← Back

Tasq

Multi-tenant work tracking platform, 6 organizations · 2026, v2 rebuild

What it is

A task and project tracker used by six organizations. Version 1 ran as a separate database and deployment per customer, which meant six of everything to maintain. Version 2 is one deployment with a Postgres schema per tenant.

Things worth pointing out

Schema per tenant

Each organization gets its own Postgres schema inside one database, using django-tenants. Apps are split into shared and per-tenant sets, so users live in the public schema while workspaces, tasks and notifications live per tenant. Onboarding a tenant is an admin record plus a domain entry; the schema is created and migrated automatically.

Tenant resolution

A middleware picks the tenant from an X-Tenant-Token header, falling back to Origin, Referer, then host. Identity provider callbacks are the exception, since their Referer is the provider's own host, so those resolve from the backend host instead and read only shared tables.

OAuth2 social login across tenant frontends

Providers match redirect URIs as exact strings and refuse hosts without a public top level domain, so per-tenant callbacks cannot be registered at all. One backend callback is registered per provider and the tenant travels in a signed state. The code is handed back to the tenant's own frontend, which posts it from its own origin, so the token exchange runs on the right schema.

One place that answers permission questions

Groups carry permissions; people never hold them directly. A single resolver answers what someone may do in a scope, either a workspace or the tenant as a whole, and fails closed. Ownership of a workspace is recorded for display but grants nothing. Results are cached with a generation key so a group edit invalidates them.

Tenant-aware background work

Celery runs through tenant-schemas-celery so a scheduled task executes inside the correct schema. It drives recurring tickets on RRULE patterns, nightly activity log rollups, cleanup of orphaned attachments, and hourly digest emails.

Screenshots

Task list with nesting, tags, statuses and per-column filters. Server-side sorting, filtering and pagination.
Task list with nesting, tags, statuses and per-column filters. Server-side sorting, filtering and pagination.
Workspace dashboard. Counts and breakdowns are aggregated per tenant schema.
Workspace dashboard. Counts and breakdowns are aggregated per tenant schema.
Editing a group. Every toggle is a permission the resolver reads; groups are the only thing that carries them.
Editing a group. Every toggle is a permission the resolver reads; groups are the only thing that carries them.
A second tenant, with its own branding and user list, served by the same deployment on a different schema.
A second tenant, with its own branding and user list, served by the same deployment on a different schema.