Donetick Self-Hosted Task and Chore Manager on AWS User Guide

Overview

Donetick is a free, open source, self-hosted task and chore manager for individuals, households and teams. It handles recurring schedules, assignments, points and shared circles or groups, giving you a private alternative to hosted chore and to-do apps that you run entirely in your own AWS account. This cloudimg image runs Donetick as a single self-contained Go binary that bundles the web application, with its data kept in an embedded SQLite database, so there is no external database to provision. The application sits behind an nginx reverse proxy on port 80; the application port is protected by a host firewall rule so only nginx is reachable from the network. A unique administrator password and a unique JWT session-signing secret are generated on the first boot of every instance, and open self-registration ships disabled, so no shared secret and no default account are ever baked into the image. Backed by 24/7 cloudimg support.

What is included:

• Donetick 0.1.75 (a single Go binary at /opt/donetick) managed by systemd, serving the API and the web app
• nginx on port 80 fronting the application, which listens on port 2021
• A host firewall rule that drops any external traffic to the application port, so only nginx port 80 is reachable
• An embedded SQLite datastore at /var/lib/donetick/donetick.db (no external database)
• A unique administrator password generated on first boot and recorded in a root-only file
• A unique JWT session-signing secret generated on first boot, never baked into the image
• Open self-registration disabled by default, so only the seeded administrator exists
• donetick.service and nginx.service as systemd units, enabled and active
• A /api/v1/health endpoint for load-balancer health checks
• 24/7 cloudimg support

Prerequisites

An AWS account, an EC2 key pair in the target region, and a VPC with a public subnet. m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type. Security group inbound: allow 22/tcp from your management network for SSH and 80/tcp for the web UI.

Step 1 - Launch the AMI

Subscribe to the listing in AWS Marketplace, choose Continue to Launch, and launch through the EC2 console or the AWS CLI. Select the m5.large instance type, your key pair, and a security group that opens ports 22 and 80.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <security-group-id> \
  --subnet-id <subnet-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=donetick}]'

Step 2 - Connect to your instance

Connect over SSH as the default login user for the OS variant you launched. This listing may ship more than one OS variant; use the matching login user below.

Step 3 - Confirm the services are running

Donetick runs behind nginx, with a one-shot first-boot service that generates the per-instance secret and admin password and seeds the administrator. Confirm the two long-running services are healthy:

systemctl is-active donetick.service nginx.service

Both report active:

active
active

Step 4 - Verify the stack and endpoints

Confirm that nginx is listening on port 80, that the health probe answers through the proxy, that the application port is protected by the host firewall rule, and that the web UI refuses anonymous API access:

ss -tln | grep ':80 '
curl -s -o /dev/null -w 'health: HTTP %{http_code}\n' http://127.0.0.1/api/v1/health
sudo iptables -C INPUT -p tcp --dport 2021 ! -i lo -j DROP && echo 'app port 2021: external DROP rule present'
curl -s -o /dev/null -w 'unauthenticated profile: HTTP %{http_code}\n' http://127.0.0.1/api/v1/users/profile

nginx is listening on port 80, /api/v1/health returns 200, the firewall DROP rule that keeps the application port off the network is present, and the unauthenticated profile endpoint returns 401 because authentication is enforced:

LISTEN 0      511          0.0.0.0:80        0.0.0.0:*
health: HTTP 200
app port 2021: external DROP rule present
unauthenticated profile: HTTP 401

Step 5 - Read your per-instance admin credential

The image ships no shared or default login. On first boot a unique administrator password is generated for this instance and written to a root-only file. Read it, confirming the file permissions and the resolved URL:

sudo stat -c '%a %U:%G' /root/donetick-credentials.txt
sudo grep -E '^donetick\.(admin\.user|url)=' /root/donetick-credentials.txt

The file is 600 root:root, donetick.admin.user is your admin username (admin), and donetick.url is the address to open in your browser:

600 root:root
donetick.url=http://<instance-public-ip>/
donetick.admin.user=admin

Run sudo cat /root/donetick-credentials.txt to also see the password.

Step 6 - Prove the login round-trip from the command line

Confirm the per-instance password authenticates against the API and returns a valid session token, exactly as your browser will:

PASS=$(sudo grep '^donetick.admin.pass=' /root/donetick-credentials.txt | cut -d= -f2-)
TOKEN=$(curl -s -H 'Content-Type: application/json' \
  -d "{\"username\":\"admin\",\"password\":\"$PASS\"}" \
  http://127.0.0.1/api/v1/auth/login | grep -oE '"token":"[^"]+"' | head -1 | sed 's/.*:"//;s/"//')
curl -s -o /dev/null -w 'authenticated profile: HTTP %{http_code}\n' \
  -H "Authorization: Bearer $TOKEN" http://127.0.0.1/api/v1/users/profile

The login returns a JWT and the authenticated profile request returns 200:

authenticated profile: HTTP 200

Step 7 - Sign in to the web UI

Open http://<instance-public-ip>/ in your browser and sign in with the admin username and the password from the credentials file.

Step 8 - Create tasks and recurring chores

After signing in you land on the tasks view. Use the + button to create a chore, give it a name, choose how often it recurs (once, daily, weekly, monthly or a custom interval), set a priority, and optionally assign it to a member. Recurring chores automatically reschedule to their next due date when marked done.

Open any task to see its assignment, schedule, completion statistics and full history, and to mark it done, skip it or start it:

Step 9 - Invite family or group members

Open self-registration is disabled by default on this appliance, so only the seeded administrator exists. To share tasks with others, sign in as the administrator and either open a circle and share its invite code, or create sub-accounts under Settings.

If you would rather allow open self-registration (so people can create their own accounts at your instance's URL), re-enable it by editing the per-instance environment file and restarting the service:

sudo sed -i 's/^DT_IS_USER_CREATION_DISABLED=true/DT_IS_USER_CREATION_DISABLED=false/' /etc/donetick/donetick.env
sudo systemctl restart donetick

Step 10 - Data, backups and TLS

Donetick keeps all of its data in the embedded SQLite database at /var/lib/donetick/donetick.db. Back it up with regular EBS snapshots or AWS Backup of the instance's volume. For HTTPS, terminate TLS at your own domain and certificate in front of the instance (for example an Application Load Balancer with an ACM certificate, or your own nginx or Caddy reverse proxy) and point it at port 80.

Security model

• The application binds to port 2021, but a host firewall rule drops any traffic to that port that does not arrive on the loopback interface, so only the nginx reverse proxy on port 80 is reachable from the network.
• A unique JWT session-signing secret is generated on each instance's first boot and is never baked into the image, so sessions minted on one deployment cannot be forged against another.
• A cryptographically random administrator password is generated on first boot and written only to the root-only file /root/donetick-credentials.txt.
• Open self-registration ships disabled; only the seeded administrator exists until you choose to enable it or invite members.
• The application runs as an unprivileged donetick system user under a hardened systemd unit with NoNewPrivileges, ProtectSystem and ProtectHome set.

Support

cloudimg provides 24/7 technical support for this product by email and live chat at support@cloudimg.co.uk. We can help with deployment, reverse-proxy termination with your own domain and TLS certificate, enabling registration and inviting members, and backup planning for your task data.