autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/bulk-account-registration/references/lobehub-selfhosted-autoreg.md

@@ -0,0 +1,75 @@
+# LobeHub Self-Hosted Auto-Registration Path (2026-07-01)
+
+## Why Self-Hosted
+
+LobeHub Cloud (app.lobehub.com) uses Clerk for auth — OAuth (Google, GitHub, Apple) only, no direct email/password. This makes bulk registration impossible without real social accounts.
+
+**The bypass:** Self-host LobeHub via Docker Compose. It uses Better Auth, which supports standard email/password registration. This is automatable.
+
+## Deployment
+
+```bash
+git clone https://github.com/lobehub/lobehub
+cd lobehub
+cp .env.example .env
+# Edit .env: DATABASE_URL, AUTH_SECRET, S3 credentials
+docker compose up -d
+```
+
+## Better Auth Registration
+
+Self-hosted LobeHub exposes Better Auth endpoints:
+
+```
+POST /api/auth/sign-up/email
+Body: {"email": "user@domain.com", "password": "Pass123!", "name": "User"}
+Response: 200 + session cookie
+```
+
+**No CAPTCHA, no rate limit by default** — configurable via Better Auth settings.
+
+## Email Strategy
+
+- **Catch-all domain**: `user+<random>@reforrm.me` → all route to one inbox
+- **No email verification required** by default (configurable)
+- **IMAP verification**: If verification enabled, use Gmail IMAP pattern from `bulk-account-registration`
+
+## Automation Script
+
+```python
+import requests
+
+BASE = "https://your-lobehub-instance.com"
+
+for i in range(10):
+    email = f"user+lb{i}@reforrm.me"
+    resp = requests.post(f"{BASE}/api/auth/sign-up/email", json={
+        "email": email,
+        "password": "Str0ng!Pass123",
+        "name": f"User{i}"
+    })
+    if resp.status_code == 200:
+        print(f"Created: {email}")
+        # Extract session cookie for API access
+        cookie = resp.cookies.get("auth_session")
+        # Use cookie for /api/auth/session → get user ID + token
+```
+
+## Provider Access
+
+After registration, users get access to 70+ AI providers through the LobeHub UI. API keys for individual providers (OpenAI, Anthropic, etc.) are configured in the server's `.env` — not per-user. All users share the same provider keys.
+
+## VPS Requirement
+
+- 2GB RAM minimum (Next.js + PostgreSQL + Redis)
+- 20GB disk
+- Docker + Docker Compose
+- Available: 3 DigitalOcean droplets (gothbreach-abuse-1, eni-sgp1, eni-nyc1)
+
+## Pitfalls
+
+- Cloud version uses Clerk — can't automate registration there
+- Self-hosted needs PostgreSQL (not SQLite) — adds complexity
+- Provider API keys are shared across all users — one user's abuse affects everyone
+- Docker Compose includes Searxng (privacy search) — optional but recommended
+- Referral codes likely don't apply to self-hosted instances