Primary question: Are you prepared to replace every default secret in docker-compose.yml before exposing the platform?
RepoDaily adoption score
RepoDaily rates this as 88/100 (strong) for adoption: evidence, installation path, production risk, differentiation, license clarity, and AI/agent fit are scored from the article sources and adoption notes.
4 source(s) across 3 source category/categories, plus a RepoDaily-specific evidence module when available.
5 workflow step(s), 5 next-action step(s), and 3 command/install signal(s) were detected.
Trending momentum is +498 stars, with maintenance/release/issue signals counted when present.
Risk is marked medium, with 5 security note(s) and 3 explicit skip condition(s).
3 opportunity lens item(s), 3 alternative(s), and 3 type-specific section(s) support differentiation.
License source or license wording is present.
3 AI/agent-related signal(s) were detected in the article text and metadata.
Project overview
AiToEarn is a TypeScript project hosted at github.com/yikart/AiToEarn that describes itself with the tagline "Let's use AI to Earn!" It landed at trending rank 13 with 498 period stars on 2026-07-03, reflecting developer interest in self-hostable AI earning infrastructure rather than yet another wrapper API.
The repository's docker-compose.yml reveals a multi-service stack: MongoDB configured as a replica set, Redis with password authentication, RustFS as an S3-compatible object store, an init container that seeds the database and writes a login token, a RustFS bucket provisioning step, and an aitoearn-ai service pulled from aitoearn/aitoearn-ai:latest. This is not a single-script demo — it is a containerized backend with persistent volumes and health checks.
The project ships under the MIT License with copyright assigned to AiToEarn in 2025. Its CONTRIBUTING.md lays out a structured contribution process: fork, branch with git checkout -b feature/your-feature-name, link an issue in the PR description using fixes #<issue_number>, and add tests. The guide also defines a bug priority table that treats security loopholes as Critical, giving maintainers a public triage policy.
From a security-tool lens, the most relevant surface is the deployment configuration itself. The compose file exposes MongoDB on port 27017, Redis on 6379, and RustFS on 9001, and it hardcodes default credentials like admin/password and rustfsadmin/rustfsadmin. Anyone evaluating AiToEarn should treat secret rotation and network exposure as the first review task, not an afterthought.
Why it is trending now
- 498 period stars and rank 13 on 2026-07-03 indicate a surge of interest in self-hostable AI earning backends rather than hosted SaaS.
- A complete Docker Compose stack — MongoDB replica set, Redis, RustFS, init seeders, and the aitoearn-ai image — lowers the barrier to a local trial.
- MIT License and an explicit CONTRIBUTING.md with a Critical priority for security loopholes signal a project that welcomes outside scrutiny.
- TypeScript codebase appeals to full-stack developers already comfortable with Node.js tooling and containerized services.
Problem it solves
- Default credentials in docker-compose.yml (admin/password, rustfsadmin/rustfsadmin, JWT_SECRET set to change-this-jwt-secret) are unsafe for any internet-facing deployment.
- MongoDB, Redis, and RustFS ports are published to the host, meaning a careless docker compose up on a cloud VM can expose services publicly.
- The aitoearn-init container writes a login token to /data/init/token.txt, which must be protected and rotated, not left on a shared volume.
- No homepage or topics are listed in repository metadata, making it harder for new users to find documentation beyond the repo itself.
How it works
- Clone the repository and open docker-compose.yml to review every service, port binding, and hardcoded secret before starting anything.
- Start the infrastructure services: MongoDB initializes as a replica set named rs0 with a generated keyfile, Redis starts with a requirepass directive, and RustFS provisions an aitoearn bucket with anonymous download enabled.
- The aitoearn-init container runs scripts/init.mjs against mongodb://admin:password@mongodb:27017, seeds the aitoearn database, and writes a login token to /data/init/token.txt.
- The aitoearn-ai container (aitoearn/aitoearn-ai:latest) starts with pull_policy: always, mounts project/aitoearn-backend/apps/aitoearn-ai/config/config.yaml, and exposes a health endpoint at http://localhost:3010/health.
- Contributors fork the repo, create a feature branch, add tests, and open a PR with fixes #<issue_number> referencing an existing issue as described in CONTRIBUTING.md.
Deployment Notes from docker-compose.yml
- MongoDB uses the mongo:latest image with a replica set named rs0, a generated 756-byte base64 keyfile at /data/mongodb-keyfile, and credentials admin/password.
- Redis runs redis-server --requirepass password on port 6379 with a health check using redis-cli --raw incr ping.
- RustFS uses the rustfs/rustfs:latest image on port 9001 with hostname rustfs.local and credentials rustfsadmin/rustfsadmin.
- rustfs-init uses minio/mc:latest to create the aitoearn bucket and set anonymous download via mc anonymous set download rustfs/aitoearn.
- aitoearn-init runs on node:lts-alpine, installs dependencies with npm install --omit=dev, and executes node init.mjs with MONGO_URI, JWT_SECRET, DB_NAME=aitoearn, and AUTO_LOGIN_TOKEN_PATH set as environment variables.
- The aitoearn-ai service exposes a health check at http://localhost:3010/health and depends on MongoDB and Redis being healthy before starting.
Integration Surface
- MongoDB is the primary datastore, accessed via mongodb://admin:password@mongodb:27017 with DB_NAME set to aitoearn.
- Redis acts as a cache or queue layer, reachable at redis:6379 with password authentication.
- RustFS provides S3-compatible object storage at rustfs.local:9000 for file uploads and assets.
- The aitoearn-ai service reads its runtime configuration from project/aitoearn-backend/apps/aitoearn-ai/config/config.yaml, mounted read-write into the container.
- Backend developers should consult project/backend/DEVELOPER_GUIDE.md referenced in CONTRIBUTING.md for step-by-step local setup.
Adoption Checklist
- Replace MONGO_INITDB_ROOT_USERNAME and MONGO_INITDB_ROOT_PASSWORD with strong, unique values.
- Change JWT_SECRET from change-this-jwt-secret to a long random string generated with openssl rand -base64 48.
- Rotate the Redis password away from the literal string password.
- Replace RUSTFS_ACCESS_KEY and RUSTFS_SECRET_KEY defaults before storing any user-uploaded content.
- Bind MongoDB, Redis, and RustFS ports to 127.0.0.1 or place them behind a private Docker network with no host port mapping.
- Protect /data/init/token.txt output and revoke or rotate the auto-login token after initial setup.
Who should pay attention?
Good fit if
- Developers who want a turnkey Docker Compose stack for an AI earning backend and can harden secrets before booting.
- Contributors looking for an MIT-licensed TypeScript project with a documented PR process and good first issues.
- Teams evaluating self-hostable alternatives to hosted AI monetization platforms who need MongoDB, Redis, and object storage in one compose file.
Skip for now if
- Anyone planning to run docker compose up unchanged on a public server — the default credentials and exposed ports are not production-safe.
- Users who need comprehensive official documentation beyond CONTRIBUTING.md and the compose file before committing time.
- Projects that require a non-MIT or enterprise-friendly license with explicit commercial warranty terms.
Risks and cautions
The stack is easy to start locally but ships with default credentials and placeholder secrets that must be replaced before any shared or public deployment.
- MongoDB, Redis, and RustFS credentials are hardcoded as admin/password and rustfsadmin/rustfsadmin in docker-compose.yml.
- JWT_SECRET defaults to change-this-jwt-secret, which is explicitly a placeholder string.
- Ports 27017, 6379, and 9001 are published to the host, increasing exposure if deployed without network controls.
- RustFS bucket aitoearn has anonymous download enabled by mc anonymous set download, which may leak uploaded files if used carelessly.
- CONTRIBUTING.md classifies security loopholes as Critical priority bugs, matching login failures and core function breakage.
- MongoDB replica set uses a generated keyfile with chmod 400 and chown mongodb:mongodb for internal authentication.
- Redis enforces authentication via --requirepass, rejecting unauthenticated connections.
- JWT_SECRET is used by aitoearn-init but defaults to a placeholder — reviewers must replace it before any real use.
- Bug reports are expected to include logs, reproduction steps, and screenshots, giving maintainers enough context to triage security issues.
Alternatives to compare
| Approach | When to use | Trade-off |
|---|---|---|
Self-hosted Dify | When you want a more mature open-source LLM application platform with broader documentation and plugin support. | Open source with Apache 2.0 license; self-hosting requires your own infrastructure. |
n8n | When your earning workflow depends on connecting AI APIs to external services through a visual node editor. | Sustainable Use License; fair-code self-hosting is free. |
FastGPT | When you need a TypeScript-friendly knowledge base and RAG pipeline with MongoDB under the hood. | Open source; self-hosting is free. |
What this trend reveals
Secret hardening automation
A wrapper script or Helm chart that generates strong secrets with openssl rand and injects them into docker-compose.yml would reduce the risk of deploying AiToEarn with default credentials.
Review docker-compose.yml lines referencing JWT_SECRET, MONGO_INITDB_ROOT_PASSWORD, and RUSTFS_SECRET_KEY, then prototype a .env-based override that the compose file already supports via environment interpolation.
Private network hardening
Moving MongoDB, Redis, and RustFS behind the aitoearn-network without host port bindings would shrink the public attack surface to just the aitoearn-ai health and application endpoints.
Confirm that aitoearn-ai only needs MongoDB and Redis connectivity over the Docker network, then remove the published port mappings for internal services.
Contributor onboarding improvements
Adding a SECURITY.md and a one-line quickstart that references project/backend/DEVELOPER_GUIDE.md would lower friction for first-time contributors browsing good first issues.
Check whether issues labeled good first issue currently point to setup steps, then draft a SECURITY.md aligned with the Critical priority classification already in CONTRIBUTING.md.
RepoDaily verdict
AiToEarn offers a well-structured Docker Compose stack for a self-hosted AI earning backend, but its default credentials and placeholder JWT secret mean it must be hardened before any deployment beyond an isolated local trial.