# MyDay > A self-hosted employee **time, absence & reporting** app by **Sechpoint**. > Delivered as a **PWA** for mobile and desktop. **Single-tenant** β€” one company per instance. **Status:** 🚧 **M0 + M0.1 implemented** β€” the auth & routing foundation and the web/PWA layer (the SPEC-002…009 slices) are built: routing Β· identity/sessions Β· the door Β· `/setup` Β· enroll/login (+ the passkey nudge) Β· roles/chain/recovery Β· the module registry Β· the web shell. Next milestone: **M1 β€” org structure**. The design of record is [`PROJECT_PLAN.md`](PROJECT_PLAN.md). --- ## What it will do | Area | | |---|---| | **Org structure** | users, the manager hierarchy, departments, positions | | **Time** | presence and timesheets (a per-user mode) | | **Absence** | leave requests, approvals, balances | | **Reporting** | rollups and aggregations | Built as **one Go binary**: a small core (`MyDay.auth` β€” identity, sessions, the door) plus drop-in **modules**. --- ## Running it ```bash # 1. configure cp config.example.yaml config.yaml # then edit; config.yaml is gitignored # 2. build go build -o myday ./cmd/myday # 3. run ./myday ``` --- ## ⚠️ First run β€” the setup code The **first user becomes the top admin** (the root of the chain). MyDay bootstraps through a **`/setup` wizard** that is **gated β€” never first-visitor-wins** (D-025/D-044). On first start it prints a **one-time 128-bit SETUP CODE** in its startup log: ``` ====================================================================== MyDay is NOT set up yet β€” no admin exists. ====================================================================== Open the setup wizard at: https://myday.sechpoint.app/setup SETUP CODE: 9f3a-1b2c-… ``` Open the domain (or `http://localhost:8080`) and enter that code at `/setup`. **Until then every page is a friendly first-run page β€” never a bare 404** β€” and every other route answers 404. Read the code again with: ```bash journalctl -u myday # inside the container pct exec 11020 -- journalctl -u myday # from the Proxmox host ``` > **Why a code, not a tunnel?** MyDay's reference deployment is an **LXC container behind > Proxmox + Zoraxy**. An SSH tunnel is impractical there: `pct enter`/SSH lands on the container > **gateway**, not loopback, so a tunnel to `127.0.0.1:8080` cannot be formed. The setup code > closes first-visitor-wins instead. A **direct SSH tunnel** to the app's loopback port still works > as a second gate and needs **no code** (D-025 gate a). > **Note:** the code is **single-use** and the entry form is **rate-limited**. Complete the wizard, > then **restart** so the app adopts the `config.yaml` the wizard wrote. > **Bonus:** to use the tunnel gate, reach the app over **`localhost` / `127.0.0.1`** β€” only a > loopback origin counts as a secure context for the browser's **WebAuthn** dialogs. Over plain http > the cookies are sent without `Secure` (required by the tunnel bootstrap); behind the proxy (https) > they are hardened β€” see *Deployment*. Only **after** the top admin exists should you put MyDay behind a reverse proxy and expose it. --- ## Deployment β€” behind Zoraxy (TLS at the proxy) > **Full walkthrough:** [`docs/deploy-zoraxy.md`](docs/deploy-zoraxy.md) β€” topology Β· config Β· > the Zoraxy ProxyHost Β· the firewall rule Β· the first-run setup code (no tunnel needed) Β· systemd > Β· the misconfig warnings. This section is the summary. The reference deployment terminates **TLS at [Zoraxy](https://github.com/tobychui/zoraxy)** at **`10.1.0.10`**; the app itself speaks **plain HTTP**. Config (`config.example.yaml` β†’ `config.yaml`, D-043): - **App** β€” `server.listen: "0.0.0.0:8080"`; the app binds any address (there is **no** setup-mode bind refusal, D-025 revised). - **Proxy** β€” Zoraxy terminates TLS and forwards to `http://:8080`, setting `X-Forwarded-For` and `X-Forwarded-Proto`. - **`trusted_proxies`** β€” `["10.1.0.10"]` (Zoraxy). The app **honours `X-Forwarded-Proto`** from a trusted proxy to decide a request is `https`, and then sets the session cookie **`Secure` + `__Host-`** and sends **HSTS**. Over plain http (the tunnel) it keeps the bare, non-`Secure` cookie so the bootstrap works. A **wrong value fails silently** β€” no `Secure` cookie, no HSTS. - **`base_url`** β€” `https://myday.sechpoint.app`: the public origin, used in invite/recovery links. - **Firewall** β€” **`:8080` MUST be reachable only from `10.1.0.10`.** Anything else that can reach the port bypasses the proxy **and its TLS**; the app would then serve plain HTTP to that client. ```bash # read the one-time setup code, then open the domain and enter it at /setup journalctl -u myday # inside the container pct exec 11020 -- journalctl -u myday # from the Proxmox host # (or, for the no-code tunnel gate: ssh -L 8080:127.0.0.1:8080 user@server) ``` --- ## What `/setup` writes β€” and the restart The wizard **persists `config.yaml`** (`setup: false`, the base URL, mail/locale, and the secrets) next to the loaded file β€” never over the committed `config.example.yaml`. If the file is not writable it **prints** the values for you to save by hand, and setup still completes. The **secrets are generated at startup** when a value is still `CHANGE_ME…`, so the wizard's ceremony is never signed with a known key. The persisted file then holds **those same values** β€” so **a restart adopts them** and the admin's TOTP secret (sealed with the generated key) keeps working. Boot a productive instance from the **written `config.yaml`**, not from the example: `config.example.yaml`'s placeholders fail closed in productive mode by design. --- ## Documentation | | | |---|---| | [`PROJECT_PLAN.md`](PROJECT_PLAN.md) | the plan & decision log of record | | [`AGENT.md`](AGENT.md) | instructions for AI agents working here | | [`docs/specs/`](docs/specs/) | implementation specs | | [`docs/deploy-zoraxy.md`](docs/deploy-zoraxy.md) | the Zoraxy deployment guide (D-043) | | [`config.example.yaml`](config.example.yaml) | configuration template | --- ## Security - Secrets live in **`config.yaml`** (gitignored) β€” **never commit them**. - Auth is **Passkey (primary) + TOTP (fallback)**. - See `PROJECT_PLAN.md` Β§10 for the deferred-security register and its **beta gate**. --- ## License TBD.