Licensing & Host-for-Profit Audit
Existential is built almost entirely from third-party open-source apps. Running them for yourself is unambiguously fine. Hosting them for paying tenants is a different legal question — you are now offering someone else's software to third parties over a network, and each app's own license governs whether you may do that, not the license of the platform you deploy with.
This page audits every app in the stack for commercial multi-tenant hosting. It is the catalog you build your offering from: host the green ones freely, comply with the yellow ones, and resolve the red ones before charging for them.
This is an engineering summary to triage risk, not legal advice. Licenses change — Redis, Open WebUI, and MinIO all relicensed within the last two years (MinIO has since been retired from this stack for exactly that reason) — so confirm each app at its current version and get counsel before launch. Re-run this audit on every version bump.
The platform itself is the easy part
The deployment control plane here is ./existential.sh — first-party shell/TypeScript this
repo ships, not a third-party app you're redistributing. There's no license question to
audit for your own code; write and change it freely.
The real exposure is the hosted catalog below.
How to read the flags
| Flag | Meaning | What you must do |
|---|---|---|
| 🟢 Permissive | MIT · Apache-2.0 · BSD · zlib · PostgreSQL · MPL-2.0 · GPL* | Nothing. Host freely. |
| 🟡 Network copyleft | AGPL-3.0 · SSPL | You may host, but must offer your users the running source, including any modifications you make. Trivial if you run upstream unmodified and link to its source. |
| 🔴 Explicit restriction | branding / commercial-hosting clause | Resolve before monetizing — keep mandated branding, or obtain a commercial/enterprise license. |
* GPL is not AGPL. Plain GPL-2.0/3.0 (ComfyUI, IT-Tools, MariaDB) imposes no obligations for hosted/SaaS use — its conditions trigger only when you distribute the binary, which you don't. GPL apps are safe to host. Only AGPL (and SSPL) reach across the network.
AI
| App | Upstream | License | Flag | Notes / action |
|---|---|---|---|---|
| Chatterbox | chatterbox-tts (Resemble AI) | MIT | 🟢 | Model and server both MIT. |
| ComfyUI | ComfyUI | GPL-3.0 | 🟢 | GPL has no SaaS clause — safe to host. |
| Firecrawl | firecrawl | AGPL-3.0 | 🟡 | Run unmodified; link to source. |
| Hermes | hermes-agent | MIT | 🟢 | Custom existential service. |
| Honcho | honcho | AGPL-3.0 | 🟡 | Run unmodified; link to source. |
| MCP | custom (Node base) | Your code | 🟢 | First-party. |
| Ollama | ollama | MIT | 🟢 | |
| Open WebUI | open-webui | BSD-3 + branding clause | 🔴 | For >50 users (rolling 30 days) you must keep "Open WebUI" branding or buy an enterprise license. White-label = enterprise license required. Hosting with branding intact is allowed. |
| OpenViking | OpenViking | AGPL-3.0 (main project) | 🟡 | crates/ov_cli and examples/ are Apache-2.0; the server component the stack runs is AGPL — run unmodified, link to source. |
| WhisperX | whisperX-FastAPI | MIT | 🟢 | |
| wyoming-piper | wyoming-piper | MIT | 🟢 | |
| wyoming-whisper | wyoming-faster-whisper | MIT | 🟢 |
Productivity & services
| App | Upstream | License | Flag | Notes / action |
|---|---|---|---|---|
| Actual Budget | actual | MIT | 🟢 | |
| Appsmith | appsmith (CE) | Apache-2.0 | 🟢 | |
| code-server | code-server | MIT | 🟢 | Runs inside the shared decree base image, not the upstream Docker image — same MIT software either way. |
| Dashy | dashy | MIT | 🟢 | |
| Decree | custom / cloned | Your code | 🟢 | First-party automation. |
| Home Assistant | core | Apache-2.0 | 🟢 | |
| Immich | immich | AGPL-3.0 | 🟡 | Run unmodified; link to source. Bundles Valkey (BSD) + Postgres. |
| IT-Tools | it-tools | GPL-3.0 | 🟢 | Client-side; GPL, no SaaS clause. |
| Lowcoder | lowcoder (CE) | AGPL-3.0 | 🟡 | Also bundles MongoDB (SSPL) internally — see databases. |
| Mealie | mealie | AGPL-3.0 | 🟡 | |
| NocoDB | nocodb | AGPL-3.0 | 🟡 | |
| Ntfy | ntfy | Apache-2.0 / GPL-2.0 | 🟢 |
Storage
| App | Upstream | License | Flag | Notes / action |
|---|---|---|---|---|
| Collabora | collabora online (CODE) | MPL-2.0 | 🟢 | Commercially hostable; CODE is not recommended for production (no LTS/support) — that's operational, not legal. Enterprise subscription optional. |
| SeaweedFS | seaweedfs | Apache-2.0 | 🟢 | Permissive. Replaced MinIO, whose repo was archived in Feb 2026. |
| Nextcloud | server | AGPL-3.0 | 🟡 | The flagship AGPL app; run unmodified + link source. Bundles MariaDB (GPL). |
| Redis | redis (v8) | Tri: RSALv2 / SSPLv1 / AGPLv3 | 🟢 | Choose AGPLv3 or RSALv2 — both permit hosting. (Redis 7.4–7.x was RSAL/SSPL-only; v8+ restored the open option.) |
Infrastructure & control plane
This tier is your plumbing, not a product you sell. Obligations only trigger if a tenant is given network access to that specific instance (e.g. you hand them a Grafana dashboard).
| Component | License | Flag | Notes |
|---|---|---|---|
| Caddy | Apache-2.0 | 🟢 | |
| Cloudflare | external SaaS | N/A | Governed by Cloudflare's ToS, not a redistributable. |
| Docker Engine / Moby | Apache-2.0 | 🟢 | |
| Grafana | AGPL-3.0 | 🟡 | Only if tenants get dashboard access. |
| Loki | AGPL-3.0 | 🟡 | As above. |
| Alloy | Apache-2.0 | 🟢 | Permissive. |
| Pi-hole | EUPL-1.2 | 🟢 | Infrastructure. |
| Portainer CE | zlib | 🟢 | |
| Prometheus | Apache-2.0 | 🟢 | |
| Uptime Kuma | MIT | 🟢 |
Supporting databases
Bundled inside app stacks, not offered as standalone database services.
| Engine | License | Flag | Notes |
|---|---|---|---|
| PostgreSQL | PostgreSQL License | 🟢 | Permissive. |
| MariaDB | GPL-2.0 | 🟢 | GPL — hosting imposes no obligations. |
| MongoDB (via Lowcoder) | SSPL-1.0 | 🟡 | SSPL targets offering the database as a service. Here it's an internal component of Lowcoder, so the trigger is likely not hit — but don't expose it as a standalone DB product. |
| Valkey (via Immich) | BSD-3 | 🟢 | The open Redis fork. |
Compliance checklist
- Every hosted app's license recorded (this page) and re-checked at its current version.
- AGPL apps run unmodified, or your modifications are published and linked in-app.
- The Open Source Notices page is exposed to tenants, linking each AGPL app's running source.
- Open WebUI: branding kept intact, or an enterprise license obtained for white-label.
- MongoDB/Redis not exposed as standalone database services; Redis license option chosen (AGPLv3/RSALv2).
- Audit re-run on every app version bump — licenses change without notice.
Bottom line
Most of the catalog is 🟢 and hostable without ceremony. The 🟡 AGPL apps (Nextcloud, Immich, Mealie, NocoDB, Lowcoder, Grafana/Loki, Firecrawl, Honcho, OpenViking) are compliant as long as you run them unmodified and offer your tenants the source — the Open Source Notices page covers it. The only genuine 🔴 is Open WebUI's branding clause: keep their branding or buy an enterprise license. Resolve that one and the catalog is clear for commercial hosting.