v1.1.0

Full Changelog: v1.0.1...v1.1.0

v1.0.2 — registry compatibility

Fixes the published image manifest so it can be read by tools expecting the standard Docker manifest-list media type — including Unraid Community Applications' scanner, which reported latest as missing.

buildx adds provenance and SBOM attestations by default, which turn a multi-arch manifest into an OCI image index containing unknown/unknown entries. Those are now disabled.

No changes to the application.

v1.0.1 — published images

No changes to the app. This release publishes container images and adds the Unraid Community Applications templates.

Container images

Multi-architecture (linux/amd64, linux/arm64), built and smoke-tested by CI on every tag:

docker pull ghcr.io/mahansford/questly:1.0.1
docker pull ghcr.io/mahansford/questly:latest

Unraid

ca_profile.xml and templates/questly.xml are now in the repository, ready for a Community Applications listing.

Questly needs a MongoDB 5+ server, which is not bundled. It keeps no local state, so there is no appdata path to configure.

Full notes in the changelog.

v1.0.0 — Questly

The first release of Questly — a self-hosted family points-and-rewards app.
Grown-ups award points for quests and good behaviour; kids spend them in a shop
of rewards you control. No third-party accounts, no ads, no subscriptions.

For kids

• Tap your face on the front page and type a 4–6 digit PIN — or no PIN at all
  for the youngest.
• A quest list with big Done! buttons, and a progress bar counting down to
  the next reward you can't quite afford yet.
• A shop that shows what you can buy now and how many points off the rest you
  are.
• Your whole points history, with a running balance.
• Installs to a phone or tablet home screen and runs full-screen.

For grown-ups

• Quick +10 / +25 / +50 / +100 buttons on each kid's card, plus custom
  amounts and take-aways, each with an optional reason.
• Quests — daily, weekly or one-off, worth a set number of points, assigned
  to specific kids or to everyone.
• A shop you stock yourself: price, icon, description, optional limited
  stock.
• One approvals page for everything waiting on you, with a count badge in
  the nav.
• Accounts — change your own name, login email, icon and password. Either
  grown-up can reset the other's password (confirmed with their own), which is
  the way back in since there's no email recovery.

Rules it enforces

• A balance can never go negative, and an excited kid mashing Buy can't
  overdraw — the deduction is a conditional atomic update.
• Two kids racing for the last limited-stock item can't both win it.
• A daily quest can be claimed once per calendar day and a weekly one once per
  ISO week, in the timezone you set.
• Rejecting a purchase refunds the points and puts the stock back.
• Every point movement is written to a ledger with the balance after it.
• CSRF protection on every mutation; kids can't reach grown-up pages.

Running it

Needs Docker with the Compose plugin — Python and MongoDB run in containers.

git clone https://github.com/mahansford/questly.git && cd questly
cp .env.example .env
sed -i.bak "s|^SECRET_KEY=.*|SECRET_KEY=$(openssl rand -hex 32)|" .env && rm -f .env.bak
docker compose up --build -d

Then open http://localhost:37000. It can also talk to a MongoDB you already
run — see the README.

Verified

tests/smoke_test.py walks every flow end to end against a real MongoDB — 53
checks covering awarding, spending, approving, refunding, PIN login, account
changes, and the failure paths for each. It runs against a throwaway database
and refuses to touch anything not named *_test.

Built with AI

Every line — application code, stylesheet, icons and documentation — was
written by Claude (Anthropic's Claude Opus 5) in Claude Code, to a human's
direction. Every commit carries a Co-Authored-By: Claude trailer. It has not
had a third-party security audit; it's a family app for a trusted home network.

Licence

AGPL-3.0. Free to
use, modify and run commercially — but modified versions that are distributed
or run as a network service must publish their source.