Penpot

License	FOSS problems	Maintenance	SSO	Users	Tested
MPL-2.0Copyleft license. Only the covered files must stay open — surrounding proprietary code in separate files is permitted.	—	Active	❌	Unlimited	✅

Evaluation

What it is

Penpot is a browser-based vector design tool — the FOSS alternative to Figma and Canva. Collaborative, real-time, and fully open source under MPL-2.0. No feature limits and no cloud dependency.

Why it could be useful

A credible replacement for Figma or Canva for teams that want to keep design work self-hosted. Everything runs in the browser, collaborative editing works out of the box, and the feature set covers most practical design needs — layouts, components, prototyping, and export.

Why not to go for it

There's no admin panel in the self-hosted version — all users are equal with no role management. New user registration must be manually disabled via feature flags after initial setup, which is easy to miss. Needs hands-on testing before recommending to a broader team — it's promising but the workflow differences from Figma or Canva take some adjustment.

Setup

1. Add DNS records pointing design.<domain> to the server:

   • A record: design → <ipv4>
   • AAAA record: design → <ipv6>

2. In Coolify, go to New Resource → Service, search for Penpot. Configure SMTP on the Penpot Backend container before deploying:

   Variable	Value
   PENPOT_SMTP_DEFAULT_FROM	{{team.DEFAULT_SMTP_FROM}}
   PENPOT_SMTP_DEFAULT_REPLY_TO	{{team.DEFAULT_SMTP_FROM}}
   PENPOT_SMTP_HOST	{{team.DEFAULT_SMTP_HOST}}
   PENPOT_SMTP_PORT	{{team.DEFAULT_SMTP_PORT}}
   PENPOT_SMTP_TLS	true
   PENPOT_SMTP_SSL	false
   PENPOT_SMTP_USERNAME	{{team.DEFAULT_SMTP_USERNAME}}
   PENPOT_SMTP_PASSWORD	{{team.DEFAULT_SMTP_PASSWORD}}

   Also set on the Penpot Backend container:

   Variable	Value
   PENPOT_PUBLIC_URI	https://design.<domain> — override the default $SERVICE_URL_FRONTEND_8080 or email links will contain the internal port

3. Set the domain on the Frontend container.

4. Deploy.

5. Register the first account. Note: there is no admin role in self-hosted Penpot — all users are equal.

6. After registering, disable new signups by adding disable-registration to PENPOT_FLAGS on both the Frontend and Backend containers, then redeploy.