Glucava

Free and self-hosted. After a Strava activity ends, Glucava adds your Dexcom glucose stats (time in range, min, max, average, sparkline) to its description:

🩸 TIR 92% | min 78 | max 164 | avg 112 mg/dL
▁▂▃▃▄▅▄▃▃▂▂▃

Strava's API is paywalled, so Glucava edits the description through a headless Chrome session with your own cookies. One Go binary (PocketBase + web UI); Chrome/Chromium must be installed.

Not a medical device. Glucava copies numbers from your CGM into a Strava description for your own reference. It does not measure, diagnose, alarm or advise, and it must never be used for treatment decisions or as a replacement for your CGM app's alarms. It can be wrong, late or silent (a source can be down, a timestamp off, Strava's page can change). Use at your own risk; see the warranty disclaimer in the license.

Glucava is an independent project. It is not affiliated with or endorsed by Strava, Dexcom, Abbott, Glooko or Nightscout; those names belong to their owners. Automating Strava's web UI may breach Strava's terms of service (see SECURITY.md); the session is your own and the volume is low, but the risk is yours.

Screenshots

All from demo mode (make mock), so the data is made up. The UI follows your light or dark preference.

The optional chart photo (square, as Strava shows it) and the settings card that styles it, with a live preview:

Notification emails (HTML with a plain-text fallback, inline charts drawn by glucava):

Quick start

make mock          # fake Strava + Dexcom data, http://127.0.0.1:8090 (make help lists all targets)

Real use, with Docker:

docker build -t glucava .
docker run -d --name glucava -p 127.0.0.1:8090:8090 -v glucava:/data \
  -e [email protected] \
  -e GLUCAVA_ADMIN_PASSWORD='long-random-password' \
  -e GLUCAVA_SECRET_KEY="$(openssl rand -base64 32)" glucava

Put a TLS reverse proxy in front. Then:

1. Sign in, open Settings, enter Dexcom Share credentials (or glucava dexcom set <user> --region us|ous|jp). Enable Share in the Dexcom app. "Test connection" checks the login.
2. Open Strava and click Open sign-in browser. A browser running on the Glucava server appears on the page; sign in to Strava in it as usual (email and password, Google, Apple or Facebook, verification codes). Glucava never sees your password: when you reach your dashboard it keeps only the session cookies, encrypted, and closes the browser. Passkeys do not work in it; choose password or another option. Alternatively paste a strava.com cookie export (or glucava strava cookies import file.json).
3. Run glucava strava check to verify the session and edit-page selectors without saving.

Usage

• Polling: Settings → poll interval. New activities from the last 24 h are processed as soon as they finish; the description text uses activity-only glucose (start minus "Minutes before start" through end) and never waits on anything else.
• Post window and delayed reprocess: "Minutes after end" (post_minutes) only widens the chart photo's curve with cooldown glucose after the activity; it plays no part in the description text. Dexcom Share can also lag a few minutes behind the wall clock, so the very last readings are sometimes still missing at the moment an activity ends or its Post window closes. "Reprocess once more after (minutes)" (post_buffer_minutes, default 5, 0 turns it off) automatically reprocesses the activity once more after that buffer, refreshing the stats and description text with whatever readings arrived since, and is also when the chart photo's first upload happens if the chart is on — never earlier, since a photo cannot be replaced once attached. Turning the buffer off (0) goes back to attaching the chart immediately after the Post window.
• Push trigger: create a token on the Tokens page (shown once), then call it from Tasker or Apple Shortcuts when the Strava notification arrives: curl -X POST -H "Authorization: Bearer gst_..." https://host/api/trigger For Android/Tasker, the Tokens page generates a ready-to-import .prf.xml (download button and QR code, next to a freshly created token) instead of building one by hand: Strava notification → check now, deliberately unfiltered (Strava's own notification wording varies by type and locale, and an extra check is harmless). See docs/triggers.md for Tasker, HTTP Shortcuts/MacroDroid, and Apple Shortcuts setup.
• Manual: open an activity for a preview, then Process or Reprocess. Existing text is kept; only the 🩸 block is replaced. Detection does not rely on the emoji or wording alone (a coincidence or a copycat app could share those), or on guessing where the block ends from its shape — it carries two invisible Unicode code points at its start and two more at its end as a fingerprint, so glucava always finds exactly its own block, however many lines it has. An older block written before this existed (0.1.2 and earlier, no fingerprint) is still recognised by its text and shape and gets the fingerprint the next time it is reprocessed.
• By id: the Strava session page has a "Process a specific activity" field for an activity the poller never saw at all (e.g. it predates glucava, or is older than the polling window). It pages through your Strava training log looking for that id, same as Reprocess otherwise.

Configuration

Variable	Meaning
GLUCAVA_ADMIN_EMAIL, GLUCAVA_ADMIN_PASSWORD	first user, created on start only while no user exists; change it later under Settings → Account or with glucava user
GLUCAVA_DEXCOM_USERNAME, GLUCAVA_DEXCOM_PASSWORD, GLUCAVA_DEXCOM_REGION	Dexcom Share login, stored on first start if no credential is stored yet (alternative to make dexcom); safe to remove afterwards
GLUCAVA_RETENTION_DAYS	readings/events retention in days (0 = forever); overrides the UI setting on every start, not just the first
GLUCAVA_PUBLIC_URL	address of the web UI, e.g. https://glucava.example.com; used for links in emails. Seeds the Public URL setting while none is saved
GLUCAVA_SMTP_HOST, GLUCAVA_SMTP_SENDER_ADDRESS	seed the SMTP settings on first start (only while none are saved; afterwards edit them in Settings → Email)
GLUCAVA_SMTP_PORT (default 587), GLUCAVA_SMTP_USERNAME, GLUCAVA_SMTP_PASSWORD, GLUCAVA_SMTP_TLS=1, GLUCAVA_SMTP_SENDER_NAME (default glucava), GLUCAVA_SMTP_TO	rest of the seed; TO is the recipient. The password goes into the encrypted vault, and is stored later too if you add it after the first start
GLUCAVA_SECRET_KEY	encryption key for stored secrets (default: <data dir>/secret.key)
GLUCAVA_TRUSTED_PROXIES	comma-separated IPs/CIDRs of your reverse proxy. Only then are X-Forwarded-For/-Proto believed (per-client rate limits, Secure cookie). Unset = direct peer only
GLUCAVA_SOURCE	live glucose source (default and currently only: dexcom); an unknown name stops the server at start
GLUCAVA_CANARY_INTERVAL	how often the edit-page canary runs, e.g. 12h; off disables it (default 24h)
GLUCAVA_POLL_LOOKBACK	how old an activity may be and still be picked up by polling (default )

Email notifications (Gmail example)

Glucava sends through any SMTP server; Gmail works well for a personal setup.

1. Turn on 2-Step Verification for the Google account.

2. Create an app password at https://myaccount.google.com/apppasswords (16 characters; your normal password is rejected). Type it without spaces.

3. Either fill in Settings → Email, or seed it from .env before the first start:

   GLUCAVA_SMTP_HOST=smtp.gmail.com
   GLUCAVA_SMTP_PORT=587
   GLUCAVA_SMTP_TLS=0            # 587 uses StartTLS; for port 465 set GLUCAVA_SMTP_TLS=1
   [email protected]
   GLUCAVA_SMTP_PASSWORD=your-16-char-app-password
   [email protected]   # must be the Gmail address (or one of its aliases)
   [email protected]
   

4. Press Send test notification on the Settings page.

5. Under What to email, choose the kinds you want:

   • Failure alerts (on by default): expired session, failed update, missing glucose data, canary failure, rejected trigger.
   • Summary after each activity (off): one mail per newly processed activity with time in range, lows and highs, average, start and end values. A reprocess from the UI does not send another.
   • Weekly summary (off): Monday from 08:00 server time, covering Monday to Sunday of the week before: activities, total time, average time in range, change against the week before, best and lowest activity, lowest glucose and how many activities had a low. A week without processed activities sends a short "no activities" note instead, so silence is never ambiguous. If glucava was down on Monday it sends when it is back that week.
   • Monthly health report (off): on the 1st from 08:00, for the month before: activities annotated and failed, glucose data coverage (share of hours with at least one reading), latest annotated activity, alerts of the month and the glucava version. It also works as a heartbeat: if it stops arriving, glucava is down.

6. Set Public URL (or GLUCAVA_PUBLIC_URL) to add "Open in glucava" buttons that point at the activity, the Strava page, the tokens page or the dashboard. Without it, mails contain no links to the web UI (the Strava activity link is always there).

Summaries are email-only; ntfy and webhooks keep receiving alerts only. Scripted: glucava config set mail_weekly true (keys mail_alerts, mail_activity, mail_weekly, public_url).

The variables only seed the settings while no SMTP host is saved yet; after that the web UI is the source of truth and later edits in .env are ignored (except a password added while none is stored). Glucava does not expose the SMTP auth method or EHLO name, so servers that need LOGIN auth or a custom EHLO name (e.g. Gmail SMTP-relay) are not supported.

Push notifications and the installable app

glucava is an installable web app (a PWA) and can send Web Push notifications to phones and computers, with no app store and no third-party account. It pushes what email does: failure alerts and, if you switch them on, the activity, weekly and monthly summaries. Nothing else: no glucose alarms, and no glucose data is stored on the device (the service worker caches only CSS, JavaScript and icons; every page and number is loaded live).

Turn it on under Settings → Notifications → Push notifications: press Enable on this device, allow notifications when the browser asks, then Send test push. Each browser or phone is enabled on its own; the card lists the subscribed devices and can remove them. Choose what is pushed with the two switches (failure alerts on by default, summaries off) and press Save settings. Scripted: glucava config set push_alerts true / push_summaries true.

Requirements and caveats:

• HTTPS is required (plain http://localhost also works, for trying it out). Browsers refuse service workers and push on insecure origins. Behind a reverse proxy this is usually already the case.
• iPhone and iPad (iOS/iPadOS 16.4 or newer): push only works for an app added to the Home Screen. Open glucava in Safari, Share → Add to Home Screen, open it from the new icon, and enable push there. The card says so when it detects this.
• Messages travel through the browser vendor's push service (Google, Mozilla or Apple), end-to-end encrypted (RFC 8291) and signed with a VAPID key that glucava generates on first start. The private key lives in the encrypted secrets vault; subscriptions are stored like any other setting and leave with a backup. Only https:// endpoints on public addresses are accepted or contacted.
• Changing the VAPID key (deleting the vapid_private secret) makes existing devices stop receiving pushes until each one presses Enable on this device again.
• A phone that was off gets the message when it is back online, within the message's lifetime (alerts 4 h, activity summaries 6 h, weekly/monthly 24 h, test 1 min).

To try it before deploying, run the mock (make mock, open http://127.0.0.1:8306): it has one made-up device and sends through a stand-in that only logs, so the card, list and buttons work, but no real push is delivered. Real delivery needs a real browser on an HTTPS address.

Scripted setup (Ansible, cloud-init, ...)

Everything the web UI can change is scriptable, with the same validation:

# settings: key=value lines, comments allowed; idempotent (prints "unchanged" on a re-run)
glucava config apply settings.conf --dev=false --dir /data
glucava config set unit=mmol/L poll_interval_minutes=5 --dev=false --dir /data
glucava config list --dev=false --dir /data        # all keys with current values
glucava config get smtp_host --dev=false --dir /data

# secrets: the value is read from stdin, never from argv
printf '%s\n' "$SMTP_APP_PASSWORD" | glucava secrets set smtp_password --dev=false --dir /data
glucava secrets status --dev=false --dir /data     # set/unset per secret, never the values

• The keys are unit, range_low, range_high, pre_minutes, post_minutes, poll_interval_minutes, retention_days, dexcom_region, dexcom_username, ntfy_url, webhook_url, email_to, smtp_host, smtp_port, smtp_username, smtp_tls, smtp_sender_address, smtp_sender_name, public_url, mail_alerts, mail_activity, mail_weekly, mail_health, push_alerts, push_summaries, gap_alert_hours, chart_image, chart_theme, chart_size, chart_band, chart_activity, chart_dots, chart_line, chart_hr, chart_panel_order, chart_pre_minutes, hr_read, post_buffer_minutes, description_template (glucava config list is authoritative).
• Settings you pass in one call are validated together, so related keys (smtp_host with smtp_sender_address) can come in any order. An invalid batch changes nothing and exits non-zero.
• Secrets: dexcom_password, ntfy_token, webhook_secret, smtp_password. Strava cookies: glucava strava cookies import. Trigger tokens: glucava token create <name>.
• GLUCAVA_RETENTION_DAYS, when set, still overrides retention_days at every server start.
• The commands work whether or not the server runs. Pass --dev=false for quiet output; results go to stdout, errors to stderr.

Maintenance

• Change the sign-in email or password under Settings → Account (needs the current password). From the command line: glucava user show prints the account email, glucava user set-email <new> changes it, and glucava user set-password reads the new password (12+ characters) from stdin. The email may be left out while there is exactly one user. All of these sign out every other session. Logout also invalidates the session server-side. Logins last 3 days.
• glucava secrets rotate-key re-encrypts stored secrets with a fresh key. Stop the server and back up the data dir first.
• Settings → Your data: retention (default 365 days for readings and events; 0 keeps them), CSV export of readings and activities, and delete-all. glucava data purge --yes does the same from the shell. Activities are kept by retention because they log what was written to Strava.
• Only one user account can exist.
• Back up the data dir and the encryption key separately; a backup holding both exposes your credentials. See Backup and restore.

Monitoring

GET /health reports {"status":"ok","build":"<version>"}, unauthenticated. GET /metrics serves Prometheus text-format metrics: job outcomes and queue depth (glucava_jobs_*), background ingest health (glucava_ingest_*, including glucava_ingest_last_success_timestamp_seconds — alert on its age to catch a source that has silently stopped answering), Strava write latency (glucava_strava_write_duration_seconds), a recent-window glucose summary (glucava_glucose_*), HTTP request counts/latency/in-flight (glucava_http_*), and the standard Go runtime/process collectors. Like /api/trigger, it needs Authorization: Bearer <token> with a token from glucava token create <name> — the same tokens, so a scrape config and a phone's trigger call can use different ones if you want to tell them apart, or the same one. A Prometheus scrape config:

scrape_configs:
  - job_name: glucava
    bearer_token: gst_...
    static_configs:
      - targets: ["host:8090"]

Backup and restore

All state is in the data dir (/data in Docker): the SQLite database (settings, activities, readings, events, encrypted secrets) and, unless you set GLUCAVA_SECRET_KEY, secret.key.

• Back up with the server stopped, or from a filesystem snapshot: copy the data dir. Keep the encryption key somewhere else (GLUCAVA_SECRET_KEY in your secret store, or secret.key copied separately). Data without the key cannot be decrypted, and the key without the data is useless, which is the point.
• Restore: put the data dir back, provide the same key, start the same or a newer version. Migrations run on start.
• Upgrades only move forward: migrations have no down steps. To go back to an older version, restore a backup taken before the upgrade.
• Lost key: stored secrets are unrecoverable. Start with a new key, then enter them again (glucava secrets set ..., glucava strava cookies import). Settings and history are not affected.
• Rehearse it once: restore a copy into a temp dir and run glucava config list --dev=false --dir <copy> and glucava secrets status --dev=false --dir <copy> with the key.

Languages

The interface language is set under Settings > Language: "Automatic" follows the browser, or pick one (English and German so far; the conversion of every screen is in progress). Translations are plain JSON files in internal/i18n/locales/, so adding a language needs no code. See docs/TRANSLATING.md.

Development

Run make hooks once to enable the git hooks (pre-commit: gofmt, vet, lint; pre-push: tests, govulncheck). make check runs everything CI runs. See docs/DEVELOPMENT.md. See SECURITY.md for the threat model. Automating Strava's web UI may breach its terms; use at your own risk.

Frontend build (Tailwind). The UI is styled with Tailwind v4. make css downloads the pinned standalone CLI (checksum-verified, into the gitignored .bin/) and rebuilds the committed internal/web/static/app.css from internal/web/static/input.css plus the class strings in internal/web/*.go. go build, go run and the Docker build never need Tailwind; you only run make css after changing input.css or a class string, and commit the result. CI runs make css-check, which fails if app.css is stale. Class strings in Go must be whole literals (see the comment in internal/web/components.go). make shot SHOTFLAGS=-matrix (with make mock running) screenshots every page at 1280 and 390 px in light and dark, and fails on browser console errors or CSP violations.

Adding a glucose source. Dexcom Share (internal/glucose/dexcom.go) is the only built-in source, but the pipeline (background ingestion, activity processing, live dashboard reading) only depends on the small glucose.Source interface:

type Source interface {
    Samples(ctx context.Context, from, to time.Time) ([]stats.Sample, error)
}

A Libre, Tandem or Medtronic live API source is a new type implementing that one method, plus one entry in sourceBuilders (cmd/glucava/wire.go); users then select it with GLUCAVA_SOURCE. No changes needed elsewhere.

Adding a file importer (a one-shot export, not a live API) is a separate, smaller interface in internal/glucose/importers:

type Importer interface {
    Parse(r io.Reader) (samples []stats.Sample, skipped int, err error)
}

Register it by name in an init() func (see libre.go) and it is immediately available to glucava glucose import --format <name>; no other wiring needed.

Either kind of contributed source, for hardware or an account type the maintainer doesn't have, is welcome but untested by CI; say so plainly in the code and docs, the same way the Libre importer is marked.

Contributing, security, license

• Contributions are welcome: read CONTRIBUTING.md first. Please follow the Code of Conduct.
• Security problems: report them privately, see SECURITY.md.
• License: AGPL-3.0, Copyright (C) 2026 Michael Reinegger. If you run a modified version for other people over a network, the AGPL requires you to offer them your source; the web UI's footer links to it (web.SourceURL, change it in a fork). Third-party components are listed in NOTICE.md.