Initial open-source release

Self-hosted personal life tracker: workouts, nutrition, Whoop sync,
AI photo calories, AI diet planner, weekly insights. All AI features
run through a single fal.ai key (openrouter/router + wizper +
fal.storage). Next.js 15, Postgres 16, Drizzle, iron-session, MIT.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: egebese

.dockerignore

@@ -0,0 +1,10 @@
+node_modules
+.next
+.git
+.env
+.env.*
+!.env.example
+.DS_Store
+*.log
+uploads
+/data

.env.example

@@ -0,0 +1,73 @@
+# ============================================================================
+# LifeOS — environment configuration
+# ============================================================================
+# Copy this file to `.env` and fill in the values. `.env` is gitignored.
+#
+# Required for the app to boot:  DATABASE_URL, SESSION_SECRET, ADMIN_EMAIL,
+#                                ADMIN_PASSWORD
+# Required for any AI feature:   FAL_KEY
+# Optional:                      everything else
+# ============================================================================
+
+
+# --- Database --------------------------------------------------------------
+# Postgres 16 connection string. The bundled docker-compose.yml spins up a
+# local instance at the URL below.
+DATABASE_URL=postgres://lifetracker:lifetracker@localhost:5432/lifetracker
+
+
+# --- Auth ------------------------------------------------------------------
+# 64-byte random base64 string used by iron-session to seal the cookie.
+# Generate one with:  openssl rand -base64 64
+SESSION_SECRET=replace_with_openssl_rand_base64_64
+
+# Bootstraps the single admin account on first boot.
+ADMIN_EMAIL=you@example.com
+
+# First-boot password ONLY. Change it from /profile after logging in.
+ADMIN_PASSWORD=changeme
+
+
+# --- AI (fal.ai) -----------------------------------------------------------
+# Every AI feature in LifeOS — food photo vision, meal parsing, voice
+# transcription, meal planner, workout program generator, weekly insights,
+# and file storage — runs through this single key.
+#
+# Get one at:  https://fal.ai/dashboard/keys
+# Top up credits at:  https://fal.ai/dashboard/billing
+#
+# Treat this like a billing credential: anyone with the key can spend your
+# fal credits.
+FAL_KEY=
+
+
+# --- Whoop OAuth (optional) ------------------------------------------------
+# Register an app at https://developer.whoop.com to sync recovery, sleep,
+# strain, workouts, and body measurements. Leave blank to disable.
+WHOOP_CLIENT_ID=
+WHOOP_CLIENT_SECRET=
+WHOOP_REDIRECT_URI=http://localhost:3000/api/whoop/callback
+
+# Optional — Whoop signs webhooks with the OAuth client_secret by default.
+# Only set this if you've configured a separate webhook secret in the portal.
+WHOOP_WEBHOOK_SECRET=
+
+
+# --- App -------------------------------------------------------------------
+# Public origin (used in OAuth callbacks and absolute links).
+NEXT_PUBLIC_APP_URL=http://localhost:3000
+
+# Set to 1 to enable in-process cron jobs (Whoop daily safety-net sync).
+# Leave 0 if you run sync from an external scheduler instead.
+ENABLE_CRON=0
+
+# IANA timezone. Affects daily rollovers (e.g. "kcal today").
+TZ=Europe/Istanbul
+
+NODE_ENV=development
+
+
+# --- Uploads ---------------------------------------------------------------
+# Local filesystem path for uploaded photos before they go to fal.storage.
+# In Docker this is overridden to /data/uploads (mounted as a volume).
+UPLOADS_DIR=./uploads

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,37 @@
+---
+name: Bug report
+about: Something is broken
+title: "[bug] "
+labels: bug
+---
+
+## What happened
+
+<!-- One sentence. -->
+
+## Steps to reproduce
+
+1.
+2.
+3.
+
+## Expected
+
+## Actual
+
+## Environment
+
+- LifeOS commit SHA:
+- Deploy target: <!-- local dev / docker compose / Coolify / other -->
+- Node version: `node --version`
+- Browser (if UI bug):
+
+## Logs
+
+<!--
+Paste relevant logs (`docker compose logs web` or browser console).
+REDACT FAL_KEY, session cookies, DB connection strings, and any personal data.
+-->
+
+```
+```

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,26 @@
+---
+name: Feature request
+about: Suggest an enhancement
+title: "[feat] "
+labels: enhancement
+---
+
+## Problem
+
+<!-- What can't you do today, or what's painful? -->
+
+## Proposed solution
+
+<!-- Optional — what would you like to see? -->
+
+## Alternatives considered
+
+## Scope check
+
+LifeOS is intentionally single-admin and fal.ai-only. Please confirm:
+
+- [ ] This does not require multi-tenant auth
+- [ ] This does not require replacing fal.ai as the AI provider
+- [ ] This is reasonable for a self-hosted single-user app
+
+(See [CONTRIBUTING.md → Scope](../../CONTRIBUTING.md) if unsure.)

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,28 @@
+<!--
+Thanks for sending a PR! Please read CONTRIBUTING.md if you haven't.
+-->
+
+## What
+
+<!-- One-line summary of the change. -->
+
+## Why
+
+<!-- Linked issue, or a sentence on the problem this solves. -->
+
+## How tested
+
+<!--
+- For UI: screenshots / screen recording at 375px and 1280px.
+- For API: curl example or test output.
+- For AI prompt changes: before/after example response + rough cost delta.
+-->
+
+## Checklist
+
+- [ ] `pnpm lint` passes
+- [ ] `pnpm typecheck` passes
+- [ ] `pnpm build` passes
+- [ ] Updated `.env.example` if I added/changed an env var
+- [ ] Updated `README.md` / docs if user-facing behaviour changed
+- [ ] No `FAL_KEY` / secrets / personal data in commits or screenshots

.github/workflows/ci.yml

@@ -0,0 +1,43 @@
+name: CI
+
+# This workflow only runs lint/typecheck/build. It does not handle any
+# untrusted input from issues, PRs, or commits (no github.event.*.title /
+# .body / commit messages used in run: blocks), so it is not vulnerable to
+# workflow injection.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  lint-typecheck-build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9.15.2
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm lint
+
+      - run: pnpm typecheck
+
+      - name: Build
+        run: pnpm build
+        env:
+          DATABASE_URL: postgres://placeholder:placeholder@localhost:5432/placeholder
+          SESSION_SECRET: ci_placeholder_secret_thats_at_least_64_bytes_long_for_iron_session_xx
+          FAL_KEY: placeholder
+          NEXT_TELEMETRY_DISABLED: "1"

.gitignore

@@ -0,0 +1,25 @@
+node_modules/
+.next/
+.turbo/
+out/
+dist/
+*.tsbuildinfo
+
+.env
+.env.local
+.env.production
+.env.*.local
+
+*.log
+.DS_Store
+
+uploads/
+/data/
+.pnpm-store/
+
+# Exercise media (synced from hasaneyldrm/exercises-dataset via pnpm sync:exercises)
+/public/exercises/
+
+# IDE
+.vscode/
+.idea/

CONTRIBUTING.md

@@ -0,0 +1,92 @@
+# Contributing to LifeOS
+
+Thanks for your interest! LifeOS is a self-hosted, single-admin personal tracker — small in scope on purpose. PRs and issues are welcome; please read this first to save us both time.
+
+## Scope — what's in / what's out
+
+**In scope** (PRs likely to be accepted):
+
+- Bug fixes (auth, sync, parsing, UI regressions)
+- Performance & a11y improvements
+- New exercise dataset translations / corrections
+- New `lib/ai/prompts.ts` improvements (better food/plan/program prompts)
+- Documentation, screenshots, deployment guides for other PaaS (Railway, Fly, Render, Hetzner Coolify, etc.)
+- Additional fal.ai endpoint integrations (e.g. swapping the default model, adding a new vision pipeline)
+- New chart types in `/analysis`
+- Whoop sync edge cases
+
+**Out of scope** (please open an issue / discussion first; will likely be declined as a PR):
+
+- Multi-tenant / multi-user auth — LifeOS is intentionally single-admin. If you need this, fork it.
+- Replacing fal.ai with another AI provider at the framework level. (Adding a *configurable* alternative behind the same `chat()` / `vision()` interface is fine; ripping fal out isn't.)
+- Switching the database away from Postgres.
+- Mobile native apps (iOS/Android shells). The PWA is intentionally web-first.
+- Major UI redesigns away from the Nothing-design aesthetic.
+
+If unsure, **open an issue before writing code**. Saves rejection cycles.
+
+## Dev setup
+
+```bash
+git clone https://github.com/egebese/lifeos.git
+cd lifeos
+
+cp .env.example .env
+# Fill in SESSION_SECRET, ADMIN_EMAIL, ADMIN_PASSWORD, FAL_KEY
+
+docker compose up -d db
+pnpm install
+pnpm db:migrate
+pnpm bootstrap:admin
+pnpm seed:exercises
+pnpm dev
+```
+
+You'll need a [fal.ai](https://fal.ai/dashboard/keys) key to test any AI feature. The free trial credits are enough for development — every call gets logged to the `ai_messages` table so you can audit usage.
+
+## Code conventions
+
+- **TypeScript strict.** No `any` unless absolutely necessary (and comment why).
+- **Server Components by default.** Drop to `"use client"` only when you need state, effects, or browser APIs.
+- **Drizzle for all DB access.** No raw SQL except in migrations.
+- **Zod schemas at API boundaries.** Look at `lib/ai/schemas.ts` for the pattern.
+- **No new env vars without a default + `.env.example` update.**
+- **AI calls go through `lib/ai/client.ts`.** Don't call `@fal-ai/client` directly from route handlers — the wrapper logs cost and errors to `ai_messages`.
+- **Mobile-first.** Test at 375px width before desktop. Use the existing `components/nothing/*` primitives where possible.
+
+## Before you push
+
+```bash
+pnpm lint
+pnpm typecheck
+pnpm build
+```
+
+All three must pass. CI runs the same on PRs.
+
+## Commit / PR style
+
+- One concern per PR. A bug fix + a refactor + a new feature = three PRs.
+- Commit messages: imperative present tense — `add voice transcription endpoint`, not `added` / `adds`.
+- PR description: what changed, why, and **how you tested it** (screenshots for UI, curl/log snippets for API).
+- If you touched a fal.ai endpoint, mention the cost impact (rough $/call) in the PR.
+
+## Reporting bugs
+
+Open an issue with:
+
+1. What you did (step-by-step).
+2. What you expected.
+3. What actually happened.
+4. Environment: Node version, deploy target (Docker/Coolify/local), browser if UI.
+5. Relevant logs — `docker compose logs web` is your friend.
+
+**Do not include `FAL_KEY`, session cookies, or DB connection strings** in issues. Redact them.
+
+## Reporting security issues
+
+See [SECURITY.md](SECURITY.md). **Do not** open a public issue for security.
+
+## License
+
+By contributing you agree your contributions are MIT-licensed under the same terms as the rest of the project.

Dockerfile

@@ -0,0 +1,52 @@
+### --- deps ---
+FROM node:20-alpine AS deps
+WORKDIR /app
+RUN apk add --no-cache libc6-compat
+COPY package.json pnpm-lock.yaml* ./
+RUN corepack enable && \
+    (pnpm install --frozen-lockfile || pnpm install --no-frozen-lockfile)
+
+### --- builder ---
+FROM node:20-alpine AS builder
+WORKDIR /app
+ENV NEXT_TELEMETRY_DISABLED=1
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+RUN corepack enable && \
+    pnpm drizzle-kit generate && \
+    pnpm build
+
+### --- runner ---
+FROM node:20-alpine AS runner
+WORKDIR /app
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+ENV PORT=3000
+ENV HOSTNAME=0.0.0.0
+
+RUN apk add --no-cache bash && \
+    addgroup -S nodejs && adduser -S nextjs -G nodejs && \
+    mkdir -p /data/uploads && chown -R nextjs:nodejs /data
+
+# Next.js standalone output
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/public ./public
+
+# Migrations + setup scripts (we still need tsx at runtime → keep node_modules of scripts deps)
+COPY --from=builder --chown=nextjs:nodejs /app/drizzle ./drizzle
+COPY --from=builder --chown=nextjs:nodejs /app/scripts ./scripts
+COPY --from=builder --chown=nextjs:nodejs /app/lib ./lib
+COPY --from=builder --chown=nextjs:nodejs /app/drizzle.config.ts ./drizzle.config.ts
+COPY --from=builder --chown=nextjs:nodejs /app/tsconfig.json ./tsconfig.json
+COPY --from=deps    --chown=nextjs:nodejs /app/node_modules ./node_modules-full
+
+# Replace standalone's slim node_modules with the build's full one (needed for tsx-based scripts)
+RUN rm -rf node_modules && mv node_modules-full node_modules
+
+ENV UPLOADS_DIR=/data/uploads
+
+USER nextjs
+EXPOSE 3000
+
+CMD ["sh", "-c", "node --import tsx scripts/migrate.ts && node --import tsx scripts/bootstrap-admin.ts && node --import tsx scripts/seed-exercises.ts && node --import tsx scripts/seed-templates.ts && node server.js"]