ShipKit Access
Access control and attendance, on your own server
A working system, not a starting sketch: turnstiles push their passes in, the platform turns them into timesheets, and your operators work in a console that already knows what a night shift is. Built on ShipKit, so the auth, the admin panel and the deployment story come with it.
What it does
The parts a first version gets wrong
Turnstiles that report to you
Devices push every pass to one authenticated endpoint; a reconcile sweep pulls what the network lost. Both paths land in the same table, idempotently, so a duplicate push and a missed one are equally uneventful.
A device layer that is not one vendor
Application code asks a factory for an AccessDevice and calls a contract: list users, upsert, delete, fetch events by cursor, parse a push. A Hikvision ISAPI adapter ships. Adding a vendor is a package, a case in the factory and a string in one union, and a shared behavioural suite tells you when it is done.
Attendance that survives real schedules
Fixed hours, flexible hours, rotating shifts that cross midnight, and 24-hour duty posts credited whole to the day they began. Lateness, early leave, overtime and absences fall out of one pure function you can read in an afternoon.
Two audiences, two apps
Operators get a console: employees, timesheet, absences, schedules, devices, an event log and Excel export. Employees get a Telegram mini-app showing their own day, month and totals — and nothing else.
Your server, your database
One Linux box: PostgreSQL with TimescaleDB, Redis, four systemd units behind nginx. No vendor cloud, no telemetry, no per-seat billing. The install guide checks itself at every step.
Before you buy hardware
Run it tonight, with no turnstile
A simulated terminal implements the same device contract the real adapter does, and the shared behavioural suite runs against it on every build. One command seeds three weeks of history and starts a generator that walks simulated staff through simulated doors on the real clock:
docker compose up -d --wait # PostgreSQL and Redis
bun run demo # schema, three weeks of history, a live generator
bun run dev # the console at :3023, the API at :3021, the mini-app at :3025The dashboard fills, day records close, the timesheet adds up. You can read the whole attendance model against data you can see before deciding whether it fits the way your organisation counts a working day.
What it is not
Where the line is
- It does not recognise faces. The terminal does that, in the terminal. The platform stores an enrolment photo, pushes it to the devices you configure, and records the events they report. What that means for biometric data is written down in the repository rather than left to you to infer.
- It is not certified for anything. It is source code you own and deploy. Fire safety, labour law and data protection in your jurisdiction remain yours.
- One vendor ships today. Hikvision over ISAPI, plus the simulator. The boundary exists so the second vendor is a package and a case rather than a rewrite — but you write that adapter, or ask us to.
What is in it
One-time licence
- Full source: REST API, operator console, Telegram mini-app, background worker
- Vendor-neutral device layer with a Hikvision ISAPI adapter
- A simulated turnstile, so you can evaluate it with no hardware
- Attendance model: fixed, flexible, rotating-shift and 24-hour-duty schedules
- Timesheet, absences, per-employee cards, Excel export
- English and Russian across the attendance screens, extraction-based
- Server guide: systemd, nginx, TLS, and a pre-production checklist
- AI skills for Claude Code, plus Cursor rules and an AGENTS.md
- Private GitHub repository access and lifetime updates
- Unlimited projects, commercial use
Looking for the general-purpose boilerplate instead? ShipKit is $149.