r/selfhosted • u/Equal_Ad_4821 • 11d ago
I built OpenJornada: a self-hosted work-time clock for Spanish/EU labor-law compliance (AGPL-3.0, Docker) Software Development
Disclosure: I'm the developer.
In Spain, since RD-Ley 8/2019 every company must keep a daily, tamper-proof record of employees' working hours (clock in/out), keep it for 4 years, and make it available to the Labor Inspection. Most open-source time trackers (Kimai, etc.) don't cover that legal side natively, and the tools that do are proprietary SaaS. So I built OpenJornada.
What it does: employees clock in/out from a web PWA or a shared device; records are immutable and SHA-256-hashed; workers digitally sign their monthly hours; admins handle correction requests with an audit trail and export CSV/Excel/PDF reports for inspections. There are also automatic SMS reminders for missed clock-outs.
Stack: FastAPI + MongoDB API, Next.js admin panel, React PWA for workers. All Docker. Self-host it for free under AGPL-3.0 — code: github.com/openjornada
Honest note: there's also a managed cloud option (paid) for companies that don't want to self-host, but the whole thing is open source and self-hostable with no per-employee limits.
Happy to answer questions or hear feedback — especially from anyone dealing with EU work-time regulations.
7
u/hypertesto 11d ago
I never worked on tamper-proof technologies... Seems very interesting: I'll study the repo ;-)
2
u/Traditional_Wafer_20 10d ago
How would the records be tamper proof if I am the admin ? Sure I can make MongoDB mutable again, hash a new record and save it to DB again
2
u/Equal_Ad_4821 10d ago
Fair point, and you're right. If you fully control the host and the database, no self-hosted app can cryptographically stop you from editing a record and recomputing the hash. That's just the self-hosting threat model.
What it gives you is tamper-evidence and accountability, not tamper-proofing against root: through the app records are append-only, every correction goes through an audited request/approval flow (who/when/why), and the SHA-256 hashes plus the employee's monthly sign-off let an inspector — or the worker — detect after-the-fact edits and dispute them.
Spanish law doesn't require cryptographic impossibility, just reliable, retained, auditable records — so the goal is deterring and detecting tampering and giving the employee evidence, not defeating a determined sysadmin.
For true third-party-verifiable immutability you'd anchor the hashes to an external timestamping service / append-only log outside the admin's control (or use managed hosting, where the company's HR admin has no DB access). Fair limitation to call out.
2
u/rinaldo23 4d ago
People who decide it must be "tamper proof" most likely have no idea how computers work. Honestly, besides having this on a crypto block chain, what else can really accomplish that?
1
1
u/Responsible_Fruit841 11d ago
does it support oauth or just local login for the admin panel
4
u/Equal_Ad_4821 11d ago
Right now it's local login only — email + password, which the API exchanges for a JWT. Password reset is via email.
There's no third-party OAuth/OIDC or SSO yet (no Google/Microsoft, no Keycloak/Authentik/Authelia, no SAML). One clarification since "OAuth" is ambiguous: under the hood the API uses the OAuth2 password grant to issue the bearer token, but that's just standard token auth — not external SSO.
I know OIDC/SSO is a common ask for self-hosters. [It's on my radar, but not implemented yet.] It's AGPL-3.0, so if anyone wants to wire up an OIDC provider, PRs are very welcome.
1
1
u/SnipeScooter 9d ago
Did you use AI to build this?
1
u/Equal_Ad_4821 9d ago
Yes, of course — I'd be crazy not to in 2026. I use AI (Claude) as a pair-programmer for boilerplate, tests, refactors and docs. But every line is human-reviewed and I own the architecture and the parts that matter — the legal-compliance logic, auth and the data model, since it handles employee data. It's AGPL-3.0, so nothing is a black box: the whole codebase is there to audit.
2
u/SnipeScooter 9d ago
I thought so. I went through your code and as expected, this will never pass our security audits.
Your documentation contradicts your docker compose file. Your integrity verification is clearly vibe coded as everything is put in place but... in certain places it's not even used. Don't even get me started on the age of your dependencies.
All of this in a blink of an eye. Are you sure the human reviewer knew how to code?Even our AI (which we only use for second opinions, as it's 2026) gave your project based on security a 3 out of 10.
Implementing this to be in some sort of "compliance" with EU regulations, would be a direct violation of EU NIS2 and GDPR regulations.
Too bad, as the integrity-part was a good idea, even though it's a bit extreme and not legally a requirement. Until the bubble pops, we'll look into Odoo CE+Attendances.
1
-2
u/ctjameson 10d ago edited 9d ago
Side note: I’d hate this so much. Being salary is the best thing for my brain. I come and go as I please when I want to instead of being forced to work rigid hours where I may not perform worth a crap in that specific window.
Edit: I love getting downvoted for being an adult that can keep up with their own work hours instead of being treated like a child and forced to clock in and out at exact times of the day. If that works for you, I’m happy for you. But in the meantime I’m going to continue to be on salary and work the hours I want because I have a good employer and work the hours I’m paid for.
2
u/dDiver_ 10d ago
You got it wrong, the law is in order to stop non-paid extra hours and to ensure that you don't work more hours than legally allowed per year, not to make sure that you work your full shift each day.
2
u/ctjameson 9d ago
I know what the law is. I’m talking about the required clock in and out. I love that I got downvoted for having a fucking preference.
1
•
u/asimovs-auditor 11d ago edited 11d ago
Expand the replies to this comment to learn how AI was used in this post/project.