The Problem

Teams need a kanban board that updates in real time across collaborators without forcing page reloads. Most self-hosted options either require a heavy Jira-style install or lack live multi-user sync. 4ga Boards targets that gap with a lightweight, realtime kanban system that runs on Docker or Kubernetes.

What This Does

4ga Boards is a full-stack kanban app. The client/ folder holds a React single-page app with SCSS styling, the server/ folder is an Express backend, and packages/ contains shared enums, locales, and utilities. The README documents dark mode, markdown editing, board import/export, SSO login (Google/GitHub/Microsoft/OIDC), and multi-language support across 16 locales.

The app supports a hierarchy of projects → boards → lists → cards → tasks, with collapsible lists and sidebar. It ships with docker-compose.yml for containerized deployment and a helm-chart/ for Kubernetes.

How It Is Wired

Execution starts in the client's sagas, not a single main function. The entry points are coreSaga in client/src/sagas/core/index.js:9, loginSaga and postLoginSaga in client/src/sagas/login/index.js. These sagas reach only 1-2 functions each and are not called elsewhere in the repo—they are the roots of the Redux-saga middleware that orchestrates side effects.

Control flows through a few high-fan-in hubs. client/src/components/Utils/index has 133 modules importing it (instability 0.13), making it the most-connected module—any change there ripples across a quarter of the client. client/src/selectors/index (59 importers) and client/src/hooks/index (57 importers) are similar chokepoints. The select function is called from 95 places, so altering it breaks nearly every data-fetching path.

Data flows through a Redux-saga pattern: actions (client/src/actions/) dispatch to sagas (client/src/sagas/core/services/), which call the API layer (client/src/api/) and transformers (client/src/api/transformers/) to shape responses. The handleSubmit → focus edge (33 calls) shows form submission consistently routes through a single focus handler. Outbound effects: 7 functions make network calls, 5 read/write files, and the deployment workflow pushes to the default branch.

The module graph shows zero circular dependencies and 611 internal call edges. The client/src/models/Card.js reducer owns the core card state logic, while client/src/entry-actions/cards.js and client/src/sagas/core/services/cards.js duplicate much of the same action/service code—a maintainability smell.

How To Use It

Setup: Install dependencies with pnpm (the repo uses pnpm as package manager). The root package.json and client/package.json define the workspace.

Configuration: Set BASE_URL, SECRET_KEY, POSTGRES_PASSWORD, and DATABASE_URL in docker-compose.yml environment sections. Generate a secret with openssl rand -hex 64.

Running it (Docker, from README):

curl -L https://raw.githubusercontent.com/RARgames/4gaBoards/main/docker-compose.yml -o docker-compose.yml
docker compose up -d

Access at http://localhost:3000 with default credentials demo/demo. For manual dev, run the client via client/scripts/start.js and the server from the server/ folder.

Real-World Use

A small team self-hosts this for sprint tracking. They deploy via Docker Compose, configure SSO for Google login, and use the realtime socket updates (client/src/sagas/core/watchers/socket.js) so multiple members see card moves instantly. The backup script boards-backup.sh runs nightly via cron to snapshot the Postgres database.

Code Health & Issues

Static analysis found 74 issues: 14 high, 58 medium, 2 low. Key findings:

  • High - Hub modules: client/src/components/Utils/index.js (133 dependents), client/src/selectors/index.js (59), client/src/hooks/index.js (57). High-blast-radius churn.
  • High - Deep nesting: client/src/components/Settings/AuthenticationSettings/AuthenticationSettings.jsx hits indentation depth 8.
  • High - Oversized files: eslint-configs/base.mjs at 808 lines, packages/locales/src/renderer.js, client/src/components/CardModal/CardModal.jsx.
  • High - Duplicated code: 1233 repeated 6-line blocks across 239 files.
  • Med - High branching density in client/utils/formatWebpackMessages.js (28 branches/65 lines).

Security audit (10 findings, 4 high):

  • High - Committed client/.env with live credentials; needs removal and rotation.
  • High - CI workflows use tag-pinned actions (docker/setup-buildx-action@v4.2.0) instead of commit SHAs.
  • High - No test command in any GitHub Action despite 18 test files.
  • High - Deploy workflow pushes directly to default branch.
  • Medium - Mutable Docker base image (node:24-alpine), no dependency scan, no pre-commit secret gate.

Test coverage is thin: 10 test files vs 1240 source files (ratio 0.008).

The Bottom Line

A functional, feature-rich kanban app with solid realtime architecture and zero circular dependencies. The main risks are the committed .env (rotate immediately), untested CI, and heavy duplication between action/service layers. Suitable for teams wanting a self-hosted, Docker-deployable kanban with SSO—but treat the test suite as aspirational until coverage improves.