Add Coworkee

[fgilde]

New app: Coworkee

What it is: self-hosted HR software for one company, in the spirit of Personio or HR-Works, with
its own PostgreSQL in the same app. Employees with a searchable directory, profiles and an org chart;
absence with leave balances and a request-and-approval workflow; time tracking; documents in
access-controlled storage; onboarding checklists; performance goals and reviews; an HR analytics
dashboard; a recruiting pipeline; and a news feed with in-app notifications. Role-based access
(ADMIN, HR, MANAGER, EMPLOYEE), light and dark mode, an audit log for every HR write action, and the
whole interface in English and German.

• Project: https://github.com/fgilde/CoworkeeNextJs
• Website: https://coworkee.de
• Image: ghcr.io/fgilde/coworkeenextjs (GHCR, public)
• Licence: AGPL-3.0

What is in the PR

Apps/Coworkee/

File
docker-compose.yml	the app on 3020 → container 3000, plus postgres:16-alpine on a coworkee-network, data under /DATA/AppData/$AppID/{storage,db}
icon.png	256×256
thumbnail.png, screenshot-1..3.png	1568×884: the dashboard, the employee directory, absence

Metadata: id: org.gilde.coworkee, main: coworkee, category Productivity, index: /,
port_map: "3020", architectures amd64, version: 1.1.2, title, tagline and description in
en_US and de_DE, a tips.before_install, and website / repo / support / docs.

No default account, and the secret is a placeholder

AUTH_SECRET signs the login sessions, and the database has a password. Both are values generated
for this package rather than words every install would share, and the before_install tip asks the
user to replace AUTH_SECRET (openssl rand -base64 32). DEMO is
empty, so the first visit opens a setup wizard that creates the administrator — there is no default
login. No host paths, no socket, no privileged mode.

Validation

• docker compose config -q on the app: clean.
• ./scripts/build_dist.sh against a source tree with this app: builds, and index.json gains
  org.gilde.coworkee with the expected title, tagline, category, architectures, icon, thumbnail and
  version; apps/org.gilde.coworkee/ has docker-compose.amd64.yml, meta.json and
  meta.de_DE.json.
• The app and postgres:16-alpine were started together with this environment and network: the
  schema is created on first start (49 tables), the app answers on the published port and shows the
  setup page rather than a login with default credentials, and a restart keeps the database.

Architecture

amd64 only, and architectures says so.

About the SonarCloud check

SonarCloud marks the credential in the compose file as a hardcoded secret. It is right that the
value is in a public file, and there is no way around that here: CasaOS has no generator for install
time, and the app needs the value to start with a login rather than without one. The apps already in
this store solve it the same way (ArchiveBox ships ADMIN_PASSWORD=casaos, Docmost a literal
POSTGRES_PASSWORD and APP_SECRET). The before_install tip asks the user to replace it, and the
field is editable in the install dialog. Happy to change the approach if you would rather have it
some other way.

[sonarqubecloud]

Quality Gate failed

Failed conditions
E Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE