feat: self-hosted deployment overhaul (docker, demo removal, namespaces, retrieval UX)

.dockerignore

@@ -0,0 +1,28 @@
+node_modules
+.next
+.git
+.gitignore
+.env
+.env.*
+!.env.local.example
+*.log
+npm-debug.log*
+.pnpm-debug.log*
+coverage
+playwright-report
+test-results
+.vscode
+.idea
+.DS_Store
+README.md
+CONTEXT.md
+AGENTS.md
+CLAUDE.md
+docs
+e2e
+skills
+drizzle
+Dockerfile
+.dockerignore
+docker-compose*.yml
+_repro*.js

.env.local.example

@@ -2,46 +2,60 @@
 # Use staging when validating staging keys.
 # KNOWHERE_BASE_URL=https://api-staging.knowhereto.ai
 
-# Optional development override. When set, Notebook skips Dashboard session
-# auth and Dashboard-issued JWT creation, then calls Knowhere directly with
-# this key. Leave unset for production and Dashboard-authenticated staging.
+# Optional development override. When set, Notebook skips session auth and
+# uses the hardcoded development user, calling Knowhere directly with this
+# key (or with keys from config/knowhere-keys.json). Leave unset to require
+# a Notebook account.
 # KNOWHERE_API_KEY=sk_your_development_key_here
 
+# Optional path to a Knowhere API keys file (multi-domain support). When
+# present, its [{ label, apiKey }] entries override the single env key.
+# KNOWHERE_KEYS_FILE=./config/knowhere-keys.json
+
 # --- Chat provider (server-side only) ---
-# Vercel AI Gateway key; AI SDK picks it up automatically
+# Two mutually exclusive chat backends. Chat is inert until one is configured.
+#
+# 1. Vercel AI Gateway (default): the AI SDK picks up this key automatically
+#    when the model is passed as a plain string.
 AI_GATEWAY_API_KEY=vck_your_key_here
 
-# Optional override — defaults to deepseek/deepseek-v4-flash
-# CHAT_MODEL=deepseek/deepseek-v4-flash
+# 2. Generic OpenAI-compatible API: point at any OpenAI-compatible endpoint
+#    (local LLM, self-hosted gateway, etc.) instead of the Vercel AI Gateway.
+#    CHAT_MODEL is MANDATORY in this mode. CHAT_API_KEY is the bearer key sent
+#    to that endpoint.
+# CHAT_BASE_URL=http://localhost:11434/v1
+# CHAT_API_KEY=sk_your_openai_compatible_key
+# CHAT_MODEL=qwen-plus
+
+# Optional override — defaults to google/gemini-3-flash
+# CHAT_MODEL=google/gemini-3-flash
 
 # --- Auth (server-side only) ---
 #
-# Notebook and Dashboard share a parent domain so a single session cookie
-# issued by Dashboard is sent by the browser on every request to Notebook.
-#
-# Production:   Dashboard = https://knowhereto.ai
-#               Notebook  = https://notebook.knowhereto.ai
-#               Shared parent = .knowhereto.ai
-#
-# Local dev:    Use /etc/hosts entries like
-#                 127.0.0.1  dashboard.local.knowhereto.ai
-#                 127.0.0.1  notebook.local.knowhereto.ai
-#               so the cookie shares the local parent too.
-
-# Dashboard origin (scheme + host + port). Notebook hardcodes the API
-# route paths since they are part of Dashboard's fixed API contract.
-#   prod:  https://knowhereto.ai
-#   local: http://dashboard.local.knowhereto.ai:3000
-DASHBOARD_ORIGIN=http://dashboard.local.knowhereto.ai:3000
-
-# Public URL of this Notebook deployment (used as `callbackURL`).
-#   prod:  https://notebook.knowhereto.ai
-#   local: http://notebook.local.knowhereto.ai:3001
-NOTEBOOK_PUBLIC_URL=http://notebook.local.knowhereto.ai:3001
+# Notebook owns its authentication: users are created by the admin CLI
+# (scripts/create-user.ts), sessions are DB-backed, and the notebook-session
+# cookie carries the session id.
+
+# Optional OAuth/SSO login providers. A provider is only offered when both
+# of its credentials are set. Callback URLs are derived from the request
+# origin: /api/auth/<provider>/callback.
+# OAUTH_GOOGLE_CLIENT_ID=...
+# OAUTH_GOOGLE_CLIENT_SECRET=...
+# OAUTH_GITHUB_CLIENT_ID=...
+# OAUTH_GITHUB_CLIENT_SECRET=...
 
-# Optional override of the session cookie names Dashboard sets. Defaults
-# to Better Auth's standard cookie names.
-# SESSION_COOKIE_NAMES=better-auth.session_token,__Secure-better-auth.session_token
+# Optional Dashboard SSO: when set, the login page offers "SSO (Dashboard)".
+# The browser's Dashboard session cookie (same host, any port; or a shared
+# parent domain via the Dashboard's AUTH_COOKIE_DOMAIN) is forwarded to the
+# Dashboard's public users.getCurrentUser endpoint to resolve the user.
+#   local: http://localhost:3000
+#   docker: http://host.docker.internal:3000
+# DASHBOARD_ORIGIN=http://localhost:3000
+
+# Public URL of this Notebook deployment (used for QStash webhook callbacks).
+#   prod:  https://notebook.knowhereto.ai
+#   local: http://localhost:3001
+NOTEBOOK_PUBLIC_URL=http://localhost:3001
 
 # --- Product analytics (client-side) ---
 # PostHog Project API key. When unset, Notebook skips analytics initialization.

.gitignore

@@ -25,6 +25,7 @@
 # misc
 .DS_Store
 *.pem
+*.swp
 
 # debug
 npm-debug.log*
@@ -36,6 +37,7 @@ yarn-error.log*
 .env
 .env.local
 .env.*.local
+.env.docker
 
 # vercel
 .vercel