# opensource

Penpot is a 60k-star, MPL-2.0 design and prototyping platform built on open web standards. A 5,000-word teardown of its SVG/CSS/HTML asset portability, the OIDC-free-vs-SAML-paid split, why MPL file-level copyleft is not AGPL, the Clojure-plus-Postgres-plus-Valkey stack, the design-to-code workflow, and exactly where your designs land.

Wiki.js is a 29k-star, AGPL-3.0 knowledge base built on Node.js with Git-backed storage. A 5,000-word teardown of its plugin architecture, the built-in ACME SSL automation, the AGPL network clause, the Apollo Server 2.x end-of-life running your auth, the OpenSSL-legacy build workaround, and the 2026 maintenance slowdown you must weigh before adopting.

BookStack is a 19k-star, MIT-licensed documentation wiki written in PHP on Laravel. A 5,000-word teardown of its opinionated shelf/book/chapter/page hierarchy, the 2026 Codeberg migration, why there is no plugin system or real-time collaboration, the bus-factor-1 risk, and exactly where your docs live and who can read them.

InfluxDB 3 Core is a 31k-star, MIT/Apache-2.0 time-series engine written in Rust on the Arrow/DataFusion/Parquet stack. A 5,000-word teardown of the v3 rewrite, the diskless object-storage architecture, line-protocol ingest, the built-in Python processing engine, the hard split between open-source Core and closed-source Enterprise, and exactly where your telemetry lands.

Directus is a 37k-star platform that wraps any SQL database in instant REST and GraphQL APIs, a no-code Studio, and field-level RBAC. A 5,000-word teardown of the database-first model, its Flows and MCP server, the hard cost of its 2026 license change to the source-available MSCL 1.0 (free under $5M revenue, commercial beyond), and exactly where your data lives.

Authelia is a 28k-star, Apache-2.0 single-binary SSO and two-factor gateway that bolts login and 2FA onto any app behind a reverse proxy. A 5,000-word teardown of forward-auth architecture, identity backends, TOTP/WebAuthn/Duo, access-control policies, the OpenID Connect certification it earned in 2026, the hard scope limits (no SAML, no federation, no multi-tenancy), and exactly where your credentials and sessions go.

Umami is a 38k-star, MIT-licensed web analytics platform that captures 100% of traffic with no cookies and no PII — a sovereign alternative to Google Analytics. A 5,000-word teardown of what it delivers, the mandatory PostgreSQL backend (MySQL dropped in v3), the attribution limits of cookie-less tracking, session replay storage, scaling via connection pooling, and exactly where your visitor data goes.

Caddy is a 75k-star, Apache-2.0 web server whose automatic HTTPS changed the industry — every feature ships in the free build, no paid tier. A 5,000-word teardown of what it delivers, the xcaddy plugin rebuild model, multi-instance storage coordination, ACME rate limits, the single-maintainer bus factor, and exactly where your certificates go.

Apache Superset is a 74k-star, Apache-2.0 business intelligence platform that rivals Tableau and Power BI on the chart side — but it is a distributed system wearing a dashboard costume. A 5,000-word teardown of what it delivers, the mandatory metadata database, the Celery plus Redis async layer, RBAC complexity, resource hunger, upgrade fragility, and exactly where your query results go.