Chaos and Order

💡 왼쪽 원문을 읽으면서 오른쪽에 따라 써보세요. Tab 키로 힌트를 받을 수 있습니다.

원문 렌더가 준비되기 전까지 텍스트 가이드로 표시합니다.

Prologue — The Workspace Bill and Data Sovereignty

Autumn 2025, the IT meeting room of a mid-size manufacturer. The bills from multinational SaaS vendors are spread across the table. 320 employees, Google Workspace Business Plus at 18 USD per seat per month. Add Slack Pro, Notion Plus and Zoom Pro and you comfortably exceed 80 USD per seat per month. Three hundred thousand dollars a year goes to SaaS tools. And the bigger problem — every byte of data lives in a US-East region.

"Our drawings, our quotes, our HR reviews are all on servers in another country," the CIO said. "The GDPR auditor for our EU subsidiary arrives next month."

This scene repeats quarterly across the EU, Korea and Japan since 2024. On one side sit Google, Microsoft, Slack, Notion and Zoom. On the other sits a modular workspace built from NextCloud, ownCloud, Seafile, Collabora, OnlyOffice, CryptPad, Etherpad, Element, Mattermost, Rocket.Chat, Penpot, Wiki.js, BookStack, HedgeDoc, Outline, Cal.com, Vaultwarden, Standard Notes, Joplin, Immich and Jellyfin. The 2026 answer is neither "all SaaS" nor "all self-hosted". You **bring the most sensitive data home with a modular open source stack** and you leave SaaS where the dependency is light.

This article is an honest map of open source workspaces as of May 2026.

- **NextCloud Hub 10** — AGPL hub bundling files, chat, mail, office, calendar and photos.

- **ownCloud Infinite Scale (oCIS)** — the Go rewrite of ownCloud. From PHP monolith to container-native.

- **Seafile 12.x** — file sync specialist. Chinese-origin but the fastest sync engine in the world.

- **Collabora Online** — LibreOffice in a browser, embedded into NextCloud and ownCloud.

- **OnlyOffice Workspace 8.x** — the browser office that mimics MS Office best.

- **LibreOffice 25.2** — the desktop suite standard. The engine inside Collabora Online.

- **CryptPad** — end-to-end encrypted real-time collab. Used by governments, press and NGOs.

- **Etherpad-lite** — the classic collab text editor. Easy to embed inside wikis.

- **HedgeDoc** — markdown real-time collab, the proper heir of CodiMD.

- **Outline / BookStack / Wiki.js** — the three big wikis and knowledge bases.

- **Element Synapse / Conduit** — Matrix-based federated chat. Adopted by the French government.

- **Rocket.Chat · Mattermost · Zulip** — three Slack alternatives.

- **Cal.com** — self-hosted scheduling.

- **Vaultwarden · Standard Notes · Joplin** — passwords and notes.

- **Photoprism · PhotoView · Immich** — photo libraries.

- **Jellyfin** — media server.

- **Penpot · Excalidraw** — design and diagramming.

- **Coolify · CapRover · Dokku** — the self-hosted PaaS that ties everything together.

Where each tool shines, where integrations are fragile, how governments and universities actually run them, and what the real cost of self-hosting is — without illusions.

Chapter 1 · Why Self-Host — The Rediscovery of Data Sovereignty

Open source workspaces have surged back since 2024 with price being the obvious reason, but the real reason is **data sovereignty**. The EU's GDPR, Korea's PIPA, Japan's APPI, and the government cloud certifications (K-ISMS, ISMAP, C5) redrew the borders of SaaS.

Since GDPR Article 44 entered into force, sending EU data to US servers requires SCCs (Standard Contractual Clauses) plus a TIA (Transfer Impact Assessment). The US CLOUD Act lets the US government compel US cloud providers to hand over data they hold. That puts EU corporate data inside Google Workspace simultaneously within reach of EU data protection authorities and US law enforcement.

The result:

1. **France EduConnect** — the French Ministry of Education transitioned to a NextCloud-based national cloud in 2023. Six million students.

2. **Germany Schleswig-Holstein** — administrative PCs standardized on NextCloud, LibreOffice and Univention starting in 2024.

3. **Switzerland Cantons** — Bern, Zürich and others standardized on NextCloud and Collabora Online.

4. **Netherlands SURF** — the university consortium runs NextCloud themselves.

5. **Korean public agencies** — the National Information Society Agency (NIA) runs a NextCloud pilot for inter-agency document sharing. Korea Electric Power has internal NextCloud. Several metropolitan governments run their own clouds.

6. **Japanese Digital Agency and municipalities** — at the evaluation stage of ownCloud and NextCloud for the 自治体 (jichitai) standard.

7. **Waseda University** — NextCloud plus Collabora is the standard for sharing lecture materials.

Price comparison as of May 2026:

| Tool | SaaS price per seat per month | Self-host infra cost for 300 employees |

| --- | --- | --- |

| Google Workspace Business Plus | 18 USD | NextCloud + Collabora — 4-core 16GB VPS at 80 USD/month |

| Microsoft 365 E3 | 36 USD | OnlyOffice Enterprise — same VPS plus free Community license |

| Slack Pro | 8.75 USD | Mattermost Team Edition — same VPS |

| Notion Plus | 10 USD | Outline / BookStack — same VPS |

| Zoom Pro | 14.99 USD | Jitsi Meet / Nextcloud Talk — same VPS |

| Total for 300 seats | 26,322 USD/month | 80 USD/month plus 0.5 FTE |

0.5 FTE isn't trivial. At 100 USD/hour for a senior infra engineer that's 8,000 USD/month. Even then total cost of ownership lands at roughly one third of SaaS. Past 1,000 employees the gap widens to 5 to 7 times.

The one-line takeaway: **self-hosting moved out of "we can't afford SaaS" territory and into "we can't afford to lose the data" territory.**

Chapter 2 · The 2026 Open Source Workspace Landscape at a Glance

Comparison matrix, grouped by category.

| --- | --- | --- | --- | --- |

License is the real axis. **AGPL has the "even network use requires source disclosure" clause**, which is fine for internal operation but tricky when reselling as SaaS. **BSL/FSL ship a "convert to open source after N years" model**, debated within the free software community. **MPL, Apache and MIT are the most permissive.**

Chapter 3 · NextCloud Hub 10 — The Integration Hub Champion

NextCloud forked from ownCloud in 2016 and has become, over a decade, the largest self-hosted workspace. As of May 2026, NextCloud Hub 10 is the stable release with Hub 11 due in six months. The company is based in Stuttgart, Germany, and the AGPL Community Edition is free forever.

The feature matrix at a glance:

- **Files** — WebDAV, sync clients for Windows/Mac/Linux/iOS/Android, external storage mounts (S3, SMB, SFTP).

- **Talk** — WebRTC calls, 1:1, group and webinar, optional E2E encryption, SIP and Matrix bridges.

- **Mail** — integrated IMAP/SMTP client. Linked to calendar and contacts.

- **Office** — Collabora Online or OnlyOffice integration. Collab on .docx, .xlsx, .pptx in the browser.

- **Calendar** — CalDAV. Syncs with iOS, Android, Thunderbird.

- **Contacts** — CardDAV.

- **Photos** — auto backup, optional face recognition, maps.

- **Notes** — simple markdown.

- **Deck** — Trello-style board.

- **Forms** — Google Forms alternative.

- **Whiteboard** — added 2025, Excalidraw-based.

- **Hub Assistant** — added 2024, integrates with local LLMs (Llama, Mistral) or OpenAI-compatible APIs.

Installation supports Docker Compose, snap and manual PHP setup. The fastest boot:

docker run -d \

--name nextcloud \

-p 8080:80 \

-v nextcloud:/var/www/html \

-e NEXTCLOUD_TRUSTED_DOMAINS=cloud.example.com \

-e POSTGRES_HOST=db \

-e POSTGRES_DB=nextcloud \

-e POSTGRES_USER=ncuser \

-e POSTGRES_PASSWORD=secret \

nextcloud:30

Production almost always looks like this:

- **Web server** — Apache 2.4 + PHP 8.3 or Nginx + PHP-FPM.

- **Database** — PostgreSQL 16 (recommended) or MariaDB 11.

- **Cache** — Redis 7, alongside APCu.

- **Storage** — local disk plus S3 external storage (for archival).

- **OnlyOffice or Collabora** — separate Docker instance.

- **HTTPS** — Caddy or Traefik reverse proxy.

Scale: NextCloud has been validated at 50,000 concurrent users on a single cluster. France EduConnect runs 6 million users with multi-node plus Redis Sentinel plus PostgreSQL HA.

E2E encryption works with client-side keys since v3.0 in 2023, with the trade-off that server-side search and previews are disabled. The trade-off is explicit.

Chapter 4 · ownCloud Infinite Scale — The Go-Based Rebirth

ownCloud started in 2010, and after the core developers left to start NextCloud in 2016 it stagnated for a while. The mood shifted with the 2020 announcement of ownCloud Infinite Scale (oCIS), a **container-native rewrite in Go**, replacing the PHP monolith. As of 2026, version 7.0 is stable, with 5.0 in 2024 and 6.0 in 2025 before it.

Key changes in oCIS:

1. **Microservices** — auth, metadata, storage and search are all independent services.

2. **Container-first** — Kubernetes Helm charts are first-class.

3. **Storage abstraction** — the Reva library handles S3, POSIX, CephFS and iRODS uniformly.

4. **OpenCloud Mesh (OCM)** — a federated sharing standard across instances. Used by university federations and inter-ministry collaboration.

5. **External identity** — OIDC first. Keycloak, Authentik and Logto integration is the default.

In 2024 ownCloud was acquired by Kiteworks, which raised concerns, but as of 2026 the oCIS open source policy is unchanged. Apache-2.0 license.

Installation works as a single binary or via container:

docker run --rm -it \

-p 9200:9200 \

-v ocis-config:/etc/ocis \

-v ocis-data:/var/lib/ocis \

owncloud/ocis:6 \

init

ownCloud vs NextCloud effectively compete for the same market in 2026. Simplified:

- **NextCloud** — wins on feature breadth and app ecosystem. Mail, notes, calendar and photos all in one. The downside is the weight of operating a PHP monolith.

- **ownCloud oCIS** — leaner core, K8s friendly. But most NextCloud add-on apps don't exist here. The philosophy is "just nail files, identity and sharing".

Pick oCIS if scale and operational automation matter, NextCloud if feature variety matters.

Chapter 5 · Seafile 12.x — Sync Performance Champion

Seafile was started in 2009 by developers from Tsinghua University in China. As of 2026, version 12.x is stable and the client-server sync engine is among the fastest in the world. Berlin-based Seafile GmbH runs the European market.

Technical differentiators:

1. **Block-level sync** — files are chunked like Git, and only changed chunks are transferred. A 1KB change inside a 100MB file uploads only 1KB.

2. **Versioning** — automatic snapshots on every library. Trash and point-in-time restore are standard.

3. **End-to-end encrypted libraries** — keys are managed on the client. The server sees nothing.

4. **C-written daemon** — small memory footprint and fast sync.

Docker installation is recommended:

docker run -d --name seafile \

-e SEAFILE_SERVER_HOSTNAME=seafile.example.com \

-e SEAFILE_ADMIN_EMAIL=admin@example.com \

-e SEAFILE_ADMIN_PASSWORD=secret \

-v /opt/seafile-data:/shared \

-p 80:80 \

seafileltd/seafile-mc:12

Seafile's philosophy compared to NextCloud is "just do files really well". Mail, calendar and office integration are weaker. Collabora Online and OnlyOffice integration is supported in 12.x.

The server core is AGPL-3.0; Pro Edition is commercially licensed (adds full-text search, audit logs, LDAP groups, OCM, etc.).

As of 2026, some Korean universities and Japanese research labs run Seafile as a photo and experiment-data repository specifically because of its sync performance.

Chapter 6 · Collabora Online — LibreOffice in the Browser

Collabora Productivity is a Cambridge, UK based company and one of the core contributors to LibreOffice. **Collabora Online runs the LibreOffice engine on the server, served to the browser**. As of 2026, 24.04 is the LTS and 25.04 is the stable.

Key features:

- **Format compatibility** — .docx, .xlsx, .pptx, .odt, .ods, .odp all supported. The most MS Office compatible open source on the market.

- **Real-time collab** — multiple users editing the same document, with cursors and selections streamed in real time.

- **WOPI protocol** — the integration standard for NextCloud, ownCloud, Seafile, Tiki, Drupal and EGroupware.

- **iframe embed** — the host opens Collabora in an iframe and passes a file token.

- **CODE** — Collabora Online Development Edition, free for evaluation.

NextCloud plus Collabora docker compose:

services:

nextcloud:

image: nextcloud:30

ports:

- "8080:80"

collabora:

image: collabora/code:24.04

environment:

- domain=cloud\\.example\\.com

- aliasgroup1=https://cloud.example.com

- extra_params=--o:ssl.enable=true

ports:

- "9980:9980"

Performance: 30 to 60 concurrent users per node is the recommended ceiling. Beyond that you need multi-node behind a load balancer. The browser opens a WebSocket to a Collabora node, which runs the LibreOffice core headless.

License is MPL-2.0, the same as the LibreOffice core. Collabora the company sells enterprise support (LTS security patches, 24/7 support) for a fee. CODE is free but has no SLA.

Chapter 7 · OnlyOffice Docs 8 — The MS Office Compatibility Champion

OnlyOffice is built by Ascensio System SIA, based in Latvia and Cyprus. Many developers are of Russian and Ukrainian origin, which created hesitation in some governments after 2022, but the company is EU-headquartered. As of 2026, OnlyOffice Docs 8.x is the stable release.

How OnlyOffice differs from Collabora:

1. **Rendering engine** — OnlyOffice uses its own canvas-plus-JS engine. Collabora runs the LibreOffice core headless.

2. **MS Office compatibility** — OnlyOffice is consistently rated the best at preserving .docx, .xlsx and .pptx layout.

3. **Co-editing model** — choose Strict (fast commits, possible conflicts) or Fast (block-level).

4. **Formula engine** — broadly compatible with Excel functions.

5. **PDF forms** — form field editing and signature support.

Installation via Docker:

docker run -i -t -d -p 80:80 \

-e JWT_ENABLED=true \

-e JWT_SECRET=changemenow \

onlyoffice/documentserver:8

NextCloud integration: install the OnlyOffice app, fill in the Document Server URL and JWT secret, done. Over 30 host integrations exist (ownCloud, Seafile, Nextcloud, Confluence, SharePoint, Strapi and more).

OnlyOffice Workspace bundles Docs plus Mail, CRM and Projects into an internal product. AGPL-3.0, so be careful when reselling as SaaS.

Selection guide:

- **100% MS Office compatibility, complex .docx and .xlsx** → OnlyOffice.

- **ODF-standard first, consistent with the LibreOffice ecosystem** → Collabora Online.

Chapter 8 · LibreOffice 25.2 — The Desktop Standard

LibreOffice is run by The Document Foundation in Berlin, Germany, and was forked from OpenOffice.org in 2010. As of May 2026, version 25.2 is the stable release.

Components:

- **Writer** — word processor. Word alternative.

- **Calc** — spreadsheet. Excel alternative.

- **Impress** — presentation. PowerPoint alternative.

- **Draw** — vector graphics and diagrams.

- **Base** — database (HSQLDB/Firebird).

- **Math** — formula editor.

Two release lines:

1. **LibreOffice Community** — accuracy and feature first. Desktop users.

2. **LibreOffice Enterprise** (certified partners like Collabora) — security patches and long-term support. Governments and enterprises.

As of 2026, swapping Microsoft 365 desktop licenses at 36 USD per seat per month for LibreOffice plus Collabora Online typically saves 70% to 85% in reported case studies. Caveats remain: macro (VBA) compatibility, some complex chart fidelity and some font rendering differences.

ODF 1.3 is standardized as ISO/IEC 26300 and is adopted as the primary document format by some EU and Korean public agencies. The German state of Schleswig-Holstein moved administrative PCs to LibreOffice plus Linux plus NextCloud starting in 2024.

Chapter 9 · CryptPad — The Gold Standard for E2E Encrypted Collab

CryptPad started at France's XWiki SAS with support from the French government. **Every document is encrypted client-side, so the server cannot see content.**

Supported document types:

- **Rich Text** — collaborative documents.

- **Code/Markdown** — markdown and code in real time.

- **Spreadsheet** — wraps the OnlyOffice engine end-to-end.

- **Slides** — markdown-based presentations.

- **Kanban** — boards.

- **Whiteboard** — whiteboard.

- **Form** — surveys.

- **Diagram** — Drawio-based.

- **PDF Annotator** — PDF annotations.

Technically:

1. **All document keys live in the URL fragment** — the server cannot see URL fragments.

2. **CryptPad uses the ChainPad CRDT** — conflict resolution.

3. **Anonymous use is supported** — create and share documents without an account.

Installation via Docker:

docker run -d --name cryptpad \

-p 3000:3000 -p 3001:3001 \

-v cryptpad-data:/cryptpad/data \

promasu/cryptpad:5

CryptPad was first deployed for French civil society groups and is now used by some German government agencies and EU Parliament citizen consultations. AGPL-3.0.

Downsides: 100 to 200 concurrent editors per instance is the recommended ceiling. Search is weak (an inherent consequence of E2E encryption).

Chapter 10 · Etherpad-lite — The Collaborative Text Classic

Etherpad started in 2008 and was acquired by Google in 2010 before being open sourced. As of 2026, etherpad-lite 2.x is the stable release.

Features are simple.

- Multi-user text editing.

- Per-author color highlighting.

- Version history (timeslider).

- Chat panel.

- 200+ plugins (LDAP, SAML, OAuth, HedgeDoc embed, LaTeX, etc.).

Installation:

docker run -d --name etherpad \

-p 9001:9001 \

-v etherpad-var:/opt/etherpad-lite/var \

etherpad/etherpad:2

Etherpad is rarely a standalone workspace. It's more often **embedded as a collaboration widget inside wikis, LMS systems, email tools and messengers.** Moodle, BigBlueButton and Sandstorm all embed it.

Apache-2.0 license. Some Korean and Japanese universities run it for lecture-note collaboration.

Chapter 11 · HedgeDoc — Markdown Collaboration

HedgeDoc forked from CodiMD in 2017. As of 2026, 1.10 is stable with 2.0 in beta. Markdown plus real-time collab plus diagrams (Mermaid, PlantUML) is the standard kit.

Main features:

- **Three-pane view** — editor, preview, concurrent cursors.

- **Slides** — Reveal.js-based slide mode.

- **Diagrams** — Mermaid, Graphviz, PlantUML, Vega.

- **Math** — KaTeX and MathJax.

- **GitHub/GitLab auth** — OAuth.

- **Pad persistence** — anonymous URLs or post-login persistence.

Tech stack: Node.js, PostgreSQL, Socket.IO, CodeMirror. Docker compose one-liner.

docker run -d --name hedgedoc \

-e CMD_DB_URL=postgres://user:pass@db:5432/hedgedoc \

-e CMD_DOMAIN=notes.example.com \

-p 3000:3000 \

quay.io/hedgedoc/hedgedoc:1.10

HedgeDoc shines for meeting notes, lecture notes and technical doc drafts. Less of a Notion alternative, more of a **Google Docs in markdown**. AGPL-3.0.

Chapter 12 · Outline · BookStack · Wiki.js — The Three Big Wikis

Wikis and knowledge bases are the heart of a self-hosted workspace. Three big choices for 2026:

Outline

- Started 2018, Node.js plus PostgreSQL plus Redis.

- Modern UI (Notion-style). Rich slash commands.

- Markdown-based with real-time collab.

- SSO (SAML, OIDC, Google, Slack, Microsoft) is first-class.

- **Switched to BSL-1.1 in 2023** — converts to Apache after 4 years. Some free software community pushback.

Installation via Docker:

docker run -d --name outline \

-e URL=https://wiki.example.com \

-e DATABASE_URL=postgres://user:pass@db:5432/outline \

-e REDIS_URL=redis://redis:6379 \

-e SECRET_KEY=$(openssl rand -hex 32) \

-p 3000:3000 \

outlinewiki/outline:0.81

BookStack

- Started 2017, PHP (Laravel) plus MySQL.

- Forces a "books, chapters, pages" hierarchy. Optimal for manuals and textbooks.

- WYSIWYG with markdown option.

- LDAP, SAML2 and OIDC integration.

- **MIT license** — the most permissive.

Installation via Docker:

docker run -d --name bookstack \

-e APP_URL=https://docs.example.com \

-e DB_HOST=db -e DB_USER=bookstack \

-e DB_PASS=secret -e DB_DATABASE=bookstackapp \

-p 80:80 \

lscr.io/linuxserver/bookstack:25

Wiki.js

- Started 2017, Node.js plus PostgreSQL.

- Multi-editor (markdown, WYSIWYG, code-only, visual builder).

- Git sync, multilingual, full-text search.

- AGPL-3.0.

Installation:

docker run -d --name wikijs \

-e DB_TYPE=postgres -e DB_HOST=db \

-e DB_PORT=5432 -e DB_USER=wikijs \

-e DB_PASS=secret -e DB_NAME=wikijs \

-p 3000:3000 \

ghcr.io/requarks/wiki:2

Selection guide:

- **Modern UX and SSO integration matter most** → Outline (if you accept BSL).

- **Technical manuals and textbook hierarchy** → BookStack.

- **Multilingual, multi-editor and Git backup** → Wiki.js.

DokuWiki and MediaWiki remain alive. DokuWiki is the lightest DB-less file-system wiki. MediaWiki, the engine behind Wikipedia, is still unmatched for large-scale public wikis.

Chapter 13 · Element · Mattermost · Rocket.Chat · Zulip — Four Slack Alternatives

Chat is the most dependency-heavy tool in a workspace. Four big options in 2026:

Element + Synapse (Matrix)

- 2019, Matrix.org Foundation plus Element the company.

- **Federated protocol** — if one server goes down, users can still talk to users on other servers.

- **E2E encryption standard** — the Olm/Megolm protocol.

- The French government's Tchap runs on Element/Matrix. The UK BBC and Germany's BWI also adopted it.

- Downside: self-hosting overhead is high. Many operational details around media, previews and integrations.

- Apache-2.0.

Installation (Synapse homeserver via Docker):

docker run -d --name synapse \

-v synapse-data:/data \

-e SYNAPSE_SERVER_NAME=matrix.example.com \

-e SYNAPSE_REPORT_STATS=no \

-p 8008:8008 \

matrixdotorg/synapse:v1.105

Mattermost

- Started 2015, Go and React.

- **The closest UX to Slack** — channels, DMs, threads.

- **AGPL Team Edition plus commercial Enterprise Edition.**

- Used by the US DoD and NASA. Several Korean conglomerates run it internally.

Installation:

docker run -d --name mattermost \

-p 8065:8065 \

-v mattermost-data:/mattermost/data \

mattermost/mattermost-team-edition:10

Rocket.Chat

- Started 2015, Node.js plus MongoDB.

- Richest integrations, bots and live chat (customer support).

- **MIT license** — the most permissive.

- Downsides: MongoDB operational overhead, some features behind the Enterprise tier.

Installation:

docker run -d --name rocketchat \

-e MONGO_URL=mongodb://mongo:27017/rocketchat \

-e ROOT_URL=https://chat.example.com \

-p 3000:3000 \

rocket.chat:7

Zulip

- Started 2013, Python and Django.

- **Threads first** — every message lives under a "Stream + Topic". Optimal for asynchronous collaboration.

- Incubated at Dropbox before being open sourced. Apache-2.0.

Selection guide:

- **Drop-in replacement for Slack** → Mattermost.

- **Federated, E2E, government-grade** → Element/Matrix.

- **Richest integrations and live chat** → Rocket.Chat.

- **Async, research and debate-centric** → Zulip.

Chapter 14 · Jitsi Meet · Nextcloud Talk — OSS Video Conferencing

If Zoom at 14.99 USD per seat per month is too much, Jitsi and Nextcloud Talk are the answer.

Jitsi Meet

- Started 2003, acquired by 8x8 in 2018. Apache-2.0 maintained.

- WebRTC plus Videobridge.

- **Instant meetings without accounts** is the killer feature.

- E2EE became optional starting in 2023.

- Recommended ceiling is 35 to 50 concurrent participants on a single node. Larger scale needs multiple Videobridges or JVB-Cluster.

Installation (official Docker Compose):

git clone https://github.com/jitsi/docker-jitsi-meet

cd docker-jitsi-meet

cp env.example .env

./gen-passwords.sh

docker compose up -d

Nextcloud Talk

- Built into NextCloud. WebRTC-based.

- Scales via HPB (High Performance Backend).

- **Pros** — integrated with NextCloud users, contacts and calendar.

- **Cons** — depends on NextCloud.

For very large concurrent participant counts, standalone Jitsi is operationally simpler. For NextCloud users, Talk is the first pick.

Chapter 15 · Cal.com · Vaultwarden · Standard Notes · Joplin — Single-Purpose Champions

The supporting tools of a workspace are also self-hostable.

Cal.com (4.x)

- Calendly alternative. Next.js plus PostgreSQL.

- AGPL-3.0, free to self-host.

- Two-way sync with Google, Outlook and Apple calendars.

- Zapier, Stripe and webhook integrations.

- Adoption is growing in Korea and Japan for cram schools and clinics.

Vaultwarden (Bitwarden-compatible server)

- Unofficial Bitwarden-compatible server written in Rust.

- Single binary plus SQLite, very light. Runs on a Raspberry Pi.

- 100% compatible with the official Bitwarden clients (web, desktop, mobile, browser).

- GPL-3.0.

Installation:

docker run -d --name vaultwarden \

-e DOMAIN=https://vault.example.com \

-v vw-data:/data \

-p 80:80 \

vaultwarden/server:1.32

Standard Notes (self-hosted)

- End-to-end encrypted notes.

- Note bodies are unreadable on the server.

- E2EE plus open source plus self-host. AGPL-3.0.

Joplin Server

- Markdown notes plus sync.

- Desktop, mobile and web clients are all open source.

- Self-hosting Joplin Server enables E2EE sync.

- AGPL-3.0.

Pick:

- **Just a password manager** → Vaultwarden.

- **E2E notes with polished mobile experience** → Standard Notes.

- **Markdown plus attachments plus deep organization** → Joplin.

Chapter 16 · Photos and Media — Immich, PhotoPrism, Jellyfin

Self-hosting family and team photos and videos is a fast-growing segment.

Immich (2.x)

- Started in 2022. AGPL-3.0.

- **The Google Photos clone** — closest UX match.

- Auto backup (iOS, Android), face recognition, object recognition (CLIP), maps, shared albums.

- ML models run locally on the onnx runtime.

Installation (Docker Compose):

wget https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml

wget https://github.com/immich-app/immich/releases/latest/download/example.env

mv example.env .env

docker compose up -d

PhotoPrism

- More mature photo library.

- AGPL-3.0.

- Richer search, tagging and ML than Immich.

- Downside: mobile backup UX is weaker than Immich.

Jellyfin (10.10)

- Open source fork of Plex. GPL-2.0.

- Movie, drama, music libraries. DLNA, Chromecast, AppleTV, iOS, Android.

- The standard home media server.

Installation:

docker run -d --name jellyfin \

-p 8096:8096 \

-v jellyfin-config:/config \

-v /mnt/media:/media \

jellyfin/jellyfin:10.10

Chapter 17 · Penpot · Excalidraw — Design and Diagramming

Penpot (2.x)

- Started by Kaleidos in 2021. **The open source Figma alternative.**

- Vectors, prototyping, design systems, design tokens.

- **MPL-2.0, very permissive.**

- Penpot 2.0 in 2024 added design system support and a plugin API.

- Funded in part by the EU. Fast adoption by governments and educational institutions.

Installation (official Docker Compose):

mkdir penpot && cd penpot

wget https://raw.githubusercontent.com/penpot/penpot/main/docker/images/docker-compose.yaml

docker compose -p penpot up -d

Excalidraw

- Hand-drawn style diagrams.

- MIT.

- Self-hostable via the `excalidraw/excalidraw` Docker image.

- Strong for whiteboarding and sketching.

Chapter 18 · Assets and Permissions — Snipe-IT, Integrated With Outline and BookStack

Snipe-IT

- IT asset management (laptops, licenses, consumables).

- PHP (Laravel) plus MySQL.

- AGPL-3.0.

- Labeling, QR codes, LDAP, API.

Installation:

docker run -d --name snipeit \

-e APP_URL=https://assets.example.com \

-e DB_HOST=db -e DB_DATABASE=snipeit \

-e DB_USERNAME=user -e DB_PASSWORD=secret \

-p 80:80 \

snipe/snipe-it:v7

When asset management, wiki, password manager, monitoring and backup all live together, the IT team is finally happy.

Chapter 19 · Coolify · CapRover · Dokku — Self-Hosted PaaS

Installing all the above by hand takes one to two days. Managing 200 containers is a different problem. A self-hosted PaaS closes that gap.

Coolify

- Started 2022, fastest growing.

- **Heroku/Vercel self-hosted clone.**

- Docker Compose, git-push deploy, auto HTTPS, DB auto backup.

- Apache-2.0.

- **One-click NextCloud, Outline, Mattermost and CryptPad installs** are standard.

Installation:

curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

CapRover

- Started 2017. Docker Swarm-based.

- 100+ one-click app installs.

- Apache-2.0.

Dokku

- Heroku Buildpack-compatible PaaS, started 2013.

- Lightest, strongest for single-node ops.

- MIT.

Pick:

- **Modern UI, multi-node support** → Coolify.

- **Swarm-based, app catalog** → CapRover.

- **Single-node Heroku-compatible git-push deploys** → Dokku.

Chapter 20 · SSO/Identity — Authentik, Keycloak, Logto

If employees use 20 self-hosted apps with 20 separate accounts, the IT help desk collapses. SSO is mandatory.

Authentik

- Started 2018, Python and Go.

- MIT.

- OIDC, SAML2, LDAP and OAuth2 full stack.

- Most modern UX, very self-host friendly.

Keycloak

- Started 2014 by Red Hat. Java and WildFly.

- Apache-2.0.

- Richest features, the enterprise standard.

- JVM overhead.

Logto

- Started 2022, TypeScript.

- MPL-2.0.

- Modern UX, developer friendly. Good for startups.

NextCloud, ownCloud, Outline, Mattermost, Rocket.Chat, Element, Cal.com, Penpot, Wiki.js, BookStack and OnlyOffice all support OIDC. Tie them to a single Authentik to complete workspace SSO.

Chapter 21 · Backup — Restic, Borg, Kopia, Duplicati

20 containers plus 100GB of data plus one mistake can end the company. Backup is non-negotiable.

Restic

- Encrypted backup written in Go.

- BSD-2-Clause.

- All major backends — S3, B2, Wasabi, Azure, local.

- Incremental, deduplication, verification.

restic -r s3:s3.amazonaws.com/my-bucket init

restic -r s3:s3.amazonaws.com/my-bucket backup /var/lib/docker/volumes

Borg

- Started 2010, Python.

- BSD.

- Compression, deduplication, encryption.

- Vorta GUI option.

Kopia

- Newer, written in Go.

- Fast performance with policy-based retention.

- Multiple backends.

Duplicati

- C# and .NET.

- LGPL.

- Friendly GUI on Windows, Mac, Linux.

- Weakness: occasional metadata corruption reports, so verification is mandatory.

Recommended pattern: **daily local NAS backups, weekly offsite S3 backups, monthly restore drills.**

Chapter 22 · Hardware and Infra — From Raspberry Pi to Data Center

Where do you actually run NextCloud, Collabora, Mattermost, Vaultwarden, Authentik, Immich and Jitsi for a 300-employee company?

Small (10 to 50 people, family, micro business)

- **Raspberry Pi 5 8GB** — NextCloud, Vaultwarden, Immich at most. Put media on an external USB SSD.

- **Beelink, Geekom mini PC** — Ryzen 7 + 32GB + 1TB NVMe. Around 300 USD. Highest recommendation.

Medium (50 to 300 people, SMBs)

- **Single VPS 8 cores 32GB plus external S3** — 200 to 400 USD per month. Hetzner CX52, OVH, etc.

- **Wrap in Coolify and operational time drops below five hours per week.**

Large (300+ people, universities, governments)

- **K8s cluster with 6 nodes plus PostgreSQL HA plus Redis Sentinel plus S3 backend.**

- **NextCloud Helm chart plus ownCloud Infinite Scale Helm chart** are K8s native.

- One to two full-time infrastructure engineers.

Hyperscaler vs On-prem

- **EU, Korea, Japan data sovereignty requirements** → on-prem or EU hosting (Hetzner, OVH, Scaleway).

- **Minimize operational burden** → Hetzner Managed PostgreSQL plus S3-compatible object storage plus self-hosted apps.

Chapter 23 · Korea Case Studies — Public Agencies and Universities

The Korean public sector self-hosting landscape as of May 2026:

- **National Information Society Agency (NIA)** — NextCloud-based pilot for inter-agency document sharing (no public announcement, internal use in some ministries).

- **Some Korea Electric Power departments** — NextCloud for sharing materials with partner firms.

- **Some metropolitan governments** — internal NextCloud-based administrative clouds (separate data centers, KISA certification).

- **Universities** — Seoul National, Yonsei and Korea University departments share research data on NextCloud and Seafile. Student LMS is mostly Moodle.

- **Research institutes** — Some labs at KIST and KAIST run Seafile plus Element/Matrix.

The Ministry of Interior's information resource consolidation guidelines plus the 2023 amended Personal Information Protection Act plus K-ISMS-P certification tightened SaaS restrictions, which brought self-hosting back into serious consideration.

Chapter 24 · Japan Case Studies — 自治体 and Universities

- **Digital Agency Government Cloud** — AWS, Azure, GCP and OCI are the four certified providers. Some 自治体 are evaluating self-hosted NextCloud and ownCloud.

- **Waseda University** — NextCloud plus Collabora Online is the standard for lecture material sharing.

- **Some University of Tokyo labs** — Seafile plus Element/Matrix.

- **Kyoto University** — NextCloud plus Jitsi.

- **NTT, NEC** — some internal OSS collab deployments.

The IPA (Information Technology Promotion Agency) OSS guidelines are accelerating 自治体 OSS adoption.

Chapter 25 · EU Government Case Studies — The Most Advanced

- **France EduConnect** — Ministry of Education NextCloud, 6 million students.

- **France Tchap** — Element/Matrix-based government messenger, 300,000 public servants.

- **France CryptPad** — citizen consultations.

- **Germany Schleswig-Holstein** — administrative PCs standardized on LibreOffice plus NextCloud plus Linux.

- **Germany BWI** — Element/Matrix military communications.

- **Germany openDesk** — open source workspace integration project (NextCloud, Collabora, Element, Jitsi).

- **Switzerland Bern/Zürich** — NextCloud plus Collabora.

- **Netherlands SURF** — NextCloud university consortium.

- **EU Parliament** — CryptPad for some citizen consultations.

After EuroStack, the EU Sovereign Cloud policy and the Digital Markets Act, reducing reliance on US SaaS became a political direction for the EU.

Chapter 26 · A Real Cost Simulation

Assume a 300-employee company and estimate the cost of running the full self-hosted stack.

| Item | SaaS monthly | Self-host monthly |

| --- | --- | --- |

| Files, docs, calendar, mail | Google Workspace 5,400 USD | NextCloud Hub + Collabora — VPS 16C 64G 400 USD |

| Chat | Slack 2,625 USD | Mattermost — VPS 4C 16G 80 USD |

| Video conferencing | Zoom 4,497 USD | Jitsi — VPS 8C 32G 160 USD |

| Wiki | Notion 3,000 USD | Outline — VPS 2C 8G 40 USD |

| Design | Figma 4,500 USD | Penpot — VPS 4C 16G 80 USD |

| Passwords | 1Password 2,400 USD | Vaultwarden — VPS 1C 2G 10 USD |

| Photos and media | Google Photos 1,800 USD | Immich — VPS 4C 16G + 4TB 120 USD |

| SSO | Okta 6,000 USD | Authentik — VPS 2C 8G 40 USD |

| Backup and infra | (included) | Hetzner S3 + monitoring 200 USD |

| Headcount | 0 (included) | Infra engineer 0.5 FTE — 8,000 USD |

| **Total** | **30,222 USD** | **9,130 USD** |

That's roughly 260,000 USD a year saved. Savings scale non-linearly with headcount. At 1,000 employees the gap widens to roughly 1 million USD SaaS versus 150,000 USD self-hosted.

Chapter 27 · Decision Tree

A decision tree for picking tools:

1. **Under 50 people, zero infra staff** → stay on SaaS. Consider Cloudron-type packaged solutions.

2. **50 to 300 people, can afford a 0.5 FTE infra hire** → start with Coolify plus NextCloud plus Mattermost plus Authentik plus Vaultwarden. Add the rest later.

3. **300+ people, data sovereignty mandated** → evaluate a K8s cluster plus NextCloud HA plus ownCloud Infinite Scale. Authentik SSO is first-class.

4. **Government or public agency** → use the openDesk model as a reference. Benchmark France and Germany.

5. **University or research institute** → NextCloud plus Seafile plus Element/Matrix plus Moodle.

6. **Individual or family** → mini PC plus Yunohost or CasaOS plus NextCloud plus Immich plus Jellyfin plus Vaultwarden.

Epilogue — The Era of Holding Your Own Data Again

The 2010s were the era of "put everything in the cloud". The mid-2020s were the era of "decide which cloud". In 2026 we are starting to ask, again, **"which data should we hold ourselves?"**

Open source workspaces are no longer a "we can't afford SaaS" tool. **Data sovereignty, regulatory compliance and the political direction of the EU, Korea and Japan** brought self-hosting back. And NextCloud Hub 10, ownCloud Infinite Scale, Seafile 12, Collabora Online, OnlyOffice 8, CryptPad, Etherpad, HedgeDoc, Outline, BookStack, Wiki.js, Element/Synapse, Mattermost, Rocket.Chat, Zulip, Jitsi Meet, Cal.com, Vaultwarden, Standard Notes, Joplin, Immich, PhotoPrism, Jellyfin, Penpot, Excalidraw, Authentik, Coolify, Restic — the tools are already mature enough.

Predictions on the table say that within five years 50% of EU governments, 30% of Korean public agencies and 20% of Japanese 自治体 will migrate to some form of self-hosted workspace. Whether you ride that wave or not, at least know where your company's data sits and whose subpoena can reach it.

References

1. NextCloud Hub 10 Release Notes — https://nextcloud.com/blog/

2. ownCloud Infinite Scale Docs — https://owncloud.dev/ocis/

3. Seafile Server Manual — https://manual.seafile.com/

4. Collabora Online Docs — https://www.collaboraonline.com/code/

5. OnlyOffice Docs Server — https://www.onlyoffice.com/document-server.aspx

6. LibreOffice 25.2 Release Notes — https://wiki.documentfoundation.org/ReleaseNotes/25.2

7. CryptPad Docs — https://docs.cryptpad.org/

8. Etherpad-lite — https://etherpad.org/

9. HedgeDoc — https://hedgedoc.org/

10. Outline Self-hosting — https://www.getoutline.com/developers

11. BookStack — https://www.bookstackapp.com/

12. Wiki.js — https://js.wiki/

13. Element/Matrix Synapse — https://matrix-org.github.io/synapse/

14. Mattermost Self-host — https://docs.mattermost.com/install/

15. Rocket.Chat Self-host — https://docs.rocket.chat/docs/deploy

16. Zulip — https://zulip.com/help/install-a-development-environment

17. Jitsi Meet Self-host — https://jitsi.github.io/handbook/docs/devops-guide/

18. Cal.com Self-host — https://cal.com/docs/self-hosting/

19. Vaultwarden — https://github.com/dani-garcia/vaultwarden

20. Standard Notes Server — https://standardnotes.com/help/47/

21. Joplin Server — https://joplinapp.org/help/install/joplin-server/

22. Immich — https://immich.app/

23. PhotoPrism — https://www.photoprism.app/

24. Jellyfin — https://jellyfin.org/

25. Penpot — https://penpot.app/

26. Excalidraw Self-host — https://github.com/excalidraw/excalidraw

27. Snipe-IT — https://snipeitapp.com/

28. Coolify — https://coolify.io/

29. CapRover — https://caprover.com/

30. Dokku — https://dokku.com/

31. Authentik — https://goauthentik.io/

32. Keycloak — https://www.keycloak.org/

33. Logto — https://logto.io/

34. Restic — https://restic.net/

35. BorgBackup — https://www.borgbackup.org/

36. Kopia — https://kopia.io/

37. France EduConnect — https://educonnect.education.gouv.fr/

38. Germany openDesk — https://opendesk.eu/

39. Schleswig-Holstein Open Source — https://www.schleswig-holstein.de/

40. Waseda University NextCloud — https://www.waseda.jp/