Introduction

Welcome to TaskMinder: an open source platform built to simplify school organization and improve collaboration between students, teams, and classes.

TaskMinder combines planning, communication, and file handling in one place, so you spend less time switching between tools and more time focusing on your actual work.

With TaskMinder, you can:

• Track homework, lessons, events, and substitutions in a structured way.
• Collaborate with classmates through shared class and team workflows.
• Upload and manage files relevant to your school tasks.
• Keep important information synchronized and accessible across your school setup.

Whether you are setting up TaskMinder for local development, self-hosting it for production, or just exploring the project, this documentation will guide you step by step.

• Development setup: Start your local environment by following the development guide.

• Production deployment: Deploy TaskMinder in production with the deployment guide.

You can explore the project on GitHub: https://github.com/Taskminder/TaskMinder

If you want a quick preview, visit: https://taskminder.de

Thanks for using TaskMinder! We hope it helps make school organization simpler, clearer, and more reliable for everyone involved.

Development

Warning

This guide outlines the current development process and is intended for contributing to the develop branch.
It may differ from the steps used in the latest stable release.

This guide outlines the steps necessary to set up your development environment for TaskMinder. This includes installing redis, PostgreSQL, bun with optional setup for ClamAV, Ghostscript and mdbook (requires rust and cargo).

Warning

Please make sure to review our license before contributing to the project!

Note

Windows is currently not supported, as the primary development and testing of this tool are carried out on Linux and macOS platforms. This may result in compatibility issues or unexpected behavior when attempting to run the server on Windows.

Installing Redis and PostgreSQL

Recommended versions: PostgreSQL 18.6+ and Redis v8.8+ (Redis Open Source).

# Redis setup is covered in the installation guide
sudo systemctl enable redis-server
sudo systemctl start redis-server
# PostgreSQL setup – this part is often not included in guides
sudo systemctl enable postgresql
sudo systemctl start postgresql

sudo apt-get update
sudo apt-get install redis
sudo service redis-server start

sudo apt-get update
sudo apt-get -y install postgresql
sudo service postgresql start

Installing Bun

Bun is required for this project.

To check if it’s already installed, run:

bun --version

You should see at least Bun 1.4 (last checked: August 24th, 2026).

If not installed, retrieve the download instructions from the Bun Download Page. For Github Codespaces, follow the npm instructions under the Mac/Linux Tab.

Installing ClamAV and Ghostscript - optional

This step installs the tools that scan files uploaded to the server. This is optional for development environments, as you typically wouldn’t enable scanning in that context. However, if you’re developing or testing upload functionality, please install these tools to ensure your code changes work correctly with the scanning pipeline.

sudo apt install clamav clamav-daemon -y

# Github Codespaces
sudo service clamav-freshclam stop
# Ubuntu/Debian (Linux)
sudo systemctl stop clamav-freshclam

# fetches the latest virus signatures from ClamAV's servers
sudo freshclam

# Github Codespaces
sudo service clamav-freshclam start
sudo service clamav-daemon start
# Ubuntu/Debian (Linux)
sudo systemctl enable clamav-freshclam
sudo systemctl start clamav-freshclam
sudo systemctl enable clamav-daemon
sudo systemctl start clamav-daemon

sudo apt install ghostscript -y
gs --version

brew install clamav

brew list clamav
clamscan --version

cd /opt/homebrew/etc/clamav
cp clamd.conf.sample clamd.conf
cp freshclam.conf.sample freshclam.conf

nano /opt/homebrew/etc/clamav/clamd.conf

# Where the database files are stored
DatabaseDirectory /opt/homebrew/var/lib/clamav
    
# Temporary directory
TemporaryDirectory /tmp
    
# Log file location
LogFile /opt/homebrew/var/log/clamav/clamd.log
LogFileMaxSize 5M
    
# Local socket (used by clamdscan)
LocalSocket /opt/homebrew/var/run/clamav/clamd.sock
FixStaleSocket yes
    
# Run as daemon
Foreground no

nano /opt/homebrew/etc/clamav/freshclam.conf

DatabaseDirectory /opt/homebrew/var/lib/clamav
UpdateLogFile /opt/homebrew/var/log/clamav/freshclam.log
DatabaseOwner _clamav
Checks 12

sudo mkdir -p /opt/homebrew/var/lib/clamav
sudo mkdir -p /opt/homebrew/var/log/clamav
sudo mkdir -p /opt/homebrew/var/run/clamav
sudo chown -R $(whoami) /opt/homebrew/var/{lib,log,run}/clamav

freshclam

brew services start clamav

brew install ghostscript
gs --version

Clone Repository and Install Bun Packages

Visit the repo at https://github.com/TaskMinder/TaskMinder and fork it.

Then, on your local machine, choose a directory and run:

git clone https://github.com/YOUR_GITHUB_USERNAME/TaskMinder.git
cd TaskMinder

Replace YOUR_GITHUB_USERNAME with your actual GitHub username.

Install all dependencies:

bun install

Initialize the Database

Before using the database, you need to log into the PostgreSQL terminal (psql) and create a database. It’s also recommended to change the default postgres password.

Replace your_db_name with your actual database name.

sudo -u postgres psql
\password

CREATE DATABASE your_db_name;

psql postgres
\password

CREATE DATABASE your_db_name;

sudo su postgres
psql postgres
\password

CREATE DATABASE your_db_name;

Create the .env File

To securely manage credentials, create a .env file in the root directory of your project. Use the .env.example file located in the root folder as a reference.

Setup mdbook (documentation) - optional

Follow the official guide: Installation mdbook. mdbook requires rust and cargo.

Applying database changes

Run bunx prisma migrate dev to apply schema changes from previously pulled commits to your local database. You should also run this command during development if the schema has been modified.

If you make changes to the schema while developing—especially on a feature branch—don’t forget to generate a migration file. Otherwise, your changes might be lost or overwritten when switching branches (e.g., to develop or main).

Start the Server

Run this command to compile the typescript code and start the development server:

bun run build
bun run dev

Notes:

• You can manually compile the code by running bun run build, or use bun run build:fe and bun run build:be to compile the frontend and backend separately. After building, start the server with bun run dev.

• We use linting/formatting tools to maintain code quality. To use ESLint and Prettier (frontend only) on this project, simply run: bun run lint (NOT bun run lint .!).

• When updating the Prisma schema, remember to run bunx prisma generate to regenerate the client and TypeScript types in node_modules/. Before committing your changes, make sure to run bunx prisma migrate dev to create and apply the necessary migration files to your local database—skipping this step may result in broken or inconsistent code.

Deployment

What you’ll need

• A valid domain (e.g. taskminder.de)
• A server (minimum 2GB RAM and 20GB storage) running Ubuntu (≥ 24.04 LTS) with sudo or root access
• The codebase of TaskMinder from https://github.com/TaskMinder/TaskMinder

1. DNS Configuration

Before proceeding with the server setup, configure your domain to point to your Ubuntu server.

Get Your Server’s Public IP Address

On your server, run:

curl ifconfig.me

Copy the returned IP (e.g., 203.0.113.42). Make sure the server is not behind a router. The following guide will use this example IP — replace it with your actual IP.

Configure DNS Records

Go to your domain registrar’s DNS management page (e.g., Namecheap, GoDaddy, Cloudflare etc.) and add the following records:

This assumes you’re using example.com and want www.example.com to also work.

We also use a subdomain for monitoring (monitoring.example.com) and a subdomain for a status page.

We use https://betterstack.com/ as it offers custom subdomains for the status page, but you may choose another provider. After setting up the status page, follow BetterStack’s instructions to configure the CNAME record.

For the monitoring page (monitoring.example.com), add the following record:

Wait for Propagation

DNS propagation can take a few minutes to several hours. Use tools like:

• https://dnschecker.org

Once your domain resolves to your server’s IP, proceed to the next step.

2. Install Required Packages

Update and install dependencies:

This installs (if not already installed) Git, curl, NGINX, libnginx-mod-http-lua (for Lua in NGINX), lua-cjson (for NGINX), gettext-base (provides envsubst, used to render the NGINX template), UFW, and Fail2Ban:

sudo apt update && sudo apt upgrade -y
sudo apt install -y git curl nginx ufw fail2ban libnginx-mod-http-lua lua-cjson gettext-base

Verify lua was installed and is enabled:

See if the module was auto-enabled, if not, enable it first before proceeding:

ls /etc/nginx/modules-enabled/ | grep lua

Install Docker and Docker Compose:

Follow the official Docker documentation to install Docker and Docker Compose:

🔗 https://docs.docker.com/engine/install/ubuntu/

Enable and start Docker

sudo systemctl enable docker
sudo systemctl start docker

Enable and configure firewall (UFW)

sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable

Configure Fail2Ban

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Check status:

sudo fail2ban-client status

3. Clone the Project from GitHub

cd /opt
sudo git clone https://github.com/TaskMinder/TaskMinder.git
cd TaskMinder

4. Configure NGINX

NGINX terminates TLS and routes the four hostnames to their containers. It does not serve static files or set cache rules and security headers, as the containers already do that themselves.

The repository contains nginx.config.template instead of a finished config. You render it with your own hostnames, as shown below.

Install Certbot and Obtain SSL Certificates

Install Certbot and its NGINX plugin:

sudo apt install -y certbot python3-certbot-nginx

Run Certbot to obtain SSL certificates (replace example.com and subdomains with your actual domains):

sudo certbot -d example.com -d app.example.com -d www.example.com -d monitoring.example.com

Certbot will automatically update the configuration file at /etc/nginx/sites-available/default. Delete this file, as you’ll be using your custom config instead. Also, delete the symlink: sudo rm /etc/nginx/sites-enabled/default

Store the certificate paths in one file

Every server block uses the same TLS settings. Put them in one file instead of repeating them (replace example.com with the certificate name Certbot reported):

sudo tee /etc/nginx/taskminder-tls.conf > /dev/null <<'EOF'
ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
EOF

Add Gzip and Lua settings in the main /etc/nginx/nginx.conf

Open the main nginx configuration file:

sudo nano /etc/nginx/nginx.conf

Inside the http { } block, comment out all related gzip lines, as we will be using it for compression work. Furthermore, add this line in the http block:

##
# Lua Maintenance Flag Setting
##
lua_shared_dict maintenance_flag 1m;

Deploy Your Final NGINX Configuration

Install the shared proxy headers, then render the template with your hostnames:

# Proxy headers, the same in every environment
sudo cp /opt/TaskMinder/nginx.proxy-headers.conf /etc/nginx/taskminder-proxy.conf

# Render the site config (replace example.com with your base domain)
LANDING_HOST=example.com \
WWW_HOST=www.example.com \
APP_HOST=app.example.com \
MONITORING_HOST=monitoring.example.com \
TLS_INCLUDE=/etc/nginx/taskminder-tls.conf \
envsubst '${LANDING_HOST} ${WWW_HOST} ${APP_HOST} ${MONITORING_HOST} ${TLS_INCLUDE}' \
  < /opt/TaskMinder/nginx.config.template \
  | sudo tee /etc/nginx/sites-available/taskminder > /dev/null

# Enable and test the configuration
sudo ln -s /etc/nginx/sites-available/taskminder /etc/nginx/sites-enabled/
sudo nginx -t

# Restart NGINX to apply changes
sudo systemctl restart nginx

The variable list after envsubst is required. Without it, envsubst also replaces NGINX’s own $host and $request_uri with empty strings.

Re-run the same command after pulling a new version of the template.

Point the project page at your application hostname

The project page redirects unknown paths and its own /join and /about links to the application. compose.yaml ships APP_HOST: app.taskminder.de, which is only correct for the official deployment.

Do not edit compose.yaml itself — it is tracked, so the next git pull will either conflict with your edit or revert it. Create a compose.override.yaml next to it instead. Docker Compose merges that file automatically, and because it is untracked it survives every pull:

cat > /opt/TaskMinder/compose.override.yaml <<'EOF'
services:
  landing:
    environment:
      APP_HOST: app.example.com
EOF

Verify the value actually reached the container once the stack is up:

curl -sI http://127.0.0.1:3002/main | grep -i "^location"
# must print your own application host, not app.taskminder.de

5. Set Up Non-Root User

Running as root means a compromised container could gain full system access. It is highly recommended to run the server as a non-root user (least privilege). We’ll use the name ubuntu for this guide, but you may choose another name.

sudo adduser ubuntu
sudo usermod -aG sudo ubuntu
sudo usermod -aG docker ubuntu

If adduser fails, the user likely already exists (common on cloud providers like AWS or DigitalOcean). In that case, just add them to the docker group:

sudo usermod -aG docker ubuntu

Give the user access to the project folder:

sudo chown -R ubuntu:ubuntu /opt/TaskMinder

Log out and reconnect as the ubuntu user:

exit
ssh ubuntu@<your-ip-address>

For enhanced security, use SSH key-based authentication instead of password-based logins to reduce the risk of unauthorized access. After adding your SSH key and verifying the connection, disable both root logins and password authentication:

Edit and/or uncomment the following lines in /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no

Then restart SSH:

sudo systemctl restart ssh

6. Automated Backup Setup (via Cron)

Make the Backup Script Executable

The cron service needs permission to run the script. You only need to do this once.

chmod +x /opt/TaskMinder/backup-cmds/db_backup.sh

Add the Job to Crontab

This will schedule the script to run automatically.

Open the crontab editor for the current user:

   crontab -e

Add the following line to the bottom of the file, then save and exit:

   0 * * * * /opt/TaskMinder/backup-cmds/db_backup.sh >> /var/log/backup.log 2>&1

Verify the Setup

Confirm the job was added successfully by listing the active cron jobs:

   crontab -l

You should see the line you just added.

7. Add Docker Secrets and .env.production

Navigate back to the TaskMinder folder and create directories for secrets and backups:

cd /opt/TaskMinder
mkdir docker_secrets
mkdir db-backups

Before starting the application, create the following text files inside the docker_secrets/ folder. These files are used as Docker secrets for configuration:

8. Run Docker Compose and reset git changes

Navigate to the project root and build/start the containers:

cd /opt/TaskMinder
docker compose up -d --build

Reset git changes:

git reset --hard

And build/start the containers again:

docker compose up -d --build

9. TaskMinder Deployment Complete

Your TaskMinder server should now be running at:

• https://example.com
• https://app.example.com
• https://www.example.com
• https://monitoring.example.com

10. What’s Next?

• Create an account to set up a class and add your subjects, teams, and timetable.
• Visit https://monitoring.example.com to change the default password “admin” to a secure one. You’ll be prompted to do this upon your first login.

11. Subsequent Updates

This guide covers minor version upgrades. For major version upgrades, please refer to the relevant migration guides to check for any breaking changes. Before upgrading, enable maintenance mode by adding a file flag with:

touch /etc/nginx/maintenance.flag

1. Navigate to the root folder of the project and stop the app service. The project page runs in its own container, so it keeps serving while the application is down:

   docker compose stop app
   

   Do not use docker compose down here, as it would stop the project page as well.

2. Pull the latest changes from the main branch on GitHub:

   git pull origin main
   

3. Rebuild and restart the Docker containers. The project page image is rebuilt too, as it comes from the same frontend build:

   docker compose up -d --build
   

   If the frontend changed, the project page image changes with it and Compose recreates that container as well. The project page is therefore unreachable for the second or two the new container needs to start, and NGINX serves maintenance.html for that window rather than a 502. Only the application is covered by the maintenance flag; the project page relies on this fallback.

4. Disable maintenance mode:

   rm /etc/nginx/maintenance.flag
   

If the application stops or crashes without the flag set, NGINX still serves maintenance.html instead of a 502.

Data Processing

Introduction

This document provides a comprehensive overview of data processing practices for our educational management system. As part of our commitment to data protection and privacy compliance (GDPR/DSGVO), we document what personal and operational data is intentionally collected, stored, and processed, as well as identify potential unintentional data capture points across all system tables.

Scope

This documentation describes all database tables defined in the current Prisma schema, with particular attention to the processing of personal data and related privacy implications. It also details the data stored in the Redis-powered cache, as well as the information collected during server monitoring (logs).

Data Processing Analysis by Table

1. Account Table

Purpose: User authentication and access management.

Privacy Concerns:

• Usernames might contain real names or other identifying information.
• Password security is critically dependent on the strength and implementation of the hashing algorithm.
• Personal data (username, password) is retained after the user has initiated deletion, creating a risk if the cleanup process fails.

Solutions:

• Hashing using bcrypt: bcrypt automatically generates a unique random salt per password, making rainbow table attacks ineffective. We use a sufficient number of salt rounds (SALT_ROUNDS = 10).
• Implemented a robust, automated cron job to ensure permanent deletion after the 30-day period.

2. Class Table

Purpose: Defines a class, acting as a central hub for all related data like students, subjects, events, homework and upload data.

Privacy Concerns:

• Class centralizes all student data, making profile-building easier.

Solutions:

• Implemented change class code function/button for class members.
• Implemented strict access controls for rows containing third-party credentials.
• Implemented secure (aes-256-gcm) server-side encryption for class codes, 3rd-party (DSB Mobile) migration coming soon

3. Event & EventType Tables

Purpose: Management of class-specific events (e.g., exams, holidays) and their categories.

Privacy Concerns:

• Free-text fields (name, description) are high-risk for unintentional storage of personal data.
• The combination of event data, when linked to a Class, can reveal detailed schedules and activities for a specific group of students.
• For private events, accountId links the event and its contents to the owning account and restricts visibility to that user.

Solutions:

• Provided clear guidance or input masks to discourage users from entering personal data in event names and descriptions.
• Regularly audit event data for inappropriate content.

4. Homework & HomeworkCheck Tables

Purpose: Management of homework assignments and tracking student completion.

Privacy Concerns:

• The HomeworkCheck table creates a direct, persistent record of individual student performance and behavior (completion status).
• This data is highly valuable for academic analytics but is privacy-sensitive and can be used for student profiling.
• For private homework, accountId links the assignment and its contents to the owning account and restricts visibility to that user.

5. JoinedClass & JoinedTeams Tables

Purpose: Manage the relationship between Accounts and the Class or Team they belong to.

Privacy Concerns:

• Social Graph: The JoinedTeams table explicitly maps out social connections and group affiliations within a class, which can be highly sensitive.
• This data can be used to analyze social dynamics, peer relationships, and potential cliques.

6. Lesson Table

Purpose: Defines the weekly class schedule, including subjects, times, and locations.

Privacy Concerns:

• The combination of fields in this table allows for the reconstruction of a detailed daily schedule for student groups, including their physical location (room) at specific times.

7. Subjects Table

Purpose: Stores information about school subjects and their assigned teachers for a specific class.

Privacy Concerns:

• Teacher’s Personal Data: This table directly stores identifiable personal data about teachers (teacherNameLong, teacherNameShort, teacherGender).
• Consent: Ensure teacher consent is obtained for storing and displaying this information.

8. Team Table

Purpose: Defines a specific group (team) within a class.

Privacy Concerns:

• The name of a team could imply academic level, behavioral status, or other sensitive classifications about its members.

9. Upload & FileMetadata Tables

Purpose: Management of file uploads, upload requests and their metadata. An upload can contain one or multiple files.

Privacy Concerns:

• Content Profiling: The combination of uploadName, uploadDescription, uploadType, mimeType, and size can create detailed profiles of what type of content users and teams are sharing.
• User Attribution: The accountId field directly links uploaded content to specific users, creating a permanent record of who shared what.
• Team Dynamics: Upload patterns (frequency, size, type) can reveal team collaboration dynamics and potentially identify active vs. inactive members.
• Temporal Tracking: Timestamps enable detailed analysis of when users are active and how they collaborate over time.

Solutions:

• Implement strict file type validation and size limits to prevent abuse.
• Ensure errorReason messages are sanitized and do not expose sensitive details.
• Implement retention policies for old uploads and automatic cleanup.
• Monitor storage usage patterns to detect potential abuse.

Cross-Table Privacy Risks

The Class schema as a central entity increases cross-table risks.

1. Granular Profile Building

Combining data across tables enables the creation of highly detailed user profiles:

• Student Profile: Academic performance (HomeworkCheck) + social connections (JoinedTeams) + daily schedule and location (Lesson) + specific activities (Event). All this data can be correlated through a combination of accountId and classId.

2. Behavioral and Social Analytics

• The normalized structure allows for analytics on student behavior, such as correlating homework completion (HomeworkCheck) with team membership (JoinedTeams) or specific lessons (Lesson).
• Social network graphs can be generated from the JoinedTeams and Account tables, revealing peer influence and group dynamics.

Data Collected and Stored in Redis and Telemetry Systems (Prometheus/Loki)

Redis

Our Redis architecture serves as a cache to temporarily store data, reducing database load and improving performance. Cached data is automatically cleared when the corresponding data is deleted from the database. The following types of content are stored:

• Homework, events, lessons, timetables, teams, substitutions and upload metadata for each class
• Authenticated user and class information
• User sessions (from express-session)

Telemetry Data

To maintain and improve our service quality, we collect certain telemetry data, which is stored in server logs:

• Date and time of the request
• Endpoint path and HTTP method
• HTTP status code
• Size of the returned data
• Referrer information
• User agent details (e.g., browser name and version, operating system, etc.)

Retention: Logs are stored for 14 days (±2h) and are permanently deleted thereafter.

• Document Version: 2.6
• Stable Version Alignment: v2.3.0
• Last Updated: July 22nd, 2026
• Next Scheduled Review: Quarterly – September 1st, 2026
• Technical Contact: info@taskminder.de

Redis Cache Architecture

Introduction

TaskMinder uses one Redis instance (redisClient) for four things:

1. Data cache: read-through caches of database query results, namespaced under cache:.
2. Auth gates: short-lived existence/validity flags that throttle account/class checks.
3. Sessions: the express-session store plus a per-class reverse index.
4. Job queue: a list used to hand file-processing jobs to a worker.

The connection, key-prefix constants, and queue helpers live in backend/src/config/redis.ts.

Key Naming Conventions

Data cache keys

All data-cache keys are built by generateCacheKey(baseKey, classId, accountId?):

cache:<baseKey>:<classId>                  // shared (class-wide) partition
cache:<baseKey>:<classId>:acc:<accountId>  // personal (per-account) partition

• <baseKey> is one of the CACHE_KEY_PREFIXES values (see table below).
• The :acc:<accountId> suffix only applies to caches with a personal partition (currently homework and events).
• Omitting accountId addresses the shared partition; passing it addresses one account’s personal partition.
• Exception: for substitutions, <classId> actually holds dsbMobileUser (the DSB Mobile login), since substitution data is keyed per school, not per class. site_statistics is a further exception; see below.

Other namespaces

1. Data Cache

Read-through, write-on-miss caches of Prisma query results. A hit returns the parsed JSON directly; a miss queries the database, writes the result back with a TTL, then returns it. BigInt values are serialized to strings via a custom replacer.

The standard TTL (cacheExpiration) is 3600 s (60 min). Three keys deviate:

• event_type_styles stores a pre-rendered CSS string rather than a row array, so it can be served straight to the client.
• substitutions_data uses stale-serve and a variable TTL; see below.
• site_statistics is a single global key with no <classId> slot, built directly (cache:${CACHE_KEY_PREFIXES.STATISTICS}) rather than via generateCacheKey, since /stats aggregates across the whole database rather than one class. Its 300 s TTL (statisticsCacheExpiration) matches the route’s Cache-Control: public, max-age=300 header, so server- and client-side staleness stay in sync. Like substitutions, it is never explicitly invalidated: class/homework/event writes happen across too many unrelated code paths for a targeted del to be worthwhile, so it relies on the TTL alone.

Personal vs. shared partitioning (homework & events)

Homework and events are split into two partitions: a shared partition (accountId = null, team-scoped, one key per class) and a personal partition (one key per account, :acc:<accountId>).

The read path fetches both partitions, merges them, and re-sorts to preserve the canonical ordering. Anonymous/account-less viewers only ever receive the shared partition. Writes invalidate only the partition they touched: the shared key when accountId is null, otherwise just the affected account’s personal key, keeping cache busts surgical.

Substitutions cache

Substitution data is fetched from the external DSB Mobile service and relies entirely on TTL, stale-serve, and prefetch rather than explicit invalidation:

• Value envelope: { data, timestamp } rather than a bare array, so freshness can be evaluated independently of the Redis TTL.
• Variable TTL: 60 s during the peak window (weekdays 06:00-09:00 local), 600 s otherwise.
• Stale-serve: if a live fetch from DSB Mobile fails, the previously cached entry is served instead of erroring.
• Prefetch: a background job warms the cache for every DSB-activated school (deduplicated by dsbMobileUser, processed in batches of 5) so peak-time reads hit a warm cache.

2. Auth Gates

Negative-lookup-avoidance flags that throttle “does this account/class still exist?” checks to once per 15 minutes instead of once per request. On a miss, the middleware queries Postgres to confirm existence (and, for accounts, that deletedAt is null), then writes the flag.

A soft-delete (deletedAt) without an accompanying del only takes effect once the flag expires, so a soft-deleted account can keep passing the gate for up to 15 minutes. Hard deletes invalidate the gate explicitly.

3. Sessions

The express-session store is implemented by RedisStore in backend/src/config/redis.session.ts.

class_sessions:<classId> is a reverse index that lets the application find and destroy all sessions for a given class (e.g. on class cleanup). Its members are kept in sync on session set/destroy/touch, its TTL is bumped to at least the longest active member session, and stale members are lazily pruned when the set is read.

4. Job Queue

Producers enqueue file-processing jobs with queueJob; the upload worker drains them with dequeueJob. Jobs are JSON-serialized.

Release Notes

All changes are grouped by type and the latest version appears first.

[v2.3.1] - 2026-09-15

Added

• feat(subject): allow class managers to assign subjects to all students or to a specific team

Fixed

• fix(bigint): serialize BigInt values consistently in API responses and Redis payloads, regardless of cache state
• fix(settings): update logged-out user permissions for the active class instead of a hard-coded class ID
• fix(legacy): show the legacy-origin notice using the Bootstrap toast API

Changed

• chore(subject): filter timetable and homework subject choices based on joined teams
• chore(team): show only joined teams in event, homework, and upload selectors, and sort teams alphabetically
• chore(timetable): include teacher names when duplicate subject names need to be distinguished
• chore(landing): link app actions and legal pages to app.taskminder.de
• chore(packages): bump packages

[v2.3.0] - 2026-09-12

Breaking Changes

• chore(codebase): migrate to typescript v6 (use oxlint workaround to satisfy prisma > v6)
• chore(license): change custom source-available TaskMinder to open source AGPLv3 license
• chore(app): separate application and landing page into app.taskminder.de and taskminder.de

Added

• chore(dev): add dev mode to /bootstrap to avoid caching issues in development
• feat(homework/events): add personal homework and events
• feat(uploads): add improved preview and support for more file types

Fixed

• fix(team): prevent authenticated users from modifying teams in arbitrary classes
• fix(session): revoke session cookie when user is removed from class to prevent continued access

Changed

• chore(ui/upload): improve upload files UI
• chore(ui/ux): combine icons into dot menu for homework and events
• chore(readme): add banner, social media and info page notice
• chore(packages): bump packages (npm, docker, ci)

[v2.2.6] - 2026-06-04

Breaking Changes

• chore(codebase): migrate to typescript 6 (locking in on v5 due to prisma issues)
• chore(prisma): migrate to prisma 7
• chore(session): migrate from connect-pg-simple to custom redis store

Added

• feat(upload): add .md, .csv and .mp3 file upload support in backend
• feat(info): add info box with link to info.taskminder.de at /join

Fixed

• fix(class): admin can delete members of other classes
• fix(middleware): pdf view fails on safari due to missing blob: for frame-src and connect-src
• fix(substitution): reduce substitution prefetch cache from 60min to 1 min (peak times) and 10 min (off-peak times)
• fix(csrfToken): do not issue csrfTokens eagerly, only when /csrf-token is requested

Changed

• chore(env): add centralized .env variable loader and config
• chore(packages): bump packages (npm, docker, gh-actions)
• chore(docs): use built-in admonitions in mdbook
• chore(impressum/dsgvo): update Impressum and DSGVO to distinguish more clearly between “Betreiber” and legal representative

[v2.2.5] - 2026-04-12

Breaking Changes

• chore(db): migrate postgresql@14 to postgresql@18
• feat(encryption): add server-side encryption

Added

• feat(frontend): add caching and offline mode
• feat(maintenance): add maintenance mode
• feat(animation): add animations, add specific calendar animation
• feat(warnings): add suspicious settings warnings
• feat(upload): add upload description and request new uploads
• feat(upload): edit files
• feat(homework/event/upload): add homework/event/upload pinning
• feat(upload): file-input as pretty wrapper for drag&drop and browse file input with preview list
• chore(homework): add “later” section
• chore(ui): show breaks in the timetable and correctly display them (respect events/substitutions)

Fixed

• fix(rate-limit): proxy setting and update nginx.config
• fix(subject): subject data not stringified correctly
• fix(account): send 201 instead of 200 at /register
• fix(links): /main links to events/homework do not use pjax
• fix(homework/check): homework check on /main does not work
• fix(navbar/login): login button in navbar does not always show up
• fix(richtextarea): allow multiple spaces in rich textarea
• fix(search): search in plaintext not styled rich textarea text

Changed

• chore(scss): compressed scss for event type styles
• chore(frontend/cache): better caching for event type styles and files
• chore(frontend/logic): guess new subjectId for substitution
• chore(ux): copy unknown error server response & better request timeout error toast
• chore(ui): better appearance of substituted breaks
• chore(logging): improve error logs on server
• chore(ui): improve frontend class settings on mobile
• chore(upload/loading): add upload loading animation
• chore(substitution): change DSBMobile fetch to weekday peak time prefetch
• chore(api): rename and change method of API routes
• chore(password): bump password requirements
• chore(ui): make bottombar icons pop on click
• chore(ui): scroll to top on site change
• chore(substitution): replace axios with node fetch
• chore(substitution): use shared cache key per school, avoid redundant DSB API fetches for classes within the same school
• chore(frontend/logic): remove $.get and replace with modern fetch
• chore(ui): change filter interface to modal and offcanvas (mobile)
• chore(tableview): improve table layouts for events & uploads
• chore(csp): remove csp .env variable
• chore(getdata): event, homework and upload metadata order by more values
• chore(docs): migrate to mdbook and github actions/pages for deployment
• chore(sitemap): update sitemap values
• chore(migration): add migrate upload metadata date script
• chore(package): update package.json version to v2.2.5, bump packages, update CI
• chore(frontend): several bugfixes and smaller improvements
• chore(backend): several bugfixes and smaller improvements

[v2.2.4] - 2026-01-11

🎉 Happy New Year! This release kicks off the year with improvements and fixes to make TaskMinder smoother, faster, and more reliable. Thanks for your support—here’s to a productive year ahead!

Added

• feat(main): new homework view on /main
• feat(upload/event): add table/gallery view
• feat(upload/event/homework): add search boxes
• feat(timetable): suggest most used room for subject, add autocomplete markings
• chore(upload): add not supported note for download for webkit-standalone users

Fixed

• fix(homework): check animation does not show
• fix(homework): homework list renders twice
• fix(homework): homework button stays disabled
• fix(navbar): reload button does not properly show / hide
• fix(getTeamsData): data is not stringified with BigIntreplacer, leading to fetch errors
• fix(migration): demo class homework/event movement does not work
• fix(upload): upload not found change http code from 400 to 404
• fix(event/homework): events/homework can be changed/deleted through API even if not in class
• fix(event): check for valid eventTypeId before adding/editing events
• fix(checkhomework): homework of foreign classes can be checked through API

Changed

• chore(docs): update year to 2026
• refactor(class): rewrite 62base method to use randomInt from crypto package
• feat(event): singleflight deduplication for sass compilation of event styles
• chore(deps): update packages, allow bun > v1.3.5 again
• fix(rate-limit): increase global threshold to 125req/s

Removed

• chore(deps): remove express-async-handler in favor of native ts implemetation

[v2.2.3b] - 2025-12-14

Fixed

• fix(regression): homework checking is not consistent across page reloads on webkit clients (Safari)
• fix(regression): improved alloy config and better labelling
• chore(docker): bump monitoring stack packages

[v2.2.3a] - 2025-12-13

Fixed

• fix(regression): checking homework would display all homework of the last 60 days
• fix(regression): page did not load properly with content (grey screen)
• fix(linting): run linting in frontend folder

[v2.2.3] - 2025-12-12

Changed

• Backend: Invalidate cache at all update actions (edit, delete, set, etc.), only refetch if getting (GET) data
• Backend: Implement individual route rate-limiters
• Sys: Lock in bun on v1.3.3 (v1.3.4 has package installment issues) in production
• Frontend: Improve performance by listening directly on changed data instead of socket to update
• Frontend: Add explicit info box for data responsibility

Fixed

• Backend: Fix awaiting some async functions in backend

Security

• Package bumping

[v2.2.2] - 2025-11-30

Changed

• Backend now sends regex for substitution data directly
• Add 400 return codes if file is too large or too many files being uploaded
• Explanation for test class is now wrapped in an info box
• Added createdAt field to multiple tables
• Cache is now invalidated/refechted if corresponding data changes
• Change cron job delete test class schedule to run every 15mins
• Uploads now support autocomplete for lessons and date (at title)

Fixed

• Migrate from promtail (deprecated) to alloy
• (. Stunde) bug still existed in /main
• Certain lessons were not displayed in timetable
• “Heute kein Unterricht” (or the blue info box in general) did not always display immediately
• Improve production deployment regarding permissions (least privilege)
• Change host volume to named volume in docker compose to avoid permission errors
• Correct docs at db migration
• Fixed Adding/editing/checking homework will lead to displaying all homework (ignoring filters) of the last 90 days

Removed

• Redis volume as not needed anymore (cache-only)

Security

• Package bumping

[v2.2.1] - 2025-11-16

Fixed

• BigInts were not correctly serialized to JSON at /get_upload_metadata
• ClamAV did not work in production as intended
• Add object “self” to CSP headers to support upload viewing

[v2.2.0] - 2025-11-16

Added

• Add feature to upload files
• Timetable announcer, e.g. “Nächste Stunde Geographie in 48min in Raum 40983.”
• Randomly select one homework (spin wheel), exclude/include homework in selection (like vocab)
• Add easter egg in devTools
• Add “Angemeldet als…” in offcanvas
• Socket events for many real-time changes
• Add loading bar to simulate progress
• Add frontend feedback for timetable changes
• Move events and homework further along (1 week)

Fixed

• Fix bug where an account could not be deleted due to too early checks in backend
• Fix bug where teams could not be deleted due to wrong css selector in frontend
• Fix big where cache could return invalid or outdated data
• Fix bug where substitution cache would return No Data due to inconsistent thrid-party response
• Fix bug where “Neuer Nutzername” at change name is type=password

Changed

• Different text styles for more or less important things, misc. UI changes
• Marking of text now adapts to background of event, etc.
• Improved data loading to skip file calling when previously called (up to 2x less requests and data transferred)
• Use substitutionData when auto selecting date at addHomework, etc.
• /main links smaller (arrows)
• Improved out-of-bounds checks and additional barrier checks in the backend
• Improved caching for all relevant tables if one related thing is updated
• Migrate from custom logger to winston
• Require bun v1.3.2 (> v1.3) in development and production (no breaking changes)
• Renaming files in backend for readability
• Monitoring /metrics endpoint exposed to local network instead of public route
• Bump loki, prometheus, grafana, promtail (no breaking changes)
• Bump redis to v8 (no breaking changes)
• Increased deletion for homework from 60 to 90 days

Security

• Package bumping
• Close security issue with validator.js (removed)

Removed

• Remove unused packages
• Remove unused domain names from nginx config

[v2.1.0] - 2025-09-27

Added

• Add prisma.config.ts to Dockerfile
• Add event cleanup cron job (365 days)
• Tests for services in backend
• Accessibility features
• ToS

Fixed

• Fix bug where a joined class user (not logged in) visiting /join or / would get the hardcoded 10d - className value
• Fixed check for team/subject (now validates specific teamId, subjectId, and classId)

Changed

• Update documentation
• Scripts improvements through GITCMD and DOCKERCMD
• Frontend improvements
• Improve SEO
• Change classCode, className, upgrade test classes to normal classes

Removed

• Remove unused packages

[v2.0.0] - 2025-08-16

Breaking Change

• Database structure (please refer to the migration guide on docs.taskminder.de)

Added

• Functionality to create new classes (account required)
• Functionality to log out, delete account, change password and username
• Add autocomplete for due date and team selection as soon as subject is selected
• QR Code sharing of class code
• Copy paste for event/homework descriptions
• Add prisma transactions for safer database handling
• Add homework check animation
• Add sharing events with calendar
• Add soft deletion of accounts wth 30d auto delete from db
• Add permission levels (0,1,2,3) for classes with different permission levels
• Default setting for unregistered user and individual permissions for registered users
• Functionality to kick members from class
• Add 404 page

Changed

• Change formatter to eslint formatting instead of prettier
• Improve data loading on frontend side
• Improve production handling by introducing build and run stages in Dockerfile
• Rename tables for more generic usage
• Update nginx config for domain change and redirection
• Change calendar month view: show 2 weeks before & after selected, not the whole month
• Improve displayed dates (strings like tomorrow or weekdays)
• Move session check and class check to extra middleware with single source of truth check with db with redis caching
• Move vaidation (zod) layer from controller to seperate middleware

Fixed

Frontend

• Show more button on rich textarea not showing up
• No 404 result
• Multiple toast containers which overlap
• Homework checking is buggy on frontend
• Class settings: made more collapsible

Backend

• Server not restarting on change
• Move type packages to devDependencies in package.json
• Error on requesting unknown route

Security

• Package bumping

Removed

• Timetable validator, ajv package
• Compression package, compression now handeled by nginx

[v1.2.2] - 2025-07-14

Changed

• change domain to taskminder.de, update email to info@taskminder.de
• update default legal information

Fixed

• fix nginx config file and setup guide in documentation

[v1.2.1] - 2025-07-14

Added

• add codylon.de migration toast

Changed

• Increase timeout to 5 seconds
• migrate to extern sh script

Fixed

• sometimes no homework & events appear on their own site
• fix cache stringify issue

[v1.2.0] - 2025-06-10

Breaking Change - License

Users must review and comply with the updated license terms before updating or continuing use.

Added

• Migrated runtime environment from Node.js to Bun for improved performance and native support for TypeScript.
• Updated all scripts and tooling to be compatible with Bun.

Changed

• Replaced npm scripts with bun equivalents.
• Adjusted build and deployment pipelines to support Bun.
• run linting and formatting tools in frontend
• LICENSE changes to clarify ownership and permissions

Removed

• Removed package-lock.json in favor of Bun’s dependency manager.

[v1.1.2] - 2025-06-08

Added

• Rich text support in homework and events.
• Added release notes for v.1.1.1 and v1.1.2
• Linting and Formatting tools - ESLint and Prettier.

Changed

• Impressum and DSGVO updates
• UI improvements

Fixed

• Resolved an issue where logged-in users were unable to join multiple teams within the same class.

Security

• Bump packages to close security iusses.

[v1.1.1] - 2025-06-04

Fixed

• fix redis cache not working correctly

[v1.1.0] - 2025-06-03

Added

• .env.example file

Changed

• Moved docs to host on readthedocs
• Migrate to prisma ORM, add migrations

Fixed

• wrong joinedTeamsData saved locally
• edit toggle btn doesn’t always show up when logged in

[v1.0.1] - 2025-05-25

Added

• Support for multiline event and homework descriptions.
• .sql dump compression to reduce storage usage.
• Collapsible long events to improve UI/UX.
• Production documentation updates for:
  • User permission details.
  • Switched the order of NGINX and Certbot setup.
• trust proxy enabled for Express Rate Limit compatibility (source).

Changed

• Resized “Copy Classcode” button for better mobile experience.
• Updated NGINX configuration for improved compatibility and performance.

Fixed

• Timetable now properly displays when no substitutions are available.
• Backup table issue resolved by referencing the correct .env variable.
• Duplicate display issue corrected in UI.

Security

• Bump packages to close securtity iusses.
• Escaping html to reduce attack risks.

[v1.0.0] – 2025-05-23

Added

• Fetch, edit, and store timetable and subjects from the frontend.
• Ability to add and edit teams.
• Privacy Policy including Impressum, Datenschutzinformation, and contact email.
• Forced login or class code entry before accessing content.
• Copy class code button for easy sharing.
• Server monitoring tools to track system health and performance metrics.

Changed

• Migrated codebase from JavaScript to TypeScript for improved type safety and maintainability.
• External content fetching moved from client-side to server-side.
• SEO improvements to enhance discoverability.
• Mobile navigation improved with off-canvas menu and direct login/logout buttons.
• File compression enabled to reduce load times.
• Documentation migrated from Notion to self-hosted MkDocs.
• Bumped core packages, including major upgrade to Express v5.
• Strengthened Content Security Policy (CSP) headers.
• Established and enforced new code standards.

Fixed

• Backup table command issues resolved.

Security

• Added server-side rate limiter to prevent abuse.
• Implemented CSRF middleware to protect against cross-site request forgery attacks.

Removed

• Previous license replaced with updated terms (see LICENSE file).

License

                GNU AFFERO GENERAL PUBLIC LICENSE
                   Version 3, 19 November 2007

Copyright (C) 2007 Free Software Foundation, Inc. https://fsf.org/ Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.

                        Preamble

The GNU Affero General Public License is a free, copyleft license for software and other kinds of works, specifically designed to ensure cooperation with the community in the case of network server software.

The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, our General Public Licenses are intended to guarantee your freedom to share and change all versions of a program–to make sure it remains free software for all its users.

When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.

Developers that use our General Public Licenses protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License which gives you legal permission to copy, distribute and/or modify the software.

A secondary benefit of defending all users’ freedom is that improvements made in alternate versions of the program, if they receive widespread use, become available for other developers to incorporate. Many developers of free software are heartened and encouraged by the resulting cooperation. However, in the case of software used on network servers, this result may fail to come about. The GNU General Public License permits making a modified version and letting the public access it on a server without ever releasing its source code to the public.

The GNU Affero General Public License is designed specifically to ensure that, in such cases, the modified source code becomes available to the community. It requires the operator of a network server to provide the source code of the modified version running there to the users of that server. Therefore, public use of a modified version, on a publicly accessible server, gives the public access to the source code of the modified version.

An older license, called the Affero General Public License and published by Affero, was designed to accomplish similar goals. This is a different license, not a version of the Affero GPL, but Affero has released a new version of the Affero GPL which permits relicensing under this license.

The precise terms and conditions for copying, distribution and modification follow.

                   TERMS AND CONDITIONS

0. Definitions.

“This License” refers to version 3 of the GNU Affero General Public License.

“Copyright” also means copyright-like laws that apply to other kinds of works, such as semiconductor masks.

“The Program” refers to any copyrightable work licensed under this License. Each licensee is addressed as “you”. “Licensees” and “recipients” may be individuals or organizations.

To “modify” a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a “modified version” of the earlier work or a work “based on” the earlier work.

A “covered work” means either the unmodified Program or a work based on the Program.

To “propagate” a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.

To “convey” a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.

An interactive user interface displays “Appropriate Legal Notices” to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion.

1. Source Code.

The “source code” for a work means the preferred form of the work for making modifications to it. “Object code” means any non-source form of a work.

A “Standard Interface” means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language.

The “System Libraries” of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A “Major Component”, in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it.

The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work’s System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.

The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source.

The Corresponding Source for a work in source code form is that same work.

2. Basic Permissions.

All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law.

You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.

Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary.

3. Protecting Users’ Legal Rights From Anti-Circumvention Law.

No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures.

When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work’s users, your or third parties’ legal rights to forbid circumvention of technological measures.

4. Conveying Verbatim Copies.

You may convey verbatim copies of the Program’s source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program.

You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.

5. Conveying Modified Source Versions.

You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:

a) The work must carry prominent notices stating that you modified
it, and giving a relevant date.

b) The work must carry prominent notices stating that it is
released under this License and any conditions added under section
7.  This requirement modifies the requirement in section 4 to
"keep intact all notices".

c) You must license the entire work, as a whole, under this
License to anyone who comes into possession of a copy.  This
License will therefore apply, along with any applicable section 7
additional terms, to the whole of the work, and all its parts,
regardless of how they are packaged.  This License gives no
permission to license the work in any other way, but it does not
invalidate such permission if you have separately received it.

d) If the work has interactive user interfaces, each must display
Appropriate Legal Notices; however, if the Program has interactive
interfaces that do not display Appropriate Legal Notices, your
work need not make them do so.

A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation’s users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.

6. Conveying Non-Source Forms.

You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:

a) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by the
Corresponding Source fixed on a durable physical medium
customarily used for software interchange.

b) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by a
written offer, valid for at least three years and valid for as
long as you offer spare parts or customer support for that product
model, to give anyone who possesses the object code either (1) a
copy of the Corresponding Source for all the software in the
product that is covered by this License, on a durable physical
medium customarily used for software interchange, for a price no
more than your reasonable cost of physically performing this
conveying of source, or (2) access to copy the
Corresponding Source from a network server at no charge.

c) Convey individual copies of the object code with a copy of the
written offer to provide the Corresponding Source.  This
alternative is allowed only occasionally and noncommercially, and
only if you received the object code with such an offer, in accord
with subsection 6b.

d) Convey the object code by offering access from a designated
place (gratis or for a charge), and offer equivalent access to the
Corresponding Source in the same way through the same place at no
further charge.  You need not require recipients to copy the
Corresponding Source along with the object code.  If the place to
copy the object code is a network server, the Corresponding Source
may be on a different server (operated by you or a third party)
that supports equivalent copying facilities, provided you maintain
clear directions next to the object code saying where to find the
Corresponding Source.  Regardless of what server hosts the
Corresponding Source, you remain obligated to ensure that it is
available for as long as needed to satisfy these requirements.

e) Convey the object code using peer-to-peer transmission, provided
you inform other peers where the object code and Corresponding
Source of the work are being offered to the general public at no
charge under subsection 6d.

A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work.

A “User Product” is either (1) a “consumer product”, which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, “normally used” refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.

“Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.

If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).

The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network.

Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying.

7. Additional Terms.

“Additional permissions” are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions.

When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission.

Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms:

a) Disclaiming warranty or limiting liability differently from the
terms of sections 15 and 16 of this License; or

b) Requiring preservation of specified reasonable legal notices or
author attributions in that material or in the Appropriate Legal
Notices displayed by works containing it; or

c) Prohibiting misrepresentation of the origin of that material, or
requiring that modified versions of such material be marked in
reasonable ways as different from the original version; or

d) Limiting the use for publicity purposes of names of licensors or
authors of the material; or

e) Declining to grant rights under trademark law for use of some
trade names, trademarks, or service marks; or

f) Requiring indemnification of licensors and authors of that
material by anyone who conveys the material (or modified versions of
it) with contractual assumptions of liability to the recipient, for
any liability that these contractual assumptions directly impose on
those licensors and authors.

All other non-permissive additional terms are considered “further restrictions” within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying.

If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms.

Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way.

8. Termination.

You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).

However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.

Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.

Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10.

9. Acceptance Not Required for Having Copies.

You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.

10. Automatic Licensing of Downstream Recipients.

Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License.

An “entity transaction” is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party’s predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts.

You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.

11. Patents.

A “contributor” is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor’s “contributor version”.

A contributor’s “essential patent claims” are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, “control” includes the right to grant patent sublicenses in a manner consistent with the requirements of this License.

Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor’s essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.

In the following three paragraphs, a “patent license” is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To “grant” such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party.

If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. “Knowingly relying” means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient’s use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid.

If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it.

A patent license is “discriminatory” if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007.

Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law.

12. No Surrender of Others’ Freedom.

If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program.

13. Remote Network Interaction; Use with the GNU General Public License.

Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. This Corresponding Source shall include the Corresponding Source for any work covered by version 3 of the GNU General Public License that is incorporated pursuant to the following paragraph.

Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the work with which it is combined will remain governed by version 3 of the GNU General Public License.

14. Revised Versions of this License.

The Free Software Foundation may publish revised and/or new versions of the GNU Affero General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.

Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU Affero General Public License “or any later version” applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU Affero General Public License, you may choose any version ever published by the Free Software Foundation.

If the Program specifies that a proxy can decide which future versions of the GNU Affero General Public License can be used, that proxy’s public statement of acceptance of a version permanently authorizes you to choose that version for the Program.

Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version.

15. Disclaimer of Warranty.

THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

16. Limitation of Liability.

IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

17. Interpretation of Sections 15 and 16.

If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee.

                 END OF TERMS AND CONDITIONS

        How to Apply These Terms to Your New Programs

If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms.

To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the “copyright” line and a pointer to where the full notice is found.

<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year>  <name of author>

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as published
by the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License
along with this program.  If not, see <https://www.gnu.org/licenses/>.

Also add information on how to contact you by electronic and paper mail.

If your software can interact with users remotely through a computer network, you should also make sure that it provides a way for users to get its source. For example, if your program is a web application, its interface could display a “Source” link that leads users to an archive of the code. There are many ways you could offer source, and different solutions will be better for different programs; see section 13 for the specific requirements.

You should also get your employer (if you work as a programmer) or school, if any, to sign a “copyright disclaimer” for the program, if necessary. For more information on this, and how to apply and follow the GNU AGPL, see https://www.gnu.org/licenses/.