edrisranjbar

Edi Life OS v1.2: accounts, a one-command Docker install, and my first outside contributors --- title: "Edi Life OS v1.2: accounts, a one-command Docker install, and my first outside contributors" published: true description: "Multiple accounts with private workspaces, a prebuilt multi-arch Docker image, 18 new currencies, and the tag bug I caught after publishing." tags: opensource, selfhosted, docker, php cover_image: edrisranjbar.github.io --- !Edi Life OS: tick a habit, ask Claude to log an expense, see it in Finance Less than two weeks after launching Edi Life OS, my self-hosted life dashboard (habits, goals, focus timer, Kanban, finances, plus an MCP server for AI assistants), here is v1.2. More than twenty pull requests have landed since the last release, and most of them came from people I had never met. What's new Multiple accounts with private workspaces Each account signs in on its own and has its own Finance, Focus, Goals, Growth, Kanban, habits, notes, attachments, theme and currency. Everything in the app and the API is filtered to the signed-in account, so one account cannot read another's data by guessing an ID. Two things to know before you use it: - Every account is an administrator. Administrators can reset each other's passwords, which means they can sign in as that person. There is no public sign-up; only add people you trust. - Back up your database before upgrading. Version 1.2 migrates the schema (version 3), and older versions of the app must not run against it, because their queries would show every account's rows. The details are in docs/accounts.md. A prebuilt Docker image No clone, no build. The image is published for amd64 and arm64, so it also runs on a Raspberry Pi: curl -fsSLO https://raw.githubusercontent.com/edrisranjbar/lifeos/main/docker-compose.image.yml curl -fsSL https://raw.githubusercontent.com/edrisranjbar/lifeos/main/.env.example -o .env # then set your sign-in and passwords docker compose -f docker-compose.image.yml up -d Open http://localhost:8080. Upgrade later with docker compose -f docker-compose.image.yml pull && docker compose -f docker-compose.image.yml up -d; your data lives in named volumes. Pin a version with LIFEOS_VERSION=1.2.0 in .env. And more - 18 more display currencies (SEK, NOK, DKK, PLN, CZK, BRL, MXN, ARS, CLP, COP, SAR, QAR, KWD, EGP, ZAR, NGN, PKR, BDT). They only change the label; nothing is converted. - Inline editing of goal checklist tasks, and redesigned Notes, Notepad and Personal Growth views. - Hardening: logout is a POST with a CSRF check, schema changes run once per version under a lock, and static assets are cached with versioned URLs. The community part This is the part I did not expect. A set of small, well-explained issues (an accessibility fix, a few currencies, backup commands, reverse-proxy examples, a troubleshooting guide, a Spanish README) turned into pull requests from three people who had never contributed here before. Their work is in the release notes with their handles. If you want a first open-source contribution, the good first issues are real and there are more. A bug I caught after publishing Right after I published the image I looked at the registry's tag list instead of assuming it was fine. The compose file asked for the latest tag, and latest did not exist yet, because that tag is only created when you push a release. The one-line install would have failed for the first person who tried it. I fixed the default, tagged the release, and then added a CI job that runs the README's exact steps on a clean machine (download the compose file, set a password, start the published image, sign in) on every change. If you publish an artifact, test the artifact, not just the code that builds it. Links - Release notes and download: github.com/edrisranjbar/lifeos/releases/tag/v1.2.0 - Repo: edrisranjbar/lifeos - Landing page: edrisranjbar.github.io - Docker image: ghcr.io/edrisranjbar/lifeos What do you check before trusting a self-hosted project with your data? I'd like to hear it in the comments.

Edi Life OS v1.2 is out 🚀 • Multiple accounts, each with a private workspace • Prebuilt Docker image (amd64 + arm64): no clone, no build • 18 new currencies • Docs, tests and fixes from 3 first-time contributors 💚 Free, open source, self-hosted. github.com/edrisranjbar/lifeos/releases/tag/v1.2.0 t.co

Your habits, goals, money and projects shouldn’t live in 5 different apps. 👇 I built Edi Life OS: one dashboard for habits, goals, focus timer, finances and projects. ✅ MCP (Talk to it through AI agents) ✅ Free & Open source edrisranjbar/lifeos t.co

自托管的生活看板 Life OS 把习惯、目标、看板、记账和番茄钟收进一个 PHP 面板，各工作区共用一个登录和数据库，自带的 MCP 服务器有 15 个工具。 edrisranjbar/lifeos t.co

Edi Life OS v1.1: what a public security pass changed after launching on Hacker News --- title: "Edi Life OS v1.1: what a public security pass changed after launching on Hacker News" published: true description: "XSS and open redirect fixes, CSRF everywhere, sign-in rate limiting, CSP, and a leaner MCP server for my self-hosted life dashboard." tags: opensource, php, security, mcp cover_image: edrisranjbar.github.io --- !Edi Life OS demo: tick a habit, ask Claude to log an expense, see it in Finance A little while ago I posted Edi Life OS on Hacker News. It's a self-hosted dashboard for habits, goals, focus, money and projects, written in plain PHP, MySQL and vanilla JavaScript, with an MCP server so Claude and other assistants can work with your real data. The launch brought a lot more eyes than I expected. More people looking at the code meant more people who would actually install it on their own servers, so the first release after launch had one theme: trust. Here's what changed in v1.1, and what I learned doing it. A security pass, written down in public I went through the PHP backend and the frontend JavaScript and wrote every finding into one public issue, ordered by priority. Then I fixed them from the top. High - Stored XSS on the dashboard. Goal titles, categories, metrics and finance category names were rendered with innerHTML without escaping. Those values can also be written through the bearer-token API, so API data could run script in the signed-in session. They're now escaped. - Open redirect after sign-in. The redirect parameter only had to start with / and not //, which browsers can be tricked around. It now has to be a real same-origin path. Medium - CSRF on Habittify. Every write endpoint checked a CSRF token except the habit tracker's API. Now it does too, through one shared life_os_require_csrf() helper. - Sign-in rate limiting. After 5 failed attempts from one client in 15 minutes you get 429 with Retry-After, and the password isn't even checked. The limit is per IP (stored as a SHA-256 hash), not per username, so an attacker can't lock the owner out from everywhere. - Security headers. Content-Security-Policy, X-Frame-Options: SAMEORIGIN, Referrer-Policy and X-Content-Type-Options on every response. The CSP still allows inline scripts for now, because the app has inline handlers; moving them out is next. - HTTPS behind a reverse proxy. A new LIFEOS_TRUST_PROXY setting makes the session cookie Secure based on X-Forwarded-Proto and rate-limits by the real client IP. It's off by default, because trusting those headers on a directly exposed app would let anyone spoof them. The lesson: with no framework, every protection a framework gives you for free (escaping, CSRF, headers) has to be built on purpose and applied everywhere. One endpoint that was written a little earlier than the others is enough to leave a gap. A leaner MCP server The MCP server never touches the database. Every tool goes through the same token-protected HTTP API the app uses, delete tools are marked destructive so the client asks first, and secret notes stay hidden unless the server explicitly allows them. In v1.1, the 12 read-only tools became one lifeos_query tool with a type parameter (dashboard, goals, tasks, habits, finance_summary, notes and so on). Fewer tools means less of every conversation spent on tool descriptions, and an easier choice for the model. Also new - Display currency. Finance started out Toman-only. You can now pick USD, EUR, GBP, AED and others in Settings. Amounts are labels and are never converted. - A landing page: edrisranjbar.github.io - First outside contributions: CI that runs the PHP and Node tests on every PR, a Docker health check, and light-theme screenshots. Try it git clone https://github.com/edrisranjbar/lifeos.git && cd lifeos cp .env.example .env # change the username and passwords docker compose up -d # then open http://localhost:8080 There's also a release zip for shared hosting: extract it, add your MySQL details, done. - Repo: edrisranjbar/lifeos - Release notes: github.com/edrisranjbar/lifeos/releases/tag/v1.1.0 If you self-host things: what's the first thing you check before you install an open-source app on your server? I'd love to hear it in the comments.

Show HN: Edi Life OS – саморазмещаемая панель управления жизнью с сервером MCP для ИИ Telegram ИИ Дайджест #ai #news

Show HN: Edi Life OS – self-hosted life dashboard with an MCP server for AI Telegram AI Digest #ai #news

Look again. github.com/edrisranjbar/lifeos/blob/c45f326716c5d… The attachment system runs a `CREATE TABLE` call every time it's included, as a simple example of why this is a big mess. I have zero objection to a plain, no-JS LAMP PHP site. But that can be done cleanly.

Show HN: Edi Life OS – self-hosted life dashboard with an MCP server for AI edrisranjbar/lifeos (news.ycombinator.com)

Show HN: Edi Life OS – self-hosted life dashboard with an MCP server for AI