openGym

If you run openGym for other people, you have had no way to answer “who signed in, and when?” — the server kept no record of anything. It does now: an activity log in the admin dashboard, covering sign-ins, sign-outs, the attempts that failed, and every admin action. The other half of this release is that the live demo is back, self-hosted this time, after two months offline. And the project has a working home again: openGym now lives on GitLab, where CI builds the container images and the signed Android APK for every release — the thing that has been missing since the GitHub account went.

Activity log

• 🧾 The admin dashboard has an activity log. Successful and failed sign-ins, profile creations and refused signups, sign-outs (including “sign out everywhere”), and every admin action: disabling or re-enabling an account, creating or revoking an invite code, and clearing the log itself. Filter it by sign-ins, admin actions or failures, and page back through it.
• 📄 It is a plain file. ./data/audit.log, one JSON object per line — tail -f and jq read it directly, which also means it is its own export format. Deliberately not part of db.json: that file is rewritten in full on every save, and the sign-in handshake is unauthenticated, so a log living in there would have turned one junk request into a full rewrite. Retention is a cap rather than an archive — the last AUDIT_MAX events (5,000) or AUDIT_DAYS days (90), whichever runs out first.
• 🔒 It records less than you might expect, on purpose. No IP addresses unless you turn them on (AUDIT_IP=net keeps only the network, full keeps the address); never the browser’s user-agent; and never the passkey id behind a failed sign-in, because that id is a stable handle for one device and storing it would let an admin follow an unknown device from one attempt to the next. A rejected invite code is not stored either — a near-miss guess sitting in a log file helps nobody.
• 🧹 Clearing it is itself logged, and the event ids keep counting, so an erased stretch always leaves a visible gap.
• ⚙️ On by default when you update, and one variable turns it off. It records strictly less than your instance already holds — every profile is in db.json, every workout is in state-<uid>.json, and any admin can already read both — and a log that ships switched off tells you nothing on the day you need it. AUDIT_LOG=0 disables it completely; no file is written. Nothing leaves your server either way: this is a local file, not telemetry.
• Guests still never appear anywhere — guest mode does not talk to the server at all.

The live demo is back

• ▶️ https://opengym.duarte-santos.ch/demo/ — the in-browser demo, running on the project’s own site instead of GitHub Pages, which went down in August with the suspended account. Same build as before: no backend, no account, seeded example history, and a reset button in its settings. The embedded demo on the landing page works again too.

openGym moved to GitLab

• 🏠 https://gitlab.com/DuarteSantos8/opengym is the home of the project. Same history, same tags, same AGPL. gitea.com was the stopgap after the GitHub suspension and stays as a mirror; it never had a CI runner, which is why releases there had no images.
• 🐳 Prebuilt images are back. docker compose pull now fetches registry.gitlab.com/duartesantos8/opengym/api and /web, built for amd64 and arm64 on every release. Pulling is anonymous — the project is public, no login, no token.
• 🤖 The APK is built by CI now, not by hand. Every vX.Y.Z tag produces a zipaligned, signed APK, attached to the GitLab release and mirrored onto the download page. The signing key sits in protected CI variables, so it exists only on main and on version tags — a merge request from a fork builds an unsigned APK and never touches the key.
• ✅ Every merge request is tested again. The frontend suite (346 tests), the locale checks, the fatigue probe and the MCP suite all run on GitLab CI. The GitHub Actions workflows stay in .github/ for the day that account comes back.
• 🌐 The in-browser demo also builds to GitLab Pages (https://opengym-bc111a.gitlab.io/, which https://duartesantos8.gitlab.io/opengym/ redirects to); https://opengym.duarte-santos.ch/demo/ remains the copy the landing page embeds.
• 📄 Security reports have a private channel again: a confidential issue on GitLab. See SECURITY.md.
• 🔁 Dependency updates continue. GitLab has no Dependabot, so Renovate runs from a monthly scheduled pipeline with the same deliberately quiet policy the Dependabot config had: grouped per ecosystem, majors on their own, odd-numbered Node images skipped, and the generated android//ios/ projects left to follow their @capacitor/* packages. Security advisories ignore the schedule and land on their own.

Housekeeping

• The self-hosting docs, SECURITY.md and .env.example cover the activity log, and the api/server.js line references in SECURITY.md are accurate again.
• Every repository link in the README, the docs, the app and the website points at GitLab, and the website’s live star/release numbers come from GitLab’s API.

---

_{Published on GitHub on 2026-09-11, mirroring the GitLab release of the same tag, where the artefacts above were built (!NN numbers are GitLab merge requests). The same images are on GHCR, built from this release by GitHub Actions: ghcr.io/duartesantos8/opengym-api:1.2.9 and ghcr.io/duartesantos8/opengym-web:1.2.9.}