feat: certificates, landing pages, ai tutor, website update, compliance

apps/api/.env.example

@@ -9,12 +9,20 @@ BETTER_AUTH_SECRET=""
 AUTH_BEARER_TOKEN=""
 AUTH_COOKIE_DOMAIN=""
 
+# Email provider — used by the API only for auth-flow emails (forgot
+# password, password-reset confirmation, email verification, email-change
+# verification). Every other email is sent by @cio/jobs-worker; see
+# apps/jobs/.env.example. Both processes can point at the same SMTP server.
 SMTP_HOST=""
 SMTP_PORT=""
 SMTP_USER=""
 SMTP_SENDER=""
 SMTP_PASSWORD=""
 
+# Optional Zoho ZeptoMail token. When set, @cio/email uses Zoho instead of
+# nodemailer/SMTP. Same dual-process note as SMTP above.
+# ZOHO_TOKEN=""
+
 # Optional - MinIO (S3-compatible, for Docker / on-premise self-hosting)
 # When API runs in Docker: use http://minio:9000. For local API: use http://localhost:9000
 MINIO_ROOT_USER=""
@@ -34,6 +42,19 @@ CLOUDFLARE_BUCKET_DOMAIN=""
 CLOUDFLARE_SECRET_ACCESS_KEY=""
 SENTRY_DNS=""
 
+# BullMQ dashboard (/admin/queues) ───────────────────────────────────────────
+# In dev the dashboard is open. In production it's hidden unless ONE of the
+# following is set; failing requests get 404 (not 401) so the route stays
+# invisible to scanners.
+#
+# Comma-separated allowlist of Better Auth user emails — log in normally,
+# visit /admin/queues, the middleware checks your session.
+# QUEUE_DASHBOARD_ADMIN_EMAILS="you@yourdomain.com,partner@yourdomain.com"
+#
+# Bearer-token escape hatch for curl / scripts. Pass via
+# `Authorization: Bearer <token>` or `?token=<token>`.
+# QUEUE_DASHBOARD_TOKEN=""
+
 # Enterprise (Optional)
 # Required only when using Enterprise-only features (SSO, token-auth, no-tracking)
 LICENSE_KEY=""
@@ -51,6 +72,11 @@ GOOGLE_API_KEY=""
 ANTHROPIC_API_KEY=""
 MOONSHOT_API_KEY=""
 
+# Jina Reader — optional Bearer for higher rate limits when using fetch_documentation_url
+# JINA_API_KEY=""
+# AGENT_MAX_FETCHES_PER_CONVERSATION=15
+# AGENT_MAX_FETCHES_PER_ORG_PER_DAY=500
+
 # Tinybird event tracking for AI observability (optional — silently skipped when not set)
 # TINYBIRD_TOKEN=""
 # TINYBIRD_BASE_URL="https://api.tinybird.co"