
     ${relatedBlock(g, all)}
@@ -691,6 +699,7 @@ function writeSitemap(guides) {
     { loc: '/tech-support/', mod: today, cf: 'weekly', pr: '0.9' },
     ...Object.keys(CATEGORIES).map((k) => ({ loc: `/tech-support/${k}/`, mod: today, cf: 'weekly', pr: '0.7' })),
     ...guides.map((g) => ({ loc: g.urlPath, mod: g.last_verified, cf: 'monthly', pr: '0.8' })),
+    { loc: ONSITE_URL, mod: today, cf: 'monthly', pr: '0.7' },
     { loc: '/book.html', mod: today, cf: 'monthly', pr: '0.7' },
     { loc: '/support.html', mod: today, cf: 'yearly', pr: '0.3' },
   ];
@@ -706,6 +715,58 @@ ${entries.map((e) => `  <url>
 `;
   fs.writeFileSync(path.join(ROOT, 'sitemap.xml'), xml);
 }
+function renderOnsiteLanding() {
+  const canonical = SITE + ONSITE_URL;
+  const ld = {
+    '@context': 'https://schema.org',
+    '@type': 'Service',
+    name: 'On-site home technology support in Montana',
+    provider: { '@type': 'Person', name: AUTHOR, url: SITE + '/' },
+    areaServed: { '@type': 'State', name: 'Montana' },
+    serviceType: 'Home technology setup and troubleshooting',
+    url: canonical,
+  };
+  return `${head({ title: 'On-site tech support in Montana — ohgeeceee', description: 'On-site help with Starlink, Wi-Fi, computers, printers, and connected devices across Montana. Request a visit and share only the details needed to plan it.', canonical, ogImage: OG_DEFAULT, type: 'website', ld })}
+<body>
+${topbar('tech')}
+<main>
+  <div class="wrap wrap--narrow">
+    ${crumbs([{ label: 'Home', href: '/' }, { label: 'Tech Support', href: '/tech-support/' }, { label: 'On-site help in Montana' }])}
+    <p class="kicker rv">MONTANA · HOME TECH SUPPORT</p>
+    <h1 class="rv">The tech at home, sorted.</h1>
+    <p class="lede rv">On-site help for rural homes, small businesses, and the places where a reliable connection matters. Tell me what is happening and where you are; we will confirm availability before scheduling.</p>
+    <section class="prereq rv">
+      <h2>What I can help with</h2>
+      <ul>
+        <li>Starlink setup, dish placement, and Wi-Fi coverage</li>
+        <li>Wi-Fi dead zones, router setup, and connected devices</li>
+        <li>Computer, printer, smart TV, and home network troubleshooting</li>
+      </ul>
+      <p class="dont">No account passwords or Wi-Fi passwords in the request form. We can arrange a safe way to share access if a visit requires it.</p>
+    </section>
+    <section class="cta" id="request">
+      <h2>Request an on-site visit</h2>
+      <p>Share your Montana town or county, a short description, and a preferred time. Exact address and access details can wait until the visit is confirmed.</p>
+      <a class="btn" id="onsite-request-link" href="/book.html?mode=onsite">Request an on-site visit &rarr;</a>
+      <p class="fine">MONTANA ON-SITE SERVICE · REQUESTS ARE CONFIRMED BEFORE A VISIT IS BOOKED</p>
+    </section>
+    <p>If remote help is a better fit, <a href="/book.html?mode=remote">request a remote session</a>. For urgent issues, call or text after we confirm your request.</p>
+  </div>
+</main>
+${footer()}
+<script>
+  const incoming = new URLSearchParams(location.search);
+  const booking = new URL('/book.html', location.origin);
+  booking.searchParams.set('mode', 'onsite');
+  booking.searchParams.set('requestType', incoming.get('requestType') || 'onsite_support');
+  booking.searchParams.set('sourcePage', incoming.get('sourcePage') || location.pathname);
+  document.getElementById('onsite-request-link').href = booking.pathname + booking.search;
+</script>
+${revealScript()}
+</body>
+</html>
+`;
+}
 function writeFeed(guides) {
   const items = guides.map((g) => `    <item>
       <title>${esc(g.title)}</title>
@@ -778,6 +839,8 @@ fs.mkdirSync(path.join(ROOT, 'content'), { recursive: true });
 fs.writeFileSync(path.join(ROOT, 'content', 'guides.json'), JSON.stringify({ generated: today, count: guides.length, guides: manifest }, null, 2));
 
 writeSitemap(guides);
+fs.mkdirSync(path.join(OUT_DIR, 'onsite-montana'), { recursive: true });
+fs.writeFileSync(path.join(OUT_DIR, 'onsite-montana', 'index.html'), renderOnsiteLanding());
 writeFeed(guides);
 writeRedirectStub();
 
@@ -785,6 +848,7 @@ console.log(`\n\u2714 Built ${guides.length} guides, ${Object.keys(CATEGORIES).l
 console.log(`  tech-support/index.html`);
 console.log(`  tech-support/<category>/index.html`);
 console.log(`  tech-support/<category>/<slug>/index.html`);
+console.log(`  tech-support/onsite-montana/index.html`);
 console.log(`  content/guides.json  (${manifest.length} entries)`);
 console.log(`  sitemap.xml, tech-support/feed.xml, tech-support.html (redirect stub)`);
 if (warnings.length) {
@@ -792,4 +856,4 @@ if (warnings.length) {
   for (const w of warnings.slice(0, 40)) console.log('   • ' + w);
   if (warnings.length > 40) console.log(`   … and ${warnings.length - 40} more`);
 }
-console.log('');
\ No newline at end of file
+console.log('');
diff --git a/content/guides.json b/content/guides.json
index 23cee8b..a3d1ace 100644
--- a/content/guides.json
+++ b/content/guides.json
@@ -28,6 +28,11 @@
         "non-technical"
       ],
       "targeted_region": "rural-us",
+      "service_intent": "pro_recommended",
+      "on_site_eligible": true,
+      "cta_type": "onsite_request",
+      "cta_label": "Request an on-site visit",
+      "service_link": "/tech-support/onsite-montana/",
       "problem_type": "No signal",
       "symptoms": [
         "No Service",
@@ -133,6 +138,11 @@
         "non-technical"
       ],
       "targeted_region": "rural-us",
+      "service_intent": "pro_required",
+      "on_site_eligible": true,
+      "cta_type": "onsite_request",
+      "cta_label": "Request on-site Starlink setup",
+      "service_link": "/tech-support/onsite-montana/",
       "problem_type": "Slow",
       "symptoms": [
         "buffering",
@@ -236,6 +246,11 @@
         "small-business"
       ],
       "targeted_region": "rural-us",
+      "service_intent": "pro_required",
+      "on_site_eligible": true,
+      "cta_type": "onsite_request",
+      "cta_label": "Request an on-site visit",
+      "service_link": "/tech-support/onsite-montana/",
       "problem_type": "Weak Wi-Fi",
       "symptoms": [
         "dead zone",
@@ -341,6 +356,11 @@
         "non-technical"
       ],
       "targeted_region": "us",
+      "service_intent": "diy_ok",
+      "on_site_eligible": false,
+      "cta_type": "remote_booking",
+      "cta_label": "Book a remote session",
+      "service_link": "/book.html",
       "problem_type": "Slow",
       "symptoms": [
         "pop-ups",
@@ -447,6 +467,11 @@
         "small-business"
       ],
       "targeted_region": "us",
+      "service_intent": "pro_recommended",
+      "on_site_eligible": false,
+      "cta_type": "remote_booking",
+      "cta_label": "Book a remote session",
+      "service_link": "/book.html",
       "problem_type": "Security",
       "symptoms": [
         "locked out",
@@ -556,6 +581,11 @@
         "small-business"
       ],
       "targeted_region": "us",
+      "service_intent": "pro_recommended",
+      "on_site_eligible": false,
+      "cta_type": "remote_booking",
+      "cta_label": "Book a remote session",
+      "service_link": "/book.html",
       "problem_type": "Slow",
       "symptoms": [
         "slow startup",
@@ -662,6 +692,11 @@
         "rural"
       ],
       "targeted_region": "us",
+      "service_intent": "pro_recommended",
+      "on_site_eligible": true,
+      "cta_type": "onsite_request",
+      "cta_label": "Request an on-site visit",
+      "service_link": "/tech-support/onsite-montana/",
       "problem_type": "Weak Wi-Fi",
       "symptoms": [
         "buffering",
@@ -766,6 +801,11 @@
         "rural"
       ],
       "targeted_region": "us",
+      "service_intent": "pro_recommended",
+      "on_site_eligible": false,
+      "cta_type": "diagnostic",
+      "cta_label": "Get a free 10-minute call",
+      "service_link": "/tech-support/onsite-montana/#request",
       "problem_type": "Security",
       "symptoms": [
         "spam texts",
@@ -871,6 +911,11 @@
         "small-business"
       ],
       "targeted_region": "us",
+      "service_intent": "pro_recommended",
+      "on_site_eligible": true,
+      "cta_type": "onsite_request",
+      "cta_label": "Request an on-site visit",
+      "service_link": "/tech-support/onsite-montana/",
       "problem_type": "Offline",
       "symptoms": [
         "printer offline",
@@ -977,6 +1022,11 @@
         "small-business"
       ],
       "targeted_region": "us",
+      "service_intent": "pro_recommended",
+      "on_site_eligible": false,
+      "cta_type": "remote_booking",
+      "cta_label": "Book a remote session",
+      "service_link": "/book.html",
       "problem_type": "Migration",
       "symptoms": [
         "new phone",
diff --git a/content/guides/02-satellite-internet-slow-starlink-hughesnet.md b/content/guides/02-satellite-internet-slow-starlink-hughesnet.md
index 5c16db1..6d5f98d 100644
--- a/content/guides/02-satellite-internet-slow-starlink-hughesnet.md
+++ b/content/guides/02-satellite-internet-slow-starlink-hughesnet.md
@@ -13,6 +13,7 @@ targeted_region: rural-us
 service_intent: pro_required
 on_site_eligible: true
 cta_type: onsite_request
+cta_label: Request on-site Starlink setup
 service_link: /tech-support/onsite-montana/
 
 problem_type: Slow
diff --git a/intake.js b/intake.js
new file mode 100644
index 0000000..3e2e47c
--- /dev/null
+++ b/intake.js
@@ -0,0 +1,89 @@
+(() => {
+  const form = document.querySelector('[data-intake-form]');
+  if (!form) return;
+
+  const status = document.getElementById('intake-status');
+  const submit = document.getElementById('intake-submit');
+  const params = new URLSearchParams(window.location.search);
+  const mode = params.get('mode');
+  const serviceMode = document.getElementById('service-mode');
+  if (mode === 'onsite' || mode === 'remote') serviceMode.value = mode;
+  const locationField = document.getElementById('location');
+  const syncLocationRequirement = () => { locationField.required = serviceMode.value === 'onsite'; };
+  serviceMode.addEventListener('change', syncLocationRequirement);
+  syncLocationRequirement();
+  if (mode === 'onsite') {
+    document.getElementById('booking-hero-title').innerHTML = 'On-site tech support<br><span>in Montana.</span>';
+    document.getElementById('booking-hero-copy').textContent = 'Starlink, Wi-Fi, computers, printers, and connected devices. Send a request with your Montana town or county and I will confirm availability.';
+    document.getElementById('booking-hero-cta').textContent = 'Request an on-site visit';
+    document.getElementById('remote-pricing').hidden = true;
+    document.getElementById('service-categories').hidden = true;
+    document.querySelector('.book h2').textContent = 'Request an on-site visit';
+  }
+
+  const requestType = params.get('requestType');
+  if (requestType && /^[a-z0-9_-]{1,80}$/i.test(requestType)) {
+    document.getElementById('request-type').value = requestType;
+    if (requestType.includes('starlink')) document.getElementById('service').value = 'starlink_setup';
+  }
+  const sourcePage = params.get('sourcePage');
+  if (sourcePage && sourcePage.startsWith('/') && !sourcePage.startsWith('//')) {
+    document.getElementById('source-page').value = sourcePage.slice(0, 240);
+  }
+
+  let idempotencyKey = crypto.randomUUID();
+  submit.disabled = false;
+  form.addEventListener('submit', async (event) => {
+    event.preventDefault();
+    if (!form.reportValidity()) return;
+
+    const values = new FormData(form);
+    const preferredContact = String(values.get('preferredContact') || '');
+    const phone = String(values.get('phone') || '').trim();
+    const email = String(values.get('email') || '').trim();
+    if ((preferredContact === 'email' && !email) || (preferredContact !== 'email' && !phone)) {
+      status.textContent = preferredContact === 'email'
+        ? 'Please add your email address, or choose phone/text as your preferred contact.'
+        : 'Please add a phone number, or choose email as your preferred contact.';
+      return;
+    }
+
+    const payload = {
+      name: String(values.get('name') || '').trim(),
+      phone,
+      email,
+      location: String(values.get('location') || '').trim(),
+      preferredContact,
+      requestType: String(values.get('requestType') || 'website_request'),
+      deviceType: String(values.get('deviceType') || '').trim(),
+      serviceMode: String(values.get('serviceMode') || 'undecided'),
+      service: String(values.get('service') || ''),
+      description: String(values.get('message') || '').trim(),
+      requestedDate: String(values.get('date') || ''),
+      requestedTime: String(values.get('time') || ''),
+      sourcePage: String(values.get('sourcePage') || '/book.html'),
+      consentToContact: values.get('consentToContact') === 'on',
+      website: String(values.get('website') || ''),
+    };
+
+    submit.disabled = true;
+    status.textContent = 'Sending your request…';
+    try {
+      const response = await fetch('https://api.ohgeec.com/v1/intake', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'Idempotency-Key': idempotencyKey },
+        body: JSON.stringify(payload),
+        credentials: 'omit',
+        referrerPolicy: 'no-referrer',
+      });
+      if (!response.ok) throw new Error('Request unavailable');
+      form.reset();
+      idempotencyKey = crypto.randomUUID();
+      status.textContent = 'Request received. I will follow up using your preferred contact method.';
+      submit.textContent = 'Request sent';
+    } catch {
+      status.textContent = 'I could not send that request right now. Please try again, or email hello@ohgeec.com. Do not include passwords.';
+      submit.disabled = false;
+    }
+  });
+})();
diff --git a/ops/crm/.env.example b/ops/crm/.env.example
new file mode 100644
index 0000000..75f66f2
--- /dev/null
+++ b/ops/crm/.env.example
@@ -0,0 +1,10 @@
+# Copy to .env on the Linux host; chmod 600. Never commit actual values.
+POSTGRES_IMAGE=postgres:17-alpine@sha256:REPLACE_WITH_REVIEWED_DIGEST
+DIRECTUS_IMAGE=directus/directus:11@sha256:REPLACE_WITH_REVIEWED_DIGEST
+CLOUDFLARED_IMAGE=cloudflare/cloudflared:REPLACE_WITH_VERSION@sha256:REPLACE_WITH_REVIEWED_DIGEST
+POSTGRES_PASSWORD=GENERATE_LONG_RANDOM_VALUE
+INTAKE_DB_PASSWORD=GENERATE_DIFFERENT_LONG_RANDOM_VALUE
+DIRECTUS_SECRET=GENERATE_64_RANDOM_CHARACTERS
+DIRECTUS_PRIVATE_URL=https://YOUR-HOST.YOUR-TAILNET.ts.net
+CLOUDFLARE_TUNNEL_TOKEN=FROM_CLOUDFLARE_ZERO_TRUST_DASHBOARD
+INTAKE_IMAGE=ghcr.io/ohgeeceee/network-intake:stable
diff --git a/ops/crm/README.md b/ops/crm/README.md
new file mode 100644
index 0000000..2c61334
--- /dev/null
+++ b/ops/crm/README.md
@@ -0,0 +1,55 @@
+# ohgeec CRM home-server deployment
+
+This Compose project runs the private CRM and the public form receiver. The portfolio stays on GitHub Pages; do not publish the home site's source or customer data from this directory. The API accepts only constrained support requests. Directus and PostgreSQL have no public hostname.
+
+## Before the first start
+
+1. Use a patched Linux host with Docker Compose v2, a firewall that blocks inbound WAN connections, full-disk encryption, and a separate backup destination. Install Tailscale on the host. Do not configure router port forwarding.
+2. Use Cloudflare DNS for the `api.ohgeec.com` hostname (the apex `ohgeec.com` can keep serving from GitHub Pages). Create a Cloudflare Tunnel and install its token in the host's `.env`. Configure exactly one public hostname route: `api.ohgeec.com` -> `http://intake:3000`. Do not add Directus, Postgres, SSH, or the Docker socket as a public route.
+3. Obtain reviewed immutable image digests for Postgres, Directus, and cloudflared. Copy `.env.example` to `.env`, replace every placeholder, set `chmod 600 .env`, and keep that file outside Git backups. Generate independent random values for every password/secret.
+4. Give the GitHub Container Registry package `ghcr.io/ohgeeceee/network-intake` read access for a dedicated host token with `read:packages` only. Log in to GHCR as the restricted deploy account. Do not use a self-hosted GitHub Actions runner on this server.
+5. Add `api.ohgeec.com` to the allowed CORS origins only if you serve the website there; the default exact allowed origins are `https://ohgeec.com` and `https://www.ohgeec.com`.
+
+## Start and administer
+
+```sh
+cp .env.example .env
+chmod 600 .env
+# Fill in .env values first.
+docker compose --env-file .env -f compose.yaml config
+docker compose --env-file .env -f compose.yaml up -d
+```
+
+On first initialization, Postgres creates the schema and a separate `intake_api` DB role. The intake role can execute only the `create_public_intake(...)` function; it cannot query CRM tables. The schema and role scripts run only when the `pgdata` volume is new. For an existing database, make a backup, apply `services/intake/sql/001_schema.sql` as the DB owner, then run the role creation statements from `020-create-api-role.sh` with a secure password.
+
+Directus listens on host loopback port 8055 only. Install Tailscale Serve on the host and proxy its HTTPS tailnet URL to `http://127.0.0.1:8055`; keep tailnet ACLs limited to your own devices. Do not expose the port on the LAN or internet. On first startup, capture the one-time bootstrap credentials printed by Directus, sign in immediately over Tailscale, set a unique password, and enable the strongest supported second factor. Keep the admin credentials in your password manager, not in Compose.
+
+Directus discovers the existing tables. In its data model, create the many-to-one relationships `service_tickets.contact_id -> contacts.id`, `client_assets.contact_id -> contacts.id`, `service_events.contact_id -> contacts.id`, and `service_events.ticket_id -> service_tickets.id`. Keep the public role with no collection permissions and do not create a public Directus route. Use the admin role only through Tailscale. The `service_events` collection holds history and notes; keep new events append-only where possible. Store only password-manager references in `credential_reference`.
+
+## Backups
+
+Keep an encrypted off-host backup. A simple backup pattern with `age` installed on the host is:
+
+```sh
+umask 077
+stamp=$(date -u +%Y%m%dT%H%M%SZ)
+docker compose --env-file .env -f compose.yaml exec -T postgres pg_dump -U ohgeec_admin -Fc ohgeec \
+  | age -r "$AGE_RECIPIENT" > "/srv/backups/ohgeec/crm-${stamp}.dump.age"
+```
+
+Use a public age recipient on the host; protect the private decryption identity separately from the server. Back up Directus uploads if you add file uploads. Test restoration to a separate database before entering customer data, and repeat restore checks regularly. A same-disk copy is not a disaster-recovery backup.
+
+## Updates and rollback
+
+The workflow publishes both an immutable `sha-<commit>` tag and a convenience `stable` tag. The host pulls the stable tag with `ops/crm/deploy.sh`, checks its container health, and keeps the prior local image tagged for rollback. Set up the included systemd unit/timer only after GHCR login and `.env` are ready:
+
+```sh
+sudo useradd --system --home /opt/ohgeec --shell /usr/sbin/nologin ohgeec-deploy
+sudo usermod -aG docker ohgeec-deploy
+# Place a clone of this repo at /opt/ohgeec/network and protect its ops/crm/.env.
+sudo cp ops/crm/ohgeec-crm-update.{service,timer} /etc/systemd/system/
+sudo systemctl daemon-reload
+sudo systemctl enable --now ohgeec-crm-update.timer
+```
+
+Membership in the Docker group is effectively root access. Protect this account and its credentials accordingly. Review GitHub Actions updates and image digests; never run PR-controlled workflows on the home machine.
diff --git a/ops/crm/compose.yaml b/ops/crm/compose.yaml
new file mode 100644
index 0000000..20eb94d
--- /dev/null
+++ b/ops/crm/compose.yaml
@@ -0,0 +1,90 @@
+name: ohgeec-crm
+services:
+  postgres:
+    image: ${POSTGRES_IMAGE:?pin a reviewed Postgres image digest}
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ohgeec
+      POSTGRES_USER: ohgeec_admin
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set in .env}
+      INTAKE_DB_PASSWORD: ${INTAKE_DB_PASSWORD:?set in .env}
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+      - ../../services/intake/sql/001_schema.sql:/docker-entrypoint-initdb.d/010-schema.sql:ro
+      - ../../services/intake/sql/020-create-api-role.sh:/docker-entrypoint-initdb.d/020-create-api-role.sh:ro
+    networks: [data]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ohgeec_admin -d ohgeec"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 20s
+
+  directus:
+    image: ${DIRECTUS_IMAGE:?pin a reviewed Directus image digest}
+    restart: unless-stopped
+    depends_on:
+      postgres: { condition: service_healthy }
+    environment:
+      SECRET: ${DIRECTUS_SECRET:?set in .env}
+      DB_CLIENT: pg
+      DB_HOST: postgres
+      DB_PORT: 5432
+      DB_DATABASE: ohgeec
+      DB_USER: ohgeec_admin
+      DB_PASSWORD: ${POSTGRES_PASSWORD:?set in .env}
+      PUBLIC_URL: ${DIRECTUS_PRIVATE_URL:?set to Tailscale HTTPS URL}
+      TELEMETRY: "false"
+      LOG_LEVEL: warn
+    ports:
+      - "127.0.0.1:8055:8055"
+    networks: [data, private_admin]
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8055/server/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 60s
+
+  intake:
+    image: ${INTAKE_IMAGE:-ghcr.io/ohgeeceee/network-intake:stable}
+    restart: unless-stopped
+    depends_on:
+      postgres: { condition: service_healthy }
+    environment:
+      DB_HOST: postgres
+      DB_PORT: "5432"
+      DB_NAME: ohgeec
+      DB_USER: intake_api
+      DB_PASSWORD: ${INTAKE_DB_PASSWORD}
+      ALLOWED_ORIGINS: https://ohgeec.com,https://www.ohgeec.com
+      PORT: "3000"
+    networks: [data, ingress]
+    read_only: true
+    tmpfs: [/tmp]
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 20s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+
+  cloudflared:
+    image: ${CLOUDFLARED_IMAGE:?pin a reviewed cloudflared image digest}
+    restart: unless-stopped
+    command: tunnel --no-autoupdate run
+    environment:
+      TUNNEL_TOKEN: ${CLOUDFLARE_TUNNEL_TOKEN:?set in .env}
+    depends_on: [intake]
+    networks: [ingress]
+
+networks:
+  data:
+    internal: true
+  ingress: {}
+  private_admin: {}
+
+volumes:
+  pgdata:
diff --git a/ops/crm/deploy.sh b/ops/crm/deploy.sh
new file mode 100644
index 0000000..c7d5665
--- /dev/null
+++ b/ops/crm/deploy.sh
@@ -0,0 +1,30 @@
+#!/bin/sh
+set -eu
+cd "$(dirname "$0")"
+compose='docker compose --env-file .env -f compose.yaml'
+service=intake
+old_id=$($compose images -q "$service" 2>/dev/null | head -n 1 || true)
+if [ -n "$old_id" ]; then docker image tag "$old_id" ohgeec-intake:rollback; fi
+$compose pull "$service"
+$compose up -d --no-deps "$service"
+
+healthy=0
+i=0
+while [ "$i" -lt 18 ]; do
+  container_id=$($compose ps -q "$service")
+  state=$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$container_id" 2>/dev/null || true)
+  if [ "$state" = healthy ]; then healthy=1; break; fi
+  sleep 5
+  i=$((i + 1))
+done
+if [ "$healthy" -eq 1 ]; then
+  echo "Intake service is healthy."
+  exit 0
+fi
+
+echo "New intake image did not become healthy; restoring the previous local image." >&2
+if [ -n "$old_id" ]; then
+  INTAKE_IMAGE=ohgeec-intake:rollback $compose up -d --no-deps --pull never "$service"
+  exit 1
+fi
+exit 1
diff --git a/ops/crm/ohgeec-crm-update.service b/ops/crm/ohgeec-crm-update.service
new file mode 100644
index 0000000..b4816bc
--- /dev/null
+++ b/ops/crm/ohgeec-crm-update.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Pull and health-check the approved ohgeec CRM intake image
+After=docker.service network-online.target
+Wants=network-online.target
+Requires=docker.service
+
+[Service]
+Type=oneshot
+User=ohgeec-deploy
+Group=docker
+WorkingDirectory=/opt/ohgeec/network/ops/crm
+ExecStart=/opt/ohgeec/network/ops/crm/deploy.sh
diff --git a/ops/crm/ohgeec-crm-update.timer b/ops/crm/ohgeec-crm-update.timer
new file mode 100644
index 0000000..89f51d4
--- /dev/null
+++ b/ops/crm/ohgeec-crm-update.timer
@@ -0,0 +1,10 @@
+[Unit]
+Description=Check for ohgeec CRM intake image updates
+
+[Timer]
+OnBootSec=3min
+OnUnitActiveSec=5min
+Persistent=true
+
+[Install]
+WantedBy=timers.target
diff --git a/privacy.html b/privacy.html
new file mode 100644
index 0000000..f319f77
--- /dev/null
+++ b/privacy.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Service request privacy — ohgeeceee</title>
+  <link rel="stylesheet" href="/fonts.css" />
+  <link rel="stylesheet" href="/portfolio.css" />
+  <meta name="robots" content="index,follow" />
+</head>
+<body>
+  <main class="wrap wrap--narrow">
+    <p class="kicker">PRIVACY · SERVICE REQUESTS</p>
+    <h1>What happens to your service request</h1>
+    <p>When you send a support request, the information you provide passes through Cloudflare Tunnel as network transport and is sent to a privately operated service system so it can be reviewed and used to arrange support. Requests are stored on a home development server and are accessible only to the service operator. The CRM is not publicly accessible.</p>
+    <h2>What to share</h2>
+    <p>Share your name, one way to contact you, your Montana town or county for on-site work, and a short description. Do not send passwords, Wi-Fi credentials, payment card details, or other account secrets through the form.</p>
+    <h2>How it is used</h2>
+    <p>Your details are used to respond to and manage your service request. The request system records the page that referred you and the time submitted. The form does not use advertising trackers or save request contents in browser storage. We keep records for service follow-up and delete them when they are no longer needed; email to request access, correction, or deletion.</p>
+    <h2>Questions or deletion requests</h2>
+    <p>Email <a href="mailto:hello@ohgeec.com">hello@ohgeec.com</a> and include enough context to identify the request. Do not include passwords.</p>
+    <p><a href="/book.html">Return to the service request form</a></p>
+  </main>
+</body>
+</html>
diff --git a/services/intake/Dockerfile b/services/intake/Dockerfile
new file mode 100644
index 0000000..f5abe1a
--- /dev/null
+++ b/services/intake/Dockerfile
@@ -0,0 +1,9 @@
+FROM node:22-alpine
+ENV NODE_ENV=production
+WORKDIR /app
+COPY package.json pnpm-lock.yaml ./
+RUN corepack enable && pnpm install --prod --frozen-lockfile && pnpm store prune
+COPY src ./src
+USER node
+EXPOSE 3000
+CMD ["node", "src/server.mjs"]
diff --git a/services/intake/package.json b/services/intake/package.json
new file mode 100644
index 0000000..0109675
--- /dev/null
+++ b/services/intake/package.json
@@ -0,0 +1,20 @@
+{
+  "name": "ohgeec-crm-intake",
+  "private": true,
+  "version": "1.0.0",
+  "type": "module",
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "start": "node src/server.mjs"
+  },
+  "dependencies": {
+    "@fastify/cors": "^11.0.1",
+    "@fastify/rate-limit": "^10.3.0",
+    "fastify": "^5.3.3",
+    "pg": "^8.16.0",
+    "zod": "^3.25.0"
+  },
+  "packageManager": "pnpm@11.19.0"
+}
diff --git a/services/intake/pnpm-lock.yaml b/services/intake/pnpm-lock.yaml
new file mode 100644
index 0000000..f099a32
--- /dev/null
+++ b/services/intake/pnpm-lock.yaml
@@ -0,0 +1,508 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    dependencies:
+      '@fastify/cors':
+        specifier: ^11.0.1
+        version: 11.3.0
+      '@fastify/rate-limit':
+        specifier: ^10.3.0
+        version: 10.3.0
+      fastify:
+        specifier: ^5.3.3
+        version: 5.12.5
+      pg:
+        specifier: ^8.16.0
+        version: 8.23.1
+      zod:
+        specifier: ^3.25.0
+        version: 3.25.76
+
+packages:
+
+  '@fastify/ajv-compiler@4.0.6':
+    resolution: {integrity: sha512-NtuzM0SfaMJbGlnjr9LWQUN5LzgSrbB8tf/wRZNas+4E1O/Nmzl53e7ruT61HDZyRCJGC6FxIogmNZO1c5ETBA==}
+
+  '@fastify/cors@11.3.0':
+    resolution: {integrity: sha512-ggQGua+xHv1MvePbPr0v//xLYEsCXbWspquXCJS9Ot5YoRXq8J8ZWzHnxDBVnbtXosvistXo6LtNzOJswf64Fw==}
+
+  '@fastify/error@4.2.0':
+    resolution: {integrity: sha512-RSo3sVDXfHskiBZKBPRgnQTtIqpi/7zhJOEmAxCiBcM7d0uwdGdxLlsCaLzGs8v8NnxIRlfG0N51p5yFaOentQ==}
+
+  '@fastify/fast-json-stringify-compiler@5.1.0':
+    resolution: {integrity: sha512-PxcYtKLbQ8Z+yApiqjK8FwxIwvEj38k2OiLc17u8dkJSlmfi2wHHPaSnaoqBPQqtvF8YVsDgDpP2snDCfFrpfw==}
+
+  '@fastify/forwarded@3.0.2':
+    resolution: {integrity: sha512-NE8HgKLgYejV9lDpqkEFaDKMLYelJBVfHekhB0UKvX0ghagXRJqg68feg8er1NPXxG4N9i6vPxzt8E+3wHfcmA==}
+
+  '@fastify/merge-json-schemas@0.2.1':
+    resolution: {integrity: sha512-OA3KGBCy6KtIvLf8DINC5880o5iBlDX4SxzLQS8HorJAbqluzLRn80UXU0bxZn7UOFhFgpRJDasfwn9nG4FG4A==}
+
+  '@fastify/proxy-addr@5.1.1':
+    resolution: {integrity: sha512-zv07Y9GEuDsJPegZoDFd4SDWaZOW8N2pa0GSrYmKpId/tjt1Hgo3BjZBVjdVpfVrHaA+Qv5jawtS2O50J5xM9g==}
+
+  '@fastify/rate-limit@10.3.0':
+    resolution: {integrity: sha512-eIGkG9XKQs0nyynatApA3EVrojHOuq4l6fhB4eeCk4PIOeadvOJz9/4w3vGI44Go17uaXOWEcPkaD8kuKm7g6Q==}
+
+  '@lukeed/ms@2.0.2':
+    resolution: {integrity: sha512-9I2Zn6+NJLfaGoz9jN3lpwDgAYvfGeNYdbAIjJOqzs4Tpc+VU3Jqq4IofSUBKajiDS8k9fZIg18/z13mpk1bsA==}
+    engines: {node: '>=8'}
+
+  '@pinojs/redact@0.4.0':
+    resolution: {integrity: sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==}
+
+  abstract-logging@2.0.1:
+    resolution: {integrity: sha512-2BjRTZxTPvheOvGbBslFSYOUkr+SjPtOnrLP33f+VIWLzezQpZcqVg7ja3L4dBXmzzgwT+a029jRx5PCi3JuiA==}
+
+  ajv-formats@3.0.1:
+    resolution: {integrity: sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==}
+    peerDependencies:
+      ajv: ^8.0.0
+    peerDependenciesMeta:
+      ajv:
+        optional: true
+
+  ajv@8.20.0:
+    resolution: {integrity: sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==}
+
+  atomic-sleep@1.0.0:
+    resolution: {integrity: sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==}
+    engines: {node: '>=8.0.0'}
+
+  avvio@9.3.0:
+    resolution: {integrity: sha512-g2tQ7LE7oOSqDfwEm3M+ZCMTJc7KiZCdJ4UwyZJb5ckTKyYu50OYmvv0mCFXPuYXoM4zkSt8zM9XQ9KCvxA74A==}
+
+  cookie@1.1.1:
+    resolution: {integrity: sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==}
+    engines: {node: '>=18'}
+
+  dequal@2.0.3:
+    resolution: {integrity: sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==}
+    engines: {node: '>=6'}
+
+  fast-decode-uri-component@1.0.1:
+    resolution: {integrity: sha512-WKgKWg5eUxvRZGwW8FvfbaH7AXSh2cL+3j5fMGzUMCxWBJ3dV3a7Wz8y2f/uQ0e3B6WmodD3oS54jTQ9HVTIIg==}
+
+  fast-deep-equal@3.1.3:
+    resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
+
+  fast-json-stringify@7.0.1:
+    resolution: {integrity: sha512-eRSayARSbbwlBjpP4vnTTIRD5QPcIrmihPxDeN1DtKnHPg66UuJLx+8hlK1kaFdjvzyQ/dzALoi4vwAQ+T+iZA==}
+
+  fast-querystring@1.1.2:
+    resolution: {integrity: sha512-g6KuKWmFXc0fID8WWH0jit4g0AGBoJhCkJMb1RmbsSEUNvQ+ZC8D6CUZ+GtF8nMzSPXnhiePyyqqipzNNEnHjg==}
+
+  fast-uri@3.1.8:
+    resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==}
+
+  fast-uri@4.2.1:
+    resolution: {integrity: sha512-TmHQgewjHtMq1E5QKA0tOE0yeYGQs25KZC/ziJpubRtWI15W92e6vPFydWOeZBVROSHBYw/QhD9d5OefdD6LDg==}
+
+  fastify-plugin@5.1.0:
+    resolution: {integrity: sha512-FAIDA8eovSt5qcDgcBvDuX/v0Cjz0ohGhENZ/wpc3y+oZCY2afZ9Baqql3g/lC+OHRnciQol4ww7tuthOb9idw==}
+
+  fastify-plugin@6.0.0:
+    resolution: {integrity: sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==}
+
+  fastify@5.12.5:
+    resolution: {integrity: sha512-OB2k1dlxs5/NAABqeKV2FUHkSD2BbENsCak8yULVcymn3fHIPDVa9TI3SDnJSWYSllZmSYuZXy2gTnsT+Sut1A==}
+
+  fastq@1.20.3:
+    resolution: {integrity: sha512-XKv5nnLs6nLF71NgiKJLIZFLkPyIEuOselLG7ujZnGrRfQK8HpvY+WqKhAJUAdLomwVHErVS4LfxFlPq0/FTAw==}
+
+  find-my-way@9.9.0:
+    resolution: {integrity: sha512-sJsgZ1sQH2UDuowPuMKg8az7Qc8F0jnj+SKkFWU/+T0xcFlgV5skgXOGUqmQzOdmW6ALA7AhJINWx3qFBkbLHA==}
+    engines: {node: '>=20'}
+
+  ipaddr.js@2.5.0:
+    resolution: {integrity: sha512-aq+t5NAc+cS6rZQQVWC2x98CPqGtKKTMDd4Gaodv0wShnItdKg/51djkGJ1hqH+Oy0ivDftCbSLCQob8zso01w==}
+    engines: {node: '>= 10'}
+
+  json-schema-ref-resolver@3.0.0:
+    resolution: {integrity: sha512-hOrZIVL5jyYFjzk7+y7n5JDzGlU8rfWDuYyHwGa2WA8/pcmMHezp2xsVwxrebD/Q9t8Nc5DboieySDpCp4WG4A==}
+
+  json-schema-traverse@1.0.0:
+    resolution: {integrity: sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==}
+
+  light-my-request@6.6.0:
+    resolution: {integrity: sha512-CHYbu8RtboSIoVsHZ6Ye4cj4Aw/yg2oAFimlF7mNvfDV192LR7nDiKtSIfCuLT7KokPSTn/9kfVLm5OGN0A28A==}
+
+  on-exit-leak-free@2.1.2:
+    resolution: {integrity: sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA==}
+    engines: {node: '>=14.0.0'}
+
+  pg-cloudflare@1.4.1:
+    resolution: {integrity: sha512-6PQbsFWZcp9EmJEwy5cGQ2La+AMWpP46lgbb8X+U/XsHIUweYDNCpeuKck5RxL2MdVFi7krbbEi5nX4Zh7JhrQ==}
+
+  pg-connection-string@2.14.1:
+    resolution: {integrity: sha512-qR3kGNPBLpCNtz0evbKA0Y/MRFXwSSdT+pTJvYp/bXTcReZbvX1kzF0IyTc1QnxqF7AZbOeBhNL8R5mYQZV/MA==}
+
+  pg-int8@1.0.1:
+    resolution: {integrity: sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw==}
+    engines: {node: '>=4.0.0'}
+
+  pg-pool@3.14.0:
+    resolution: {integrity: sha512-gKtPkFdQPU3DksooVLi9LsjZxrsBUZIpa+7aVx+LV5pNh0KzP4Zleud2po+ConrxbuXGBJ6Hfer6hdgpIBpBaw==}
+    peerDependencies:
+      pg: '>=8.0'
+
+  pg-protocol@1.16.1:
+    resolution: {integrity: sha512-p9VOFMiHB/ZbJATetbg+99PxssTVSQRnyuPSQ67mN1+1KBOjZaZ83ZQzltnxPhJwSsC3nwVjJ10DVJlerbFzLg==}
+
+  pg-types@2.2.0:
+    resolution: {integrity: sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA==}
+    engines: {node: '>=4'}
+
+  pg@8.23.1:
+    resolution: {integrity: sha512-aL96AHANtWjPLDOLqnhx+ngp9+UK7ETEU8VJrDCGvsSSi/mGLcWYsS6Herg7lmaBJe4uwrfqsa7gTEFaSizDoQ==}
+    engines: {node: '>= 16.0.0'}
+    peerDependencies:
+      pg-native: '>=3.0.1'
+    peerDependenciesMeta:
+      pg-native:
+        optional: true
+
+  pgpass@1.0.5:
+    resolution: {integrity: sha512-FdW9r/jQZhSeohs1Z3sI1yxFQNFvMcnmfuj4WBMUTxOrAyLMaTcE1aAMBiTlbMNaXvBCQuVi0R7hd8udDSP7ug==}
+
+  pino-abstract-transport@3.0.0:
+    resolution: {integrity: sha512-wlfUczU+n7Hy/Ha5j9a/gZNy7We5+cXp8YL+X+PG8S0KXxw7n/JXA3c46Y0zQznIJ83URJiwy7Lh56WLokNuxg==}
+
+  pino-std-serializers@7.1.0:
+    resolution: {integrity: sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw==}
+
+  pino@10.4.0:
+    resolution: {integrity: sha512-bk1ZMTwG/Vymx+zPoa28MhNzucFvXJWp3csrSuxuHPSMeUettaCoQ5Jvg07mtC4JGNpcfTwz41oVCnNgBK9+vA==}
+    hasBin: true
+
+  postgres-array@2.0.0:
+    resolution: {integrity: sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA==}
+    engines: {node: '>=4'}
+
+  postgres-bytea@1.0.1:
+    resolution: {integrity: sha512-5+5HqXnsZPE65IJZSMkZtURARZelel2oXUEO8rH83VS/hxH5vv1uHquPg5wZs8yMAfdv971IU+kcPUczi7NVBQ==}
+    engines: {node: '>=0.10.0'}
+
+  postgres-date@1.0.7:
+    resolution: {integrity: sha512-suDmjLVQg78nMK2UZ454hAG+OAW+HQPZ6n++TNDUX+L0+uUlLywnoxJKDou51Zm+zTCjrCl0Nq6J9C5hP9vK/Q==}
+    engines: {node: '>=0.10.0'}
+
+  postgres-interval@1.2.0:
+    resolution: {integrity: sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==}
+    engines: {node: '>=0.10.0'}
+
+  process-warning@4.0.1:
+    resolution: {integrity: sha512-3c2LzQ3rY9d0hc1emcsHhfT9Jwz0cChib/QN89oME2R451w5fy3f0afAhERFZAwrbDU43wk12d0ORBpDVME50Q==}
+
+  process-warning@5.1.0:
+    resolution: {integrity: sha512-jQSaVHsPgtyw60e1rQ/A+/ArPEj/S8pS/vFnyGa/gYFXrKk/6RuDkoqVDQ5NI5MmS01698ltlAk0NoDBNLujRw==}
+
+  quick-format-unescaped@4.0.4:
+    resolution: {integrity: sha512-tYC1Q1hgyRuHgloV/YXs2w15unPVh8qfu/qCTfhTYamaw7fyhumKa2yGpdSo87vY32rIclj+4fWYQXUMs9EHvg==}
+
+  real-require@1.0.0:
+    resolution: {integrity: sha512-P4nbQYQfePJxRSmY+v/KINxVucm4NF3p3s7pJveMTtom52FR4YGltUQLB8idDXwDDWW+eYrWDFbuzUnjoWHF7g==}
+
+  require-from-string@2.0.2:
+    resolution: {integrity: sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==}
+    engines: {node: '>=0.10.0'}
+
+  ret@0.5.0:
+    resolution: {integrity: sha512-I1XxrZSQ+oErkRR4jYbAyEEu2I0avBvvMM5JN+6EBprOGRCs63ENqZ3vjavq8fBw2+62G5LF5XelKwuJpcvcxw==}
+    engines: {node: '>=10'}
+
+  reusify@1.1.0:
+    resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
+    engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
+
+  rfdc@1.4.1:
+    resolution: {integrity: sha512-q1b3N5QkRUWUl7iyylaaj3kOpIT0N2i9MqIEQXP73GVsN9cw3fdx8X63cEmWhJGi2PPCF23Ijp7ktmd39rawIA==}
+
+  safe-regex2@5.1.1:
+    resolution: {integrity: sha512-mOSBvHGDZMuIEZMdOz/aCEYDCv0E7nfcNsIhUF+/P+xC7Hyf3FkvymqgPbg9D1EdSGu+uKbJgy09K/RKKc7kJA==}
+    hasBin: true
+
+  safe-stable-stringify@2.5.0:
+    resolution: {integrity: sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==}
+    engines: {node: '>=10'}
+
+  secure-json-parse@4.1.0:
+    resolution: {integrity: sha512-l4KnYfEyqYJxDwlNVyRfO2E4NTHfMKAWdUuA8J0yve2Dz/E/PdBepY03RvyJpssIpRFwJoCD55wA+mEDs6ByWA==}
+
+  semver@7.8.5:
+    resolution: {integrity: sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+  set-cookie-parser@2.7.2:
+    resolution: {integrity: sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==}
+
+  sonic-boom@4.2.1:
+    resolution: {integrity: sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==}
+
+  split2@4.2.0:
+    resolution: {integrity: sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==}
+    engines: {node: '>= 10.x'}
+
+  thread-stream@4.2.0:
+    resolution: {integrity: sha512-e2zZ96wSChazBsbENf/Pcm/4swHt2cEKQ92rhUjkL9GCKiTDJIaTBenjE/m9DXi0QBmTMDkFDdOomUy20A1tDQ==}
+    engines: {node: '>=20'}
+
+  toad-cache@3.7.4:
+    resolution: {integrity: sha512-m1TdR/rvT7kgGJZhspNtXdsdYk0fddFpJJFlG5s+UkPFo6lkLoZ3YLOaovPYjq1R75NP5JfeTlSHaOsE09peCg==}
+    engines: {node: '>=20'}
+
+  xtend@4.0.2:
+    resolution: {integrity: sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==}
+    engines: {node: '>=0.4'}
+
+  zod@3.25.76:
+    resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==}
+
+snapshots:
+
+  '@fastify/ajv-compiler@4.0.6':
+    dependencies:
+      ajv: 8.20.0
+      ajv-formats: 3.0.1(ajv@8.20.0)
+      fast-uri: 4.2.1
+
+  '@fastify/cors@11.3.0':
+    dependencies:
+      fastify-plugin: 6.0.0
+      toad-cache: 3.7.4
+
+  '@fastify/error@4.2.0': {}
+
+  '@fastify/fast-json-stringify-compiler@5.1.0':
+    dependencies:
+      fast-json-stringify: 7.0.1
+
+  '@fastify/forwarded@3.0.2': {}
+
+  '@fastify/merge-json-schemas@0.2.1':
+    dependencies:
+      dequal: 2.0.3
+
+  '@fastify/proxy-addr@5.1.1':
+    dependencies:
+      '@fastify/forwarded': 3.0.2
+      ipaddr.js: 2.5.0
+
+  '@fastify/rate-limit@10.3.0':
+    dependencies:
+      '@lukeed/ms': 2.0.2
+      fastify-plugin: 5.1.0
+      toad-cache: 3.7.4
+
+  '@lukeed/ms@2.0.2': {}
+
+  '@pinojs/redact@0.4.0': {}
+
+  abstract-logging@2.0.1: {}
+
+  ajv-formats@3.0.1(ajv@8.20.0):
+    optionalDependencies:
+      ajv: 8.20.0
+
+  ajv@8.20.0:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      fast-uri: 3.1.8
+      json-schema-traverse: 1.0.0
+      require-from-string: 2.0.2
+
+  atomic-sleep@1.0.0: {}
+
+  avvio@9.3.0:
+    dependencies:
+      '@fastify/error': 4.2.0
+      fastq: 1.20.3
+
+  cookie@1.1.1: {}
+
+  dequal@2.0.3: {}
+
+  fast-decode-uri-component@1.0.1: {}
+
+  fast-deep-equal@3.1.3: {}
+
+  fast-json-stringify@7.0.1:
+    dependencies:
+      '@fastify/merge-json-schemas': 0.2.1
+      ajv: 8.20.0
+      ajv-formats: 3.0.1(ajv@8.20.0)
+      fast-uri: 4.2.1
+      json-schema-ref-resolver: 3.0.0
+      rfdc: 1.4.1
+
+  fast-querystring@1.1.2:
+    dependencies:
+      fast-decode-uri-component: 1.0.1
+
+  fast-uri@3.1.8: {}
+
+  fast-uri@4.2.1: {}
+
+  fastify-plugin@5.1.0: {}
+
+  fastify-plugin@6.0.0: {}
+
+  fastify@5.12.5:
+    dependencies:
+      '@fastify/ajv-compiler': 4.0.6
+      '@fastify/error': 4.2.0
+      '@fastify/fast-json-stringify-compiler': 5.1.0
+      '@fastify/proxy-addr': 5.1.1
+      abstract-logging: 2.0.1
+      avvio: 9.3.0
+      fast-json-stringify: 7.0.1
+      find-my-way: 9.9.0
+      light-my-request: 6.6.0
+      pino: 10.4.0
+      process-warning: 5.1.0
+      rfdc: 1.4.1
+      secure-json-parse: 4.1.0
+      semver: 7.8.5
+      toad-cache: 3.7.4
+
+  fastq@1.20.3:
+    dependencies:
+      reusify: 1.1.0
+
+  find-my-way@9.9.0:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      fast-querystring: 1.1.2
+      safe-regex2: 5.1.1
+
+  ipaddr.js@2.5.0: {}
+
+  json-schema-ref-resolver@3.0.0:
+    dependencies:
+      dequal: 2.0.3
+
+  json-schema-traverse@1.0.0: {}
+
+  light-my-request@6.6.0:
+    dependencies:
+      cookie: 1.1.1
+      process-warning: 4.0.1
+      set-cookie-parser: 2.7.2
+
+  on-exit-leak-free@2.1.2: {}
+
+  pg-cloudflare@1.4.1:
+    optional: true
+
+  pg-connection-string@2.14.1: {}
+
+  pg-int8@1.0.1: {}
+
+  pg-pool@3.14.0(pg@8.23.1):
+    dependencies:
+      pg: 8.23.1
+
+  pg-protocol@1.16.1: {}
+
+  pg-types@2.2.0:
+    dependencies:
+      pg-int8: 1.0.1
+      postgres-array: 2.0.0
+      postgres-bytea: 1.0.1
+      postgres-date: 1.0.7
+      postgres-interval: 1.2.0
+
+  pg@8.23.1:
+    dependencies:
+      pg-connection-string: 2.14.1
+      pg-pool: 3.14.0(pg@8.23.1)
+      pg-protocol: 1.16.1
+      pg-types: 2.2.0
+      pgpass: 1.0.5
+    optionalDependencies:
+      pg-cloudflare: 1.4.1
+
+  pgpass@1.0.5:
+    dependencies:
+      split2: 4.2.0
+
+  pino-abstract-transport@3.0.0:
+    dependencies:
+      split2: 4.2.0
+
+  pino-std-serializers@7.1.0: {}
+
+  pino@10.4.0:
+    dependencies:
+      '@pinojs/redact': 0.4.0
+      atomic-sleep: 1.0.0
+      on-exit-leak-free: 2.1.2
+      pino-abstract-transport: 3.0.0
+      pino-std-serializers: 7.1.0
+      process-warning: 5.1.0
+      quick-format-unescaped: 4.0.4
+      real-require: 1.0.0
+      safe-stable-stringify: 2.5.0
+      sonic-boom: 4.2.1
+      thread-stream: 4.2.0
+
+  postgres-array@2.0.0: {}
+
+  postgres-bytea@1.0.1: {}
+
+  postgres-date@1.0.7: {}
+
+  postgres-interval@1.2.0:
+    dependencies:
+      xtend: 4.0.2
+
+  process-warning@4.0.1: {}
+
+  process-warning@5.1.0: {}
+
+  quick-format-unescaped@4.0.4: {}
+
+  real-require@1.0.0: {}
+
+  require-from-string@2.0.2: {}
+
+  ret@0.5.0: {}
+
+  reusify@1.1.0: {}
+
+  rfdc@1.4.1: {}
+
+  safe-regex2@5.1.1:
+    dependencies:
+      ret: 0.5.0
+
+  safe-stable-stringify@2.5.0: {}
+
+  secure-json-parse@4.1.0: {}
+
+  semver@7.8.5: {}
+
+  set-cookie-parser@2.7.2: {}
+
+  sonic-boom@4.2.1:
+    dependencies:
+      atomic-sleep: 1.0.0
+
+  split2@4.2.0: {}
+
+  thread-stream@4.2.0:
+    dependencies:
+      real-require: 1.0.0
+
+  toad-cache@3.7.4: {}
+
+  xtend@4.0.2: {}
+
+  zod@3.25.76: {}
diff --git a/services/intake/sql/001_schema.sql b/services/intake/sql/001_schema.sql
new file mode 100644
index 0000000..0dd8741
--- /dev/null
+++ b/services/intake/sql/001_schema.sql
@@ -0,0 +1,171 @@
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+CREATE TABLE IF NOT EXISTS contacts (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  full_name text NOT NULL,
+  phone text,
+  phone_normalized text,
+  email text,
+  email_normalized text,
+  location_label text,
+  preferred_contact_method text NOT NULL DEFAULT 'phone'
+    CHECK (preferred_contact_method IN ('phone','sms','email')),
+  consent_to_contact boolean NOT NULL DEFAULT true,
+  source text NOT NULL DEFAULT 'website',
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CHECK (phone IS NOT NULL OR email IS NOT NULL)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS contacts_email_normalized_unique
+  ON contacts(email_normalized) WHERE email_normalized IS NOT NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS contacts_phone_normalized_unique
+  ON contacts(phone_normalized) WHERE phone_normalized IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS service_tickets (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  ticket_number bigint GENERATED ALWAYS AS IDENTITY UNIQUE,
+  contact_id uuid NOT NULL REFERENCES contacts(id),
+  issue_category text NOT NULL,
+  request_type text NOT NULL DEFAULT 'website_request',
+  device_type text,
+  service_mode text NOT NULL DEFAULT 'undecided'
+    CHECK (service_mode IN ('onsite','remote','undecided')),
+  status text NOT NULL DEFAULT 'new'
+    CHECK (status IN ('new','triaged','scheduled','in_progress','waiting_client','resolved','closed','cancelled')),
+  priority text NOT NULL DEFAULT 'normal'
+    CHECK (priority IN ('low','normal','high','urgent')),
+  location_label text,
+  requested_window text,
+  public_description text NOT NULL,
+  source_page text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS client_assets (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  contact_id uuid NOT NULL REFERENCES contacts(id),
+  asset_type text NOT NULL,
+  make text,
+  model text,
+  serial_or_service_id text,
+  installed_at date,
+  location_label text,
+  specs jsonb NOT NULL DEFAULT '{}'::jsonb,
+  operational_notes text,
+  credential_reference text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS service_events (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  ticket_id uuid REFERENCES service_tickets(id),
+  contact_id uuid NOT NULL REFERENCES contacts(id),
+  event_type text NOT NULL CHECK (event_type IN ('note','status_change','visit','call','remote_session','work_log','intake')),
+  body text NOT NULL,
+  visibility text NOT NULL DEFAULT 'internal' CHECK (visibility IN ('internal','client_shareable')),
+  created_by text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS intake_submissions (
+  idempotency_key text PRIMARY KEY,
+  ticket_id uuid REFERENCES service_tickets(id),
+  received_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS tickets_status_priority_created ON service_tickets(status, priority, created_at DESC);
+CREATE INDEX IF NOT EXISTS tickets_contact_created ON service_tickets(contact_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS assets_contact ON client_assets(contact_id);
+CREATE INDEX IF NOT EXISTS events_ticket_created ON service_events(ticket_id, created_at DESC);
+
+CREATE OR REPLACE FUNCTION touch_updated_at() RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  NEW.updated_at = now();
+  RETURN NEW;
+END;
+$$;
+DROP TRIGGER IF EXISTS contacts_touch_updated_at ON contacts;
+CREATE TRIGGER contacts_touch_updated_at BEFORE UPDATE ON contacts
+  FOR EACH ROW EXECUTE FUNCTION touch_updated_at();
+DROP TRIGGER IF EXISTS tickets_touch_updated_at ON service_tickets;
+CREATE TRIGGER tickets_touch_updated_at BEFORE UPDATE ON service_tickets
+  FOR EACH ROW EXECUTE FUNCTION touch_updated_at();
+DROP TRIGGER IF EXISTS assets_touch_updated_at ON client_assets;
+CREATE TRIGGER assets_touch_updated_at BEFORE UPDATE ON client_assets
+  FOR EACH ROW EXECUTE FUNCTION touch_updated_at();
+
+CREATE OR REPLACE FUNCTION create_public_intake(
+  p_idempotency_key text,
+  p_full_name text,
+  p_phone text,
+  p_email text,
+  p_phone_normalized text,
+  p_email_normalized text,
+  p_location text,
+  p_preferred_contact text,
+  p_issue_category text,
+  p_device_type text,
+  p_service_mode text,
+  p_requested_window text,
+  p_description text,
+  p_request_type text,
+  p_source_page text
+) RETURNS uuid
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $$
+DECLARE
+  v_contact_id uuid;
+  v_ticket_id uuid;
+  v_inserted_key text;
+BEGIN
+  INSERT INTO intake_submissions(idempotency_key)
+    VALUES (p_idempotency_key)
+    ON CONFLICT (idempotency_key) DO NOTHING
+    RETURNING idempotency_key INTO v_inserted_key;
+
+  IF v_inserted_key IS NULL THEN
+    SELECT ticket_id INTO v_ticket_id FROM intake_submissions WHERE idempotency_key = p_idempotency_key;
+    RETURN v_ticket_id;
+  END IF;
+
+  IF p_email_normalized IS NOT NULL THEN
+    INSERT INTO contacts(full_name, phone, phone_normalized, email, email_normalized, location_label,
+                         preferred_contact_method, consent_to_contact, source)
+      VALUES (p_full_name, NULLIF(p_phone, ''), p_phone_normalized, NULLIF(p_email, ''), p_email_normalized,
+              NULLIF(p_location, ''), p_preferred_contact, true, 'website')
+      ON CONFLICT (email_normalized) WHERE email_normalized IS NOT NULL
+      DO UPDATE SET updated_at = now()
+      RETURNING id INTO v_contact_id;
+  ELSIF p_phone_normalized IS NOT NULL THEN
+    INSERT INTO contacts(full_name, phone, phone_normalized, email, email_normalized, location_label,
+                         preferred_contact_method, consent_to_contact, source)
+      VALUES (p_full_name, NULLIF(p_phone, ''), p_phone_normalized, NULLIF(p_email, ''), NULL,
+              NULLIF(p_location, ''), p_preferred_contact, true, 'website')
+      ON CONFLICT (phone_normalized) WHERE phone_normalized IS NOT NULL
+      DO UPDATE SET updated_at = now()
+      RETURNING id INTO v_contact_id;
+  ELSE
+    RAISE EXCEPTION 'contact method required';
+  END IF;
+
+  INSERT INTO service_tickets(contact_id, issue_category, request_type, device_type, service_mode, location_label,
+                              requested_window, public_description, source_page)
+    VALUES (v_contact_id, p_issue_category, p_request_type, NULLIF(p_device_type, ''), p_service_mode,
+            NULLIF(p_location, ''), NULLIF(p_requested_window, ''), p_description, NULLIF(p_source_page, ''))
+    RETURNING id INTO v_ticket_id;
+
+  INSERT INTO service_events(ticket_id, contact_id, event_type, body, visibility, created_by)
+    VALUES (v_ticket_id, v_contact_id, 'intake', 'Public website service request received.', 'internal', 'website-intake');
+
+  UPDATE intake_submissions SET ticket_id = v_ticket_id WHERE idempotency_key = p_idempotency_key;
+  RETURN v_ticket_id;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION create_public_intake(text,text,text,text,text,text,text,text,text,text,text,text,text,text,text) FROM PUBLIC;
diff --git a/services/intake/sql/020-create-api-role.sh b/services/intake/sql/020-create-api-role.sh
new file mode 100644
index 0000000..b7ccb66
--- /dev/null
+++ b/services/intake/sql/020-create-api-role.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+set -eu
+: "${INTAKE_DB_PASSWORD:?INTAKE_DB_PASSWORD must be set for initial database creation}"
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
+  -v intake_password="$INTAKE_DB_PASSWORD" <<'SQL'
+CREATE ROLE intake_api LOGIN PASSWORD :'intake_password' NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT;
+REVOKE CREATE ON SCHEMA public FROM PUBLIC;
+GRANT USAGE ON SCHEMA public TO intake_api;
+GRANT EXECUTE ON FUNCTION create_public_intake(text,text,text,text,text,text,text,text,text,text,text,text,text,text,text) TO intake_api;
+SQL
diff --git a/services/intake/src/server.mjs b/services/intake/src/server.mjs
new file mode 100644
index 0000000..f88aea6
--- /dev/null
+++ b/services/intake/src/server.mjs
@@ -0,0 +1,122 @@
+import Fastify from 'fastify';
+import cors from '@fastify/cors';
+import rateLimit from '@fastify/rate-limit';
+import pg from 'pg';
+import { z } from 'zod';
+
+const { Pool } = pg;
+const origins = (process.env.ALLOWED_ORIGINS || 'https://ohgeec.com,https://www.ohgeec.com')
+  .split(',').map((origin) => origin.trim()).filter(Boolean);
+const pool = new Pool({
+  host: process.env.DB_HOST || 'postgres',
+  port: Number(process.env.DB_PORT || 5432),
+  database: process.env.DB_NAME || 'ohgeec',
+  user: process.env.DB_USER || 'intake_api',
+  password: process.env.DB_PASSWORD,
+  max: 5,
+  idleTimeoutMillis: 10_000,
+});
+const app = Fastify({
+  logger: false,
+  bodyLimit: 16 * 1024,
+  trustProxy: false,
+});
+
+const optionalText = (max) => z.string().trim().max(max).optional().default('');
+const intakeSchema = z.object({
+  name: z.string().trim().min(1).max(120),
+  phone: optionalText(32),
+  email: z.union([z.string().trim().email().max(254), z.literal('')]).optional().default(''),
+  location: optionalText(120),
+  preferredContact: z.enum(['phone', 'sms', 'email']),
+  requestType: z.string().trim().min(1).max(80).regex(/^[a-z0-9_-]+$/i),
+  deviceType: optionalText(120),
+  serviceMode: z.enum(['onsite', 'remote', 'undecided']),
+  service: z.enum(['virus_malware','setup_optimization','data_recovery','software_help','network_wifi','starlink_setup','tutoring','other']),
+  description: z.string().trim().min(3).max(2000),
+  requestedDate: z.union([z.string().regex(/^\d{4}-\d{2}-\d{2}$/), z.literal('')]).optional().default(''),
+  requestedTime: z.union([z.string().regex(/^\d{2}:\d{2}$/), z.literal('')]).optional().default(''),
+  sourcePage: z.string().trim().max(240).regex(/^\/(?!\/)[^\r\n]*$/),
+  consentToContact: z.literal(true),
+  website: optionalText(200),
+}).strict();
+
+const normPhone = (value) => {
+  const digits = value.replace(/\D/g, '');
+  if (!digits.length) return null;
+  if (digits.length === 10) return `+1${digits}`;
+  if (digits.length === 11 && digits.startsWith('1')) return `+${digits}`;
+  return `+${digits}`;
+};
+const normEmail = (value) => value ? value.trim().toLowerCase() : null;
+const accepted = async (_request, reply) => reply.code(202).send({ accepted: true });
+
+await app.register(cors, {
+  origin: (origin, callback) => callback(null, !origin || origins.includes(origin)),
+  methods: ['POST', 'OPTIONS'],
+  allowedHeaders: ['Content-Type', 'Idempotency-Key'],
+  maxAge: 600,
+});
+await app.register(rateLimit, {
+  max: 12,
+  timeWindow: '10 minutes',
+  keyGenerator: (request) => request.headers['cf-connecting-ip'] || request.ip,
+  errorResponseBuilder: () => ({ error: 'Please wait before trying again.' }),
+});
+
+app.get('/healthz', async (_request, reply) => {
+  try {
+    await pool.query('SELECT 1');
+    return reply.send({ ok: true });
+  } catch {
+    return reply.code(503).send({ ok: false });
+  }
+});
+
+app.post('/v1/intake', async (request, reply) => {
+  const key = request.headers['idempotency-key'];
+  if (typeof key !== 'string' || !/^[a-zA-Z0-9_-]{16,100}$/.test(key)) {
+    return reply.code(400).send({ error: 'Request could not be accepted.' });
+  }
+  const parsed = intakeSchema.safeParse(request.body);
+  if (!parsed.success) return reply.code(400).send({ error: 'Please check the request fields and try again.' });
+  const form = parsed.data;
+  if (form.website) return accepted(request, reply);
+  if (form.serviceMode === 'onsite' && !form.location) {
+    return reply.code(400).send({ error: 'Please add your Montana town or county for an on-site request.' });
+  }
+  if (form.preferredContact === 'email' && !form.email) {
+    return reply.code(400).send({ error: 'Please add the preferred contact detail.' });
+  }
+  if (form.preferredContact !== 'email' && !form.phone) {
+    return reply.code(400).send({ error: 'Please add the preferred contact detail.' });
+  }
+
+  const requestedWindow = [form.requestedDate, form.requestedTime].filter(Boolean).join(' ');
+  try {
+    await pool.query(
+      'SELECT create_public_intake($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)',
+      [key, form.name, form.phone, form.email, normPhone(form.phone), normEmail(form.email), form.location,
+       form.preferredContact, form.service, form.deviceType, form.serviceMode, requestedWindow,
+       form.description, form.requestType, form.sourcePage],
+    );
+    return reply.code(202).send({ accepted: true });
+  } catch {
+    // Do not log customer payloads or database error details.
+    return reply.code(503).send({ error: 'Request could not be saved right now. Please try again later.' });
+  }
+});
+
+app.setNotFoundHandler((_request, reply) => reply.code(404).send({ error: 'Not found.' }));
+app.setErrorHandler((_error, _request, reply) => reply.code(400).send({ error: 'Request could not be accepted.' }));
+
+const port = Number(process.env.PORT || 3000);
+await app.listen({ host: '0.0.0.0', port });
+
+const shutdown = async () => {
+  await app.close();
+  await pool.end();
+  process.exit(0);
+};
+process.on('SIGTERM', shutdown);
+process.on('SIGINT', shutdown);
diff --git a/sitemap.xml b/sitemap.xml
index cce3e7b..abf7fc6 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -96,6 +96,12 @@
     <changefreq>monthly</changefreq>
     <priority>0.8</priority>
   </url>
+  <url>
+    <loc>https://ohgeec.com/tech-support/onsite-montana/</loc>
+    <lastmod>2026-10-04</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.7</priority>
+  </url>
   <url>
     <loc>https://ohgeec.com/book.html</loc>
     <lastmod>2026-10-04</lastmod>
diff --git a/tech-support/connectivity/boost-wifi-signal-large-home-outbuildings/index.html b/tech-support/connectivity/boost-wifi-signal-large-home-outbuildings/index.html
index fca2d9c..2e1ff3a 100644
--- a/tech-support/connectivity/boost-wifi-signal-large-home-outbuildings/index.html
+++ b/tech-support/connectivity/boost-wifi-signal-large-home-outbuildings/index.html
@@ -204,16 +204,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>Log into the router and separate the 2.4 GHz and 5 GHz network names so you can choose. 2.4 GHz reaches further; 5 GHz is faster but shorter.</li><li>Change the Wi-Fi channel to 1, 6, or 11 on 2.4 GHz if neighbours' networks are crowding you.</li><li>Add a mesh system for one building — a set of two or three units is far better than a single booster.</li><li>Use a point-to-point wireless bridge for a separate outbuilding. This is the correct tool for a shop or barn 50 feet or more away, and it is not the same thing as a Wi-Fi booster.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/tech-support/onsite-montana/?requestType=boost-wifi-signal-large-home-outbuildings&amp;sourcePage=%2Ftech-support%2Fconnectivity%2Fboost-wifi-signal-large-home-outbuildings%2F">Request an on-site visit &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/tech-support/onsite-montana/?requestType=boost-wifi-signal-large-home-outbuildings&amp;sourcePage=%2Ftech-support%2Fconnectivity%2Fboost-wifi-signal-large-home-outbuildings%2F" rel="noopener">Request an on-site visit &rarr;</a>
+  <p class="fine rv">ON-SITE SERVICE IN MONTANA</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -267,11 +267,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/connectivity/fix-no-service-sos-mode-rural-montana/index.html b/tech-support/connectivity/fix-no-service-sos-mode-rural-montana/index.html
index 6763f93..1f56443 100644
--- a/tech-support/connectivity/fix-no-service-sos-mode-rural-montana/index.html
+++ b/tech-support/connectivity/fix-no-service-sos-mode-rural-montana/index.html
@@ -217,16 +217,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>Reset Network Settings (iPhone: Settings &gt; General &gt; Transfer or Reset iPhone &gt; Reset &gt; Reset Network Settings; Android: Settings &gt; System &gt; Reset &gt; Reset Wi-Fi, mobile and Bluetooth). This forgets saved Wi-Fi passwords, so have them handy.</li><li>Power the phone off, remove the SIM tray with the pin tool, reseat the card, and power back on. Skip this if your phone uses an eSIM.</li><li>Move the SIM into another phone to prove whether the trouble is the phone or the network.</li><li>Ask a neighbour on the same carrier whether their phone is working right now.</li><li>Check your carrier coverage map and report the dead zone so it is on record.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/tech-support/onsite-montana/?requestType=fix-no-service-sos-mode-rural-montana&amp;sourcePage=%2Ftech-support%2Fconnectivity%2Ffix-no-service-sos-mode-rural-montana%2F">Request an on-site visit &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/tech-support/onsite-montana/?requestType=fix-no-service-sos-mode-rural-montana&amp;sourcePage=%2Ftech-support%2Fconnectivity%2Ffix-no-service-sos-mode-rural-montana%2F" rel="noopener">Request an on-site visit &rarr;</a>
+  <p class="fine rv">ON-SITE SERVICE IN MONTANA</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -280,11 +280,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/connectivity/index.html b/tech-support/connectivity/index.html
index 83d530d..c0c496b 100644
--- a/tech-support/connectivity/index.html
+++ b/tech-support/connectivity/index.html
@@ -121,11 +121,30 @@ <h2 class="rv">Prefer to just <em>have it fixed?</em></h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/connectivity/satellite-internet-slow-starlink-hughesnet/index.html b/tech-support/connectivity/satellite-internet-slow-starlink-hughesnet/index.html
index b181bd5..62d9cf4 100644
--- a/tech-support/connectivity/satellite-internet-slow-starlink-hughesnet/index.html
+++ b/tech-support/connectivity/satellite-internet-slow-starlink-hughesnet/index.html
@@ -207,16 +207,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>Power-cycle the dish: unplug it at the wall for a full 60 seconds, then plug it back in and let it re-acquire (up to 15 minutes).</li><li>Move the router away from the dish's power supply and away from microwaves and cordless phone bases.</li><li>Run an ethernet cable from the router straight to one device to prove whether the slowdown is Wi-Fi or the satellite link itself.</li><li>Contact support with your speed test history and the exact times the slowdown happens — evenings and storms are normal and worth documenting.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/tech-support/onsite-montana/?requestType=satellite-internet-slow-starlink-hughesnet&amp;sourcePage=%2Ftech-support%2Fconnectivity%2Fsatellite-internet-slow-starlink-hughesnet%2F">Request on-site Starlink setup &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/tech-support/onsite-montana/?requestType=satellite-internet-slow-starlink-hughesnet&amp;sourcePage=%2Ftech-support%2Fconnectivity%2Fsatellite-internet-slow-starlink-hughesnet%2F" rel="noopener">Request on-site Starlink setup &rarr;</a>
+  <p class="fine rv">ON-SITE SERVICE IN MONTANA</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -270,11 +270,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/hardware/fix-printer-offline-wireless-setup/index.html b/tech-support/hardware/fix-printer-offline-wireless-setup/index.html
index be9eda8..3001fcb 100644
--- a/tech-support/hardware/fix-printer-offline-wireless-setup/index.html
+++ b/tech-support/hardware/fix-printer-offline-wireless-setup/index.html
@@ -209,16 +209,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>Give the printer a fixed address. In the router settings, reserve an IP address for the printer so it stops changing.</li><li>Remove the printer from your computer and add it again by its address rather than by name.</li><li>Connect by USB once to confirm the printer works at all, then return to Wi-Fi.</li><li>Update the printer firmware from the printer's own menu or the manufacturer's app.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/tech-support/onsite-montana/?requestType=fix-printer-offline-wireless-setup&amp;sourcePage=%2Ftech-support%2Fhardware%2Ffix-printer-offline-wireless-setup%2F">Request an on-site visit &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/tech-support/onsite-montana/?requestType=fix-printer-offline-wireless-setup&amp;sourcePage=%2Ftech-support%2Fhardware%2Ffix-printer-offline-wireless-setup%2F" rel="noopener">Request an on-site visit &rarr;</a>
+  <p class="fine rv">ON-SITE SERVICE IN MONTANA</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -272,11 +272,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/hardware/index.html b/tech-support/hardware/index.html
index c9ce259..f2692b2 100644
--- a/tech-support/hardware/index.html
+++ b/tech-support/hardware/index.html
@@ -111,11 +111,30 @@ <h2 class="rv">Prefer to just <em>have it fixed?</em></h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/hardware/smart-tv-streaming-weak-wifi/index.html b/tech-support/hardware/smart-tv-streaming-weak-wifi/index.html
index ba30aef..0b2bad7 100644
--- a/tech-support/hardware/smart-tv-streaming-weak-wifi/index.html
+++ b/tech-support/hardware/smart-tv-streaming-weak-wifi/index.html
@@ -202,16 +202,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>Switch the TV to the 2.4 GHz network if it is far from the router — it reaches further even though it is slower.</li><li>Move the router higher and out of a cupboard, closer to the TV wall.</li><li>Move the streaming stick out of a metal TV cabinet or away from the back of the TV with a short extension cable.</li><li>Run an ethernet cable to the TV. If the TV has no port, use a powerline adapter or a Wi-Fi extender with an ethernet port, and plug the TV into that.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/tech-support/onsite-montana/?requestType=smart-tv-streaming-weak-wifi&amp;sourcePage=%2Ftech-support%2Fhardware%2Fsmart-tv-streaming-weak-wifi%2F">Request an on-site visit &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/tech-support/onsite-montana/?requestType=smart-tv-streaming-weak-wifi&amp;sourcePage=%2Ftech-support%2Fhardware%2Fsmart-tv-streaming-weak-wifi%2F" rel="noopener">Request an on-site visit &rarr;</a>
+  <p class="fine rv">ON-SITE SERVICE IN MONTANA</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -265,11 +265,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/index.html b/tech-support/index.html
index e028850..dc94414 100644
--- a/tech-support/index.html
+++ b/tech-support/index.html
@@ -205,11 +205,30 @@ <h2 class="rv">Something broken? <em>Let us fix it.</em></h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/onsite-montana/index.html b/tech-support/onsite-montana/index.html
new file mode 100644
index 0000000..9a94676
--- /dev/null
+++ b/tech-support/onsite-montana/index.html
@@ -0,0 +1,138 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
+<title>On-site tech support in Montana — ohgeeceee</title>
+<meta name="description" content="On-site help with Starlink, Wi-Fi, computers, printers, and connected devices across Montana. Request a visit and share only the details needed to plan it." />
+<meta name="robots" content="index,follow" />
+<meta name="theme-color" content="#FAF7F2" />
+<link rel="canonical" href="https://ohgeec.com/tech-support/onsite-montana/" />
+
+<meta property="og:type" content="website" />
+<meta property="og:site_name" content="the ohgeeceee network" />
+<meta property="og:title" content="On-site tech support in Montana — ohgeeceee" />
+<meta property="og:description" content="On-site help with Starlink, Wi-Fi, computers, printers, and connected devices across Montana. Request a visit and share only the details needed to plan it." />
+<meta property="og:url" content="https://ohgeec.com/tech-support/onsite-montana/" />
+<meta property="og:image" content="https://ohgeec.com/og-image.png" />
+<meta property="og:image:width" content="1200" />
+<meta property="og:image:height" content="630" />
+<meta name="twitter:card" content="summary_large_image" />
+<meta name="twitter:title" content="On-site tech support in Montana — ohgeeceee" />
+<meta name="twitter:description" content="On-site help with Starlink, Wi-Fi, computers, printers, and connected devices across Montana. Request a visit and share only the details needed to plan it." />
+<meta name="twitter:image" content="https://ohgeec.com/og-image.png" />
+
+<link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Crect width='24' height='24' rx='5' fill='%23FAF7F2'/%3E%3Ccircle cx='12' cy='5' r='2.4' fill='%2314110E'/%3E%3Ccircle cx='5' cy='17' r='2.4' fill='%2314110E'/%3E%3Ccircle cx='19' cy='17' r='2.4' fill='%2314110E'/%3E%3Cpath d='M12 6.6 5.6 15.4M12 6.6l6.4 8.8M6.6 17.6h10.8' stroke='%2314110E' stroke-width='1.3' stroke-linecap='round' fill='none'/%3E%3C/svg%3E" />
+<link rel="apple-touch-icon" href="/apple-touch-icon.png" />
+
+<link rel="preload" href="/fonts/fraunces-var.woff2" as="font" type="font/woff2" crossorigin />
+<link rel="preload" href="/fonts/inter-var.woff2" as="font" type="font/woff2" crossorigin />
+<link rel="stylesheet" href="/fonts.css" />
+<link rel="stylesheet" href="/tech-support/tech-support.css" />
+<script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "Service",
+  "name": "On-site home technology support in Montana",
+  "provider": {
+    "@type": "Person",
+    "name": "ohgeeceee",
+    "url": "https://ohgeec.com/"
+  },
+  "areaServed": {
+    "@type": "State",
+    "name": "Montana"
+  },
+  "serviceType": "Home technology setup and troubleshooting",
+  "url": "https://ohgeec.com/tech-support/onsite-montana/"
+}
+</script>
+</head>
+<body>
+<header class="topbar">
+  <a class="brand" href="/">
+    <svg viewBox="0 0 24 24" fill="none" aria-hidden="true">
+      <circle cx="12" cy="5" r="2.4" fill="#14110E"/><circle cx="5" cy="17" r="2.4" fill="#14110E"/><circle cx="19" cy="17" r="2.4" fill="#14110E"/>
+      <path d="M12 6.6 5.6 15.4M12 6.6l6.4 8.8M6.6 17.6h10.8" stroke="#14110E" stroke-width="1.3" stroke-linecap="round"/>
+    </svg>
+    <b>ohgeeceee</b>
+  </a>
+  <span class="coords">Remote &mdash; anywhere in the US</span>
+  <nav>
+    <a href="/#work">Index</a>
+    <a href="/#about">About</a>
+    <a href="/tech-support/" class="current" aria-current="page">Tech help</a>
+    <a href="/support.html" class="nav-support">Support</a>
+  </nav>
+</header>
+<main>
+  <div class="wrap wrap--narrow">
+    <nav class="crumb" aria-label="Breadcrumb"><ol><li><a href="/">Home</a></li><li><a href="/tech-support/">Tech Support</a></li><li><span aria-current="page">On-site help in Montana</span></li></ol></nav>
+    <p class="kicker rv">MONTANA · HOME TECH SUPPORT</p>
+    <h1 class="rv">The tech at home, sorted.</h1>
+    <p class="lede rv">On-site help for rural homes, small businesses, and the places where a reliable connection matters. Tell me what is happening and where you are; we will confirm availability before scheduling.</p>
+    <section class="prereq rv">
+      <h2>What I can help with</h2>
+      <ul>
+        <li>Starlink setup, dish placement, and Wi-Fi coverage</li>
+        <li>Wi-Fi dead zones, router setup, and connected devices</li>
+        <li>Computer, printer, smart TV, and home network troubleshooting</li>
+      </ul>
+      <p class="dont">No account passwords or Wi-Fi passwords in the request form. We can arrange a safe way to share access if a visit requires it.</p>
+    </section>
+    <section class="cta" id="request">
+      <h2>Request an on-site visit</h2>
+      <p>Share your Montana town or county, a short description, and a preferred time. Exact address and access details can wait until the visit is confirmed.</p>
+      <a class="btn" id="onsite-request-link" href="/book.html?mode=onsite">Request an on-site visit &rarr;</a>
+      <p class="fine">MONTANA ON-SITE SERVICE · REQUESTS ARE CONFIRMED BEFORE A VISIT IS BOOKED</p>
+    </section>
+    <p>If remote help is a better fit, <a href="/book.html?mode=remote">request a remote session</a>. For urgent issues, call or text after we confirm your request.</p>
+  </div>
+</main>
+<footer class="site">
+  <span>ohgeeceee &mdash; plain-language tech guides, built on the same philosophy as <a href="https://finally.help" rel="noopener">finally.help</a></span>
+  <span>46.8797&deg; N, 110.3626&deg; W</span>
+  <span>&copy; <span id="yr">2026</span> the ohgeeceee network &mdash; <a href="/">&larr; Back to the network</a></span>
+</footer>
+<script>
+  const incoming = new URLSearchParams(location.search);
+  const booking = new URL('/book.html', location.origin);
+  booking.searchParams.set('mode', 'onsite');
+  booking.searchParams.set('requestType', incoming.get('requestType') || 'onsite_support');
+  booking.searchParams.set('sourcePage', incoming.get('sourcePage') || location.pathname);
+  document.getElementById('onsite-request-link').href = booking.pathname + booking.search;
+</script>
+<script>
+(function () {
+  "use strict";
+  var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
+  var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
+  var els = document.querySelectorAll(".rv");
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
+})();
+</script>
+</body>
+</html>
diff --git a/tech-support/security/index.html b/tech-support/security/index.html
index a9a54e7..6330a8b 100644
--- a/tech-support/security/index.html
+++ b/tech-support/security/index.html
@@ -111,11 +111,30 @@ <h2 class="rv">Prefer to just <em>have it fixed?</em></h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/security/password-recovery-password-managers-2fa/index.html b/tech-support/security/password-recovery-password-managers-2fa/index.html
index fac4dd1..1a596c2 100644
--- a/tech-support/security/password-recovery-password-managers-2fa/index.html
+++ b/tech-support/security/password-recovery-password-managers-2fa/index.html
@@ -224,16 +224,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>If the reset email never arrives, check the spam and junk folders, and search your inbox for the account name.</li><li>If the account uses a phone number you no longer have, use the account's account-recovery form rather than the normal reset.</li><li>If you are locked out of your email itself, call the provider's support line — email is the master key, so it is worth the phone call.</li><li>If you believe the account was taken over, change the email password first, then everything else, then check the account's forwarding and recovery settings for anything you did not add.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html?requestType=password-recovery-password-managers-2fa&amp;sourcePage=%2Ftech-support%2Fsecurity%2Fpassword-recovery-password-managers-2fa%2F">Book a remote session &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/book.html?requestType=password-recovery-password-managers-2fa&amp;sourcePage=%2Ftech-support%2Fsecurity%2Fpassword-recovery-password-managers-2fa%2F" rel="noopener">Book a remote session &rarr;</a>
+  <p class="fine rv">REMOTE SUPPORT AVAILABLE</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -288,11 +288,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/security/spot-avoid-phishing-text-scams-robocalls/index.html b/tech-support/security/spot-avoid-phishing-text-scams-robocalls/index.html
index 631693b..ddc90b5 100644
--- a/tech-support/security/spot-avoid-phishing-text-scams-robocalls/index.html
+++ b/tech-support/security/spot-avoid-phishing-text-scams-robocalls/index.html
@@ -202,16 +202,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>If you already gave out a password, change it immediately and turn on two-factor — start with email.</li><li>If you gave card details, call the number on the back of the card and ask them to freeze it.</li><li>If you installed something they told you to install, remove it and run a malware scan.</li><li>Report the message: forward spam texts to 7726 (SPAM), and report calls and emails to the FTC at ReportFraud.ftc.gov.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/tech-support/onsite-montana/?requestType=spot-avoid-phishing-text-scams-robocalls&amp;sourcePage=%2Ftech-support%2Fsecurity%2Fspot-avoid-phishing-text-scams-robocalls%2F#request">Get a free 10-minute call &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/tech-support/onsite-montana/?requestType=spot-avoid-phishing-text-scams-robocalls&amp;sourcePage=%2Ftech-support%2Fsecurity%2Fspot-avoid-phishing-text-scams-robocalls%2F#request" rel="noopener">Get a free 10-minute call &rarr;</a>
+  <p class="fine rv">REMOTE SUPPORT AVAILABLE</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -265,11 +265,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/software/clear-cache-cookies-popups/index.html b/tech-support/software/clear-cache-cookies-popups/index.html
index 70f86ec..be7b1ba 100644
--- a/tech-support/software/clear-cache-cookies-popups/index.html
+++ b/tech-support/software/clear-cache-cookies-popups/index.html
@@ -205,16 +205,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>Turn on the browser's pop-up blocker (Chrome: Settings &gt; Privacy and security &gt; Site settings &gt; Pop-ups and redirects).</li><li>Remove suspicious extensions: Settings &gt; Extensions. Anything you do not recognise, turn off.</li><li>Reset the browser's settings to default as a last resort — this keeps bookmarks but clears the rest.</li><li>If pop-ups appear even with the browser closed, run a malware scan. That is not a browser problem.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html?requestType=clear-cache-cookies-popups&amp;sourcePage=%2Ftech-support%2Fsoftware%2Fclear-cache-cookies-popups%2F">Book a remote session &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/book.html?requestType=clear-cache-cookies-popups&amp;sourcePage=%2Ftech-support%2Fsoftware%2Fclear-cache-cookies-popups%2F" rel="noopener">Book a remote session &rarr;</a>
+  <p class="fine rv">REMOTE SUPPORT AVAILABLE</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -268,11 +268,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/software/index.html b/tech-support/software/index.html
index 8b0b44b..f78d8a9 100644
--- a/tech-support/software/index.html
+++ b/tech-support/software/index.html
@@ -121,11 +121,30 @@ <h2 class="rv">Prefer to just <em>have it fixed?</em></h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/software/speed-up-slow-computer/index.html b/tech-support/software/speed-up-slow-computer/index.html
index a64daee..87be6bc 100644
--- a/tech-support/software/speed-up-slow-computer/index.html
+++ b/tech-support/software/speed-up-slow-computer/index.html
@@ -211,16 +211,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>Check the drive type. If the computer still has a spinning hard disk rather than an SSD, replacing it with an SSD is the single biggest speed upgrade available and is often cheaper than a new machine.</li><li>Run a full malware scan with the built-in tool (Windows Security or a reputable scanner). Adware is a very common cause of a slow machine.</li><li>Check for a failing drive: run the manufacturer's health tool. A drive that is dying makes everything slow and is worth catching early.</li><li>If it is a work machine or over five years old, weigh the cost of an SSD and more memory against a replacement.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html?requestType=speed-up-slow-computer&amp;sourcePage=%2Ftech-support%2Fsoftware%2Fspeed-up-slow-computer%2F">Book a remote session &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/book.html?requestType=speed-up-slow-computer&amp;sourcePage=%2Ftech-support%2Fsoftware%2Fspeed-up-slow-computer%2F" rel="noopener">Book a remote session &rarr;</a>
+  <p class="fine rv">REMOTE SUPPORT AVAILABLE</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -274,11 +274,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>
diff --git a/tech-support/software/transfer-photos-data-new-device-cloud/index.html b/tech-support/software/transfer-photos-data-new-device-cloud/index.html
index c16a7f4..76392e6 100644
--- a/tech-support/software/transfer-photos-data-new-device-cloud/index.html
+++ b/tech-support/software/transfer-photos-data-new-device-cloud/index.html
@@ -201,16 +201,16 @@ <h2>Did it work?</h2>
       <summary>Still not working?</summary>
       <div class="esc-body">
         <ol><li>If the new device runs out of storage, move photos to an external drive or cloud and keep only recent ones on the device.</li><li>If a transfer app stalls, do it in batches — photos first, then documents, then everything else.</li><li>If an old device will not turn on, remove its storage drive and read it with a USB adapter, or take it to a shop before disposing of it.</li><li>If cloud storage is full, either upgrade the plan or use an external drive — do not delete the only copy.</li></ol>
-        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html">Book a session &rarr;</a></p>
+        <p class="esc-pro">If none of that helped, it is usually a hardware or account problem rather than a settings one &mdash; and that is exactly the kind of thing worth handing to someone for an hour. <a href="/book.html?requestType=transfer-photos-data-new-device-cloud&amp;sourcePage=%2Ftech-support%2Fsoftware%2Ftransfer-photos-data-new-device-cloud%2F">Book a remote session &rarr;</a></p>
       </div>
     </details>
   </div>
 
   <section class="cta">
   <h2 class="rv">Still stuck? <em>I can take it from here.</em></h2>
-  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote, flat rate, plain language. You watch everything I do.</p>
-  <a class="btn rv" href="/book.html" rel="noopener">Book a session &rarr;</a>
-  <p class="fine rv">REMOTE SESSIONS ONLY &mdash; ANYWHERE IN THE US &mdash; FLAT RATE, UP FRONT</p>
+  <p class="rv">If the steps above did not do it, that is what I am here for &mdash; remote or on-site in Montana, plain language, and clear pricing.</p>
+  <a class="btn rv" href="/book.html?requestType=transfer-photos-data-new-device-cloud&amp;sourcePage=%2Ftech-support%2Fsoftware%2Ftransfer-photos-data-new-device-cloud%2F" rel="noopener">Book a remote session &rarr;</a>
+  <p class="fine rv">REMOTE SUPPORT AVAILABLE</p>
 </section>
 
   <div class="wrap wrap--narrow">
@@ -264,11 +264,30 @@ <h2>Around the network</h2>
   var yr = document.getElementById("yr"); if (yr) yr.textContent = new Date().getFullYear();
   var reduced = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   var els = document.querySelectorAll(".rv");
-  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); return; }
-  var io = new IntersectionObserver(function (entries) {
-    entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
-  }, { threshold: 0.08 });
-  els.forEach(function (e) { io.observe(e); });
+  if (reduced || !("IntersectionObserver" in window)) { els.forEach(function (e) { e.classList.add("in"); }); }
+  else {
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) { if (e.isIntersecting) { e.target.classList.add("in"); io.unobserve(e.target); } });
+    }, { threshold: 0.08 });
+    els.forEach(function (e) { io.observe(e); });
+  }
+  // sticky CTA bar — appears past half a page, dismissible, remembered. No tracker.
+  var bar = document.getElementById("stickybar");
+  if (bar) {
+    var KEY = "ogc-cta-dismissed";
+    try { if (localStorage.getItem(KEY) === "1") { bar.parentNode.removeChild(bar); return; } } catch (e) {}
+    var onScroll = function () {
+      var h = document.documentElement.scrollHeight - window.innerHeight;
+      bar.hidden = (h > 0 ? window.scrollY / h : 0) < 0.5;
+    };
+    window.addEventListener("scroll", onScroll, { passive: true });
+    onScroll();
+    var x = bar.querySelector(".sb-x");
+    if (x) x.addEventListener("click", function () {
+      bar.parentNode.removeChild(bar);
+      try { localStorage.setItem(KEY, "1"); } catch (e) {}
+    });
+  }
 })();
 </script>
 </body>

From b32e00a8ba0c50255099cae505aedf1dd7fa984d Mon Sep 17 00:00:00 2001
From: ohgeecee <records@montanablotter.com>
Date: Sun, 4 Oct 2026 08:11:05 +0000
Subject: [PATCH 02/11] Pin intake build base image

---
 services/intake/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/intake/Dockerfile b/services/intake/Dockerfile
index f5abe1a..ec880f0 100644
--- a/services/intake/Dockerfile
+++ b/services/intake/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:22-alpine
+FROM docker.io/library/node:22-alpine@sha256:2c752226d477b4a886378baa95b9af252be59301b725fdb0b7e15208131505a8
 ENV NODE_ENV=production
 WORKDIR /app
 COPY package.json pnpm-lock.yaml ./

From 8a65b4926dcfb4f4e161cec510b524a1aad3a01b Mon Sep 17 00:00:00 2001
From: ohgeecee <records@montanablotter.com>
Date: Sun, 4 Oct 2026 08:11:07 +0000
Subject: [PATCH 03/11] Pin CRM runtime images and document admin secrets

---
 ops/crm/.env.example | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/ops/crm/.env.example b/ops/crm/.env.example
index 75f66f2..76eadc4 100644
--- a/ops/crm/.env.example
+++ b/ops/crm/.env.example
@@ -1,10 +1,12 @@
 # Copy to .env on the Linux host; chmod 600. Never commit actual values.
-POSTGRES_IMAGE=postgres:17-alpine@sha256:REPLACE_WITH_REVIEWED_DIGEST
-DIRECTUS_IMAGE=directus/directus:11@sha256:REPLACE_WITH_REVIEWED_DIGEST
-CLOUDFLARED_IMAGE=cloudflare/cloudflared:REPLACE_WITH_VERSION@sha256:REPLACE_WITH_REVIEWED_DIGEST
+POSTGRES_IMAGE=docker.io/library/postgres:17.11-alpine3.24@sha256:aa90e97ee862e558111d34cfb8b2c4bec768c2b039fb791341686928560263b3
+DIRECTUS_IMAGE=docker.io/directus/directus:11.17.4@sha256:304e86483c3f44ceb0b90a1227104f165774483d157da145b4382d9c35b56b0b
+CLOUDFLARED_IMAGE=docker.io/cloudflare/cloudflared:2026.9.3@sha256:2fa795d0271a71c133a8f17c19a2a625e1976ad716329e0e61789f9fd8ee0091
 POSTGRES_PASSWORD=GENERATE_LONG_RANDOM_VALUE
 INTAKE_DB_PASSWORD=GENERATE_DIFFERENT_LONG_RANDOM_VALUE
 DIRECTUS_SECRET=GENERATE_64_RANDOM_CHARACTERS
+ADMIN_EMAIL=SET_TO_A_VALID_ADMIN_EMAIL
+ADMIN_PASSWORD=GENERATE_A_UNIQUE_PASSWORD
 DIRECTUS_PRIVATE_URL=https://YOUR-HOST.YOUR-TAILNET.ts.net
 CLOUDFLARE_TUNNEL_TOKEN=FROM_CLOUDFLARE_ZERO_TRUST_DASHBOARD
 INTAKE_IMAGE=ghcr.io/ohgeeceee/network-intake:stable

From 3a19599217c310b16b2780c554c99c614f7dae6f Mon Sep 17 00:00:00 2001
From: ohgeecee <records@montanablotter.com>
Date: Sun, 4 Oct 2026 08:11:08 +0000
Subject: [PATCH 04/11] Configure first Directus admin from protected env

---
 ops/crm/compose.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ops/crm/compose.yaml b/ops/crm/compose.yaml
index 20eb94d..6805698 100644
--- a/ops/crm/compose.yaml
+++ b/ops/crm/compose.yaml
@@ -27,6 +27,8 @@ services:
       postgres: { condition: service_healthy }
     environment:
       SECRET: ${DIRECTUS_SECRET:?set in .env}
+      ADMIN_EMAIL: ${ADMIN_EMAIL:?set in .env}
+      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?set in .env}
       DB_CLIENT: pg
       DB_HOST: postgres
       DB_PORT: 5432

From 790675000334205ca11a83acd561f6f84a860cbc Mon Sep 17 00:00:00 2001
From: ohgeecee <records@montanablotter.com>
Date: Sun, 4 Oct 2026 08:11:10 +0000
Subject: [PATCH 05/11] Clarify encrypted storage and Directus bootstrap

---
 ops/crm/README.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ops/crm/README.md b/ops/crm/README.md
index 2c61334..9e47e1f 100644
--- a/ops/crm/README.md
+++ b/ops/crm/README.md
@@ -4,9 +4,9 @@ This Compose project runs the private CRM and the public form receiver. The port
 
 ## Before the first start
 
-1. Use a patched Linux host with Docker Compose v2, a firewall that blocks inbound WAN connections, full-disk encryption, and a separate backup destination. Install Tailscale on the host. Do not configure router port forwarding.
+1. Use a patched Linux host with Docker Compose v2 or Podman 5 with a Compose provider, a firewall that blocks inbound WAN connections, full-disk encryption, and a separate backup destination. Install Tailscale on the host. Do not configure router port forwarding. Do not enter real client information until full-disk encryption and encrypted off-host backups are ready.
 2. Use Cloudflare DNS for the `api.ohgeec.com` hostname (the apex `ohgeec.com` can keep serving from GitHub Pages). Create a Cloudflare Tunnel and install its token in the host's `.env`. Configure exactly one public hostname route: `api.ohgeec.com` -> `http://intake:3000`. Do not add Directus, Postgres, SSH, or the Docker socket as a public route.
-3. Obtain reviewed immutable image digests for Postgres, Directus, and cloudflared. Copy `.env.example` to `.env`, replace every placeholder, set `chmod 600 .env`, and keep that file outside Git backups. Generate independent random values for every password/secret.
+3. The example pins the reviewed x86-64 image digests for Postgres, Directus, and cloudflared. Copy `.env.example` to `.env`, set a valid `ADMIN_EMAIL`, and replace every remaining placeholder. Generate independent random values for every password/secret, set `chmod 600 .env`, and keep that file outside Git backups.
 4. Give the GitHub Container Registry package `ghcr.io/ohgeeceee/network-intake` read access for a dedicated host token with `read:packages` only. Log in to GHCR as the restricted deploy account. Do not use a self-hosted GitHub Actions runner on this server.
 5. Add `api.ohgeec.com` to the allowed CORS origins only if you serve the website there; the default exact allowed origins are `https://ohgeec.com` and `https://www.ohgeec.com`.
 
@@ -22,7 +22,7 @@ docker compose --env-file .env -f compose.yaml up -d
 
 On first initialization, Postgres creates the schema and a separate `intake_api` DB role. The intake role can execute only the `create_public_intake(...)` function; it cannot query CRM tables. The schema and role scripts run only when the `pgdata` volume is new. For an existing database, make a backup, apply `services/intake/sql/001_schema.sql` as the DB owner, then run the role creation statements from `020-create-api-role.sh` with a secure password.
 
-Directus listens on host loopback port 8055 only. Install Tailscale Serve on the host and proxy its HTTPS tailnet URL to `http://127.0.0.1:8055`; keep tailnet ACLs limited to your own devices. Do not expose the port on the LAN or internet. On first startup, capture the one-time bootstrap credentials printed by Directus, sign in immediately over Tailscale, set a unique password, and enable the strongest supported second factor. Keep the admin credentials in your password manager, not in Compose.
+Directus listens on host loopback port 8055 only. Install Tailscale Serve on the host and proxy its HTTPS tailnet URL to `http://127.0.0.1:8055`; keep tailnet ACLs limited to your own devices. Do not expose the port on the LAN or internet. On first startup, Directus creates the admin account from `ADMIN_EMAIL` and `ADMIN_PASSWORD`. Sign in immediately over Tailscale, enable the strongest supported second factor, then remove those two bootstrap values from `.env` and recreate the Directus container. Keep the current credential in your password manager.
 
 Directus discovers the existing tables. In its data model, create the many-to-one relationships `service_tickets.contact_id -> contacts.id`, `client_assets.contact_id -> contacts.id`, `service_events.contact_id -> contacts.id`, and `service_events.ticket_id -> service_tickets.id`. Keep the public role with no collection permissions and do not create a public Directus route. Use the admin role only through Tailscale. The `service_events` collection holds history and notes; keep new events append-only where possible. Store only password-manager references in `credential_reference`.
 

From 4ffebf26b8c72f398e8ae01f5f6de1d9936cad9b Mon Sep 17 00:00:00 2001
From: ohgeecee <records@montanablotter.com>
Date: Sun, 4 Oct 2026 08:13:50 +0000
Subject: [PATCH 06/11] Keep intake health probes outside rate limits

---
 services/intake/src/server.mjs | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/services/intake/src/server.mjs b/services/intake/src/server.mjs
index f88aea6..defde99 100644
--- a/services/intake/src/server.mjs
+++ b/services/intake/src/server.mjs
@@ -64,7 +64,7 @@ await app.register(rateLimit, {
   errorResponseBuilder: () => ({ error: 'Please wait before trying again.' }),
 });
 
-app.get('/healthz', async (_request, reply) => {
+app.get('/healthz', { config: { rateLimit: false } }, async (_request, reply) => {
   try {
     await pool.query('SELECT 1');
     return reply.send({ ok: true });
@@ -108,7 +108,12 @@ app.post('/v1/intake', async (request, reply) => {
 });
 
 app.setNotFoundHandler((_request, reply) => reply.code(404).send({ error: 'Not found.' }));
-app.setErrorHandler((_error, _request, reply) => reply.code(400).send({ error: 'Request could not be accepted.' }));
+app.setErrorHandler((error, _request, reply) => {
+  const status = Number.isInteger(error.statusCode) && error.statusCode >= 400 && error.statusCode < 500
+    ? error.statusCode : 400;
+  const message = status === 429 ? 'Please wait before trying again.' : 'Request could not be accepted.';
+  return reply.code(status).send({ error: message });
+});
 
 const port = Number(process.env.PORT || 3000);
 await app.listen({ host: '0.0.0.0', port });

From 5b731ce655f4d6cff8e7b83f1b65562c3f2bcbcd Mon Sep 17 00:00:00 2001
From: ohgeecee <259193421+ohgeeceee@users.noreply.github.com>
Date: Sun, 4 Oct 2026 06:10:19 -0400
Subject: [PATCH 07/11] Clarify Tailscale setup prerequisites

---
 ops/crm/README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ops/crm/README.md b/ops/crm/README.md
index 9e47e1f..c990cae 100644
--- a/ops/crm/README.md
+++ b/ops/crm/README.md
@@ -4,7 +4,7 @@ This Compose project runs the private CRM and the public form receiver. The port
 
 ## Before the first start
 
-1. Use a patched Linux host with Docker Compose v2 or Podman 5 with a Compose provider, a firewall that blocks inbound WAN connections, full-disk encryption, and a separate backup destination. Install Tailscale on the host. Do not configure router port forwarding. Do not enter real client information until full-disk encryption and encrypted off-host backups are ready.
+1. Use a patched Linux host with Docker Compose v2 or Podman 5 with a Compose provider, a firewall that blocks inbound WAN connections, full-disk encryption, and a separate backup destination. Install and authenticate Tailscale on the host before enabling remote admin access. Do not configure router port forwarding. Do not enter real client information until full-disk encryption and encrypted off-host backups are ready.
 2. Use Cloudflare DNS for the `api.ohgeec.com` hostname (the apex `ohgeec.com` can keep serving from GitHub Pages). Create a Cloudflare Tunnel and install its token in the host's `.env`. Configure exactly one public hostname route: `api.ohgeec.com` -> `http://intake:3000`. Do not add Directus, Postgres, SSH, or the Docker socket as a public route.
 3. The example pins the reviewed x86-64 image digests for Postgres, Directus, and cloudflared. Copy `.env.example` to `.env`, set a valid `ADMIN_EMAIL`, and replace every remaining placeholder. Generate independent random values for every password/secret, set `chmod 600 .env`, and keep that file outside Git backups.
 4. Give the GitHub Container Registry package `ghcr.io/ohgeeceee/network-intake` read access for a dedicated host token with `read:packages` only. Log in to GHCR as the restricted deploy account. Do not use a self-hosted GitHub Actions runner on this server.
@@ -22,7 +22,7 @@ docker compose --env-file .env -f compose.yaml up -d
 
 On first initialization, Postgres creates the schema and a separate `intake_api` DB role. The intake role can execute only the `create_public_intake(...)` function; it cannot query CRM tables. The schema and role scripts run only when the `pgdata` volume is new. For an existing database, make a backup, apply `services/intake/sql/001_schema.sql` as the DB owner, then run the role creation statements from `020-create-api-role.sh` with a secure password.
 
-Directus listens on host loopback port 8055 only. Install Tailscale Serve on the host and proxy its HTTPS tailnet URL to `http://127.0.0.1:8055`; keep tailnet ACLs limited to your own devices. Do not expose the port on the LAN or internet. On first startup, Directus creates the admin account from `ADMIN_EMAIL` and `ADMIN_PASSWORD`. Sign in immediately over Tailscale, enable the strongest supported second factor, then remove those two bootstrap values from `.env` and recreate the Directus container. Keep the current credential in your password manager.
+Directus listens on host loopback port 8055 only. After the tailnet owner enables Tailscale Serve, proxy its HTTPS tailnet URL to `http://127.0.0.1:8055`; keep tailnet ACLs limited to your own devices. Do not expose the port on the LAN or internet. On first startup, Directus creates the admin account from `ADMIN_EMAIL` and `ADMIN_PASSWORD`. Sign in immediately over Tailscale, enable the strongest supported second factor, then remove those two bootstrap values from `.env` and recreate the Directus container. Keep the current credential in your password manager.
 
 Directus discovers the existing tables. In its data model, create the many-to-one relationships `service_tickets.contact_id -> contacts.id`, `client_assets.contact_id -> contacts.id`, `service_events.contact_id -> contacts.id`, and `service_events.ticket_id -> service_tickets.id`. Keep the public role with no collection permissions and do not create a public Directus route. Use the admin role only through Tailscale. The `service_events` collection holds history and notes; keep new events append-only where possible. Store only password-manager references in `credential_reference`.
 

From 07788d6202f93bed9b9e06b6372b5dec99987c31 Mon Sep 17 00:00:00 2001
From: ohgeecee <259193421+ohgeeceee@users.noreply.github.com>
Date: Sun, 4 Oct 2026 06:12:28 -0400
Subject: [PATCH 08/11] Make Directus bootstrap credentials optional

---
 ops/crm/compose.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ops/crm/compose.yaml b/ops/crm/compose.yaml
index 6805698..4de9afd 100644
--- a/ops/crm/compose.yaml
+++ b/ops/crm/compose.yaml
@@ -27,8 +27,8 @@ services:
       postgres: { condition: service_healthy }
     environment:
       SECRET: ${DIRECTUS_SECRET:?set in .env}
-      ADMIN_EMAIL: ${ADMIN_EMAIL:?set in .env}
-      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?set in .env}
+      ADMIN_EMAIL: ${ADMIN_EMAIL:-}
+      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
       DB_CLIENT: pg
       DB_HOST: postgres
       DB_PORT: 5432

From 6cb1252a812cd7897f59f853a12b15e5a85ec916 Mon Sep 17 00:00:00 2001
From: ohgeecee <259193421+ohgeeceee@users.noreply.github.com>
Date: Sun, 4 Oct 2026 20:34:47 -0400
Subject: [PATCH 09/11] Align CRM updater with rootless Podman

---
 DEPLOY.md                              |  2 +-
 ops/crm/README.md                      | 15 ++++++++++++--
 ops/crm/deploy.sh                      | 28 ++++++++++++++++++--------
 ops/crm/ohgeec-crm-update.user.service |  9 +++++++++
 ops/crm/ohgeec-crm-update.user.timer   | 10 +++++++++
 thanks.html                            |  6 +++---
 6 files changed, 56 insertions(+), 14 deletions(-)
 create mode 100644 ops/crm/ohgeec-crm-update.user.service
 create mode 100644 ops/crm/ohgeec-crm-update.user.timer

diff --git a/DEPLOY.md b/DEPLOY.md
index f8a42fa..1603c99 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -34,7 +34,7 @@ The private host needs Docker Compose v2, outbound DNS/HTTPS, a Tailscale client
 ## Update flow
 
 1. A merge to `main` deploys the new static site and publishes the intake container.
-2. The home server's systemd timer runs `ops/crm/deploy.sh` every five minutes.
+2. The host's systemd timer runs `ops/crm/deploy.sh` every five minutes. The script uses rootless Podman when available; the current laptop host should use the included user-level units (`ohgeec-crm-update.user.service` and `.timer`). Docker hosts can use the system-level units.
 3. The deploy script pulls the `stable` image, restarts only the intake service, waits for its health check, and restores the previous local image tag if the new container does not become healthy.
 4. Schema changes require an encrypted backup and a reviewed forward migration before the application image is rolled out.
 
diff --git a/ops/crm/README.md b/ops/crm/README.md
index c990cae..99ae1f2 100644
--- a/ops/crm/README.md
+++ b/ops/crm/README.md
@@ -7,7 +7,7 @@ This Compose project runs the private CRM and the public form receiver. The port
 1. Use a patched Linux host with Docker Compose v2 or Podman 5 with a Compose provider, a firewall that blocks inbound WAN connections, full-disk encryption, and a separate backup destination. Install and authenticate Tailscale on the host before enabling remote admin access. Do not configure router port forwarding. Do not enter real client information until full-disk encryption and encrypted off-host backups are ready.
 2. Use Cloudflare DNS for the `api.ohgeec.com` hostname (the apex `ohgeec.com` can keep serving from GitHub Pages). Create a Cloudflare Tunnel and install its token in the host's `.env`. Configure exactly one public hostname route: `api.ohgeec.com` -> `http://intake:3000`. Do not add Directus, Postgres, SSH, or the Docker socket as a public route.
 3. The example pins the reviewed x86-64 image digests for Postgres, Directus, and cloudflared. Copy `.env.example` to `.env`, set a valid `ADMIN_EMAIL`, and replace every remaining placeholder. Generate independent random values for every password/secret, set `chmod 600 .env`, and keep that file outside Git backups.
-4. Give the GitHub Container Registry package `ghcr.io/ohgeeceee/network-intake` read access for a dedicated host token with `read:packages` only. Log in to GHCR as the restricted deploy account. Do not use a self-hosted GitHub Actions runner on this server.
+4. Give the GitHub Container Registry package `ghcr.io/ohgeeceee/network-intake` read access for a dedicated host token with `read:packages` only. Log in to GHCR as the restricted deploy account (`podman login ghcr.io` for the rootless Podman host, or `docker login ghcr.io` for Docker). Do not use a self-hosted GitHub Actions runner on this server.
 5. Add `api.ohgeec.com` to the allowed CORS origins only if you serve the website there; the default exact allowed origins are `https://ohgeec.com` and `https://www.ohgeec.com`.
 
 ## Start and administer
@@ -41,7 +41,18 @@ Use a public age recipient on the host; protect the private decryption identity
 
 ## Updates and rollback
 
-The workflow publishes both an immutable `sha-<commit>` tag and a convenience `stable` tag. The host pulls the stable tag with `ops/crm/deploy.sh`, checks its container health, and keeps the prior local image tagged for rollback. Set up the included systemd unit/timer only after GHCR login and `.env` are ready:
+The workflow publishes both an immutable `sha-<commit>` tag and a convenience `stable` tag. The host pulls the stable tag with `ops/crm/deploy.sh`, checks its container health, and keeps the prior local image tagged for rollback. The script uses rootless Podman when available and can be forced to Docker with `CONTAINER_ENGINE=docker`. Set up an update timer only after GHCR login and `.env` are ready.
+
+For the current rootless Podman laptop host, install the user units and adjust the working path if the repository lives elsewhere:
+
+```sh
+mkdir -p ~/.config/systemd/user
+cp ops/crm/ohgeec-crm-update.user.{service,timer} ~/.config/systemd/user/
+systemctl --user daemon-reload
+systemctl --user enable --now ohgeec-crm-update.user.timer
+```
+
+For a Docker host with the dedicated deploy account, use the system units:
 
 ```sh
 sudo useradd --system --home /opt/ohgeec --shell /usr/sbin/nologin ohgeec-deploy
diff --git a/ops/crm/deploy.sh b/ops/crm/deploy.sh
index c7d5665..2cf9344 100644
--- a/ops/crm/deploy.sh
+++ b/ops/crm/deploy.sh
@@ -1,18 +1,30 @@
 #!/bin/sh
 set -eu
 cd "$(dirname "$0")"
-compose='docker compose --env-file .env -f compose.yaml'
+
+if [ -n "${CONTAINER_ENGINE:-}" ]; then
+  engine=$CONTAINER_ENGINE
+elif command -v podman >/dev/null 2>&1; then
+  engine=podman
+else
+  engine=docker
+fi
+
+compose() {
+  "$engine" compose --env-file .env -f compose.yaml "$@"
+}
+
 service=intake
-old_id=$($compose images -q "$service" 2>/dev/null | head -n 1 || true)
-if [ -n "$old_id" ]; then docker image tag "$old_id" ohgeec-intake:rollback; fi
-$compose pull "$service"
-$compose up -d --no-deps "$service"
+old_id=$(compose images -q "$service" 2>/dev/null | head -n 1 || true)
+if [ -n "$old_id" ]; then "$engine" image tag "$old_id" ohgeec-intake:rollback; fi
+compose pull "$service"
+compose up -d --no-deps "$service"
 
 healthy=0
 i=0
 while [ "$i" -lt 18 ]; do
-  container_id=$($compose ps -q "$service")
-  state=$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$container_id" 2>/dev/null || true)
+  container_id=$(compose ps -q "$service")
+  state=$("$engine" inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$container_id" 2>/dev/null || true)
   if [ "$state" = healthy ]; then healthy=1; break; fi
   sleep 5
   i=$((i + 1))
@@ -24,7 +36,7 @@ fi
 
 echo "New intake image did not become healthy; restoring the previous local image." >&2
 if [ -n "$old_id" ]; then
-  INTAKE_IMAGE=ohgeec-intake:rollback $compose up -d --no-deps --pull never "$service"
+  INTAKE_IMAGE=ohgeec-intake:rollback compose up -d --no-deps --pull never "$service"
   exit 1
 fi
 exit 1
diff --git a/ops/crm/ohgeec-crm-update.user.service b/ops/crm/ohgeec-crm-update.user.service
new file mode 100644
index 0000000..6f05fb5
--- /dev/null
+++ b/ops/crm/ohgeec-crm-update.user.service
@@ -0,0 +1,9 @@
+[Unit]
+Description=Pull and health-check the approved ohgeec CRM intake image
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+WorkingDirectory=%h/services/ohgeec/network/ops/crm
+ExecStart=%h/services/ohgeec/network/ops/crm/deploy.sh
diff --git a/ops/crm/ohgeec-crm-update.user.timer b/ops/crm/ohgeec-crm-update.user.timer
new file mode 100644
index 0000000..89f51d4
--- /dev/null
+++ b/ops/crm/ohgeec-crm-update.user.timer
@@ -0,0 +1,10 @@
+[Unit]
+Description=Check for ohgeec CRM intake image updates
+
+[Timer]
+OnBootSec=3min
+OnUnitActiveSec=5min
+Persistent=true
+
+[Install]
+WantedBy=timers.target
diff --git a/thanks.html b/thanks.html
index 570b930..e3068ff 100644
--- a/thanks.html
+++ b/thanks.html
@@ -3,7 +3,7 @@
 <head>
 <meta charset="UTF-8" />
 <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-<title>Thank you — Remote Tech Support</title>
+<title>Request received — Remote Tech Support</title>
 <style>
   :root{ --bg:#0b1020; --bg2:#111a33; --txt:#e8edff; --accent:#5b8cff; --accent2:#22d3ee; }
   *{box-sizing:border-box}
@@ -21,8 +21,8 @@
 <body>
   <div class="box">
     <div class="check"><svg viewBox="0 0 24 24"><path d="M20 6L9 17l-5-5"/></svg></div>
-    <h1>You're booked in!</h1>
-    <p>Thanks for your request. You'll get a confirmation email shortly with next steps. I'll be in touch to confirm your session.</p>
+    <h1>Request received</h1>
+    <p>Thanks for your request. I’ll follow up using your preferred contact method to confirm next steps and availability.</p>
     <a class="btn" href="index.html">← Back to home</a>
   </div>
 </body>

From e3aac4549b5ef94dabccc8e79c41017233a71caa Mon Sep 17 00:00:00 2001
From: ohgeecee <259193421+ohgeeceee@users.noreply.github.com>
Date: Sun, 4 Oct 2026 20:43:58 -0400
Subject: [PATCH 10/11] Switch public intake to Tailscale Funnel

---
 DEPLOY.md                      | 12 ++++--------
 book.html                      |  2 +-
 intake.js                      |  3 ++-
 ops/crm/.env.example           |  3 +--
 ops/crm/README.md              |  6 +++---
 ops/crm/compose.yaml           | 15 ++++-----------
 services/intake/src/server.mjs |  3 +++
 7 files changed, 18 insertions(+), 26 deletions(-)

diff --git a/DEPLOY.md b/DEPLOY.md
index 1603c99..6543565 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -15,19 +15,15 @@ GitHub Actions uses GitHub-hosted runners only. It publishes `ghcr.io/ohgeeceee/
 
 ## DNS and public API
 
-Keep `ohgeec.com` pointed at GitHub Pages. Add `api.ohgeec.com` as the only public home-server route, through Cloudflare Tunnel. For the tunnel's custom hostname, manage the zone in the same Cloudflare account or configure the required CNAME at the authoritative DNS provider. If moving DNS to Cloudflare, recreate the existing GitHub Pages apex A/AAAA and `www` CNAME records as DNS-only records; keep only the tunnel hostname proxied. The tunnel makes outbound connections, so no router port-forward or public home IP is needed.
+The portfolio stays on GitHub Pages at `ohgeec.com`. The laptop exposes only the intake API through Tailscale Funnel at `https://parrot.tail60dba7.ts.net:8443`; Directus remains private on the separate Tailscale Serve port 443. Funnel provides a tailnet hostname, not a custom `api.ohgeec.com` hostname, and does not require a router port-forward or public home IP.
 
-In Cloudflare Zero Trust, create a tunnel on the home server and configure one published application:
+The compose file binds intake to `127.0.0.1:3000`. Enable Funnel on port 8443 with `sudo tailscale funnel --bg --https=8443 --yes http://127.0.0.1:3000`. Do not route other services through Funnel. `PUBLIC_INTAKE_ENABLED` defaults to `false`; change it to `true` only after full-disk encryption and encrypted backup restoration have been verified, then recreate the intake container.
 
-- Hostname: `api.ohgeec.com`
-- Service: `http://intake:3000`
-- No other public hostname routes
-
-The public form sends JSON to `https://api.ohgeec.com/v1/intake`. The receiver validates an allowlisted schema and writes the contact, ticket, and first event in one PostgreSQL function call. CORS only allows the portfolio's exact origins; it is not treated as authentication. The form contains no shared secret.
+The public form sends JSON to `https://parrot.tail60dba7.ts.net:8443/v1/intake`. The receiver validates an allowlisted schema and writes the contact, ticket, and first event in one PostgreSQL function call when intake is enabled. CORS only allows the portfolio's exact origins; it is not treated as authentication. The form contains no shared secret.
 
 ## Private CRM host
 
-Follow [ops/crm/README.md](ops/crm/README.md) on the Linux server. Directus listens on `127.0.0.1:8055`; use Tailscale Serve for the owner's tailnet access. PostgreSQL has no host port. Never create Cloudflare routes for Directus or PostgreSQL and never mount the Docker socket into application containers.
+Follow [ops/crm/README.md](ops/crm/README.md) on the Linux server. Directus listens on `127.0.0.1:8055`; use Tailscale Serve for the owner's tailnet access. PostgreSQL has no host port. Never expose Directus or PostgreSQL publicly and never mount the Docker socket into application containers.
 
 The private host needs Docker Compose v2, outbound DNS/HTTPS, a Tailscale client, GHCR `read:packages` access, a protected `ops/crm/.env`, and a separate encrypted backup target. Image digests in `.env` must be set to reviewed versions before starting services. The compose stack is not live until those host-specific values, DNS, tunnel route, and initial Directus account are configured.
 
diff --git a/book.html b/book.html
index ae2ddf4..a4d17b3 100644
--- a/book.html
+++ b/book.html
@@ -171,7 +171,7 @@ <h3>Premium</h3>
     <h2>Request tech support</h2>
     <p class="sub">Tell me what is happening and when works for you. I will follow up using your preferred contact method.</p>
 
-    <form id="service-request" data-intake-form>
+    <form id="service-request" data-intake-form data-intake-endpoint="https://parrot.tail60dba7.ts.net:8443/v1/intake">
       <input type="hidden" id="request-type" name="requestType" value="website_request" />
       <input type="hidden" id="source-page" name="sourcePage" value="/book.html" />
 
diff --git a/intake.js b/intake.js
index 3e2e47c..e54e2f5 100644
--- a/intake.js
+++ b/intake.js
@@ -1,6 +1,7 @@
 (() => {
   const form = document.querySelector('[data-intake-form]');
   if (!form) return;
+  const intakeEndpoint = form.dataset.intakeEndpoint || 'https://api.ohgeec.com/v1/intake';
 
   const status = document.getElementById('intake-status');
   const submit = document.getElementById('intake-submit');
@@ -69,7 +70,7 @@
     submit.disabled = true;
     status.textContent = 'Sending your request…';
     try {
-      const response = await fetch('https://api.ohgeec.com/v1/intake', {
+      const response = await fetch(intakeEndpoint, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json', 'Idempotency-Key': idempotencyKey },
         body: JSON.stringify(payload),
diff --git a/ops/crm/.env.example b/ops/crm/.env.example
index 76eadc4..1f0be5e 100644
--- a/ops/crm/.env.example
+++ b/ops/crm/.env.example
@@ -1,12 +1,11 @@
 # Copy to .env on the Linux host; chmod 600. Never commit actual values.
 POSTGRES_IMAGE=docker.io/library/postgres:17.11-alpine3.24@sha256:aa90e97ee862e558111d34cfb8b2c4bec768c2b039fb791341686928560263b3
 DIRECTUS_IMAGE=docker.io/directus/directus:11.17.4@sha256:304e86483c3f44ceb0b90a1227104f165774483d157da145b4382d9c35b56b0b
-CLOUDFLARED_IMAGE=docker.io/cloudflare/cloudflared:2026.9.3@sha256:2fa795d0271a71c133a8f17c19a2a625e1976ad716329e0e61789f9fd8ee0091
 POSTGRES_PASSWORD=GENERATE_LONG_RANDOM_VALUE
 INTAKE_DB_PASSWORD=GENERATE_DIFFERENT_LONG_RANDOM_VALUE
 DIRECTUS_SECRET=GENERATE_64_RANDOM_CHARACTERS
 ADMIN_EMAIL=SET_TO_A_VALID_ADMIN_EMAIL
 ADMIN_PASSWORD=GENERATE_A_UNIQUE_PASSWORD
 DIRECTUS_PRIVATE_URL=https://YOUR-HOST.YOUR-TAILNET.ts.net
-CLOUDFLARE_TUNNEL_TOKEN=FROM_CLOUDFLARE_ZERO_TRUST_DASHBOARD
 INTAKE_IMAGE=ghcr.io/ohgeeceee/network-intake:stable
+PUBLIC_INTAKE_ENABLED=false
diff --git a/ops/crm/README.md b/ops/crm/README.md
index 99ae1f2..d11b1b5 100644
--- a/ops/crm/README.md
+++ b/ops/crm/README.md
@@ -5,10 +5,10 @@ This Compose project runs the private CRM and the public form receiver. The port
 ## Before the first start
 
 1. Use a patched Linux host with Docker Compose v2 or Podman 5 with a Compose provider, a firewall that blocks inbound WAN connections, full-disk encryption, and a separate backup destination. Install and authenticate Tailscale on the host before enabling remote admin access. Do not configure router port forwarding. Do not enter real client information until full-disk encryption and encrypted off-host backups are ready.
-2. Use Cloudflare DNS for the `api.ohgeec.com` hostname (the apex `ohgeec.com` can keep serving from GitHub Pages). Create a Cloudflare Tunnel and install its token in the host's `.env`. Configure exactly one public hostname route: `api.ohgeec.com` -> `http://intake:3000`. Do not add Directus, Postgres, SSH, or the Docker socket as a public route.
-3. The example pins the reviewed x86-64 image digests for Postgres, Directus, and cloudflared. Copy `.env.example` to `.env`, set a valid `ADMIN_EMAIL`, and replace every remaining placeholder. Generate independent random values for every password/secret, set `chmod 600 .env`, and keep that file outside Git backups.
+2. The public intake route uses Tailscale Funnel at `https://<host>.<tailnet>.ts.net:8443`; Funnel supports only tailnet hostnames and specific HTTPS ports. The compose file binds intake to host loopback port 3000; route Funnel port 8443 to `http://127.0.0.1:3000`. Keep the existing Tailscale Serve route on port 443 for private Directus administration. Do not expose Directus, Postgres, SSH, or the Docker socket publicly. Leave `PUBLIC_INTAKE_ENABLED=false` until full-disk encryption and encrypted backup restoration have been verified.
+3. The example pins the reviewed x86-64 image digests for Postgres and Directus. Copy `.env.example` to `.env`, set a valid `ADMIN_EMAIL`, and replace every remaining placeholder. Generate independent random values for every password/secret, set `chmod 600 .env`, and keep that file outside Git backups.
 4. Give the GitHub Container Registry package `ghcr.io/ohgeeceee/network-intake` read access for a dedicated host token with `read:packages` only. Log in to GHCR as the restricted deploy account (`podman login ghcr.io` for the rootless Podman host, or `docker login ghcr.io` for Docker). Do not use a self-hosted GitHub Actions runner on this server.
-5. Add `api.ohgeec.com` to the allowed CORS origins only if you serve the website there; the default exact allowed origins are `https://ohgeec.com` and `https://www.ohgeec.com`.
+5. Keep the allowed CORS origins limited to the website origins `https://ohgeec.com` and `https://www.ohgeec.com`; do not add the API hostname as an origin.
 
 ## Start and administer
 
diff --git a/ops/crm/compose.yaml b/ops/crm/compose.yaml
index 4de9afd..17fae0c 100644
--- a/ops/crm/compose.yaml
+++ b/ops/crm/compose.yaml
@@ -60,8 +60,11 @@ services:
       DB_USER: intake_api
       DB_PASSWORD: ${INTAKE_DB_PASSWORD}
       ALLOWED_ORIGINS: https://ohgeec.com,https://www.ohgeec.com
+      PUBLIC_INTAKE_ENABLED: ${PUBLIC_INTAKE_ENABLED:-false}
       PORT: "3000"
-    networks: [data, ingress]
+    networks: [data]
+    ports:
+      - "127.0.0.1:3000:3000"
     read_only: true
     tmpfs: [/tmp]
     cap_drop: [ALL]
@@ -73,19 +76,9 @@ services:
       retries: 5
       start_period: 20s
 
-  cloudflared:
-    image: ${CLOUDFLARED_IMAGE:?pin a reviewed cloudflared image digest}
-    restart: unless-stopped
-    command: tunnel --no-autoupdate run
-    environment:
-      TUNNEL_TOKEN: ${CLOUDFLARE_TUNNEL_TOKEN:?set in .env}
-    depends_on: [intake]
-    networks: [ingress]
-
 networks:
   data:
     internal: true
-  ingress: {}
   private_admin: {}
 
 volumes:
diff --git a/services/intake/src/server.mjs b/services/intake/src/server.mjs
index defde99..2f92e04 100644
--- a/services/intake/src/server.mjs
+++ b/services/intake/src/server.mjs
@@ -74,6 +74,9 @@ app.get('/healthz', { config: { rateLimit: false } }, async (_request, reply) =>
 });
 
 app.post('/v1/intake', async (request, reply) => {
+  if (process.env.PUBLIC_INTAKE_ENABLED !== 'true') {
+    return reply.code(503).send({ error: 'Online requests are temporarily unavailable. Please email hello@ohgeec.com.' });
+  }
   const key = request.headers['idempotency-key'];
   if (typeof key !== 'string' || !/^[a-zA-Z0-9_-]{16,100}$/.test(key)) {
     return reply.code(400).send({ error: 'Request could not be accepted.' });

From ffcee6f47e418b3f85067165004faea029dab439 Mon Sep 17 00:00:00 2001
From: ohgeecee <259193421+ohgeeceee@users.noreply.github.com>
Date: Sun, 4 Oct 2026 21:20:07 -0400
Subject: [PATCH 11/11] Add project and lead tracking CRM schema

---
 ops/crm/README.md                          |  4 +-
 ops/crm/compose.yaml                       |  1 +
 services/intake/sql/001_schema.sql         | 29 +++++++++
 services/intake/sql/002_crm_extensions.sql | 72 ++++++++++++++++++++++
 4 files changed, 104 insertions(+), 2 deletions(-)
 create mode 100644 services/intake/sql/002_crm_extensions.sql

diff --git a/ops/crm/README.md b/ops/crm/README.md
index d11b1b5..5d09afb 100644
--- a/ops/crm/README.md
+++ b/ops/crm/README.md
@@ -20,11 +20,11 @@ docker compose --env-file .env -f compose.yaml config
 docker compose --env-file .env -f compose.yaml up -d
 ```
 
-On first initialization, Postgres creates the schema and a separate `intake_api` DB role. The intake role can execute only the `create_public_intake(...)` function; it cannot query CRM tables. The schema and role scripts run only when the `pgdata` volume is new. For an existing database, make a backup, apply `services/intake/sql/001_schema.sql` as the DB owner, then run the role creation statements from `020-create-api-role.sh` with a secure password.
+On first initialization, Postgres creates the schema and a separate `intake_api` DB role. The intake role can execute only the `create_public_intake(...)` function; it cannot query CRM tables. The init scripts run only when the `pgdata` volume is new. For an existing database, apply each new migration from `services/intake/sql/` as the DB owner; `002_crm_extensions.sql` adds lead follow-up and project tracking without deleting data.
 
 Directus listens on host loopback port 8055 only. After the tailnet owner enables Tailscale Serve, proxy its HTTPS tailnet URL to `http://127.0.0.1:8055`; keep tailnet ACLs limited to your own devices. Do not expose the port on the LAN or internet. On first startup, Directus creates the admin account from `ADMIN_EMAIL` and `ADMIN_PASSWORD`. Sign in immediately over Tailscale, enable the strongest supported second factor, then remove those two bootstrap values from `.env` and recreate the Directus container. Keep the current credential in your password manager.
 
-Directus discovers the existing tables. In its data model, create the many-to-one relationships `service_tickets.contact_id -> contacts.id`, `client_assets.contact_id -> contacts.id`, `service_events.contact_id -> contacts.id`, and `service_events.ticket_id -> service_tickets.id`. Keep the public role with no collection permissions and do not create a public Directus route. Use the admin role only through Tailscale. The `service_events` collection holds history and notes; keep new events append-only where possible. Store only password-manager references in `credential_reference`.
+Register the `contacts`, `projects`, `service_tickets`, `client_assets`, and `service_events` tables as Directus collections. Create the many-to-one relationships `projects.contact_id -> contacts.id`, `service_tickets.contact_id -> contacts.id`, `service_tickets.project_id -> projects.id`, `client_assets.contact_id -> contacts.id`, `service_events.contact_id -> contacts.id`, `service_events.ticket_id -> service_tickets.id`, and `service_events.project_id -> projects.id`. Keep the public role with no collection permissions and do not create a public Directus route. Use the admin role only through Tailscale. The `service_events` collection holds history and notes; keep new events append-only where possible. Store only password-manager references in `credential_reference`.
 
 ## Backups
 
diff --git a/ops/crm/compose.yaml b/ops/crm/compose.yaml
index 17fae0c..64ba5de 100644
--- a/ops/crm/compose.yaml
+++ b/ops/crm/compose.yaml
@@ -11,6 +11,7 @@ services:
     volumes:
       - pgdata:/var/lib/postgresql/data
       - ../../services/intake/sql/001_schema.sql:/docker-entrypoint-initdb.d/010-schema.sql:ro
+      - ../../services/intake/sql/002_crm_extensions.sql:/docker-entrypoint-initdb.d/015-crm-extensions.sql:ro
       - ../../services/intake/sql/020-create-api-role.sh:/docker-entrypoint-initdb.d/020-create-api-role.sh:ro
     networks: [data]
     healthcheck:
diff --git a/services/intake/sql/001_schema.sql b/services/intake/sql/001_schema.sql
index 0dd8741..0f99626 100644
--- a/services/intake/sql/001_schema.sql
+++ b/services/intake/sql/001_schema.sql
@@ -8,6 +8,9 @@ CREATE TABLE IF NOT EXISTS contacts (
   email text,
   email_normalized text,
   location_label text,
+  lead_status text NOT NULL DEFAULT 'new'
+    CHECK (lead_status IN ('new','contacted','qualified','converted','inactive')),
+  next_follow_up_at timestamptz,
   preferred_contact_method text NOT NULL DEFAULT 'phone'
     CHECK (preferred_contact_method IN ('phone','sms','email')),
   consent_to_contact boolean NOT NULL DEFAULT true,
@@ -21,10 +24,28 @@ CREATE UNIQUE INDEX IF NOT EXISTS contacts_email_normalized_unique
 CREATE UNIQUE INDEX IF NOT EXISTS contacts_phone_normalized_unique
   ON contacts(phone_normalized) WHERE phone_normalized IS NOT NULL;
 
+CREATE TABLE IF NOT EXISTS projects (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_number bigint GENERATED ALWAYS AS IDENTITY UNIQUE,
+  contact_id uuid NOT NULL REFERENCES contacts(id),
+  name text NOT NULL,
+  summary text,
+  status text NOT NULL DEFAULT 'planned'
+    CHECK (status IN ('planned','scheduled','in_progress','blocked','completed','cancelled')),
+  priority text NOT NULL DEFAULT 'normal'
+    CHECK (priority IN ('low','normal','high','urgent')),
+  start_date date,
+  target_date date,
+  completed_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
 CREATE TABLE IF NOT EXISTS service_tickets (
   id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
   ticket_number bigint GENERATED ALWAYS AS IDENTITY UNIQUE,
   contact_id uuid NOT NULL REFERENCES contacts(id),
+  project_id uuid REFERENCES projects(id),
   issue_category text NOT NULL,
   request_type text NOT NULL DEFAULT 'website_request',
   device_type text,
@@ -61,6 +82,7 @@ CREATE TABLE IF NOT EXISTS client_assets (
 CREATE TABLE IF NOT EXISTS service_events (
   id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
   ticket_id uuid REFERENCES service_tickets(id),
+  project_id uuid REFERENCES projects(id),
   contact_id uuid NOT NULL REFERENCES contacts(id),
   event_type text NOT NULL CHECK (event_type IN ('note','status_change','visit','call','remote_session','work_log','intake')),
   body text NOT NULL,
@@ -77,8 +99,12 @@ CREATE TABLE IF NOT EXISTS intake_submissions (
 
 CREATE INDEX IF NOT EXISTS tickets_status_priority_created ON service_tickets(status, priority, created_at DESC);
 CREATE INDEX IF NOT EXISTS tickets_contact_created ON service_tickets(contact_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS tickets_project_created ON service_tickets(project_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS projects_status_target ON projects(status, target_date);
+CREATE INDEX IF NOT EXISTS projects_contact ON projects(contact_id, created_at DESC);
 CREATE INDEX IF NOT EXISTS assets_contact ON client_assets(contact_id);
 CREATE INDEX IF NOT EXISTS events_ticket_created ON service_events(ticket_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS events_project_created ON service_events(project_id, created_at DESC);
 
 CREATE OR REPLACE FUNCTION touch_updated_at() RETURNS trigger
 LANGUAGE plpgsql
@@ -94,6 +120,9 @@ CREATE TRIGGER contacts_touch_updated_at BEFORE UPDATE ON contacts
 DROP TRIGGER IF EXISTS tickets_touch_updated_at ON service_tickets;
 CREATE TRIGGER tickets_touch_updated_at BEFORE UPDATE ON service_tickets
   FOR EACH ROW EXECUTE FUNCTION touch_updated_at();
+DROP TRIGGER IF EXISTS projects_touch_updated_at ON projects;
+CREATE TRIGGER projects_touch_updated_at BEFORE UPDATE ON projects
+  FOR EACH ROW EXECUTE FUNCTION touch_updated_at();
 DROP TRIGGER IF EXISTS assets_touch_updated_at ON client_assets;
 CREATE TRIGGER assets_touch_updated_at BEFORE UPDATE ON client_assets
   FOR EACH ROW EXECUTE FUNCTION touch_updated_at();
diff --git a/services/intake/sql/002_crm_extensions.sql b/services/intake/sql/002_crm_extensions.sql
new file mode 100644
index 0000000..0600a16
--- /dev/null
+++ b/services/intake/sql/002_crm_extensions.sql
@@ -0,0 +1,72 @@
+BEGIN;
+
+ALTER TABLE contacts
+  ADD COLUMN IF NOT EXISTS lead_status text NOT NULL DEFAULT 'new',
+  ADD COLUMN IF NOT EXISTS next_follow_up_at timestamptz;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'contacts_lead_status_check'
+      AND conrelid = 'contacts'::regclass
+  ) THEN
+    ALTER TABLE contacts ADD CONSTRAINT contacts_lead_status_check
+      CHECK (lead_status IN ('new','contacted','qualified','converted','inactive'));
+  END IF;
+END;
+$$;
+
+CREATE TABLE IF NOT EXISTS projects (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_number bigint GENERATED ALWAYS AS IDENTITY UNIQUE,
+  contact_id uuid NOT NULL REFERENCES contacts(id),
+  name text NOT NULL,
+  summary text,
+  status text NOT NULL DEFAULT 'planned'
+    CHECK (status IN ('planned','scheduled','in_progress','blocked','completed','cancelled')),
+  priority text NOT NULL DEFAULT 'normal'
+    CHECK (priority IN ('low','normal','high','urgent')),
+  start_date date,
+  target_date date,
+  completed_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+ALTER TABLE service_tickets ADD COLUMN IF NOT EXISTS project_id uuid;
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'service_tickets_project_id_fkey'
+      AND conrelid = 'service_tickets'::regclass
+  ) THEN
+    ALTER TABLE service_tickets ADD CONSTRAINT service_tickets_project_id_fkey
+      FOREIGN KEY (project_id) REFERENCES projects(id);
+  END IF;
+END;
+$$;
+
+ALTER TABLE service_events ADD COLUMN IF NOT EXISTS project_id uuid;
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'service_events_project_id_fkey'
+      AND conrelid = 'service_events'::regclass
+  ) THEN
+    ALTER TABLE service_events ADD CONSTRAINT service_events_project_id_fkey
+      FOREIGN KEY (project_id) REFERENCES projects(id);
+  END IF;
+END;
+$$;
+
+CREATE INDEX IF NOT EXISTS contacts_lead_follow_up ON contacts(lead_status, next_follow_up_at);
+CREATE INDEX IF NOT EXISTS tickets_project_created ON service_tickets(project_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS projects_status_target ON projects(status, target_date);
+CREATE INDEX IF NOT EXISTS projects_contact ON projects(contact_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS events_project_created ON service_events(project_id, created_at DESC);
+
+DROP TRIGGER IF EXISTS projects_touch_updated_at ON projects;
+CREATE TRIGGER projects_touch_updated_at BEFORE UPDATE ON projects
+  FOR EACH ROW EXECUTE FUNCTION touch_updated_at();
+
+COMMIT;