37 of the top 50 self-hosted apps can go closed

Pick something you self-host. Could the people behind it put the next release out under terms that aren’t open source, without asking anyone?

I went through the 50 most-starred apps on awesome-selfhosted, its non-free list included, to find out. For 37 of them the answer is yes, or they already have. The AGPL badge on the repo doesn’t tell you which group yours is in.

• Already ship some non-open code11
• Permissive18
• Copyleft with a company CLA8
• Copyleft, no CLA11
• Permissive, owned by a foundation2

Group	Apps
Already ship some non-open code (11)	Dify, Open WebUI, Stirling-PDF, LobeHub, NocoDB, Meilisearch, Twenty, Metabase, Rocket.Chat, Outline, Novu
Permissive (18)	Ollama, Hoppscotch, code-server, AnythingLLM, Caddy, Traefik, Memos, PocketBase, Gitea, Appwrite, LocalAI, LibreChat, Hyperswitch, Reactive Resume, Kong, Appsmith, MindsDB, Umami
Copyleft with a company CLA (8)	AppFlowy, Plane, Odoo, Discourse, Puter, ToolJet, PhotoPrism, Halo
Copyleft, no CLA (11)	Immich, Syncthing, Vaultwarden, Pi-hole, Penpot, Jellyfin, SiYuan, paperless-ngx, RSSHub, Sunshine, ERPNext
Permissive, owned by a foundation (2)	Home Assistant, Apache Airflow

The first three groups are the 37, and the 11 at the top are a mix. NocoDB, Outline, Dify, LobeHub and Open WebUI put the whole app under their own terms, while Metabase, Rocket.Chat, Twenty, Meilisearch, Novu and Stirling-PDF fence off the paid bits in a folder or marked files. Anyone could make a closed fork of Home Assistant or Airflow, but the official ones belong to foundations that exist to keep them open.

I only counted what’s in each public repo as of 17 October, so Odoo and Kong, which already sell closed enterprise editions from elsewhere, aren’t in the first group. I ran the next 50 as well and it drops to 31, beacuse there are more volunteer projects like SearXNG and Invidious with no company to do it. That’s 68 of the top 100.

NocoDB did it in one commit

NocoDB is a self-hosted Airtable with 65,000 stars, and untill this year it was AGPL. On 8 January a commit called “chore: change to sustainable use license” deleted the 661-line AGPL and put 61 lines of the Sustainable Use License in it’s place, the same licence n8n uses. The last AGPL release, 0.265.1, came out last October. Every release since says this instead:

You may use or modify the software only for your own internal business purposes or for non-commercial or personal use.

GitHub lists 336 contributors to that repo. None of them had to be asked, and a week after the release a user said as much:

For the record, this project uses a CLA, so there isn’t a legal issue with changing the license of external contributions.

A CLA, or contributor licence agreement, is something you sign before your PR gets merged, and NocoDB’s contributing guide has asked for one since 2022. The founder’s reason for the switch, posted on Cloudron’s forum, was companies running private forks and ignoring the AGPL, with lawyers too pricey to chase them. I’ve a bit of sympathy for that. But it was NocoDB’s call alone, and the licence page says “The license protects contributors”, which is one way of putting it.

The CLA’s the bit that matters

A copyleft licence is meant to stop exactly this. If I send a fix to an AGPL project, my fix is AGPL, and nobody can ship it closed without my say-so. A CLA is where I give that say-so up front.

AppFlowy, Plane, Puter, ToolJet and PhotoPrism are all AGPL today, and all have a CLA. So do Odoo, Discourse and Halo on the other GPLs. I read all eight agreements and every one lets the company license your code on other terms. PhotoPrism’s is the bluntest:

this includes the right to apply any license to the Contributions that PhotoPrism considers fit for the respective purpose as decided by PhotoPrism in its sole discretion, including other open-source, copyleft, and proprietary licenses

None of that is hidden, and people have been asking about it for ages. Discourse’s own forum has a thread from 2013 titled “Does Discourse’s contributor agreement provide an exit door from Open Source?”. Discourse is still GPL 13 years on.

Companies add the CLA early, though. The copyleft apps that did change all had theirs well before they used it. Metabase’s came more than four years ahead of its enterprise/ folder, and NocoDB’s nearly four years ahead of January.

Not every CLA lets them do it, mind. Postiz, 61st by stars, uses the FSFE’s Fiduciary License Agreement, which says any closed version of your code has to come with an open one too.

My own box isn’t any better. My analytics run on Plausible, which is AGPL with a CLA bot on every PR, and has an extra/ folder whose licence grants “no rights to use, distribute or otherwise exploit this software”. The community edition I run doesn’t compile it in. My error tracker, Bugsink, was never open source to begin with, and I picked it anyway.

MIT never needed one

The latest app to switch isn’t even in the top 50. ThingsBoard, 100th by stars, swapped Apache 2.0 for the Business Source License in 4.4, out on 29 September. You can still use it for free with a licence key from them, but only up to 1,000 devices, or 100 on a single server if you’re a business. The release notes don’t mention it, and awesome-selfhosted still lists it as Apache.

It didn’t have to ask anyone. MIT and Apache let anyone take the code and ship a closed version, as long as they keep the licence and notices, and that includes the people who wrote it. Contributors’ code comes in under the same terms, so there’s nothing to sign. That’s how most of the 11 got there. The 18 permissive apps are the biggest group in the table, and the one people worry abut least.

Stirling-PDF didn’t need a CLA either

Copyleft with no CLA should be the safe group. Contributors licensed their code as GPL or AGPL and nothing else, so the owners can’t take it closed without evey one of them agreeing. Some projects ask for a Signed-off-by line on each commit (a DCO), but that hands over nothing.

Stirling-PDF was in that group until September 2024, when a single commit swapped its GPL-3.0 for MIT. An app/proprietary/ folder came the next year. I couldn’t find a PR or anything asking past contributors, which doesn’t mean nobody did.

The rest aren’t quite as locked as they look. Immich went from MIT to AGPL in February 2024 and RSSHub only last December, so anyone can still take their MIT-era code closed. Sunshine’s owner had contributors assign it their copyright from 2022 until it dropped its CLA in 2024, so it owns what people sent in during that time outright. And Syncthing and Penpot are MPL 2.0, which works file by file, so a brand new file can be proprietary.

If you run one of these

Whatever’s allready been released stays under the licence it shipped with. NocoDB’s 0.265.1 is AGPL forever and anyone can fork it, though I couldn’t find anyone keeping up an AGPL fork.

If you run one at home, the new licences still let you. New features just go in the paid bit. Twenty’s SSO arrived in 2024 as commercial-only files, and an issue from August points out NocoDB’s new documents API needs an Enterprise licence on self-hosted.

To check an app that isn’t in the table, look for “CLA” in its contributing guide, then at the checks on a merged PR from an outside contributor:

$ gh pr checks 10037 -R makeplane/plane | grep -i cla
license/cla  pass  0  https://cla-assistant.io/makeplane/plane?pullRequest=10037  Contributor License Agreement is signed.

That won’t catch a CLA that’s only a file in the repo, like Open WebUI’s.