Donetick - Secure Self-Hosted Task and Chore Manager AMI by cloudimg

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Donetick is a free and open-source, self-hosted task and chore manager for individuals, households and teams. It handles recurring schedules, assignments, points and shared circles or groups, giving you a private alternative to hosted chore and to-do apps that you run and control entirely in your own AWS account. This AMI is delivered fully installed and secured, so a working task manager is reachable in your browser within minutes of launch.

This image eliminates the manual binary download and checksum verification, systemd unit authoring, reverse-proxy configuration and credential hardening that a from-scratch install requires. Donetick signs user sessions with a JWT secret that must be unique per deployment; a shared secret baked into an image would let anyone forge sessions on another customer's instance. This image never ships that secret. What normally takes several steps across binary setup, service configuration and security hardening is completed for you at image build time. Launch the instance, read your unique administrator credential and sign in.

Donetick is a single self-contained Go binary that bundles the web application; there is no runtime interpreter to manage and no external database to provision. Its datastore is an embedded SQLite database, keeping the whole appliance self-contained on a single node. The server binds to the loopback interface only and is fronted by an nginx reverse proxy on port 80. systemd starts the application and the web server on boot and restarts them on failure.

This image follows a defence-in-depth approach:

• Network isolation: the application binds exclusively to the loopback interface and a host firewall rule drops any external traffic to the application port; only the nginx reverse proxy is exposed
• Unique signing secret per instance: a fresh 48-byte JWT session secret is generated on each instance's first boot and is never baked into the image, so sessions cannot be forged across deployments
• No default or shared credentials: a cryptographically random administrator password is generated on first boot and written only to a root-only file; no default account survives into the image
• Closed registration by default: after the single administrator is seeded, open self-registration is disabled so the appliance ships closed; re-enabling it is a documented one-line change
• Least privilege: the application runs as an unprivileged system user with NoNewPrivileges, ProtectSystem and ProtectHome set
• Automatic restart: systemd monitors both the application and nginx and restarts them on failure

Buyers requiring formal compliance documentation should contact cloudimg to discuss specific requirements.

• Household chore coordination: A family sharing recurring cleaning, bins and pet-care tasks across a circle, with rotating assignments, due dates and points to keep everyone accountable
• Small-team operational checklists: An office or lab tracking recurring maintenance, opening and closing routines and compliance checks, self-hosted so task data never leaves the company AWS account
• Personal recurring task management: An individual managing bills, medication reminders, subscriptions and home maintenance on a private instance with multiple views and completion history

Deploy on any EC2 instance type. Use the health endpoint with an Application Load Balancer for availability monitoring. Back up the SQLite datastore and configuration using EBS snapshots or AWS Backup. Terminate TLS at your own domain and certificate in front of the instance for HTTPS access.

Read your administrator credential from the root-only file, open the web interface in your browser, sign in, and create your first tasks and recurring chores. Organize work into circles or groups, assign it to members, and track completion history from any of the built-in views.

24/7 technical support by email and chat. Help with deployment, reverse-proxy termination with your own domain and certificate, enabling registration and inviting members, and backup planning for your task data.