Homelab · App

Running club management app

A web app for social running clubs: attendance, credits and club money in one place.

Social running clubs often manage run-night attendance, prepaid credits, cash and reimbursements across a spreadsheet, a banking app and group chats. This app brings it together in one installable web app. Members can help out, like taking attendance, without seeing the money side.

Running the money side on the night? See the treasurer operations guide.

It's built for my own club first. Branding and rules come from a single config, because the plan is to offer it to other running clubs around the world, so the demo is private for now.

From staging

Attendance screen of the running club app on the staging build, with fake example names — Attendance (staging build, fake names)

Staging sign-in screen of the running club app, with a STAGING banner — Staging sign-in (fake demo data only)

Architecture

Phone (installable web app)→Cloudflare Workers (static assets)→Supabase Postgres + Auth (RLS)→Workers (sheet sync, keep-alive)

Front end	Progressive web app (PWA) in plain HTML and JavaScript, served as static assets by Cloudflare Workers on custom domains, with a strict Content Security Policy.
Back end	Supabase (Postgres, Auth) in Sydney. Row-level security on every table, scoped to the signed-in member or the treasurer role.
Sign-in	Passwordless email: magic link or one-time code, sent through Resend on a dedicated mail subdomain with DKIM.
Workers	TypeScript Cloudflare Workers for a database keep-alive and syncing closed runs to the club’s spreadsheet.

Environments and delivery

Environments	Separate staging and production: their own Workers, domains and Supabase projects. Staging carries a visible STAGING banner, its own icon and fake demo data only.
CI	GitHub Actions: secret scanning with gitleaks, lint, typecheck and unit tests (Vitest), dependency audits, and actions pinned by commit SHA with least-privilege permissions. Dependabot keeps dependencies current.
Database as code	Versioned SQL migrations, tested in CI with pgTAP on a throwaway local Supabase (including tests that members can’t see each other’s records), and applied by a deploy workflow with a dry-run mode.
Deploys	Pushes to the staging branch deploy staging; merges to main deploy production. Worker config lives in the repo and deploys with Wrangler.
Security and privacy	The web build refuses to ship secret keys or real data; logs never carry personal data; privacy policy and real deletion are required before other people sign in.