Duckboard

A server-rendered dashboard framework for Node.js with zero dependencies. Routes, templates, widgets, themes, middleware, session auth and a JSON API mode - the whole thing fits in one lib/ folder and reads like a recipe, not an abstraction.

lib/
  server.js      the Duckboard app: routes, templates, middleware, listen
  router.js      method-aware path matching with :params
  templates.js   {{variable}} / {{#each}} rendering, auto-escaped
  widgets.js     numberCard + table HTML builders
  themes.js      light / dark CSS
  middleware.js  composable (req, res, next) chains
  auth.js        scrypt passwords + cookie sessions (built-in crypto)
  store.js       JSON file-backed key/value store
  json.js        JSON API mode for any handler

Quick start

$ npm install
$ node bin/duckboard.js --port 8080

        __
       /  \__
      (  oo \_
       \__   \_
          \   \_
          /  /  \
         /  /    \
        (__)(__)

  Duckboard v3.0.0
  zero-dependency dashboards
  listening on http://localhost:8080

API

const { Duckboard } = require('duckboard');

const app = new Duckboard({
  templates: { index: '<h1>Hello {{name}}</h1>' },
});

app.use(someMiddleware);              // optional chain
app.get('/widgets/:id', handler);     // :params supported
app.post('/save', handler);
app.render('index', { name: 'duck' }); // escaped by default

app.listen(8080);

Zero dependencies

lib/ imports only http, fs, path, crypto and assert. The test suite is a plain runner in test/run.js - no mocha, no jest, no install step beyond the package itself.

Tests

$ npm test
  23 passed, 0 failed

Field milestones - the route so far

Every gate below is closed and stamped. The route from a loose idea to the frozen 3.0 framework ran through nine of them.

• M1 - Server-rendered core (router, templates, static pass-through) - closed 2019-07-11, 14:05 CEST
• M2 - Widget layer (numberCard, table, sparkline with escape-safe rendering) - closed 2020-08-20, 11:30 CEST
• M3 - Layout system (grid rows, columns, responsive collapse rules) - closed 2021-09-30, 16:20 CEST
• M4 - Store + JSON persistence (file-backed state, atomic writes) - closed 2022-10-14, 13:45 CEST
• M5 - Auth middleware (session cookies, signed tokens, login flow) - closed 2023-06-27, 15:10 CEST
• M6 - Themes (theme tokens, runtime switch, no CSS build step) - closed 2024-05-08, 09:55 CEST
• M7 - CLI (duckboard init/serve/build, project scaffolding) - closed 2025-02-19, 12:00 CET
• M8 - Zero-dependency audit (full test suite on a bare node_modules-less checkout) - closed 2025-11-06, 10:40 CET
• M9 - DuckBoard 3.0 - stable API freeze - closed 2026-08-09, 12:00 CEST

Commits per year - the build log

\ ext 2018 ▇▇▇▇ 26 2019 ▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇ 120 2020 ▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇ 130 2021 ▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇ 140 2022 ▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇ 150 2023 ▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇ 160 2024 ▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇ 170 2025 ▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇ 180 2026 ▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇ 120 \

The field team

• alessia4757 - audited the quick start on a fresh checkout and fixed two copy-paste drifts in the scaffolding commands (Sep 2025).
• ThiagoPatel7644 - reviewed the API chapter and documented the middleware ordering rules with runnable examples (Oct 2025).

License

MIT - see LICENSE.