Pace only shared-mailbox sends; review a new account's first large own-ESP broadcast

.env.example

@@ -44,6 +44,13 @@ SENDLIT_DEPLOYMENT_MODE=oss
 # BILLING_RAMP_DAYS_7_13_LIMIT=10000
 # BILLING_TEST_VOLUME_THRESHOLD=100
 
+# Optional test-send limits (all deployments; each recipient counts once).
+# See apps/docs self-hosting/sending-safeguards.
+# TEST_SEND_DAILY_LIMIT=100
+# TEST_SEND_BURST_LIMIT=50
+# TEST_SEND_BURST_HOURS=3
+# TEST_SEND_EMAIL_DAILY_LIMIT=20
+
 # Public origins. For a local installation, keep these defaults. For a public
 # deployment, use the externally reachable HTTPS origins and set PROTOCOL=https.
 API_PUBLIC_URL=http://localhost:5000

README.md

@@ -92,6 +92,8 @@ For an internet-facing deployment:
 - Put the API and web ports behind a TLS reverse proxy, and set `ENABLE_TRUST_PROXY=true` when it forwards client IPs.
 - Back up the `postgres-data` volume and keep the `.env` secrets stable. Changing the ESP encryption key makes stored team SMTP credentials unreadable.
 - If you send through Amazon SES, follow [Amazon SES bounces and complaints](./apps/docs/content/docs/self-hosting/amazon-ses-feedback.mdx) so SendLit suppresses bounced and complaining addresses.
+- See [Sending safeguards](./apps/docs/content/docs/self-hosting/sending-safeguards.mdx) for which limits apply to a self-hosted install (test-send limits, auto-pause, your ESP's own tracking) and how to change them.
+- To let teams use their own tracking domains, configure on-demand TLS in your reverse proxy as described in [Tracking domains](./apps/docs/content/docs/self-hosting/tracking-domains.mdx).
 
 Prebuilt images are published on release tags: [`codelit/sendlit`](https://hub.docker.com/r/codelit/sendlit) (API) and [`codelit/sendlit-web`](https://hub.docker.com/r/codelit/sendlit-web) (dashboard).
 

apps/api/.env.example

@@ -169,10 +169,23 @@ GOOGLE_CLIENT_SECRET=
 # IMPORT_ALERT_CONTACTS_NEW_ACCOUNT=1000
 # IMPORT_ALERT_GROWTH_FACTOR=3
 # IMPORT_HOLD_NEW_ACCOUNTS=true
-# PACING_HOURS=12                         # spread a new account's daily sends over this many hours
+# PACING_HOURS=12                         # spread a new account's daily shared-mailbox sends over this many hours
+# FIRST_BROADCAST_REVIEW_RECIPIENTS=1000  # a new account's first broadcast this large through its own ESP waits for review
 # CONTENT_SCAN=heuristic                  # off | heuristic | ai (default ai when ANTHROPIC_API_KEY is set)
 # ANTHROPIC_API_KEY=
 
+# Custom tracking domains (#50). Teams point a CNAME at this host; defaults to
+# the host in DOMAIN. Your proxy must serve those hosts over HTTPS; see
+# apps/docs self-hosting/tracking-domains.
+# TRACKING_DOMAIN_CNAME_TARGET=
+
+# Auto-pause of a sending broadcast or sequence (all deployments).
+# AUTO_PAUSE_MIN_SENT=100
+# AUTO_PAUSE_BOUNCE_BPS=200               # 2%
+# AUTO_PAUSE_COMPLAINT_BPS=8              # 0.08%
+# AUTO_PAUSE_CONSECUTIVE_FAILURES=5
+# AUTO_PAUSE_CHECK_SECONDS=30
+
 # Test sends (all deployments). Every recipient counts once; windows are rolling.
 # TEST_SEND_DAILY_LIMIT=100               # per team, any 24 hours
 # TEST_SEND_BURST_LIMIT=50                # per team, any TEST_SEND_BURST_HOURS

apps/api/drizzle/0024_abuse_flag_broadcast.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "abuse_flags" DROP CONSTRAINT "abuse_flags_kind_check";--> statement-breakpoint
+ALTER TABLE "abuse_flags" ADD CONSTRAINT "abuse_flags_kind_check" CHECK ("abuse_flags"."kind" IN ('signup', 'content', 'import', 'broadcast'));

apps/api/drizzle/0025_tracking_domain.sql

@@ -0,0 +1,8 @@
+ALTER TABLE "settings" ADD COLUMN "tracking_domain" text;--> statement-breakpoint
+ALTER TABLE "settings" ADD COLUMN "tracking_domain_status" text;--> statement-breakpoint
+ALTER TABLE "settings" ADD COLUMN "tracking_domain_error" text;--> statement-breakpoint
+ALTER TABLE "settings" ADD COLUMN "tracking_domain_verified_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "settings" ADD COLUMN "tracking_domain_checked_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "settings" ADD COLUMN "tracking_domain_failures" integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE "settings" ADD COLUMN "retired_tracking_domains" text[] DEFAULT '{}'::text[] NOT NULL;--> statement-breakpoint
+ALTER TABLE "settings" ADD CONSTRAINT "settings_tracking_domain_unique" UNIQUE("tracking_domain");