Der neue Monatsrückblick für Mai und Juni 2026 ist online!

[bmueller]

[New adapter] Kanban board

Current release: 0.3.0. What changed since 0.2.1 is at the bottom under "New in 0.3.0".

A Kanban board as a dedicated ioBroker adapter. What I wanted was shared task management that feels like a normal Kanban board, but tied into the smart home. It brings its own web server, serves a single-page app with no framework, and keeps every open view in sync over a WebSocket. Every event lands in a state that scripts and Node-RED can read, and the board embeds into Lovelace as a webpage card.

Features

• Own web server (default port 8095). The UI comes straight from the adapter, so a UI update needs no iobroker upload
• Multiple boards with freely configurable columns (name, order, display limit, WIP limit, the "new" and "done" flags)
• Cards with title, Markdown description, assignees, due date (optionally with a time of day), labels, colour, priority, checklist, link, location and calendar invite
• Recurring tasks: daily, weekly, monthly, yearly, nth weekday, nth working day including public-holiday calculation, plus free cron expressions
• Trash per board: deleted cards stay restorable for 30 days, and old done cards can move there automatically
• Per-column sorting in five modes with a direction toggle, or keep ordering by hand with drag and drop
• Drag and drop with mouse and touch, live sync over WebSocket to every open view
• Multiple users without a login: the user list lives in the instance settings, and each board decides who is assignable. The chips in the header double as a person filter that is remembered per board
• E-mail notifications through the email adapter on assignment, due date and card events, switchable per event and per user, with a calendar invite attached
• Eleven languages (de, en, fr, nl, it, es, pl, pt, ru, uk, zh-cn), plus a per-instance date and time format, light/dark/auto theme, accent colour and custom CSS

Integration

• REST API for everything the UI can do. Reading is open on the LAN, writing needs a token
• Inbound webhooks with a separate token per integration, restrictable to individual boards
• Outbound webhooks: a JSON POST to any URL on every event
• sendTo and the action state for ioBroker scripts, using the same command vocabulary
• Mirror states per board and per user (card count, overdue cards, last event) for dashboards and script triggers
• iframe friendly, with ?embed=1 for Lovelace webpage cards

Other services such as Telegram or Pushover are deliberately not hard-wired. Every event is written to the state kanban.0.lastEvent and, if configured, sent as an outbound webhook, so a short script can route it anywhere. A ready-to-copy Telegram example is in the docs, and Pushover, Pushbullet or WhatsApp need nothing but a different send line.

Mobile

On narrow screens the board stacks the columns, and each one folds away like an accordion. Dialogs open full screen with a fixed action bar. To move a card, press and hold it; while dragging, a row of target columns appears along the top.

Requirements and installation

You need js-controller 6.0.11 or newer and Node.js 22 or newer. For e-mail notifications you also need a configured email instance, and for region-accurate public holidays the optional feiertage adapter.

The adapter is not in the official ioBroker repository yet, inclusion is in progress. Until then install it through Adapters, install from own URL:

https://github.com/bmueller77/ioBroker.kanban

Then create an instance, check the port under Instances and open http://<host>:8095/.

Worth knowing before you start

The board works without a login. Anyone who can reach the port can read and edit. Writing through the API is token protected, which stops other websites and naive scanners, but it is no substitute for network isolation: a device on the same network that loads the page can read the token along with it. The adapter is built for a LAN. If you want it reachable from outside, bind the port to the LAN only and put an authenticating reverse proxy in front.

New in 0.3.0

Two of the larger additions come from requests in the German thread, where @lyc raised them in post #5.

Per-column sorting (#10): a toggle in the column header offers five modes, drag and drop, drag handles, due date, priority, and age in the column. For the automatic modes a second toggle reverses the direction. Both are stored per device, so they apply only to you, and your own order comes back when you switch to a manual mode. The drag handle was the second half of that request: every card gets a grip on the left and is dragged only by it, which is far easier to hit on a touchscreen.

Moving or copying cards between boards (#11): the Manage button in the card editor offers clone, copy and move. The open questions from that thread are answered like this: the target column defaults to the first column of the target board, labels are matched by name, and assignees only survive if they are members of the target board. If nobody would be left, the dialog asks first.

Messenger support (#12) stays open. Only e-mail is built in, everything else goes through lastEvent or an outbound webhook. The notification tab now links straight to the section of the docs that walks through it.

Also new: the trash with its 30-day retention and the automatic cleanup of old done cards, recurrence by cron expression with a plain-language preview and the next three dates, series calendar invites instead of one event per occurrence, dueAt (due date including time as an ISO timestamp) in every event and every API response, an option for minute-precise cardDue events, confirmation dialogs inside the UI instead of the browser prompt, six more languages and some minor design changes.

Security, please read

Two holes that affect everyone who uses the API:

The write token was readable by any website. Access-Control-Allow-Origin: * sat on every route, including the page that hands the token to the UI. Any website you had open could scan the network for the adapter in the background, read that page, take the token and then change or delete cards and boards. CORS is now limited to /api and /webhook, and only to origins you list, with an empty default. Only browser access was ever affected, since scripts and curl never went through that check.

A board-restricted token could escape its boards. On /api the restriction was not checked at all, and on the command route any allowed board named somewhere in the body counted as proof. What counts now is the board the call actually touches.

Also: a token row left blank used to match every request that carried no token, and an empty "allowed boards" field counted as "all" instead of "none". Both are fixed. Tokens are no longer accepted as a URL parameter, and the internal SPA secret lives in the adapter's file storage instead of a readable state.

Important for existing automations

The API no longer quietly straightens out bad input. An unknown columnId used to land in the first column, an invalid due was dropped, and getBoard on an unknown board answered with 200 and null. All three now return an error.

Fixed since 0.2.1

• on tablets, cards could not be dragged into another column.
• cards landed in the wrong place when dragged while a filter or a display limit was active.
• After switching boards, the views dialog kept offering the users of the previous board.
• A board refresh could pull you back to the board you had just left.
• A recurrence did not pass time of day, location and the calendar flag on to the follow-up card.
• A board whose member list pointed nowhere after renaming user IDs became unusable.
• Ticking a checklist item scrolled the board back to the top. Live sync now reconnects reliably after an adapter restart.

---

Feedback and requests are welcome in this thread. The full documentation is in the repository under docs/en/README.md, and the complete changelog is in the README.