Can't log in because I don't know the defaults

[masukomi]

the default username and password don't seem to be documented anywhere, but after installing it locally and booting it it is asking me for a username and password.

Side note. default port isn't documented either so i had to go hunting through the source to figure out what URL to hit. Nothing obvious came up in my searches when trying to figure out the default account info.

[almarklein]

Hey Kay, that is because there is no default username and password, because that's somewhat of a security risk. You should provide your own credentials (there's a tool at https://timetagger.app/cred to create some).

Another option is to use localhost login. When accessing via http://localhost, this option is available in the login:

default port isn't documented either

It's here: https://timetagger.readthedocs.io/en/latest/libapi/

[desrod]

Many to most users who self-host docker containers for services like time tracking, will not run them on localhost, and thus this won't work.

There's no way to 'inject' credentials into the existing docker container at runtime, and so providing a locked docker container in the registry that nobody can log into is a no-op, compelling people to build it from scratch using the Dockerfile and custom creds, or to find another tool to fill this niche.

[almarklein]

There's no way to 'inject' credentials into the existing docker container at runtime

You indeed need a tool like docker-compose, see e.g. this example.

Perhaps we can make this more explicit in the docs. I'm sure there are other tools that can be used, like kubernetes or docker swarm, if you already have something like that running.

Perhaps someone else knows some other easy to use tools for running a Docker image (with custom credentials)? cc-ing the people who have contributed to the CD job to build the Docker images: @dorianim, @maresmar, @danielhass

[danielhass]

@desrod - I probably don't really get your problem statement.
@almarklein referenced the docker-compose example which shows the environment variables and their format that need to be set in order to provide custom credentials without the need to rebuild anything.

These environment variables can also be set without any third-party tooling just within your container engine. For Docker you can use the -e command line flag (see upstream docs for further details).

[masukomi]

there's a simpler and well explored solution.

Use default credentials, and force a password change as soon as the person logs in the first time.

[almarklein]

Yes, that's a nice workflow, but this is not how the default credentials work in TimeTagger.

The process of setting the password is exactly by setting the TIMETAGGER_CREDENTIALS environment variable, in e.g. docker compose or whatever system you use to run your docker containers. In other words, there is no way to force a password change.

To provide some context: not so long ago there was no default authentication system - it was expected that users provided their own means of authentication if they ran on anything other than localhost. The current builtin authentication system is a simple, relatively un-opinionated method to provide basic authentication, that is also pretty secure. A nice and simple default. But don't expect more than that. You are free to implement your own form of authentication, by implementing your own main script.

[drajabr]

Hey! First of all thanks for your work, already love it!.

I'm also a self hoster, and I can tell you, it was frustrating to setup user auth even with proxy "doc are quite misleading", but finally, i got it working!!

I don't know if something wrong in my side or what, but it didn't work until I created the same user locally, then authenticate this user from the proxy.

problem for me now, can't create user without password and rely completely on proxy to auth! you have to create user and assign password!! OR something wrong in my side??

[almarklein]

What docs for proxy auth were you using, and how do you think they are misleading? Perhaps we can update them to make them more clear and avoid confusion.

[drajabr]

@almarklein It was my problem, per docs we had proxy_auth_enabled (bool), proxy_auth_trusted (str), proxy_auth_header (str), which I couldn't grasp how to use them as environment variables for the docker container.

I then noticed in the docs that datadir can be set as env var as: TIMETAGGER_DATADIR then I figured it out for proxy variables.

I would suggest to add them to the sample docker-compose file in the repo to make them clear.

And apologies for my late reply.

[drajabr]

@almarklein I filed a PR to make it clear in the sample docker-compose files #447