WorkTimeTracker
A local-first, open-source desktop work-time tracker built with Tauri 2. Data stays in a Postgres
database you control, for example the bundled compose service.
Features
- Dashboard: start, pause, resume, stop, and switch timers; day navigation; daily and weekly
targets with a cumulative overtime balance; time distribution per project.
- Time Management: add worked time retroactively via quick-add buttons or durations such as
2h 45m; entries are placed in the first free slot of the day and never overlap.
- Budgets: per-project hour budgets with a due date; consumption and forecast appear in
Reports.
- Working Time: breaks as entries of their own, warnings for break, daily maximum and rest
period limits, a monthly CSV or PDF record per employee, and an audit trail of every change.
- Absences: vacation, sick leave, unpaid leave, or half day for a day or a range. A full-day
absence drops that day's target to zero, a half day keeps half of it.
- Settings: weekly working time and working days; the daily target follows from both. The
working time limits default to the German ArbZG and can be adjusted or restored.
- Accounts: registration with a strict password policy, Argon2id hashes, login lockout, and
per-user data isolation.
Stack
Tauri 2 with typed Rust commands, React, TypeScript, Vite, Tailwind CSS, Zustand, TanStack Query,
Zod, Drizzle schema and migrations, Postgres, Recharts, Vitest, Playwright, and LikeC4.
Installation
Installers and portable archives for every release, the required database settings, and what to do
when a start fails are described in one place: docs/installation.md.
Running the application from the source code — prerequisites, the bundled Postgres service,
npm run tauri dev and the browser-only UI — is described in
docs/development.md. The contribution workflow is in
CONTRIBUTING.md; coding agents follow AGENTS.md.
Get involved
Obtain the software. Installers and portable archives for every release are attached to the
GitHub releases and listed on the
project website. Downloading, installing, and
configuring them is described in docs/installation.md; building the
application from source is described in docs/development.md.
Provide feedback. Bug reports and enhancement requests belong in the issue tracker:
open a new issue after searching the
existing issues. A useful report names the
application version, the operating system, the steps to reproduce, and the expected and the actual
result. Report a security vulnerability privately as described in SECURITY.md
instead of opening a public issue.
Contribute. Fork the repository, create a branch, add tests for your change, run lint,
typecheck, and the test suites, then open a pull request whose title follows Conventional Commits.
The workflow, the commit convention, and the pull request checklist are in
CONTRIBUTING.md, the local setup and the checks in
docs/development.md, and the rules for coding agents in
AGENTS.md.
Database
Postgres is required for the native application; application tables live in the dedicated wtt
schema, leaving the default public schema empty. WORK_TIME_TRACKER_ENV decides which database
may be reached: development accepts a local host only, production a remote host only over a TLS
connection verified against a pinned certificate authority, and it never migrates the shared
database. The rules and their reasoning are recorded in
architecture/decisions.md,
every setting in .env.example, and the secrets the release workflow injects in
docs/development.md.
Release
The Release workflow runs on manual dispatch. It checks that package.json,
src-tauri/Cargo.toml, and src-tauri/tauri.conf.json declare the same version, runs the checks
listed in docs/development.md, bundles the application on
Windows and macOS, and attaches those installers and the portable archives below to a GitHub
release tagged v<version>. The release notes are the section of the released version in
CHANGELOG.md, written by hand, or Unreleased while the post-release bump has not
promoted it yet, followed by the upgrade impact and a collapsed list of the commits since the
previous tag that scripts/build-release-notes.mjs appends. A release without any notes fails the
release job.
The release_type dispatch input chooses the version prepared on main after a successful
publication: patch, minor, or major opens a protected-branch pull request that bumps the three
version files, the Cargo lockfile entry, notes the bump under Unreleased in the changelog, and
turns the notes of the released commit into a dated version section. Choose none for re-runs or
hotfix republishes that must leave main unchanged.
Portable archives
Every release also carries windows-x86_64-WorkTimeTracker-portable.zip and
macos-aarch64-WorkTimeTracker-portable.zip for machines where nothing may be installed. Using one
is described in docs/installation.md, how the release job builds and
checks it in docs/development.md.
Security
Every push and pull request is scanned by CodeQL (TypeScript and Rust), OSV-Scanner and
npm audit for vulnerable dependencies, and gitleaks; Semgrep runs on pull requests. Weekly
Dependabot updates cover npm, cargo, GitHub Actions, and the container files. Reporting a
vulnerability is described in SECURITY.md.
Documentation
docs/installation.md — download, install, configure, and troubleshoot the applicationdocs/development.md — required tools, local setup, scripts, checks, and release checksCONTRIBUTING.md — contribution workflow, commit convention, and the pull request checklistCHANGELOG.md — the changes of every release, and the source of the release notesAGENTS.md — concise instructions for coding agents and automationdocs/ui-principles.md — binding UI design principles and Laws of UXarchitecture/decisions.md — architecture decisionsdocs/data-model.md — logical data model of the persistence layer in C4 styledocs/e2e-test-cases.md — end-to-end test cases in Given/When/Then form
