Donetick on Ubuntu 24.04 on Azure User Guide

Overview

Donetick is the popular open source, self-hosted task and chore manager for individuals and groups — recurring tasks, assignments and rotation between members, optional points to gamify who does what, circles (groups) that share task lists, and clear views of what is due — a privacy-respecting alternative to hosted chore and to do apps, deployable in your own virtual network. The cloudimg image runs the Donetick server (a single Go binary that serves both the REST API and the bundled web app) behind nginx as a reverse proxy, with an embedded SQLite database, so the whole appliance runs on one disk with nothing else to deploy. The server listens on port 2021 and is reached through nginx on port 80; a host firewall rule drops any traffic to 2021 that does not arrive on the loopback interface, so nginx on :80 is the only network-facing entry point.

On the first boot of every deployed VM, a one-shot service generates a fresh session-signing secret unique to that VM (nothing is baked into the image), seeds a single administrator account with a per-VM password via Donetick's own signup API, then disables open self-registration. The login is written to /root/donetick-credentials.txt with mode 0600. Backed by 24/7 cloudimg support.

What is included:

• Donetick 0.1.75 server binary at /opt/donetick/donetick (REST API + web app in one, embedded web UI)
• nginx reverse proxy on :80 in front of the Donetick server (port 2021, restricted to loopback by a host firewall rule)
• Embedded SQLite datastore at /var/lib/donetick/donetick.db — no external database to run
• Per-VM administrator login generated at first boot, in a root-only file; per-VM session-signing secret; open self-registration disabled by default
• donetick.service, nginx.service and a donetick-firewall.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point; Donetick is lightweight and comfortably fits it. NSG inbound: allow 22/tcp from your management network and 80/tcp (plus 443/tcp once you enable HTTPS) from the networks your users will reach Donetick on.

Step 1 — Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Donetick by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create → Create.

Step 2 — Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name donetick \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name donetick --port 80 --priority 1010

Step 3 — Connect to your VM

ssh azureuser@<vm-public-ip>

First-boot initialisation completes in under a minute; the credentials file is in place by the time SSH is ready.

Step 4 — Confirm the service is running

systemctl is-active donetick.service nginx.service
curl -fsS -o /dev/null -w 'health endpoint -> HTTP %{http_code}\n' http://127.0.0.1/api/v1/health

Both services report active and the open health endpoint returns HTTP 200 — proof the stack (nginx and the Donetick server) is serving. The whole appliance, including its SQLite database, lives on the single OS disk:

df -h / | tail -1
ls -l /var/lib/donetick/

Service status, the open /api/v1/health endpoint returning HTTP 200, and the SQLite database directory on the OS disk.

Step 5 — Retrieve your administrator login

The administrator password is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/donetick-credentials.txt

The file contains the Donetick URL, the administrator username (admin) and the password. You can confirm the API authenticates end to end from the same session:

PASS=$(sudo grep '^donetick.admin.pass=' /root/donetick-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'no token  -> HTTP %{http_code}\n' http://127.0.0.1/api/v1/users/profile
curl -s -H 'Content-Type: application/json' \
  -d "{\"username\":\"admin\",\"password\":\"$PASS\"}" \
  http://127.0.0.1/api/v1/auth/login | head -c 60; echo

The unauthenticated request returns HTTP 401 and the login call returns a JSON Web Token (access_token).

The root-only credentials file and an API authentication round-trip — 401 without a token, a JWT with the per-VM password.

Step 6 — First sign-in

Open a web browser and navigate to http://<vm-public-ip>/. Donetick presents its sign-in page. Enter the username admin and the password from /root/donetick-credentials.txt, then select Login.

The Donetick sign-in, served on first boot with a per-VM administrator login.

Step 7 — Create tasks and chores

After signing in you land on the tasks overview. Select Create Task (or the + button), give the task a name, choose how often it repeats — Once, Daily, Weekly, Monthly, or a custom interval — optionally set who it is assigned to and how many points completing it is worth, then save. Recurring chores automatically roll forward to their next due date when marked done.

The Donetick tasks overview — recurring household chores with due dates and points.

Step 8 — Assignments, points and completing a task

Open a task to see its details: its schedule, assignee, points and history. Mark a chore done from the overview or the detail view and Donetick records who completed it and when, awards the points, and (for a recurring chore) schedules the next occurrence. Points accumulate per member so a household or team can see who is pulling their weight.

A task detail view — schedule, assignment, points and completion history.

Step 9 — Invite members and use the API

Donetick organises people into circles (groups) that share tasks. From Settings you can view your circle and share its invite code so family or team members can join, or create sub-accounts. Open self-registration is disabled by default on this appliance, so only the administrator account exists until you invite members. To re-enable open self-registration, set DT_IS_USER_CREATION_DISABLED=false in /etc/donetick/donetick.env and restart:

sudo systemctl restart donetick

Every action in the web app is also available through the REST API at http://<vm-public-ip>/api/v1/ — authenticate with POST /api/v1/auth/login to obtain a token, then call the API with an Authorization: Bearer <token> header. For example, to create a task and mark it done:

PASS=$(sudo grep '^donetick.admin.pass=' /root/donetick-credentials.txt | cut -d= -f2-)
TOKEN=$(curl -s -H 'Content-Type: application/json' \
  -d "{\"username\":\"admin\",\"password\":\"$PASS\"}" \
  http://127.0.0.1/api/v1/auth/login | grep -oE '"token":"[^"]+"' | head -1 | sed 's/.*:"//;s/"//')
ID=$(curl -s -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"name":"Sort the recycling","frequencyType":"weekly","frequency":1,"assignStrategy":"no_assignee","points":5}' \
  http://127.0.0.1/api/v1/chores/ | grep -oE '"res":[0-9]+' | grep -oE '[0-9]+')
echo "created task id: $ID"
curl -s -o /dev/null -w 'mark done -> HTTP %{http_code}\n' \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' -d '{}' \
  http://127.0.0.1/api/v1/chores/$ID/do

Security baseline

The image ships fully patched at capture time and keeps patching itself: Ubuntu's unattended-upgrades service is enabled, so security updates are installed automatically on your running VM. The Donetick server is bound behind a host firewall rule and open self-registration is disabled. Verify the state at any time:

systemctl is-enabled unattended-upgrades
grep -h . /etc/apt/apt.conf.d/20auto-upgrades
sudo iptables -C INPUT -p tcp --dport 2021 ! -i lo -j DROP && echo 'app port 2021: loopback-only (DROP rule active)'
sudo ss -tlnp | grep -E ':2021 '

The Donetick server listens on port 2021, but the host firewall drops any traffic to it that does not arrive on the loopback interface — nginx on :80 is the single network-facing entry point.

Automatic security updates enabled, and the Donetick app port restricted to loopback by a host firewall rule.

Enabling HTTPS

For any production deployment serve Donetick over HTTPS so logins cannot be intercepted. The image ships with nginx, which certbot can configure automatically. The following assumes a DNS record pointing your fully qualified domain name at the VM's public IP address (and 443/tcp open in the NSG):

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d tasks.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

After certbot finishes, set the public URL so generated links are correct, then restart Donetick:

sudo sed -i 's|^DT_SERVER_PUBLIC_HOST=.*|DT_SERVER_PUBLIC_HOST=https://tasks.your-domain.example|' /etc/donetick/donetick.env
sudo systemctl restart donetick

Backup and maintenance

Donetick keeps all of its state — tasks, circles, users, points and history — in a single SQLite database at /var/lib/donetick/donetick.db. Back it up with a consistent online copy:

sudo systemctl stop donetick
sudo cp /var/lib/donetick/donetick.db <backup-dir>/donetick-$(date +%F).db
sudo systemctl start donetick

Keep the OS patched with sudo apt update && sudo apt upgrade. To upgrade Donetick, replace /opt/donetick/donetick with a newer release binary and restart — database migrations run automatically on start. See https://docs.donetick.com/.

Support

This image is backed by 24/7 cloudimg support. Guaranteed response within 24 hours, one hour average for critical issues. Contact support@cloudimg.co.uk for help with deployment, upgrades, integrations, TLS termination and backups.

For general Donetick questions consult the documentation at https://docs.donetick.com/. Donetick is a trademark of its respective owner; use here is nominative and does not imply affiliation or endorsement. All product and company names are trademarks or registered trademarks of their respective holders.