Licence drift: the quiet relicensing of self-hosted software

7.6 percent of this index is source-available or proprietary, and 44.8 percent is copyleft. As a snapshot that is unremarkable, and it is the wrong thing to look at. The direction of travel has a shape: a project builds an open core, the features that make it usable by more than one person move into a paid edition, and single sign-on is almost always first across the line.

The cases, exactly#

Each is checkable against the project's own LICENSE file or release notes, and the details differ more than the summaries suggest.

n8n was never open source. The Sustainable Use License 1.0 permits use and modification for internal business or personal purposes, and redistribution only free of charge and only non-commercially. Running it for your own company and profiting from the workflows is explicitly allowed; reselling it as a service is not. Any file with .ee. in the name or .ee in the directory path is carved out of the licence entirely and needs an Enterprise License. SAML, OIDC and LDAP all live there, so the free build has local accounts and nothing else.

PLANKA moved twice. MIT, then AGPL-3.0 in 2023, then to the PLANKA Community License (a Fair Use License 1.1 derived from n8n's) with the 2.0 release candidates in May 2025. Personal, hobby, educational and internal-organization use stay free and unrestricted. The expensive change came later: version 2.2.0 in August 2026 moved OIDC to PLANKA Pro and deactivated every SSO-based account, because those users have no password to fall back on. An admin has to set a password for each one and reactivate them individually. Files with .pe. in the name are Pro and outside the community licence.

MinIO archived the community edition. GitHub archived minio/minio on 25 April 2026 and the README opens with a statement that the repository is no longer maintained. Before that, RELEASE.2025-05-24T17-08-30Z removed the embedded management console and stripped external OIDC and LDAP login from the community build. An ordinary in-place upgrade took away the admin interface and directory login in one step. The successor, AIStor Free, is not a relicensed MinIO: it is a different product under a EULA permitting standalone single-node use only, with no clustering, no modification and no redistribution. MinIO vs Garage covers the maintained alternative.

Grafana went the other way, and that matters. It moved from Apache-2.0 to AGPLv3 in April 2021. AGPL is still OSI-approved, so this was not a move out of open source, and everything a single operator needs (unified alerting, generic OIDC login, every community data source) is in the free build. What Enterprise gates is SAML, role-based access control, data source permissions, query caching, reporting and around forty commercial data source plugins. Note the pattern anyway: SAML on the paid side, OIDC on the free side.

Synapse relicensed and changed hands. Element moved it from Apache-2.0 to AGPL-3.0-only in late 2023, with a commercial licence available as the alternative, and moved the repository from matrix-org to element-hq in December 2023. The Matrix.org Foundation still owns the spec; Element writes and ships the server. The README now points at Element Server Suite, and ESS Community is free but scoped to non-commercial use up to 100 users, a limit worth reading before you standardize on it.

Docmost ships a split repository. The root LICENSE is AGPL-3.0, but the README carves out apps/server/src/ee, apps/client/src/ee and packages/ee under a proprietary Docmost Enterprise licence. That server ee directory is a git submodule pointing at github.com/docmost/ee, which returns 404 to the public, so git clone --recurse-submodules fails and you cannot rebuild the official image from public source. Behind the key: SAML, OIDC, LDAP, MFA, page-level permissions and audit logs, at 6 US dollars per seat per month with a ten seat minimum.

authentik and Portainer split by edition rather than by relicensing. authentik went the friendly direction, GPLv3 to MIT in 2022, and keeps authentik/enterprise/ under a separate Authentik Security licence gated by a runtime key. Nothing behind that wall matters at home: it is Google Workspace and Entra provisioning, RADIUS EAP-TLS, detailed audit logging and CSV export. Portainer is stranger: Community Edition is genuinely open source under the zlib licence, while the proprietary Business Edition is free for three nodes and has more features. That free tier used to be five nodes, it is one licence per company domain, and the key expires annually.

Unraid changed tiers, not terms. It has always been proprietary. In 2024 the lifetime-only key was replaced by Starter at 49 USD for up to six storage devices, Unleashed at 109 USD for unlimited devices, and Lifetime at 249 USD. Starter and Unleashed include one year of OS updates, after which a 36 USD annual extension is optional; skip it and you keep the version you have indefinitely.

Two more from the index fit the pattern. Open WebUI left plain BSD-3-Clause at v0.6.6 on 19 April 2025 for a modified BSD-3 with a branding-protection clause, which the project's own documentation states is not OSI-approved; deployments with 50 or fewer users in a rolling 30-day period are exempt. Outline is BUSL-1.1 with a change date of 1 September 2030, after which it becomes Apache-2.0, and hosting it as a service for third parties terminates your rights in the meantime.

Look at the bottom of that chart, not the top. The top is MIT, Apache-2.0 and the GPL family doing what they always did. The tail is a list of one-off licence strings that exist for exactly one project each: a Fair Use License, a Sustainable Use License, a branding clause, an NCUL1 dashboard sitting on a GPL agent, a Plus License on the default container image. Each is a bespoke document you have to read individually, and that is the actual cost of the trend: there is no longer a short list of licences you can learn once.

The uncomfortable part: copyleft is not the protection you think#

The instinct is to treat AGPL as the safe end of the table. AGPL is frequently the licence a company picks because it wants to sell exceptions: it repels competitors while leaving the vendor free to dual-license. Grafana, Synapse, MinIO, Docmost, Mattermost, Stalwart and PhotoPrism are all AGPL at the core, and every one of them either sells a commercial licence, keeps proprietary code in the same repository, or ships a default image built under different terms.

What predicts whether a project can change terms is not the licence, it is who holds the copyright. A single company with a contributor licence agreement can relicense whenever it likes; a foundation or a large distributed contributor base effectively cannot. That is the structural difference between Forgejo, which is copyleft and governed by a nonprofit, and a tool whose LICENSE currently says AGPL under a single corporate owner.

How to tell whether a licence change affects you#

Almost always it does not. Run through this and you are usually done in two minutes.

1. Are you using it personally, or inside one legal entity? Every source-available licence in this index permits that, free and indefinitely. (The three genuinely proprietary entries, Plex, Emby and Unraid, are a purchase decision, not a drift question.) Read the permitted-use section, not the headline.
2. Are you giving accounts to people outside that entity in a commercial relationship? That is the line PLANKA's Fair Use License draws explicitly, and clients or contractors with logins is the easiest way to cross it by accident.
3. Are you hosting it as a service, reselling it, or removing the branding? That is what BUSL-1.1, n8n's Sustainable Use License and the Open WebUI branding clause are all written to stop.
4. Do you need an OSI-approved licence for procurement or policy? Then the answer is no regardless of what you are doing with it.

The real risk is the feature, not a lawyer#

Nobody here is going to sue a household. What happens is that you pull a tag and something you were using is gone. MinIO's May 2025 release took away the admin console and directory login. PLANKA 2.2.0 deactivated the accounts of everyone who logged in through your identity provider. Mattermost's v11 Team Edition dropped GitLab SSO and capped activation at 250 users.

The defence is boring and it works: pin exact version tags, read the release notes for the feature you depend on before upgrading, and know which edition it lives in. An update strategy that does not lose data covers the mechanics.

Check the LICENSE file, not the marketing page#

The GitHub sidebar label reads the root LICENSE file only, so a repository with a proprietary ee directory still shows a green "AGPL-3.0" chip. Do this instead:

git clone --depth 1 https://github.com/docmost/docmost && cd docmost
cat LICENSE                       # the root terms
cat .gitmodules 2>/dev/null       # private submodules hide closed code
grep -rniIl "enterprise licen\|source available\|fair use" --include="LICENSE*" --include="README*" .
find . -type d \( -name ee -o -name enterprise -o -name pro \) -not -path "*/node_modules/*"
find . -name "*.ee.*" -o -name "*.pe.*" | head

Then check the artifact, not just the source. The image you pull is not always the code you read: PhotoPrism's latest ships under the Plus License with member extensions compiled in and the ce tag is the pure AGPL build, Netdata's agent is GPLv3 while the dashboard UI it fetches is NCUL1, and Grafana publishes an Enterprise image that runs free features until a key is applied.

The question to ask before you adopt a source-available tool#

One question, and it is not about the licence text: if the feature I depend on moved to a paid edition next month, what is my exit?

Answer it in three parts before you commit anything hard to migrate:

• Is the data in a documented, exportable format? A Postgres schema you can dump and read is an exit. An opaque blob store is not. Moving a service to a new machine is the drill.
• Is there a maintained fork or a real alternative? Woodpecker CI exists because Drone went proprietary. Garage exists as an answer to MinIO. Vikunja and BookStack are the copyleft answers to PLANKA and Docmost respectively, both with OIDC in the free build.
• Can you pin the last freely licensed tag and live with it? Sometimes yes for a year. Never forever, because you also pin the security fixes.

If all three answers are uncomfortable, choose differently now. Migrating a wiki with two hundred pages is a weekend; migrating it after you have four thousand and an SSO integration is a project.

What to do next#

Find the source-available entries among the tools you already run, then check which of your features sit behind an edition wall. State of self-hosting 2026 has the rest of the index-wide figures, The single sign-on gap covers how much of this is specifically about SSO, and the licence and edition facts for every profile are checked against primary sources under our methodology.