Documents, notes and knowledge

Every tool here is pleasant to write in for the first month, which is the wrong thing to evaluate. What decides whether you were right is year five, when the project has stalled, relicensed, been forked twice, or needs a database version your host no longer ships. On that day the only feature that matters is whether you can get your content out in a form something else reads.

So evaluate the exit first and the editor second. The exit is a checkable thing: what exactly does a backup contain, and what would open it if the application never started again?

The default: BookStack#

BookStack is the boring one, and boring is the point. A Laravel app on MySQL, MIT licensed, one maintainer working on it full time since 2015. Between v24.05.1 and v26.05 the only documented manual upgrade steps were an export font permission change and a revision visibility change: everything else was a pull, composer install --no-dev and php artisan migrate.

Your archive is a mysqldump plus four paths:

tar -czvf files.tar.gz .env public/uploads storage/uploads themes

That is the whole product. There is no plugin ecosystem to rot, and the shelf, book, chapter, page hierarchy is rigid enough that nothing exotic can be encoded in it. The costs are real: MySQL or MariaDB only, no official Docker image so you take LinuxServer.io's or solidnerd's, and a tree that frustrates people who think in backlinks.

Two situations where BookStack is wrong.

You are one person and you think in trees. Trilium Notes: 200 MB, one SQLite file, no database service, scaling past 100,000 notes. Install from the right place, because three names circulate and two are dead ends: zadam/trilium redirects, TriliumNext/Notes was archived in June 2025, and development is at TriliumNext/Trilium with the image triliumnext/trilium. Single user is the real limit, not stability.

You have fifteen people and an identity provider already. Outline is the nicest thing here to use and the worst fit for one person, because it has no local accounts at all: the sample config says at least one third-party sign-in provider is required or you have no sign-in options. An expired certificate on that provider locks you out of your own wiki. It is BUSL-1.1 until 2030, not open source.

For paper, none of the above. Paperless-ngx is a different job: scan, OCR, index, find any document in seconds. It is the heaviest thing here at 450 MB idle and five containers with Gotenberg and Tika, and the one people say changed how they handle mail.

What the licence does to the exit#

Several tools here are not straightforwardly open source, and each restricts you differently. Outline is source-available until its 2030 change date. Docmost is AGPL at the root with ee directories under a proprietary licence whose submodule points at a private repository, so you cannot rebuild the image you run; SSO, page-level permissions and audit logs sit behind a key at 6 US dollars per seat per month with a ten seat minimum. HedgeDoc is AGPL and healthy, but its successor has no migration path after six years.

None of that makes them bad software. It changes what self-hosting is buying you, and it is worth knowing before a hundred pages are filed.

The mistakes people actually make#

• Backing up the database and not the key. APP_KEY, SECRET_KEY, APP_SECRET: lose one and a perfect dump restores into unreadable content or locked-out MFA users.
• Forgetting local file storage. Outline's backup docs cover Postgres and environment variables, not /var/lib/outline/data, so the default storage is what people miss. Every document then renders with broken images.
• Choosing the database you already run. Wiki.js 3.0 drops MySQL, MariaDB, MSSQL and SQLite for PostgreSQL only. Installing on MariaDB today buys you a database migration on top of an application migration later.
• Pinning to last year's version. BookStack's patch releases are almost all security fixes: v26.05.1 through v26.05.4 covered attachment permission leaks, a ZIP import remote code execution path and draft permission bypasses. A pinned instance is not stable, it is unpatched.
• Leaving HedgeDoc open. CMD_ALLOW_ANONYMOUS and CMD_ALLOW_EMAIL_REGISTER both default to true, so a fresh instance on a public hostname lets anyone register.
• Serving a wiki from a subpath. Wiki.js and Outline both refuse: example.com/wiki ends in broken assets and a login loop. Allocate a subdomain first.

What to read next#

BookStack vs Wiki.js and Outline vs Docmost settle the wiki choice; Paperless-ngx vs Nextcloud covers whether you need a document archive or just a folder. Replace Notion and Replace Evernote are the migrations off hosted note services. Every tool here sits on a database, so read Backing up a running database and Backups that actually restore before trusting the nightly job, then An update strategy that does not lose data for the security releases you cannot skip.