Coding Time Tracker

Engineering & Development

A self-hosted coding time tracking service: the WakaTime plugin in your editor sends in your coding records, and the service turns them into daily and weekly statistics by project, language and editor. You bring it up on your own machine with Docker Compose, the data lives in SQLite, the password salt is generated at random by a script, and the public leaderboard, mail sending and error reporting are off by default. Derived from a frozen snapshot of open-source statistics software under the MIT licence; the delivery adds an orchestration file that builds the image from source, a script that generates the password salt, and a quick-start guide in Traditional Chinese.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness4 / 5

What you need

Few changes needed4 / 5

Who it is for

Individual developers and small teams who want to hold their own coding time statistics and not hand the records to a third-party service.

How to start

$ sh scripts/quickstart/init-env.sh
$ docker compose up -d --build

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview562 paths

▸bruno20

Heartbeats/
Misc/
Shields/
Summary/
WakaTime/
bruno.json
collection.bru
environments/

▸config15

config.go
config_test.go
cookie.go
db.go
db_opts.go
eventbus.go
fs.go
jobqueue.go
logging.go
oidc.go
…

▸coverage1

coverage.out

▸data2

colors.json
data.go

▸etc2

Caddyfile
wakapi.service

▸helpers6

date.go
helpers.go
http.go
interval.go
interval_test.go
summary.go

▸lib1

concurrent_map.go

▸middlewares10

authenticate.go
authenticate_test.go
custom/
filetype.go
logging.go
principal.go
security.go
sentry.go
shared_data.go

▸migrations44

20201103_rename_language_mappings_table.go
20201106_migration_cascade_constraints.go
20210202_fix_cascade_for_alias_user_constraint.go
20210206_drop_badges_column_add_sharing_flags.go
20210213_add_has_data_field.go
20210221_add_created_date_column.go
20210411_add_imprint_content.go
20210411_drop_migrations_table.go
20210806_remove_persisted_project_labels.go
20211215_migrate_id_to_bigint.go
…

▸mocks19

aggregation_service.go
alias_repository.go
alias_service.go
api_key_service.go
base_repository.go
duration_repository.go
duration_service.go
heartbeat_repository.go
heartbeat_service.go
key_value_service.go
…

▸models58

alias.go
api_key.go
canonical_names.go
compat/
diagnostics.go
duration.go
durations.go
filters.go
filters_test.go
heartbeat.go
…

▸repositories17

alias.go
api_key.go
base.go
diagnostics.go
duration.go
duration_test.go
heartbeat.go
heartbeat_test.go
key_value.go
language_mapping.go
…

▸routes59

api/
compat/
handler.go
home.go
home_test.go
imprint.go
leaderboard.go
login.go
login_test.go
misc.go
…

▸scripts27

aggregate_durations_mysql.sql
aggregate_durations_postgres.sql
build.sh
bundle_icons.js
clean_duplicates.sql
convert_colors.py
count_duplicates_by_user.sql
create_user.sh
database_size_mysql.sql
dbmigrate.go
…

▸services39

activity.go
aggregation.go
aggregation_test.go
alias.go
alias_test.go
api_key.go
diagnostics.go
duration.go
duration_test.go
heartbeat.go
…

▸static52

assets/
contribute.json
docs/

▸testing98

compose.yml
config.mysql.yml
config.postgres.yml
config.sqlite.yml
data.sql
run_api_tests.sh
run_mail_tests.sh
schema.sql
wakapi_api_tests/

▸utils21

auth.go
collection.go
color.go
cron.go
date.go
date_test.go
db.go
dns.go
fs/
func.go
…

▸views31

alerts.tpl.html
entity-filter.tpl.html
foot.tpl.html
footer.tpl.html
head.tpl.html
header.tpl.html
imprint.tpl.html
index.tpl.html
leaderboard.tpl.html
login-btn.tpl.html
…

▫ATTRIBUTION.md

▫CONTRIBUTING.md

▫Dockerfile

▫LICENSE

▫LICENSE-99LL.md

▫PRODUCT.md

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫SECURITY.upstream.md

▫compose.yml

▫config.default.yml

▫delivery-manifest.txt

▫doap.rdf

▫entrypoint.sh

▫funding.json

▫go.mod

▫go.sum

▫main.go

▫package.json

▫sonar-project.properties

▫tailwind.config.js

▫version.txt

▫yarn.lock

▫Config and hidden files 16

Latest passing run

Clone → Checkout → Toolchain → Build images → Signup login and heartbeat

Pre-purchase Disclosure

What you are buying

A self-hosted coding time tracking service: the WakaTime plugin in your editor sends in your coding records, and the service turns them into statistics by project, language and editor. After running the password salt generation script you bring it up with Docker Compose, and the data lives in SQLite.

Derived from open-source statistics software under the MIT licence, and not the original project itself. Our work: an orchestration file that builds the image from source, a script that generates the password salt, and a quick-start guide in Traditional Chinese.

Delivery is a frozen snapshot: one zip, taken from the product repository at revision 8a0bfab.

Known limitations

The service serves plain HTTP on port 3000 of the local machine; TLS and a reverse proxy are yours to bring
The interface is in English
The WakaTime plugin for the editor is not part of the delivery, and you install it yourself
No record was sent from a real editor plugin before delivery
Registration is open by default, and after creating your account you close it yourself in the settings
The public leaderboard, mail sending, error reporting and subscription features are all off by default
The password salt cannot be changed after accounts exist, and changing it makes every password stop verifying
docker compose down -v deletes all accounts and statistics
The first start builds the image from source, fetching from the registry and the Go module repository during that time
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit 67ca60b. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

5 PASS0 WARN0 FAIL

Source ReviewPASS

Execution surface of the delivery reviewed item by item. Our own additions were read line by line: compose.yml (the published port is bound to 127.0.0.1 only; it refuses to start when the password salt is missing; SQLite lives in a named volume; the public leaderboard, mail, error reporting and subscriptions are off), scripts/quickstart/init-env.sh (openssl generates the random salt, .env is mode 600, an existing .env is left alone) and the Dockerfile changes (base images pinned by digest). The upstream Go sources were not read file by file; the basis is the MIT licence and container isolation.

Script SafetyPASS

The scripts on the buyer’s delivery path were each inspected: init-env.sh is ours (read line by line); the build goes through the Dockerfile (read line by line: a Go build in a pinned image and a static health check program, copied into a distroless runtime image that runs as a non-root user, with no download piped straight into a shell).

RecencyPASS

This product is a frozen snapshot and does not follow upstream: the upstream source is pinned to the main-line revision taken on the day the product repository was created (see the evidence link), and the product repository is that snapshot plus our own commits.

LicensePASS

SPDX:LicenseRef-99LL-Product

Upstream LICENSE was checked word for word (the evidence link points at the file itself at the pinned version and matches the copy inside the product repository): the standard MIT text, whose copyright line carries only a year and names no copyright holder. It allows commercial use, modification, derivative works, redistribution and sale; the duty is to keep the copyright notice and licence text (LICENSE and ATTRIBUTION.md ship in the zip); upstream has no NOTICE file. The decision does not rest on GitHub’s licence field. For the product as a whole the 99LL product licence template is attached: upstream’s LICENSE is kept as it is and LICENSE-99LL.md is added as the sale and liability terms for the part we built, with spdx recorded as LicenseRef-99LL-Product.

Dependency LicensesPASS

This records the declared side, not a scan result: the Go dependencies are declared in go.mod and checked by go.sum, the packages themselves are fetched from the Go module repository when the buyer builds, and the base images come from a registry. These dependency trees were not scanned package by package for licences. Upstream has no submodule and no third-party dataset was copied in (see ATTRIBUTION.md).