EDIT 2026-05-03: v1.0.0-rc.14 is out and adds a native Android app.
Full announcement: https://lemmy.world/post/46382994
(original post below)
Hey all, sharing what I've been working on. NutriTrace is a self-hosted nutrition and wellness tracker that runs entirely on your own server in a single Docker container.
I built it because every commercial nutrition app has the same shape. You hand them years of food data, body measurements, and biometrics, and your data is held hostage when they pivot or paywall. I wanted to track macros and pull in my Fitbit data without participating in that.
Daily food diary with multi-ingredient meals, recipes, body stats, water tracking, day-level notes. Personal food database, barcode scanner, imports from Open Food Facts and USDA, plus optional Mealie integration. Statistics with trend charts, full backup, exports as CSV / JSON / full ZIP.
Optional wellness device sync from Fitbit, Withings, Garmin, and Android Health Connect. Sleep / readiness / stress scores computed from your data.
Optional AI assistant where you bring your own Claude / OpenAI / Gemini key. It queries your real data via tool use so it can answer things like "what was my average protein this month" without making numbers up. There's a voice food logger too. Both fully optional, off by default.
Tech: Svelte 4 + Express + better-sqlite3, multi-stage Dockerfile, AGPL-3.0. Native Android app is in active development; PWA installs to home screen on any modern browser today.
Repo and docker-compose example: https://github.com/TraceApps/nutritrace
Happy to answer questions.
OIDC feature has been added to app in latest build (1.0.0-rc9). Please test and let me know how it works for you. I successfully tested with Authentik.
Thanks for implementing it that fast! Unfortunately I wasn't able to test it.
I found the new section in the readme. So I followed it. I created an admin account (which confused me a bit - my user already had admin permissions. So why is it necessary to create another admin user?). Then I wanted to logout and login with the admin again. But I wasn't able to figure out how to log out. So I just deleted the cookies and local storage.
After that I was greeted by the login page. So I logged in as admin, entered the User Management - and found an interface to manage users. Ok, sounds logic to find a user management tool in the "user management" menu entry. But the readme said, that there should be oidc settings. Maybe they got lost in a merge conflict or something like that. I was testing on rc12.
Anyways I would prefer an env variable to configure oidc. I like to separate the technical configuration (like credentials, etc) from the user space configuration.
This comment may sound super negative, but I'm actually very grateful you addressed this feature. Thanks!
Thanks for the detailed walkthrough. A few of the rough edges you ran into are fixed in the latest release:
The admin-account confusion makes sense in hindsight. If you were already running NutriTrace single-user, you genuinely didn't need an admin account, that step exists because OIDC requires user management to be on. The README now spells that out as a prerequisite up front so it doesn't feel like surprise paperwork.
Logout has a real home now. Profile lives at the very top of Settings as a card showing your name and photo, and Log Out is right there inside it. No more digging through the cookie jar.
The "where are the OIDC settings" question was on me. They were buried inside User Management. They're now their own top-level section called Authentication, sitting right under User Management, with presets for Authentik, Keycloak, Authelia, Pocket ID, Auth0, Google, and a generic OIDC option for anything else.
And on your env-var preference, that's in too. You can configure providers entirely from .env or docker-compose.yml. Single-provider shorthand:
OIDC_ISSUER=https://auth.example.com/ OIDC_CLIENT_ID=nutritrace OIDC_CLIENT_SECRET=... OIDC_DISPLAY_NAME=Authentik OIDC_REDIRECT_URIS=https://nutritrace.example.com/api/auth/oidc/callback/1
Multi-provider works with OIDC_PROVIDER_2_, OIDC_PROVIDER_3_, etc. Anything you define this way shows up in the Settings UI with a lock badge and is read-only there, so it's clear where the source of truth lives. Full doc in .env.example and the README.
Pull the latest and give it another shot when you have a minute. Please confirm the env-var path actually works for your IdP when you have a chance.
Thanks again.