Redesign marketing pages and isolate public routes from app auth.

Give the landing, legal, and sign-in flows a consistent product shell while keeping marketing pages free of tRPC/session calls, fixing dev auth URL handling, and refreshing env and deploy docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -1,68 +1,153 @@
-# beenvoice-web environment
+# =============================================================================
+# beenvoice-web — environment template
+# =============================================================================
 #
-# Local dev:  cp .env.example .env.local
-# Docker:     cp .env.example .env
+# Quick start (local dev):
+#   cp .env.example .env.local
+#   docker compose -f docker-compose.dev.yml up -d
+#   bun run db:push    # or: bun run db:migrate
+#   bun run dev
 #
-# Docker deploy checklist:
-#   1. Set AUTH_SECRET, BETTER_AUTH_URL, NEXT_PUBLIC_APP_URL to your public URL
-#   2. docker compose build --no-cache app   # NEXT_PUBLIC_* is baked in at build
-#   3. docker compose up -d --build          # migrations run on app container start
+# Quick start (Docker app + Postgres):
+#   cp .env.example .env
+#   # edit AUTH_SECRET + public URLs below
+#   docker compose up -d --build
 #
-# Updating: git pull && docker compose up -d --build
-#   (git pull alone does not rebuild; up -d without --build keeps the old image)
+# -----------------------------------------------------------------------------
+# Build-time vs runtime (Docker)
+# -----------------------------------------------------------------------------
 #
-# Migrations are idempotent — only pending SQL files are applied on each start.
+# Baked into the image at `docker compose build` (rebuild after changes):
+#   NEXT_PUBLIC_APP_URL
+#   NEXT_PUBLIC_* branding / theme defaults
+#   NEXT_PUBLIC_AUTHENTIK_ENABLED
+#   NEXT_PUBLIC_UMAMI_*
+#
+# Read from .env when the container starts (restart app after changes):
+#   AUTH_SECRET, BETTER_AUTH_URL, DATABASE_URL (compose overrides host),
+#   RESEND_*, DISABLE_SIGNUPS, AUTHENTIK_* secrets, CRON_SECRET
+#
+# `NEXT_PUBLIC_APP_URL` should still match your public browser URL for SSR,
+# emails, and MCP links. In the browser, sign-in uses the current page origin
+# automatically so dev works when Next picks another port (e.g. 3002).
+#
+# Updating production: git pull && docker compose up -d --build
+# Migrations run on every app start (idempotent — only pending SQL is applied).
 
-# Runtime
-NODE_ENV=production
-WEB_PORT=3000
+# =============================================================================
+# Core — required
+# =============================================================================
 
-# Auth
-# Generate with: openssl rand -base64 32
+# PostgreSQL connection string.
+# Local dev (docker-compose.dev.yml): host is localhost
+DATABASE_URL=postgres://postgres:postgres@localhost:5432/postgres
+
+# Session signing secret. Required in production.
+# Generate: openssl rand -base64 32
 AUTH_SECRET=change-me-generate-a-real-secret
-# Must match the URL users open in the browser (include https:// and port if non-standard).
+
+# Public URL users open in the browser (scheme + host + port if non-standard).
+# Must match how you access the app for cookies, OAuth callbacks, and email links.
 BETTER_AUTH_URL=http://localhost:3000
 
-# Public app URL — baked into the client bundle at Docker build time.
-# Set this to the same value as BETTER_AUTH_URL before `docker compose build`.
+# Same as BETTER_AUTH_URL in most setups. Embedded in the client bundle at build.
 NEXT_PUBLIC_APP_URL=http://localhost:3000
 
-# Postgres used by docker-compose.yml
+# =============================================================================
+# Local development
+# =============================================================================
+
+NODE_ENV=development
+
+# Set true when connecting to local Postgres without SSL (default for compose).
+DB_DISABLE_SSL=true
+
+# Dev-only: host port for `docker compose -f docker-compose.dev.yml` Postgres.
+POSTGRES_PORT=5432
+
+# Optional: if Next dev picks another port, you do not need to change URLs for
+# sign-in — the auth client uses window.location.origin in the browser.
+
+# =============================================================================
+# Docker Compose (app + database)
+# =============================================================================
+
+# Host port mapped to container :3000 (WEB_PORT, then PORT, then 3000).
+WEB_PORT=3000
+
+# Postgres credentials for docker-compose.yml `db` service.
+# DATABASE_URL inside the app container is set by compose (host `db`, not localhost).
 POSTGRES_USER=postgres
 POSTGRES_PASSWORD=postgres
 POSTGRES_DB=postgres
-DATABASE_URL=postgres://postgres:postgres@localhost:5432/postgres
-DB_DISABLE_SSL=true
 
-# White-label defaults used at image build time.
-# Admin-managed platform branding in the app can override these after setup.
-NEXT_PUBLIC_BRAND_NAME="beenvoice"
-NEXT_PUBLIC_BRAND_TAGLINE="Simple and efficient invoicing for freelancers and small businesses"
-NEXT_PUBLIC_BRAND_LOGO_TEXT="beenvoice"
-NEXT_PUBLIC_BRAND_ICON="$"
-NEXT_PUBLIC_DEFAULT_INTERFACE_THEME="beenvoice"
-NEXT_PUBLIC_DEFAULT_FONT="brand"
-NEXT_PUBLIC_DEFAULT_BODY_FONT="brand"
-NEXT_PUBLIC_DEFAULT_HEADING_FONT="brand"
-NEXT_PUBLIC_DEFAULT_RADIUS="xl"
-NEXT_PUBLIC_DEFAULT_SIDEBAR_STYLE="floating"
+# =============================================================================
+# White-label defaults (optional)
+# =============================================================================
+# Baked in at Docker build. After first deploy, admins can override many of
+# these from Settings → Appearance in the dashboard.
+
+NEXT_PUBLIC_BRAND_NAME=beenvoice
+NEXT_PUBLIC_BRAND_TAGLINE=Simple and efficient invoicing for freelancers and small businesses
+NEXT_PUBLIC_BRAND_LOGO_TEXT=beenvoice
+NEXT_PUBLIC_BRAND_ICON=$
+
+# Interface theme: beenvoice | frutiger | frutiger-aero | shadcn | minimal | editorial
+NEXT_PUBLIC_DEFAULT_INTERFACE_THEME=beenvoice
+
+# Font prefs: brand | frutiger | platform | inter | serif
+NEXT_PUBLIC_DEFAULT_FONT=brand
+NEXT_PUBLIC_DEFAULT_BODY_FONT=brand
+NEXT_PUBLIC_DEFAULT_HEADING_FONT=brand
+
+# Corner radius: none | sm | md | lg | xl
+NEXT_PUBLIC_DEFAULT_RADIUS=xl
+
+# Sidebar chrome: floating | docked
+NEXT_PUBLIC_DEFAULT_SIDEBAR_STYLE=floating
+
+# =============================================================================
+# Email — Resend (optional)
+# =============================================================================
+# Leave blank to disable invoice and password-reset email delivery.
 
-# Email delivery via Resend (optional)
-# Leave blank to disable invoice/password-reset email delivery.
 RESEND_API_KEY=
 RESEND_DOMAIN=
 
-# Analytics via Umami (optional)
-# Leave website ID blank to disable analytics.
+# =============================================================================
+# Analytics — Umami (optional)
+# =============================================================================
+# Leave website ID blank to disable.
+
 NEXT_PUBLIC_UMAMI_WEBSITE_ID=
 NEXT_PUBLIC_UMAMI_SCRIPT_URL=https://analytics.umami.is/script.js
 
-# Block new email/password registrations (optional)
+# =============================================================================
+# Access control (optional)
+# =============================================================================
+
+# Block new email/password registrations. Use literal true or false.
 # DISABLE_SIGNUPS=true
 
-# SSO via Authentik OIDC (optional)
+# Bearer token for POST /api/cron/generate-recurring (recurring invoice cron).
+# CRON_SECRET=
+
+# =============================================================================
+# SSO — Authentik OIDC (optional)
+# =============================================================================
+# Set NEXT_PUBLIC_AUTHENTIK_ENABLED=true and rebuild the image to show SSO on
+# sign-in. Server secrets are runtime-only (no rebuild needed for secrets).
+
 NEXT_PUBLIC_AUTHENTIK_ENABLED=false
 AUTHENTIK_ISSUER=
 AUTHENTIK_CLIENT_ID=
 AUTHENTIK_CLIENT_SECRET=
+# Optional extra trusted origin for better-auth (defaults derived from issuer).
 AUTHENTIK_ORIGIN=
+
+# =============================================================================
+# Advanced / CI (usually unset)
+# =============================================================================
+
+# Skip Zod env validation during `next build` (set automatically in Dockerfile).
+# SKIP_ENV_VALIDATION=1