Outline

License	FOSS problems	Maintenance	SSO	Users	Tested
BSL 1.1Source available license. Source available under restricted terms until a conversion date, after which it becomes open source. Each project sets its own restrictions.	Open Washing	Active	✅	Unlimited	✅

Evaluation

What it is

Outline is a collaborative knowledge base with a Notion-like editing experience — nested documents, real-time editing, comments, and a clean interface. Login is via magic links sent by email, or via OAuth providers (Google, Slack, OIDC).

Why it could be useful

Clean, fast, and pleasant to use. Real-time collaborative editing makes it better for active team collaboration than static tools like BookStack. Good full-text search and a well-designed interface lower the barrier for non-technical contributors. Despite the BSL license, the self-hosted version is surprisingly complete — most things work.

Why not to go for it

The license is BSL — Business Source License. It is not an OSI-approved open source license. Outline uses it to prevent competitors from hosting their product, but it also means this is not free software in any meaningful sense. Some features are locked out in the self-hosted version: structured data and some security features.

Setup

Add DNS records pointing docs.<domain> to the server:
- A record: docs → <ipv4>
- AAAA record: docs → <ipv6>

In Coolify, go to New Resource → Service, search for Outline, set the domain on the outline container (inside the container settings), then fill in the mail environment variables before deploying.

Outline uses magic links for login — SMTP is required, not optional:

Variable	Value
`SMTP_HOST`	`{{team.DEFAULT_SMTP_HOST}}`
`SMTP_PORT`	`{{team.DEFAULT_SMTP_PORT}}`
`SMTP_USERNAME`	`{{team.DEFAULT_SMTP_USERNAME}}`
`SMTP_PASSWORD`	`{{team.DEFAULT_SMTP_PASSWORD}}`
`SMTP_FROM_EMAIL`	`{{team.DEFAULT_SMTP_FROM}}`
`SMTP_SECURE`	`false` (port 587 uses STARTTLS, still encrypted)
`SMTP_NAME`	a simple name without symbols (e.g. `outline`) — some mail providers reject the HELO command if this contains special characters

Deploy.

Authentik SSO

In Authentik, go to Applications → Providers → Create, choose OAuth2/OpenID Provider. Set a name, leave Client Type as Confidential, and add the redirect URI https://docs.<domain>/auth/oidc.callback. Save and note the Client ID and Secret.
Go to Applications → Applications → Create and link it to the provider from step 4. Note the application slug.
In Authentik, the default OpenID 'email' mapping does not include an email_verified claim, which Outline requires. Create a custom one:
- Go to Customization → Property Mappings → Create → OAuth2/OpenID Provider (not OAuth Source)
- Name it anything, set Scope name to email
- Set the expression to:
```
return {
    "email": request.user.email,
    "email_verified": True
}
```
- Save, then go back to the provider from step 4, add this mapping under Advanced protocol settings → Property Mappings, and remove the default OpenID 'email' mapping.
In the same Authentik provider, add a second redirect URI to allow post-logout redirect back to Outline:
```
strict: https://docs.<domain>
```

In Coolify, set the following environment variables on the Outline container:

Variable	Value
`OIDC_CLIENT_ID`	from Authentik provider
`OIDC_CLIENT_SECRET`	from Authentik provider
`OIDC_AUTH_URI`	`https://auth.<domain>/application/o/<slug>/authorize/`
`OIDC_TOKEN_URI`	`https://auth.<domain>/application/o/<slug>/token/`
`OIDC_USERINFO_URI`	`https://auth.<domain>/application/o/<slug>/userinfo/`
`OIDC_DISPLAY_NAME`	`Authentik`
`OIDC_SCOPES`	`openid profile email`
`OIDC_LOGOUT_URI`	`https://auth.<domain>/application/o/<slug>/end-session/`
`OIDC_ALLOWED_DOMAINS`	(optional — leave unset to allow any domain)

Restart the container after saving.

Evaluation​

What it is​

Why it could be useful​

Why not to go for it​

Setup​

Authentik SSO​