timeclock-server

Overview ¶

Command timeclock-server runs Timeclock on its own, with its own accounts.

timeclock-server                                    serve (the default)
timeclock-server workspace KEY [NAME] [--admin EMAIL]   make a workspace, and invite its first admin
timeclock-server invite KEY EMAIL [--admin]         invite someone to a workspace
timeclock-server openapi                            print the API's OpenAPI document

It is configured from the environment:

TIMECLOCK_DATABASE_URL    PostgreSQL URL (required)
TIMECLOCK_SCHEMA          schema to use (default "timeclock")
PORT                      port to listen on (default 8080)
TIMECLOCK_PUBLIC_URL      where people reach it, such as https://time.example.com
TIMECLOCK_SECRET_KEY      seals authenticator secrets and providers' client secrets in the
                          database; at least 32 characters, and required
TIMECLOCK_ADMIN_EMAILS    comma-separated emails of the people who run payroll; each is
                          invited to the default workspace when the server first starts
TIMECLOCK_AUDITOR_EMAILS  comma-separated emails of the people who read History, every change
                          to payroll data; being an admin doesn't make someone one
TIMECLOCK_SMTP_HOST, TIMECLOCK_SMTP_PORT (default 587), TIMECLOCK_SMTP_USERNAME,
TIMECLOCK_SMTP_PASSWORD, TIMECLOCK_SMTP_FROM
                          the mail server for invitations and password resets; without one
                          the links are written to the log
TIMECLOCK_SMTP_SECURITY   starttls (the default), tls, or none
TIMECLOCK_BREACH_CHECK    "off" stops refusing passwords known from breaches
TIMECLOCK_TRUST_PROXY     set when a reverse proxy in front sets X-Forwarded-For, so sign-in is
                          slowed per client and not for everyone behind the proxy
TIMECLOCK_OIDC_ISSUER     an OpenID Connect provider to sign in with besides a password,
                          such as https://accounts.google.com
TIMECLOCK_OIDC_CLIENT_ID, TIMECLOCK_OIDC_CLIENT_SECRET
TIMECLOCK_ALLOWED_DOMAIN  the only email domain the provider may sign in
TIMECLOCK_DEV_USER        an email every request is signed in as, with no sign-in (development only)
TIMECLOCK_VITE_URL        the Vite dev server, proxied while no web build is embedded