Self-host: it-ops broker, per-user auth, preview isolation, visual editor + comments

.dockerignore

@@ -0,0 +1,13 @@
+node_modules
+.next
+.git
+data
+dist
+build
+out
+.turbo
+.vercel
+electron/dist
+*.log
+.env
+.env.local

.env.example

@@ -0,0 +1,55 @@
+# Claudable server config — copy to .env on your host (DO NOT COMMIT).
+
+# --- Agent auth: run claude -p with your Claude subscription (no API billing) ---
+# Generate once with `claude setup-token` on a logged-in machine, paste here.
+CLAUDE_CODE_OAUTH_TOKEN=
+
+# --- Git provider: 'github' (default) or 'gitea' (self-hosted) ---
+GIT_PROVIDER=github
+GIT_API_BASE_URL=https://git.example.com/api/v1
+GIT_HTTP_BASE=https://git.example.com
+GIT_ORG=your-org
+GIT_DEPLOY_DOMAIN=example.com
+# Git API token (write:repository, write:organization). Used for repo create + push.
+GIT_TOKEN=
+
+# --- App / public URL ---
+DATABASE_URL=file:../data/cc.db
+PROJECTS_DIR=./data/projects
+WEB_PORT=3700
+# Public URL of this Claudable instance (behind your reverse proxy).
+NEXT_PUBLIC_APP_URL=https://claudable.example.com
+# Template for preview URLs. Prefer {project} (a STABLE per-project subdomain whose
+# Traefik route is rewritten to the live port each start — a reused port can never
+# cross projects). Requires TRAEFIK_DYNAMIC_DIR (below) mounted + writable. The
+# legacy {port} form works too but is port-keyed (guessable, cross-project risk).
+PREVIEW_URL_TEMPLATE=https://preview-{project}.example.com
+# How your reverse proxy reaches host-network containers (host gateway IP, or
+# host.docker.internal on Docker Desktop).
+DEPLOY_HOST_GATEWAY=host.docker.internal
+
+# --- Auth (Google OAuth via Auth.js) ---
+# Create an OAuth client at console.cloud.google.com (Web app), redirect URI:
+#   https://<your-app>/api/auth/callback/google
+AUTH_SECRET=                       # openssl rand -hex 32
+AUTH_URL=https://claudable.example.com
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+ALLOWED_EMAIL_DOMAINS=example.com  # comma-separated; these domains auto-provision users
+BOOTSTRAP_ADMIN_EMAIL=             # this email becomes admin on first sign-in
+AUTH_ENABLED=false                 # flip to true to enforce the login gate
+
+# --- it-ops broker (admin-enabled per project; tools run in THIS process, never
+#     in the agent). Each block is opt-in: unset = that tool reports "not
+#     configured". Gitea write tools reuse GIT_TOKEN above. AWS stays propose-only.
+# Coolify: scoped list/restart/deploy/env tools. Token: Coolify → Keys & Tokens.
+COOLIFY_API_BASE=http://localhost:8000
+COOLIFY_API_TOKEN=
+# Traefik: publish dynamic routes. Mount the host's proxy dynamic dir (set the
+# host path) AND point the in-container path at the mount.
+TRAEFIK_DYNAMIC_HOST_DIR=          # e.g. /data/coolify/proxy/dynamic (host path)
+TRAEFIK_DYNAMIC_DIR=               # e.g. /traefik-dynamic (in-container mount path)
+
+# --- One-click Postgres backend (provisioned via Coolify) ---
+COOLIFY_SERVER_UUID=              # the Coolify server uuid to place databases on
+PREVIEW_DB_HOST=127.0.0.1         # how preview/deploy reach the DB (host-networked)

.gitignore

@@ -25,9 +25,10 @@ npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 
-# local env files
-.env*.local
+# local env files — ignore every .env variant, keep only the example template
 .env
+.env.*
+!.env.example
 
 # vercel
 .vercel

Dockerfile

@@ -0,0 +1,57 @@
+# Claudable — self-hosted AI web builder, running the agent via `claude -p`
+# (Claude Code CLI / Agent SDK) with subscription auth (CLAUDE_CODE_OAUTH_TOKEN).
+FROM node:22-bookworm-slim
+
+# Tooling the agent needs at runtime: git (push), ripgrep (claude search), ca-certs.
+# chromium + fonts-liberation power server-side project thumbnails (headless capture).
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends git ca-certificates ripgrep curl chromium fonts-liberation \
+  && rm -rf /var/lib/apt/lists/*
+
+# Path to the headless browser used for thumbnail capture (lib/services/thumbnail.ts).
+ENV CHROMIUM_PATH=/usr/bin/chromium
+
+# Go toolchain — lets the preview build+run a project's Go backend (the `static`
+# import mode's backend sidecar). Pinned; copied from the official image.
+COPY --from=golang:1.25-bookworm /usr/local/go /usr/local/go
+ENV PATH="/usr/local/go/bin:${PATH}" \
+    GOTOOLCHAIN=local \
+    GOFLAGS=-buildvcs=false
+
+# Docker CLI ONLY (not the daemon) — for project-environment isolation, Claudable
+# builds/runs hardened sibling containers via the socket-proxy (DOCKER_HOST). Just
+# the static client binary; talks to a remote daemon, runs nothing locally.
+RUN curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz \
+    | tar -xz -C /usr/local/bin --strip-components=1 docker/docker \
+  && docker --version
+
+# Claude Code CLI on PATH so the Agent SDK can spawn `claude` headless.
+RUN npm install -g @anthropic-ai/claude-code
+
+# Run as the non-root `node` user (uid 1000, matches the host volume owner) — Claude
+# Code refuses --dangerously-skip-permissions as root. Building entirely as `node`
+# (with COPY --chown) means files are created node-owned, so NO slow recursive chown.
+WORKDIR /app
+RUN chown node:node /app
+USER node
+
+# Pre-create ~/.claude as node so a bind-mount at ~/.claude/skills doesn't make
+# Docker create the parent as root (which blocks the agent writing session-env).
+RUN mkdir -p /home/node/.claude
+
+# Install deps (cached on lockfile). --ignore-scripts skips electron/postinstall.
+COPY --chown=node:node package*.json ./
+RUN npm ci --ignore-scripts
+COPY --chown=node:node prisma ./prisma
+RUN npx prisma generate
+
+# Build the Next.js app.
+COPY --chown=node:node . .
+RUN npm run build
+
+ENV NODE_ENV=production
+ENV PORT=3700
+ENV WEB_PORT=3700
+
+# Ensure the SQLite schema exists on the mounted volume, then start.
+CMD ["sh", "-c", "npx prisma db push --skip-generate && npx next start -p ${WEB_PORT}"]

README.md

@@ -25,6 +25,40 @@
 </a>
 </p>
 
+---
+
+## 🍴 About this fork
+
+This is a **self-hosted fork** of [opactorai/Claudable](https://github.com/opactorai/Claudable),
+adapted to run entirely on **your own infrastructure** (no Vercel / GitHub / Supabase
+required) and extended into a **multi-user, team review** tool. Everything upstream still
+works; this fork adds:
+
+- **Self-hosting on your own box** — provider-aware Git (self-hosted **Gitea** as well as
+  GitHub), one-click publish + auto-deploy via **Gitea Actions**, and a shared **Traefik**
+  proxy. Each running preview gets a **stable per-project subdomain** with automatic HTTPS
+  (Let's Encrypt DNS-01), isolated so one project's preview can never show another's.
+- **Multi-user** — Google login with an auth gate, per-project access control, and
+  per-user Claude credentials (paste your own `claude setup-token`).
+- **Visual editor** — an *Edit* mode to click elements in the live preview and tweak text
+  & CSS, then apply the change to code through the agent.
+- **Preview comments** — Figma-style pinned, per-route review comments overlaid on the
+  preview (Claudable-only; never touches the app source), with author, resolve & clear-all.
+- **Device preview** — a device selector (iPhone/iPad/Pixel/Surface…) with portrait ⇄
+  landscape and always-fit scaling.
+- **it-ops broker** *(admin-opt-in, per user)* — scoped, audited infrastructure tools the
+  agent can use (Gitea repo/admin, Coolify apps & projects, Traefik routes); AWS/IAM stays
+  propose-only, and credentials never enter the agent's context.
+- **Agent sandboxing** — the agent's environment is scrubbed of Claudable's secrets and
+  guarded from escaping its own project.
+- **Quality-of-life** — a large **design-style catalog** (skills), chunked large-file
+  uploads with progress, and a project dashboard.
+
+Deployment specifics live in `.env.example` and `docker-compose.yml`; no infrastructure
+values or secrets are committed. It tracks upstream and is not intended for merge back.
+
+---
+
 ## What is Claudable?
 
 Claudable is a powerful Next.js-based web app builder that combines **C**laude Code's (Cursor CLI also supported!) advanced AI agent capabilities with **Lovable**'s simple and intuitive app building experience. Just describe your app idea - "I want a task management app with dark mode" - and watch as Claudable instantly generates the code and shows you a live preview of your working app. You can deploy your app to Vercel and integrate database with Supabase for free.
@@ -35,8 +69,6 @@ How to start? Simply login to Claude Code (or Cursor CLI), start Claudable, and
 
 ## Features
 
-![Claudable Demo](assets/gif/Claudable_v2_cc_4_1080p.gif)
-
 - **Powerful Agent Performance**: Leverage the full power of Claude Code and Cursor CLI Agent capabilities
 - **Natural Language to Code**: Simply describe what you want to build, and Claudable generates production-ready Next.js code
 - **Instant Preview**: See your changes immediately with hot-reload as AI builds your app
@@ -47,16 +79,6 @@ How to start? Simply login to Claude Code (or Cursor CLI), start Claudable, and
 - **Supabase Database**: Connect production PostgreSQL with authentication ready to use
 - **Desktop App**: Available as Electron desktop application for Mac, Windows, and Linux
 
-## Demo Examples
-
-### Codex CLI Example
-
-![Codex CLI Demo](assets/gif/Claudable_v2_codex_1_1080p.gif)
-
-### Qwen Code Example
-
-![Qwen Code Demo](assets/gif/Claudable_v2_qwen_1_1080p.gif)
-
 ## Supported AI Coding Agents
 
 Claudable supports multiple AI coding agents, giving you the flexibility to choose the best tool for your needs: