MEGAINFRA-WEBAPP/docs/setup/email.md

Email from the dashboard

The dashboard sends two mails: a welcome invite when an admin adds a user or presses "Send welcome email", and a password reset when someone uses "Forgot password?" on the sign-in page.

Both go out through Resend — one HTTP POST to https://api.resend.com/emails, no SDK and no new dependency. The key stays on the server; the browser never sees it.

Environment variables

Set these in the Next.js server environment (Coolify env vars, .env.local, or whatever your host uses):

Variable	Required	What it does
RESEND_API_KEY	Yes	The Resend API key (re_…). Without it the mail feature is off and the admin button answers "Email is not set up yet".
EMAIL_FROM	No	The sender shown on the mail. Defaults to MEGA Dashboard <support@apphub.co.za>.
EMAIL_REPLY_TO	No	The address a reply goes to. Falls back to the sender.
APP_URL	No	The dashboard's public URL, used to build the link in the mail and to point the logo at your own server. Falls back to the request's own origin.

RESEND_API_KEY is the same key you already use as the PocketBase SMTP password. Resend's "API key" and its "SMTP password" are different strings — use the API key here (re_…), not the SMTP password.

RESEND_API_KEY=re_xxxxxxxxxxxxxxxxxxxx
EMAIL_FROM=MEGA Dashboard <support@apphub.co.za>
EMAIL_REPLY_TO=support@apphub.co.za
APP_URL=https://wfdash.mega.infra.apphub.co.za

APP_URL must be the address people actually open. If it is wrong, every "Choose your password" link points somewhere nobody can reach.

Run the migration

The links live in a PocketBase collection. Run this once against the environment you are deploying to:

PB_URL=https://pb.mega.infra.apphub.co.za \
PB_ADMIN_EMAIL=admin@mega.co.za \
PB_ADMIN_PASSWORD=... \
python3 scripts/migrations/2026-11-02-password-links.py

The script is idempotent — it creates password_links when it is missing and verifies it when it is there. Every API rule on the collection stays null, so only the server's admin client can read or write these rows.

The collection holds no passwords and no live links: only the SHA-256 hash of each token. A row lifted from the database cannot be turned back into a working link.

Moving to megainfra.co.za later

Until the domain is verified, mail from support@apphub.co.za may land in spam or be rejected. To send as your own domain:

1. Verify the domain in Resend. Resend → Domains → Add Domain. Use megainfra.co.za, or a sub-domain such as mail.megainfra.co.za if the root domain is used for something else.
2. Add the DNS records Resend shows you (SPF, DKIM, and a DMARC record if offered) to the DNS zone for the domain. Wait until Resend marks the domain as verified — usually minutes, sometimes longer if the zone is slow.
3. Change EMAIL_FROM to the verified sender, for example MEGA Dashboard <no-reply@megainfra.co.za>, and restart the app.

Keep EMAIL_FROM on a domain you have actually verified. Sending from an unverified domain is the usual reason mail disappears.

What the user sees

• Welcome — a greeting, what the dashboard (or the clock app, for a clock user) is for, a "Choose your password" button, three short getting-started steps, and the plain link for mail clients that will not show a button. The link is valid for 7 days.
• Reset — a "Reset password" button, valid for 1 hour, and a line telling them to ignore the mail if they did not ask for it.

Both pages also work by hand: /forgot-password asks for the email and /set-password?token=… sets the new password. The forgot-password route always answers the same way, so it never reveals whether an address has an account.