Choosing between services

The blueprint ships several services for some problems. Where that happens it is because they suit different situations, not because one is a spare.

This page covers the cases where a choice exists. Services that solve a problem nobody else here solves are in the overview.

Files and sync

	Nextcloud	Seafile	Seafile Pro
Beyond file sync	calendar, contacts, apps	none	none
Shape	five containers	multi-container	multi-container
Sync over large trees	slower	its design goal	its design goal
Full-text search, antivirus	via apps	no	yes
Licence	AGPL-3.0	AGPL-3.0	commercial
Company	Nextcloud GmbH, Germany	Seafile Ltd, China	Seafile Ltd, China

Nextcloud if you want one system for files, calendars and contacts, and accept a heavier stack for it. It is the only one here that replaces several services at once. Guide →

Seafile if sync performance over large directory trees is the deciding factor. It does file sync and does not try to be a suite. Guide →

Seafile Pro adds full-text search and antivirus scanning under a commercial licence. Guide →

The company behind Seafile is Chinese and behind Nextcloud is German. Whether that matters depends on what you store and who might ask about it — see data sovereignty.

Paperless-ngx solves a different problem: it takes scanned paper, runs OCR, and gives back a searchable archive, rather than syncing files that already exist. Guide → It does not open or edit what it archives — see document editing, next.

Document editing in the browser

All three plug into Nextcloud as a shared backend; OnlyOffice and Euro-Office also plug into Seafile, and Collabora does with settings this blueprint does not ship. Pick on capability and governance.

Collabora is the light one — one stateless container, about 400 MiB idle and 650 MiB with three editors open, LibreOffice underneath. Take it when the host is small. Guide →

Euro-Office is an EU-governed fork of OnlyOffice, maintained by a group that includes Nextcloud, IONOS, XWiki and Proton. Same editor, different governance. Take it when the supplier’s jurisdiction is part of the decision.

OnlyOffice stays closest to Microsoft formats. Take it when documents move back and forth with people using Word and Excel. OnlyOffice and Euro-Office each bring their own database, queue and cache, about 1.5–2 GB in all. Guide →

Dashboards

Four, and what separates them is how you configure them.

Dashy — one YAML file, and the interface rebuilds when it changes. The simplest to keep in version control.

Heimdall — a launcher first. Quick to set up, with optional per-service status widgets. Take it when you want links on a page and not a control panel.

Homarr — configured in the browser and built around integrations. It shows live state from media servers, download clients and reverse proxies rather than only linking to them.

Homepage — also file-based YAML, but split by concern: services, bookmarks, widgets and settings each in their own file. More structure for a larger setup.

Photo libraries

Five, separated by what they are for.

Immich is the phone-backup one. Mobile apps upload automatically, with machine-learning search and face recognition.

LibrePhotos covers face and object recognition and location data, closest to PhotoPrism in scope.

Lychee presents rather than manages: fast browsing, clean galleries, little machinery.

PhotoPrism manages an existing library — TensorFlow classification, face recognition, and strong handling of large collections already on disk.

Photoview is built around RAW files and EXIF. Take it if you shoot RAW and want the folder structure to stay the organising principle.

Publishing

BookStack for a wiki. Shelves, books, chapters and pages, and no attempt to be a CMS.

Ghost for a publication — newsletters and paid memberships are built in.

WordPress for a site that will need plugins and themes, and where other people will edit it.

Appointments

Cal.diy is the community edition of Cal.com and asks the most of the host.

Easy!Appointments has run since 2013 on PHP and MariaDB, and installs without a build step.

Tymeslot is the newest of the three: an Elixir application in two containers that syncs with Google, Outlook, Apple and CalDAV calendars, with releases several times a week.

E-signature

Documenso and OpenSign both replace DocuSign for self-hosted signing. Documenso is US-registered with development largely from Hamburg; OpenSign is registered in India. Documenso guide →

Uptime monitoring

Gatus is configured in YAML and nothing else, which is what you want when the monitoring configuration belongs in the same repository as everything else. Guide →

Uptime Kuma is configured in its interface. Rich probe types, SQLite behind it, quick to get running. Guide →

Project management

OpenProject is the full platform — Gantt, work packages, time tracking, wikis. The Community Edition has no OIDC or SSO.

Vikunja is task management: kanban, lists, Gantt and table views, closer to Trello than to a planning suite.

Secret sharing

Three different jobs, not three competing password managers. None of them store a login long-term — that is Vaultwarden.

	Yopass	Hemmelig	PrivateBin
Purpose	Ephemeral secret sharing	Ephemeral sharing + secret requests	Generic encrypted paste
Licence	Apache-2.0	O’Saasy License (self-hosting unrestricted, not OSI-approved)	zlib
Recipient can request a secret	No — a paid Yopass Business feature	Yes, but the sender must send the decryption key back manually	No

Yopass for a plain link that self-destructs — the simplest of the three, and the one with the fewest moving parts.

Hemmelig if the request-a-secret workflow is worth its license and the manual key hand-off. Self-hosting it is unaffected by the license; reselling it as a hosted service is what the license rules out.

PrivateBin for anything that is not specifically a credential — a config fragment, a recovery code, a note — or when a plain permissive licence matters more than the request workflow. Guide →

Single sign-on

	Authentik	Keycloak
Containers	five	two
Memory limits as shipped	5.75 GB across the stack	2 GB
Runtime	Python	Java
Licence · origin	MIT · Netherlands, EU	Apache-2.0 · US, CNCF
A login in front of an application without OIDC	yes — the embedded outpost, wired into Traefik as auth-authentik@file	no
Federation	LDAP and RADIUS through outposts	LDAP and Active Directory built in
Configuration as code	YAML blueprints	JSON realm export and import
Ecosystem	one company, since 2019	most frameworks ship an adapter; Red Hat’s supported edition; since 2014

Authentik when the point is a login in front of applications that have none — that path is wired into Traefik: an unauthenticated request is sent to the login, the application receives the identity header, and the route fails closed when Authentik does not answer. Guide →

Keycloak when your applications speak OpenID Connect or SAML themselves, when you federate an existing directory, or when Keycloak is already the standard where you work. Guide →

Neither is small, and running both means two places where users exist.

Where to go next

• Data sovereignty — licence, jurisdiction, and what each service sends outward
• Applications — the services that have a full guide
• The repository lists every service it ships, each with its own README

What this page is

An editorial comparison of the stacks as this repository ships them, not a benchmark and not an external citation — how sources are chosen and checked sets the standard the security pages meet, and a comparison of this kind does not meet it.

Feature sets, licences and resource appetite all move. Where a difference would change your decision, confirm it against the project itself rather than against this page.