Starlight
Documentation sites on Astro, with self-hosted full-text search built in rather than bolted on. Mix React, Vue, or Svelte components in one site. Still pre-1.0 after three years.
Open Source Alternatives: The Sovereign Stack
A curated database of vetted open source alternatives to proprietary SaaS. Find tools that are safe, compliant, and ready for business.
Showing of 183 solutions
VitePress
Vue and Vite powered documentation sites. Markdown in, static HTML out, with a build fast enough that large sites stay pleasant. The stable line has been quiet for about a year.
Sphinx
The documentation generator behind Python itself. One plain-text source builds a website, a PDF, and an API reference pulled from your code. reStructuredText is the learning tax.
Docusaurus
Documentation as code. Your content stays as Markdown in your own Git repo and ships as static HTML you host anywhere. Search is the one piece you still solve yourself.
NSD
An authoritative-only DNS server from the Dutch non-profit NLnet Labs, run by DNS root servers and many TLDs. Minimal attack surface by design, BSD-3. It serves zones only, not recursion.
Unbound
A validating recursive DNS resolver from the Dutch non-profit NLnet Labs. Resolve from the root servers yourself, so no public resolver sees your lookups. A focused resolver, not a full server.
BIND 9
The reference DNS implementation much of the internet runs on, governed by the non-profit ISC, not a company. Authoritative and recursive, MPL-2.0. Configuration is manual and zonefile-driven.
PowerDNS
Carrier-grade open source DNS used by ISPs and telcos: authoritative server, recursor and load balancer in one GPLv2 codebase. EU-owned via Open-Xchange. The management UI and support are a paid tier.
AdGuard Home
A self-hosted DNS ad-blocker with encrypted DNS and DHCP built in, blocking ads across every device. Auditable GPL code that phones nothing home. A modern sinkhole, not a full authoritative server.
Pi-hole
A network DNS sinkhole that blocks ads and trackers for every device, with no client software. Runs fully offline, so its US parent never sees a query. A focused ad-blocker, not a full DNS server.
Technitium DNS Server
A self-hosted DNS server that works as both a privacy resolver and a full authoritative server. Encrypted DNS, DNSSEC, clustering and SSO are all free, with no paid tier. Development rests on one maintainer.
Passbolt
A Luxembourg-based, OpenPGP password manager for teams sharing credentials. EU jurisdiction keeps it clear of the US CLOUD Act. SSO, directory sync and audit logs are paywalled.
KeePassXC
An offline password vault with no server and no vendor cloud. Credentials live in a local encrypted file you control. No central administration, so offboarding and backups are yours.
OpenZiti
Apache-2.0 zero-trust overlay you embed into the application itself. The whole stack, controller included, is self-hostable with no capability paywall. NetFoundry sells only managed hosting and support.
Headscale
BSD-licensed control server that runs official Tailscale clients on coordination infrastructure you host, no proprietary cloud. Volunteer-maintained; no GUI, RBAC, or commercial support.
NetBird
WireGuard mesh VPN with a control plane you self-host, the EU-sovereign answer to Tailscale. OIDC SSO included; active-active HA, SCIM, and SIEM streaming are commercial.
CrowdSec
MIT-licensed collaborative intrusion prevention that blocks malicious IPs from your logs and shares the signals network-wide, so every user gains herd immunity. Premium blocklists are paid.
Security Onion
Source-available (ELv2) network security monitoring on Suricata, Zeek, and the Elastic Stack. Self-hostable and airgappable; SSO and disk encryption require the paid Pro tier.
Lightdash
Open-core, dbt-native BI that turns metrics and dashboards into version-controlled code. The MIT core is self-hostable; SSO and fine-grained RBAC sit behind the paid tier.
Redash
A SQL-first query, dashboard, and alerting tool with 50+ data connectors and no paid tier. Databricks abandoned the hosted service in 2021; the community rebuilt it.
Plakar
French, EU-sovereign backup on the open ISC-licensed Kloset format: immutable, deduplicated, encrypted snapshots. Centralized fleet management and KMS are a paid Enterprise tier. A young project.
Kopia
Encrypted, deduplicated backups to storage you own, with a built-in GUI and a multi-client server mode. You hold the keys, back up to S3, B2, Azure or local disk, every feature free.
Restic
Encrypted, deduplicated backups to storage you own, from one static binary. You hold the keys (zero-knowledge), back up to S3, B2, SFTP or local disk, and every feature is free.
Seafile
AGPL-licensed file sync and share, a fast self-hosted Dropbox alternative for large file libraries. The vendor is China-based, and SSO, audit logs and search sit behind a paid tier.