Personal Dashboard

A private dashboard for inbox notes, a reading list, shortcuts, Gmail, Apple Calendar, GitHub pull requests, daily digests with acknowledged urgent alerts, and reviewed Codex handoffs. Cached data renders immediately, then configured sources refresh in the background when the dashboard opens or returns to the foreground. The Bun server listens on loopback. Tailscale Serve supplies HTTPS ingress and authenticated identity headers.

Project status

This project is in a very early stage. It may contain security vulnerabilities, data-loss risks, reliability issues, and breaking changes.

It is not production-ready. Review the source, configuration, authentication, and network exposure before running it with sensitive data. Use it at your own risk.

Requirements

• Bun 1.3.14
• Linux with systemd for VPS deployment, or macOS with launchd for local deployment
• Tailscale
• An authenticated Codex CLI installation for the service account

Development

bun install --frozen-lockfile
bun run dev

The development launcher creates a random request token, starts the API on 127.0.0.1:3100, and configures Vite to attach the token while proxying API requests. Development never reuses the production port. Requests made directly to the API without the token are denied.

Run the local checks with:

bun run check
bun run integrations:check
bun run codex:check
bun run sources:refresh

Integration commands read the private XDG configuration. Tests use fixtures and in-memory databases.

Configuration

Copy config.example.toml to $XDG_CONFIG_HOME/dashboard/config.toml and restrict it to the service account with mode 0600. Real credentials belong only in that file. Configuration lists each setting and the data limits applied by the collectors.

Deployment

Build and install per-user services with paths derived from the current account:

bun run deploy:local
tailscale serve --bg --yes http://127.0.0.1:3000

deploy:local builds the current source before installing and restarting the service. local:restart also rebuilds first, so pulling a new revision and restarting cannot silently keep serving an older production bundle.

The same lifecycle commands work with Linux systemd user services and macOS launchd jobs:

bun run local:status
bun run local:start
bun run local:stop
bun run local:restart

VPS deployment covers Linux installation, lingering, verification, upgrades, rollback, log inspection, Tailscale teardown, and database backup and restore. Local deployment covers the shared per-user workflow and macOS details.

Security

The application is intended for one operator inside a tailnet. Production API requests require an allowlisted Tailscale-User-Login; mutations also require a matching Origin and CSRF token. The proposal model runs in an ephemeral read-only workspace without tools or network access. A handoff starts only after the saved execution values have been reviewed and confirmed.