- Server settings (Settings page): SMTP, AI, publishing, Meta, platform keys and,
on the control centre only, Stripe/billing. Stored sealed in data/settings.json and
applied over .env in every process; hosted agency workspaces don't see our email,
platform keys or billing.
- Odoo connection per workspace in Connections (login checked before saving).
- provision-tenants.sh marks agency containers with QUORLA_HOSTED_TENANT=true.
- docs/wildcard-subdomains.html: one-time setup for automatic agency subdomains.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The app runs as uid 1000 inside the image; folders created by the deploy
user (another uid) made the container crash with EACCES on /app/data.
Fixed with a one-off root container, so the script still needs no sudo.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Control centre (QUORLA_CONTROL=true on app.quorlasocial.com): public /signup → Stripe Checkout,
verified Stripe webhook (paid, updated, cancelled, payment failed), Admin → Agencies
(approve without Stripe, suspend, resume, billing portal, resend welcome, remove)
- deploy/provision-tenants.sh (cron): one container per agency with its own .env and data,
nginx map for <agency>.quorlasocial.com, upgrades agencies after a rebuild, archives removed data
- New workspaces: first admin only via the emailed one-time setup link (SETUP_TOKEN)
- Meta system user token can be saved in Settings (encrypted) for workspaces that can't edit .env
- docs/multi-tenant.md: DNS, wildcard cert, nginx, sudoers, cron, Stripe setup; tests for the control centre
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
