From 8a26d605b4aa5fdea0e02a17159c1cae478a7e47 Mon Sep 17 00:00:00 2001
From: Tania Sanz <info@taniasanz.com>
Date: Mon, 11 May 2026 09:34:31 +0200
Subject: [PATCH] fix: pass DISABLE_SIGNUPS and EMAIL_RATE_LIMIT_PER_SECOND
 through compose; trim .env.self-host.example
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PR review (#371): scope the self-host baseline to envs that make sense
without reselling Plunk.

docker-compose.yml: pass through only DISABLE_SIGNUPS (private/single-
admin self-host) and EMAIL_RATE_LIMIT_PER_SECOND (works around the
silent 14/sec fallback when ses:GetSendQuota is denied). Drop the
VERIFY_EMAIL_ON_SIGNUP and OPENROUTER_API_KEY passthroughs — signup
hygiene and phishing detection are reselling concerns.

.env.self-host.example: drop the entire Stripe Billing block (billing
only matters when reselling), drop the VERIFY_EMAIL_ON_SIGNUP doc
block for the same reason, and add an EMAIL_RATE_LIMIT_PER_SECOND
section explaining the silent-14/sec fallback so operators know why
they'd set it.
---
 .env.self-host.example | 24 ++++++++++--------------
 docker-compose.yml     |  8 ++++++++
 2 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/.env.self-host.example b/.env.self-host.example
index 78f6537..32d5ab2 100644
--- a/.env.self-host.example
+++ b/.env.self-host.example
@@ -60,15 +60,6 @@ GITHUB_OAUTH_SECRET=
 GOOGLE_OAUTH_CLIENT=
 GOOGLE_OAUTH_SECRET=
 
-# ========================================
-# OPTIONAL: Stripe Billing
-# ========================================
-STRIPE_SK=
-STRIPE_WEBHOOK_SECRET=
-STRIPE_PRICE_ONBOARDING=
-STRIPE_PRICE_EMAIL_USAGE=
-STRIPE_METER_EVENT_NAME=emails
-
 # ========================================
 # OPTIONAL: File Storage (Minio)
 # ========================================
@@ -154,11 +145,16 @@ SMTP_DOMAIN=smtp.example.com
 # Default: false
 # DISABLE_SIGNUPS=false
 
-# Controls whether email validation checks are performed on signup
-# When enabled (true), validates emails for disposable domains, plus-addressing, domain existence, and MX records
-# When disabled (false), skips these validation checks and allows any email format
-# Default: false
-# VERIFY_EMAIL_ON_SIGNUP=false
+# ========================================
+# OPTIONAL: SES Sending Rate
+# ========================================
+# Caps the email-worker's send rate (messages per second) for the SES sandbox or
+# manually-throttled accounts. When unset, the worker probes the AWS account at
+# startup via ses:GetSendQuota; if that call is denied or transiently fails,
+# the worker silently falls back to 14/sec which may exceed sandbox limits and
+# trigger SES throttling errors. Set this explicitly to avoid the silent fallback.
+# Default: unset (auto-detect, falls back to 14)
+# EMAIL_RATE_LIMIT_PER_SECOND=1
 
 # ========================================
 # ADVANCED (rarely needed)
diff --git a/docker-compose.yml b/docker-compose.yml
index 36fc6f8..66f5da8 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -190,6 +190,14 @@ services:
       # Security
       AUTO_PROJECT_DISABLE: ${AUTO_PROJECT_DISABLE:-false}
 
+      # Self-hosting user management (documented in .env.self-host.example
+      # and read by apps/api/src/app/constants.ts at import time)
+      DISABLE_SIGNUPS: ${DISABLE_SIGNUPS:-false}
+
+      # Explicit SES sending rate (avoid silent fallback to 14/sec when
+      # ses:GetSendQuota is denied or transiently fails at worker startup)
+      EMAIL_RATE_LIMIT_PER_SECOND: ${EMAIL_RATE_LIMIT_PER_SECOND:-}
+
     volumes:
       # Persistent storage for application data
       - plunk_data:/app/data