TimeTagger

Use a reverse proxy like Caddy to redirect root requests to /timetagger/app and proxy to the TimeTagger container. Example Caddyfile: 'timetagger.example.com { redir / /timetagger/app/; reverse_proxy localhost:8081 }'. Alternatively, create a custom main script based on __main__.py to modify the path, or use the upcoming feature from PR #577 with arguments '--path_prefix=/ --app-redirect=true' (once merged).

This error occurs when Timetagger is bound to a Unix socket (TIMETAGGER_BIND=unix:...) and proxy authentication is enabled, because the ASGI request.scope may not contain a 'client' key. As a workaround, copy /timetagger/__main__.py to a separate location, then comment out or modify the trust check block near line 157. For example, replace:

client = request.scope["client"][0]
if client not in TRUSTED_PROXIES:
    return 403, {}, "forbidden: the proxy is not trusted"

with:

if "client" in request.scope:
    client = request.scope["client"][0]
    if client not in TRUSTED_PROXIES:
        return 403, {}, "forbidden: the proxy is not trusted"

Then start Timetagger with the modified file as the entry point. This preserves some trust checking when a client IP is available. Alternatively, simply comment out the entire block if your environment is fully trusted. No official patch is yet available (as of Timetagger 25.06.1). Track the issue for updates.