Self-Hosted Creative Production Suite — Deep Research + DEPLOYMENT

"A self-hosted Photopea, an alternative to Premiere Pro, and more" — web-native only

✅ DEPLOYED — behind *.example.tld

All services below run on a single capable host (Coolify/Traefik, Let's Encrypt), reachable at public HTTPS subdomains via explicit DNS A records. A second, oversubscribed box is left untouched.

URL	Tool	Status
https://paint.example.tld	miniPaint (raster)	✅ 200
https://audio.example.tld	AudioMass (audio, multitrack)	✅ 200
https://wavacity.example.tld	Wavacity (Audacity WASM)	✅ 200
https://clip.example.tld	Omniclip (quick-cut NLE)	✅ 200
https://daw.example.tld	openDAW (browser DAW, built from source)	✅ 200
https://draw.example.tld	Excalidraw (whiteboard)	✅ 200
https://diagrams.example.tld	drawio (diagrams)	✅ 200
https://penpot.example.tld	Penpot (Figma alt; registration disabled)	✅ 200
https://pdf.example.tld	Stirling-PDF (login disabled = open)	✅ 200
https://cut.example.tld	OpenCut classic (full NLE; archived, patched to build)	✅ 200
https://photos.example.tld	Immich (photos, ML on CPU)	✅ 200
https://rembg.example.tld	rembg (bg removal API)	✅ 401→200 authed
https://stems.example.tld	demucs (stem separation)	✅ 401→200 authed
https://sd.example.tld	FastSD CPU (image gen)	✅ 401→200 authed
https://inpaint.example.tld	IOPaint (inpaint/erase/upscale/restore)	⏳ see note

AI endpoints are behind HTTP basic-auth (the password is kept in a file on the host, outside this repo) because they're compute-abuse targets on a public domain. Everything else is open (client-side statics hold no data; Penpot/Immich have their own accounts).

Revideo = a code scaffold on the host (server-side renderVideo() for pipelines), not a hosted service.

Compose stacks: creative-statics, penpot, stirling-pdf, opencut-classic, immich, ai-creative, fastsdcpu, revideo-scaffold.

Infra note: the host's root disk hit 100% mid-deploy — its containerd image store lives on the root LV (while the Docker data-root is on a separate fast volume). Fix: grow the root LV online (no downtime), or relocate the containerd store. Expect this on any host where big image builds land on a small root partition.

🧹 DEBLOAT + HARNESS CROSS-CHECK (2026-07-15)

Every service was audited (Playwright network capture + fetch(no-store) ground-truth + config) and patched so it phones home to nothing and shows no Pro/upsell nags — offline/bloat-free:

Service	Removed / disabled
Wavacity	Google Analytics (G-X8B5RE90CJ), Amplitude SDK (b4b0592…), crash-telemetry POST to crash.transitions.dj
Omniclip	vendored PIXI/Shoelace/es-module-shims + mediainfo.js + opfs-tools + web-demuxer WASM locally; PostHog (eu.i.posthog.com) neutralized; Google Fonts dropped → fully offline (no-store so returning visitors get the clean build)
Excalidraw	built from source (not the official image, which hardcodes excalidraw.com); stripped SimpleAnalytics + Google-Fonts + DigitalOcean-CDN fonts (vendored locally) + Excalidraw+ redirect; self-hosted collab via excalidraw-room.example.tld
Stirling-PDF	PostHog + Scarf + analytics-consent nag, update check, desktop-install upsell (v2.14.2)
OpenCut	Vercel BotID phone-home, Databuddy analytics, react-scan CDN, MarbleCMS blog fetch
Penpot	telemetry confirmed off + onboarding/newsletter/what's-new/templates promo + Google-fonts-provider disabled → 0 external calls
Immich	GitHub version-check + external map tiles disabled; telemetry is local-only
miniPaint / AudioMass / openDAW / drawio	audited clean (no trackers, no load-time phone-home)

Cross-check verdict (Playwright): Penpot login works (dashboard reached); Penpot, Immich, OpenCut all made 0 external network calls on load; Excalidraw & Omniclip served chains verified clean via fetch(no-store). New route added: excalidraw-room.example.tld (collab backend, LE cert, socket.io 200).

---

Date: 2026-07-14 · Estate: one capable host (Ryzen 7950X / 183 GB / Coolify) + a second, oversubscribed box (gets nothing new) Scope constraint: no VM / KVM / VNC-webtop / GPU-passthrough patterns. Pure web-native apps in plain containers, CPU-only. Method: deep-research workflow (5 angles, 23 sources, 111 extracted claims — primary-source-heavy) + inline gap-fill (12 searches, 2 verification fetches). The workflow's adversarial-verify phase was killed by the usage limit; claims are sourced from primary pages (GitHub repos / official docs) but not triple-verified. Load-bearing claims for the shortlist (OpenCut classic self-host + archival, AudioMass multitrack) were re-verified directly.

---

TL;DR

1. Photopea can't be self-hosted — dev refuses (issues-only repo), the only path is an enterprise license (~$500–2000/month, annual). It does run fully client-side and works offline after one visit, so using photopea.com leaks nothing during editing — but it's not yours. The self-hosted raster answer is miniPaint (MIT, static files, layers/filters/multi-format export, v4.14.3 April 2026).
2. No self-hostable web NLE is Premiere-class yet. The deployable-today option is OpenCut classic (MIT, docker compose up -d, Next.js+Postgres+Redis+Rust/WASM) — but it was archived 2026-05-17; the OpenCut rewrite (68.7k★, Rust core, headless rendering, API, MCP server) is the thing to watch, not deploy. Omniclip (MIT, static, pushed today) is a decent quick-cut editor but renders client-side via WebCodecs and lacks audio editing/keyframes. For automated video production, Revideo (MIT, server-side renderVideo()) is the real gem — it pairs naturally with your n8n.
3. Design/vector is the most mature category — deploy all three: Penpot (MPL-2.0, official compose, the Figma alternative), Excalidraw (MIT + excalidraw-room for collab), drawio (official jgraph/drawio image, fully offline-capable).
4. Audio went from "gap" to "solved" in 2025–26: AudioMass (MIT, ~65KB static, now with full multitrack mode), Wavacity (GPLv2 Audacity→WASM port, static), openDAW (AGPLv3 browser DAW, 1.0 due in 2026), and self-hosted demucs stem separation (MIT model, several docker UIs; CPU is 5–10× slower than GPU — a 7950X eats it anyway).
5. AI image utilities, all CPU (GPU is a dead end here regardless: Intel killed IPEX and DG2 caps single allocations at 4GB): rembg (official CPU docker + HTTP API), IOPaint (inpaint/object-removal + RemoveBG/RealESRGAN/GFPGAN plugins — archived Aug 2025, still functional), FastSD CPU (MIT, compose, sub-second 512² via OpenVINO on a weaker CPU than yours).
6. Traps confirmed: tldraw (source-available, license key required in prod, watermark on free tier), Remotion (company license above $1M ARR — fine for personal use, flagged anyway), PhotoPrism (multi-user paywalled), Tdarr (freemium/proprietary), Photopea (above). Stirling-PDF is safe post-v1.0: core stays MIT, only SSO/team features paywalled — moot behind Authentik forward-auth.
7. Photo management: Immich (AGPL, ML on CPU is fine, stack idles 1.5–2GB) is a genuine upgrade over Nextcloud Memories (faces/semantic search/mobile UX) but also a second photo DB to babysit — decision point, not default. PhotoPrism and LibrePhotos are out.

---

A. Landscape by category

A1. Raster photo editing ("self-hosted Photopea")

Tool	License	Self-host	State 2026	Verdict
Photopea	Proprietary	❌ refused / ~$500–2k/mo enterprise	active SaaS	Use the site if needed; not self-hostable (photopea#4870)
miniPaint	MIT	✅ static nginx	v4.14.3 (2026-04-20), ~3.4k★	Deploy (repo)
Graphite	Apache-2.0	✅ static build (no official image)	alpha; vector solid, raster still experimental (LWN)	Watchlist (repo)
Filerobot & co	mixed	—	embeddable JS libraries, not apps	Skip

• miniPaint: fully client-side, real layer system (transparency/merge), selections, filters/effects, exports PNG/JPG/BMP/WEBP/animated GIF/TIFF + JSON layer format, official iframe embed. It's "Photoshop-shaped", not Photoshop-deep — no faithful PSD round-trip. For anything heavier: desktop GIMP/Krita on the Mac (the in-browser desktop route was researched and excluded per scope constraint).
• Graphite: Rust→WASM PWA, ~26.6k★, 170+ contributors, node-based nondestructive engine (node graph is shipped and working; the Tauri desktop app was abandoned in favor of the PWA). When raster lands, it becomes the category answer. Re-check in 6–12 months.

A2. Video ("alternative to Premiere Pro")

Deployable editors:

• OpenCut classic (opencut-app/opencut-classic) — MIT. Verified: docker compose up -d → full stack (Next.js web, Node services, Postgres, Redis, Rust/WASM GPU-compositing core) on :3100. Verified: archived 2026-05-17, "no longer maintained." Deploy it as a frozen convenience if you want a timeline editor at a URL today; expect zero fixes.
• Omniclip (omni-media/omniclip) — MIT, fully client-side, no official image (wrap npm run build in a static container). Very alive: last push 2026-07-14, ~1.4k★, 2.0 in progress. Trim/split, text/audio/video/image tracks, transitions, effects, WebRTC collab, 10–120fps, 4K export — all rendering happens in the browser via WebCodecs (your Mac does the work, the server just serves JS). Missing: audio editing, keyframes, speech-to-text. Quick-cut tool, not Premiere.
• Honest bottom line: for real NLE work (multicam, grading, motion), nothing web-native self-hosted competes in 2026. Desktop apps remain the pro path; the server's role is automation (below).

Programmatic / automated video (the underrated win):

• Revideo — MIT fork of Motion Canvas adding a first-class server-side rendering API (renderVideo() callable from Express/queue/cron). Built for automated pipelines — thumbnails, shorts, templated clips — and composes naturally with your n8n. (comparison)
• Remotion — React-based, more mature ecosystem, but company license: free under $1M ARR, paid above (license). Fine for personal use; Revideo is the cleaner license.

Watchlist: OpenCut rewrite (opencut-app/opencut, 68.7k★, v0.3.0 Apr 2026) — single Rust core, headless rendering, editor API, plugin system, MCP server all promised; no docker/self-host path yet; closed to outside contributions during the redesign. If it ships, it's the future category winner.

A3. Design / vector / whiteboard — the mature category

• Penpot (docs, self-host guide) — MPL-2.0 (genuinely open; file-level copyleft only). Official docker-compose: frontend (nginx), backend (Clojure/JVM), exporter (Node+Puppeteer), PostgreSQL, Valkey, MinIO; default :9001; ~2GB+ RAM. The real Figma alternative (design-to-code, real-time collab), and the flagship deploy of this whole report.
• Excalidraw (repo, official image) — MIT, E2E-encrypted collab via the official excalidraw-room server (+ optional storage backend; community composes exist, e.g. lrvt's guide; AstraDraw is a batteries-included MIT fork with workspaces if you want persistence/accounts). 1 vCPU/1GB is plenty.
• drawio (jgraph/drawio image, official blog) — Apache-2.0, official Tomcat-based image, runs fully self-contained offline (export server, PlantUML, VSDX included; DRAWIO_SELF_CONTAINED=1).
• tldraw — avoid: source-available proprietary license, production requires an active license key, free hobby tier forces a watermark, trial keys phone home. (tldraw.dev/community/license)
• SVG-edit: library-grade, superseded by the three above. Skip.

A4. Audio

• AudioMass (repo) — MIT, ~65KB, fully client-side static app (trim/fade/EQ/compress/reverb/pitch), verified: now ships a full multitrack mode (layer tracks, drag clips, crossfade, record onto armed channels, bounce to one file). ~2.9k★. The instant deploy.
• Wavacity (ahilss/wavacity) — GPLv2, Audacity ported to WASM/Emscripten, static self-host. Full Audacity UX in a tab; heavier and slower-moving than AudioMass, complementary.
• openDAW (opendaw.org, repo) — AGPLv3(+), serious browser DAW (17 stock devices, synths/sampler/drum machine), privacy-first, no telemetry, 1.0 launch expected in 2026. Deploy when 1.0 lands.
• Stem separation (demucs, MIT model): several self-hostable UIs — voice-separator-demucs (one-liner docker run -p 7860:7860), Muxr (FastAPI + compose, 2 services), demucs-web. CPU is 5–10× slower than GPU — on 32 threads of 7950X that's a few minutes per song. Pick voice-separator-demucs for zero-effort, Muxr if you want an API.

A5. AI image utilities — CPU-only by design

(GPU wouldn't help anyway: Intel discontinued IPEX — the canonical ComfyUI-on-Arc docker archived itself 2025-10-19 pointing to native PyTorch XPU — and DG2 silicon caps any single allocation at 4GB, an entry-level dGPU's total VRAM. Everything below runs happily on a modern multicore CPU.)

• rembg (danielgatis/rembg) — background removal as a service: rembg s --host 0.0.0.0 --port 7000 → HTTP API (/api/remove). Official CPU docker image works out of the box; GPU paths are CUDA/ROCm only. Persist ~/.u2net (model cache). Model menu: u2net, u2netp (light), isnet, birefnet, sam.
• IOPaint (Sanster/IOPaint) — Apache-2.0. Inpaint/outpaint, object/watermark/people removal (LaMa, CPU-friendly), plus plugins that close four gaps in one container: RemoveBG, RealESRGAN (upscale), GFPGAN + RestoreFormer (face/old-photo restoration), Segment Anything. Caveat: archived 2025-08-13 (last release Nov 2024) — functional homelab utility, don't build pipelines on its API.
• FastSD CPU (rupeshs/fastsdcpu) — MIT, docker-compose, Gradio UI + CLI + REST API + MCP server. Sub-second 512×512 on an i7-12700 (SDXS + OpenVINO + TAESD); 2–11GB RAM; actively maintained into 2026 (FLUX.2-Klein GGUF). Realistic expectations: turbo/distilled models at 512–768px — a utility generator, not an SDXL art station.
• Skip: robertsLando/upscaler (young single-maintainer, single fixed x4 model, LICENSE file missing — IOPaint's RealESRGAN plugin covers it), ComfyUI-on-CPU (technically runs, painfully slow for anything modern; SwarmUI/Forge same story without a real GPU).

A6. Photo management — optional upgrade

• Immich — AGPL-3.0, very active (docs CI within 5 days of research date), past 1.0 (APIs still unstable between majors). Postgres+Redis+ML stack idles ~1.5–2GB (ML ~500MB) → fine on the capable host, not on the oversubscribed box. ML is CPU-fine: 40k photos indexed in ~18h on an Intel N100 (homenode comparison) — a 7950X-class CPU will be several times faster. Community feature matrix: meichthys' table (Immich's own docs delegate comparison to it).
• PhotoPrism — free tier effectively single-user (multi-user behind Plus ~$4/mo). Out.
• LibrePhotos — inconsistent maintenance. Out. (Piwigo exists for huge web galleries but overlaps Nextcloud + PeerTube use.)
• Verdict: Nextcloud Memories (already running, with imaginary + go-vod) covers storage/timeline/transcode. Immich adds faces, CLIP semantic search, and the best mobile auto-backup UX — net-new capability, but a second photo database. Deploy only if that UX is actually wanted; use external-library mode against existing storage.

A7. Adjacent quick wins

• Stirling-PDF — v1.0 went open-core but core stays MIT: all essential PDF ops free, no user limits; the paywall covers SSO/SAML2/team mgmt/audit (discussion #4332). SSO paywall is moot behind Authentik forward-auth at the proxy. Java, ~0.5–1GB. Closes the whole PDF gap in one container.
• Cap (CapSoftware/Cap, cap.so) — MIT open-source Loom alternative: screen recording (macOS/Windows app) + self-hosted web backend via docker compose (API, DB, media server, S3-compatible storage) for instant share links, comments, transcripts. Self-hosted version fully functional, no artificial limits. Neat fit: record on the Mac, share links served from your own domain.
• FileFlows (fileflows.com) — transcode/file-processing pipeline automation (AV1/HEVC/H.264, VMAF-optimized, subtitles burn-in, watermarking, image/ebook flows). Free and better-regarded than Tdarr (freemium/proprietary — skip). Only bother if a batch re-encode need actually appears — Jellyfin + ConvertX already cover the daily cases. Verify FileFlows' current license tier before adopting.
• Not needed: HandBrake-web variants (your ConvertX + ffmpeg + Jellyfin cover it), OBS-in-container (X11/VNC family — out of scope by your constraint; Cap + SpectatorStream cover recording/broadcast).

---

B. What you have vs what it covers

Need	Today	After this plan
Conversion / utilities / sharing	ConvertX, CyberChef, IT-Tools, Zipline, PingvinShare, Send, PrivateBin	unchanged ✅
Media platforms	Jellyfin, PeerTube, Navidrome+ytm, Kavita	unchanged ✅
Photo storage/timeline	Nextcloud AIO + Memories (imaginary, go-vod)	+ Immich (optional)
Broadcast	SpectatorStream chain	+ Cap (screen-rec sharing)
Raster editing	❌	miniPaint (+ Graphite later)
Design/vector/diagram/whiteboard	❌	Penpot + Excalidraw + drawio
Video editing	❌	OpenCut classic (frozen) / Omniclip; Revideo for pipelines; OpenCut-rewrite on watch
Audio editing	❌	AudioMass (+ Wavacity; openDAW at 1.0)
Stem separation	❌	voice-separator-demucs or Muxr
AI image utils	❌	rembg + IOPaint + FastSD CPU
PDF suite	❌	Stirling-PDF
3D	❌	stays desktop (Blender on the Mac) — no sane web-native self-host in 2026

C. Ranked shortlist

Deploy — high confidence, low cost:

1. Penpot — flagship; the one that unlocks a real design workflow.
2. miniPaint — the Photopea stand-in; static, free, done in 10 minutes.
3. Excalidraw + excalidraw-room — whiteboard/collab.
4. drawio — diagrams, offline-capable official image.
5. Stirling-PDF — whole PDF category in one shot.
6. AudioMass — audio editor, static, multitrack.
7. rembg + IOPaint — the two most-used AI utilities (BG removal, object erase/upscale/restore), CPU.

Deploy if the need is real (decision points): 8. FastSD CPU — local image generation. 9. demucs UI (voice-separator-demucs / Muxr) — stems. 10. Cap — self-hosted Loom. 11. Immich — only for the faces/semantic-search/mobile UX. 12. OpenCut classic — timeline editor at a URL, knowingly frozen (archived 2026-05-17). 13. Revideo — when an automated-video use case shows up (n8n-friendly).

Skip: Photopea self-host (refused/enterprise), tldraw (license trap), Kasm/webtops (excluded by scope; also SSO-paywalled/security-sensitive), ComfyUI & friends (no viable GPU; CPU too slow), Tdarr (proprietary freemium), PhotoPrism (single-user free tier), LibrePhotos (maintenance), robertsLando/upscaler (redundant), Remotion (license; Revideo instead), SVG-edit, Filerobot, Piwigo (overlap).

Watchlist (re-check ~T1 2027): OpenCut rewrite (headless render + API + MCP), Graphite raster tools, Omniclip 2.0, openDAW 1.0.

D. Phased deployment

Everything on the capable host (fast NVMe, behind the Coolify proxy on a dedicated subdomain family). The oversubscribed box gets nothing. All CPU; zero interaction with the GPU / media server. Auth: the client-side statics hold no data at rest — Authentik forward-auth optional; anything with accounts/storage (Penpot, Stirling-PDF, Cap, Immich, OpenCut classic) goes behind Authentik (Coolify documents the forwardAuth middleware pattern officially: docs).

• Phase 1 — statics (one afternoon, ~zero RAM): miniPaint, Excalidraw(+room), drawio, AudioMass, Wavacity. Each = tiny image or static build behind coolify-proxy.
• Phase 2 — platforms (~an evening): Penpot (official compose: 6 services, ~2GB), Stirling-PDF (~1GB). Optional: OpenCut classic, Cap.
• Phase 3 — AI-CPU services: rembg (CPU image + ~/.u2net volume), IOPaint (LaMa + plugins), FastSD CPU (compose), demucs UI. Idle cost is near-zero; they burn CPU only while working.
• Phase 4 — decisions: Immich (external-library mode), Revideo (as a code dependency in a pipeline, not a service), openDAW at 1.0.

---

Sources

Workflow (23): photopea#4870 · viliusle/miniPaint · GraphiteEditor/Graphite · LWN 1051242 · opencut-app/opencut · omni-media/omniclip · linuxserver docs (kdenlive, webtop, selkies base, securing-kasm PSA) · kasm intel/amd · coolify authentik · pistack comparison · Docker_IPEX_ComfyUI · ComfyUI#476 · Sanster/IOPaint · rupeshs/fastsdcpu · robertsLando/upscaler · rembg notes · homenode photo managers 2026 · immich comparison · tldraw license · Stirling-PDF #4332 Gap-fill (12+): penpot docs · penpot 2026 review · excalidraw image · excalidraw-room · lrvt excalidraw guide · AstraDraw · jgraph/drawio · drawio docker blog · pkalogiros/AudioMass · ahilss/wavacity · opendaw.org · andremichelle/openDAW · voice-separator-demucs · Muxr · demucs-web · opencut-classic (verified: compose self-host + archived 2026-05-17) · remotion license · pkgpulse remotion/revideo 2026 · CapSoftware/Cap · fileflows.com · alternativeto tdarr