Add HaVeWa

[fgilde]

New app: HaVeWa

What it is: property-management software for rental and HOA (WEG, the German form of condominium
ownership) administration, with its own PostgreSQL in the same app. Properties, units, people and
meters; leases with stepped and index rent and deposits; charges, payments, open items, SEPA mandates
and dunning; service-charge statements with a BetrKV allocation engine; co-ownership shares, economic
plan, HOA fees, annual statement and reserves; owners' meetings with agenda, voting and resolution
collection; documents; maintenance tickets with workflow and time tracking; tenant and owner portals;
camt.053 import and DATEV/SEPA export. Multi-tenant, role-based, bilingual (German and English), with
a REST API and an MCP server for AI agents.

• Project: https://github.com/fgilde/hausverwaltung
• Docs: https://fgilde.github.io/hausverwaltung/docs/
• Image: ghcr.io/fgilde/hausverwaltung (GHCR, public)
• Licence: AGPL-3.0

What is in the PR

Apps/HaVeWa/

File
docker-compose.yml	the app on 3010 → container 3000, plus postgres:16-alpine on a havewa-network, data under /DATA/AppData/$AppID/{storage,db}
icon.png	256×256
thumbnail.png, screenshot-1..3.png	1568×884: the dashboard, a service-charge statement, the HOA view

Metadata: id: org.gilde.havewa, main: havewa, category Productivity, index: /,
port_map: "3010", architectures amd64, version: 0.3.0, title, tagline and description in
en_US and de_DE, a tips.before_install, and website / repo / support / docs.

The secret in the package is a placeholder

AUTH_SECRET signs the login sessions, and the database has a password. Both are values generated
for this package rather than words every install would share, and the before_install tip asks the
user to replace AUTH_SECRET in the install dialog (openssl rand -base64 32). There is no default account: the first visit opens a setup wizard that
creates the administrator, and SEED_DEMO=true is the documented opt-in for the demo data set with
its known login. No host paths, no socket, no privileged mode.

Validation

• docker compose config -q on the app: clean.
• ./scripts/build_dist.sh against a source tree containing this app: builds, and index.json gains
  org.gilde.havewa with the expected title, tagline, category, architectures, icon, thumbnail and
  version; apps/org.gilde.havewa/ has docker-compose.amd64.yml, meta.json and meta.de_DE.json.
  (Building the whole store on my Windows machine segfaults inside build_appstore.py regardless of
  this app; the same run over the other apps is unaffected by this PR.)
• The app and postgres:16-alpine were started together with this environment and network: the
  schema migrates on first start (43 tables), the first visit shows the setup page rather than a
  login with default credentials, and a restart keeps the database.

Architecture

amd64 only, and architectures says so.

About the SonarCloud check

SonarCloud marks the credential in the compose file as a hardcoded secret. It is right that the
value is in a public file, and there is no way around that here: CasaOS has no generator for install
time, and the app needs the value to start with a login rather than without one. The apps already in
this store solve it the same way (ArchiveBox ships ADMIN_PASSWORD=casaos, Docmost a literal
POSTGRES_PASSWORD and APP_SECRET). The before_install tip asks the user to replace it, and the
field is editable in the install dialog. Happy to change the approach if you would rather have it
some other way.

[sonarqubecloud]

Quality Gate failed

Failed conditions
E Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE