$ show ellite/Wallos
Wallos is a self-hosted PHP web application for tracking personal subscriptions, payments, and budgets. It provides a full CRUD interface for subscriptions with categories, currencies, payment methods, and household members. The backend is PHP 8.3 with SQLite, served via Nginx and PHP-FPM in a Docker container. It supports multi-user accounts, OIDC/OAuth login, TOTP two-factor authentication, and email/password reset flows. The application includes a rich set of notification channels (email, Discord, Telegram, Pushover, Gotify, ntfy, Web Push, webhooks, and more) triggered by cron jobs for upcoming payments and cancellations. A statistics dashboard aggregates costs, trends, and budget comparisons. The codebase is organized as a flat PHP application without a framework, using custom includes for shared logic and a simple API layer for external access. The architecture follows a page-based pattern where each PHP file serves as a route, with AJAX endpoints under `/endpoints/` for dynamic actions. The application demonstrates attention to security with CSRF tokens, prepared statements for all SQL queries, input validation, and a centralized SSRF protection module for outbound HTTP requests. A notable feature is the Web Push notification implementation that follows RFC 8290-8292 using VAPID and ECDH encryption. The currency conversion system uses a WeakMap-based cache per request to avoid repeated API calls. The codebase is actively maintained with frequent releases and a comprehensive migration system. However, the code exhibits significant repetition across notification channels and logo handling, with many nearly identical endpoint files. The i18n system is manually maintained across 20+ languages, leading to potential drift. The application lacks a formal testing framework beyond a custom test harness that checks security regressions and data integrity. The absence of a Composer dependency manager and reliance on vendored libraries (PHPMailer, Parsedown) adds maintenance overhead. Overall, Wallos is a functional, feature-rich self-hosted application with some well-crafted security components but suffers from code duplication and boilerplate typical of PHP applications without a framework.
The LLM identified 4 files worth highlighting for reuse:
Centralized Server-Side Request Forgery (SSRF) protection module. Validates outbound HTTP URLs by resolving hostnames to IPs, checking against private/reserved ranges (including IPv4-mapped IPv6, NAT64, 6to4, Teredo, CGNAT), and pinning the resolved IP via CURLOPT_RESOLVE to prevent DNS rebinding. Supports an allowlist (from DB or environment variable) and provides separate validation functions for webhooks, OIDC endpoints, and SMTP hosts. This is a self-contained, well-documented security component that could be extracted into any PHP project needing safe outbound requests.
Implements Web Push protocol (RFC 8290-8292) including VAPID JWT generation, ECDH key exchange, HKDF key derivation, and AES-GCM encryption of notification payloads. Includes test vector references and a fallback for missing OpenSSL config (e.g., XAMPP). Lazy VAPID key generation and push subscription pruning. This is a rare, self-contained PHP implementation of the Web Push standard that can be extracted and used in any PHP project needing browser push notifications.
Currency conversion helper that uses a WeakMap-based per-connection cache to avoid repeated exchange rate lookups within the same request. Provides a simple `wallos_convert_price($price, $from, $to)` function. The caching pattern is clean and could be extracted for any rate-limited external API integration.
RFC 5545 compliant iCalendar property escaping and line folding utilities. Includes `icalFold()` for proper line continuation and `icalEscape()` for safe text encoding. A small, self-contained component that can be reused in any application generating iCal feeds.