Self-Hosted Task Board

Productivity

A self-hosted task board: one board per project, task cards you drag between columns, subtasks, due dates, filtering and search, and multi-user permissions. You bring it up on your own machine with Docker Compose, the admin password is generated at random by a script, and the upstream factory password is replaced at start-up. Derived from a frozen snapshot of open-source kanban software under the MIT licence; the delivery adds an orchestration file that builds the image from source, a start-up script that replaces the password, a script that generates the password, and a quick-start guide in Traditional Chinese.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness4 / 5

What you need

Few changes needed4 / 5

Who it is for

Individuals and small teams who want to manage work on a kanban board and keep the project data on their own machine.

How to start

$ sh scripts/quickstart/init-env.sh
$ docker compose up -d --build

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview2,000+ paths

▸app1028

.htaccess
Action/
Analytic/
Api/
Auth/
Console/
Controller/
Core/
Decorator/
Event/
…

▸assets266

css/
fonts/
img/
js/
vendor/

▸custom-hooks3

README.md
install-custom-hooks.sh
post-checkout

▸data2

.htaccess
web.config

▸docker11

etc/
usr/
var/

▸libs257

Captcha/
SimpleQueue/
SimpleValidator/
erusev/
event-dispatcher/
ical/
jsonrpc/
minify/
path-converter/
phpqrcode/
…

▸plugins1

.gitignore

▸scripts3

quickstart/

▸tests262

.htaccess
configs/
configtest/
integration.mysql.xml
integration.postgres.xml
integration.sqlite.xml
integration/
units.mssql.xml
units.mysql.xml
units.postgres.xml
…

▸vendor123

autoload.php
christian-riesen/
composer/
pimple/
psr/
symfony/

▫ATTRIBUTION.md

▫CONTRIBUTING.md

▫ChangeLog

▫Dockerfile

▫LICENSE

▫LICENSE-99LL.md

▫Makefile

▫PRODUCT.md

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫SECURITY.upstream.md

▫cli

▫composer.json

▫composer.lock

▫config.default.php

▫delivery-manifest.txt

▫docker-compose.yml

▫favicon.ico

▫healthcheck.php

▫index.php

▫jsonrpc.php

▫robots.txt

▫web.config

▫Config and hidden files 20

Latest passing run

Clone → Checkout → Toolchain → Build images → Board ready and admin login

Pre-purchase Disclosure

What you are buying

A self-hosted task board system: one board per project, task cards you drag between columns, subtasks, due dates, filtering and search, and multi-user permissions. After running the password generation script you bring it up with Docker Compose.

Derived from open-source kanban software under the MIT licence, and not the original project itself. Our work: an orchestration file that builds the image from source, a start-up script that replaces the upstream factory password, a script that generates the admin password, and a quick-start guide in Traditional Chinese.

Delivery is a frozen snapshot: one zip, taken from the product repository at revision df926ab.

Known limitations

The service serves plain HTTP on port 8080 of the local machine; TLS and a reverse proxy are yours to bring
The interface is in English by default, and upstream ships a Traditional Chinese language set that you switch on in the settings yourself
No mail service is set up by default, so the board sends no notification mail; to send mail you bring your own SMTP
The admin password is applied only at the first start, and afterwards the password changed in the interface is the one that counts
Online plugin installation stays off
The data lives in Docker named volumes, and docker compose down -v deletes all projects, cards and accounts
The first start builds the image from source, fetching from the registry and apk during that time
Upstream is in maintenance mode and fixes only small problems
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit c50f1c6. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

5 PASS0 WARN0 FAIL

Source ReviewPASS

Execution surface of the delivery reviewed item by item. Our own additions were read line by line: docker-compose.yml (the published port is bound to 127.0.0.1 only; it refuses to start when the admin password is missing; online plugin installation stays off; data, plugins and certificates use named volumes), scripts/quickstart/app-entrypoint.sh and set-admin-password.php (they replace the password only while it is still upstream’s factory value, and check before finishing that the factory value can no longer sign in, otherwise the container does not start), and scripts/quickstart/init-env.sh (openssl generates random values, .env is mode 600, existing values are not overwritten). The upstream PHP and front-end sources were not read file by file; the basis is the MIT licence and container isolation.

Script SafetyPASS

The scripts on the buyer’s delivery path were each inspected: init-env.sh, app-entrypoint.sh and set-admin-password.php are ours (read line by line); the build goes through the Dockerfile (read line by line: system packages from apk, the source added from this folder, with no download piped straight into a shell). Upstream’s start-up script was read too: it creates a self-signed certificate when none is present, fixes folder ownership and starts the services under s6.

RecencyPASS

This product is a frozen snapshot and does not follow upstream: the upstream source is pinned to the main-line revision taken on the day the product repository was created (see the evidence link), and the product repository is that snapshot plus our own commits.

LicensePASS

SPDX:LicenseRef-99LL-Product

Upstream LICENSE was checked word for word (the evidence link points at the file itself at the pinned version and matches the copy inside the product repository): the standard MIT text, copyright holder Frédéric Guillot. It allows commercial use, modification, derivative works, redistribution and sale; the duty is to keep the copyright notice and licence text (LICENSE and ATTRIBUTION.md ship in the zip); upstream has no NOTICE file. The decision does not rest on GitHub’s licence field. For the product as a whole the 99LL product licence template is attached: upstream’s LICENSE is kept as it is and LICENSE-99LL.md is added as the sale and liability terms for the part we built, with spdx recorded as LicenseRef-99LL-Product.

Dependency LicensesPASS

This records the declared side, not a scan result: the PHP dependencies are declared in composer.json, locked by composer.lock and kept in the vendor folder, the front-end libraries sit in the assets folder, and the base image and system packages come from a registry and apk. These dependency trees were not scanned package by package for licences. Upstream has no submodule and no third-party dataset was copied in (see ATTRIBUTION.md).