DieselDesk

enough to pull life along.

A small shared checklist app. Everyone has one list; friends can put tasks on each other's lists. Completed tasks move to a Done archive, tags organise things, effort ratings say how much work each task is, and an admin manages accounts. There is no public sign-up — the first visitor creates the admin, who creates everyone else.

This is the Tier-1 rebuild onto the "Nosdesk stack" architecture blueprint: a Rust/Actix/Diesel/Postgres backend and a Vue 3/Vite/Pinia/Colada/Tailwind frontend, replacing the original tiny Go + SQLite implementation (kept in legacy-go/ for reference). The Cherry's Labs dark-pink design system is carried over faithfully.

Scope note: this is Tier 1 (the "fast baseline") — conventional request/response with server-cache invalidation. The offline-first sync engine (Tier 2) and collab/Tauri/shared-core codegen (Tier 3) are intentionally not built yet; the layering is structured so Tier 2 can be added without reshaping handlers/services.

Run it

Everything runs in Docker via Compose --watch — no host toolchains needed.

make dev

(If your shell isn't in the docker group yet, use sg docker -c 'docker compose up --watch --build'.)

Then open http://localhost:5173. A fresh install has no account, so it routes you to a setup screen to create the first admin, then the onboarding wizard.

• Frontend (Vite dev): http://localhost:5173 — proxies /api to the backend
• Backend (Actix): http://localhost:8080/api
• Postgres: localhost:5432 (dieseldesk / dieseldesk)

See DEVELOPMENT.md for the full dev loop and gotchas.

Architecture

backend/      Rust · Actix-web 4 · Diesel 2 · Postgres 17
  src/
    config.rs        env-loaded, validated at boot
    error.rs         thiserror enum → one JSON HTTP mapping
    db.rs            r2d2 pool + embedded migrations (run at boot)
    auth/            argon2 hashing, JWT cookie, CSRF, extractors (Authed/Active/Admin)
    handlers/        thin HTTP: session, setup, me, tasks, tags, users, admin, onboarding
    services/        business logic + permission rules
    repository/      Diesel queries
    models/ schema.rs
  migrations/        Diesel SQL

frontend/     Vue 3.5 · Vite 6 · Pinia · @pinia/colada · Tailwind 4
  src/
    router/          guards: setup → login → change-password → onboarding → app
    stores/auth.ts   current user (bootstrap/login/setup/logout)
    queries/·views/·components/·composables/
    styles/          ported Cherry's Labs design system + component CSS

packages/core/  @dieseldesk/core — shared API client + TS types (the transport seam)

Layering (backend): handlers → services → repository → models. Config validated at boot, errors as a thiserror enum with a single HTTP mapping, tracing for observability.

Auth: Argon2id passwords; JWT in an httpOnly ds_session cookie; CSRF double-submit (the SPA echoes the ds_csrf cookie as X-CSRF-Token on every mutation). Recipient-only edit (effort/notes) and every /api/admin/* route are enforced server-side in the service layer.

Product parity

Setup → forced password change → onboarding wizard (admin 4-step incl. starter tasks and friend accounts with one-time passwords; member 2-step) → Home (tag filter, sort, effort bars, due chips, check-off) → Done → Friends (cross-account send) → Tags (own + borrow) → Admin (all-tasks filters, user management). Same behaviour as the design handoff in design_handoff_dieseldesk/.

Tailored out of the Tier-1 blueprint (with reasons)

Redis (no rate-limit/presence need yet), a Storage trait (no file assets), Fluent i18n, WebAuthn/TOTP/OIDC, Tantivy search, and two SPA entries are all omitted — none are in the DieselDesk product. Local auth only.