Skip to main content

Self-Hosted instances of CWClock

Kubernetes​

A helmchart is available on this repository (in the folder helm). You can also use the cwclock cli with cwclock bootstrap command.

Trying with docker​

On this repository, the whole stack (PostgreSQL, Flyway migrations, backend and the frontend served by nginx) can be started with a single command:

docker compose up --build --force-recreate

This will:

  1. Start a PostgreSQL database.
  2. Run the SQL migrations with Flyway.
  3. Build and start the Go backend, listening on http://localhost:8080.
  4. Build the React frontend and serve it through nginx on http://localhost:3000, calling the backend directly at the CWCLOCK_API_URL environment variable.

Once it's up, open http://localhost:3000 in your browser.

A public image is available here rg.fr-par.scw.cloud/cwclock-t8d7th/cwclock-api:latest.

Security​

You can change the default value of the following variables:

  • JWT_SECRET which is changeme by default
  • CWCLOCK_CONFIRMATION_EMAIL_EXPIRATION which is 24h by default (expiration of the confirmation's email link of reset password link)

Confirmation mode​

There's an environment variable CWCLOCK_ACTIVATION_MODE which is set to admin by default. It's requiring to activate the new registred account by an administrators withour sending confirmation's emails.

Otherwise you can set this variable to email and it will send confirmation emails through the CWCloud's email API.

OIDC configuration​

CWClock supports OIDC configuration for Google OIDC, Github and Keycloak.

You have to setup the following variables on the API:

CWCLOCK_UI_URL=https://{your frontend domain}
CWCLOCK_OIDC_GOOGLE_CLIENT_ID=
CWCLOCK_OIDC_GOOGLE_CLIENT_SECRET=
CWCLOCK_OIDC_GITHUB_CLIENT_ID=
CWCLOCK_OIDC_GITHUB_CLIENT_SECRET=
CWCLOCK_OIDC_KEYCLOAK_BASE_URL=
CWCLOCK_OIDC_KEYCLOAK_CLIENT_ID=
CWCLOCK_OIDC_KEYCLOAK_CLIENT_SECRET=
CWCLOCK_OIDC_KEYCLOAK_GROUPS=

Here's the redirect/callback URL for the frontend: https://{your api domain}/oidc/callback

And here`s the redirect/callback URL for each provider for API authentication:

  • Google OIDC: https://{your api domain}/v1/oidc/google/callback
  • Github: https://{your api domain}/v1/oidc/github/callback
  • Keycloak: https://{your api domain}/v1/oidc/keycloak/callback

Getting client id and secret from Google OIDC​

1/ Go on GCP console and search for "OIDC":

google-oidc-1

You'll land to "Google Auth Platform"

2/ Create a new client app:

google-oidc-2

Fill the redirects URI with the following URLs:

  • https://{your api domain}/v1/oidc/google/callback
  • https://{your frontend domain}/oidc/callback

Fill also the Authorised JavaScript origins with https://{your frontend domain}

3/ Copy/paste the client id and client secret (in the environment variables CWCLOCK_OIDC_GOOGLE_CLIENT_ID and CWCLOCK_OIDC_GOOGLE_CLIENT_SECRET):

google-oidc-3

Getting client id and secret from Github​

1/ Go on developers settings:

github-oidc-1

2/ Create a new "OAuth App"

github-oidc-2

Fill the redirects URI with the following URL: https://{your api domain}/oidc/callback

3/ Generate a new client secret:

github-oidc-3

4/ Copy/paste the client id and client secret (in the environment variables CWCLOCK_OIDC_GITHUB_CLIENT_ID and CWCLOCK_OIDC_GITHUB_CLIENT_SECRET):

github-oidc-4

Email API​

CWClock can send emails (for confirmation links, regenerating password, sending invoices) through the CWCloud's email API.

You have to configure the following environment's variables:

  • CWCLOUD_API_URL (which is set by default to https://api.cwcloud.tech but if you're using a separated tenant of CWCloud you can override this value)
  • CWCLOUD_API_KEY which is expecting an API key
  • CWCLOUD_CONTACT_FORM_ID the CWCloud's contact form id
  • CWCLOCK_MAIL_FROM which is the sender of the emails
  • CWCLOCK_LIMIT_MAIL which is a monthly limit of emails sent by an organizations (by default it's 100)

If it's not configured, CWClock will work anyway but it won't send emails.

Note: if you don't want to use CWCloud emails or contact form api, you'll just have to create endpoints compliant which will do whatever you want.