Inspectable
The web app, API, database migrations and iOS app are maintained in one public repository. You can inspect what actually runs.
MIT open source
Your inventory.Your stack.Your code.
Open Inventory is open source, self-hostable and documented — from Docker and PostgreSQL to the native iOS app and its OpenAPI interface.
MIT licenseDocker ComposePostgreSQLOpenAPI 3.1
open-inventory.stackhealthy
Web app
Next.js
iOS app
SwiftUI
Integrations
OpenAPI 3.1
Open Inventory
auth · api · jobs · migrations
PostgreSQL
inventory_postgres
Local uploads
inventory_uploads
Example architecture · optional external providers not shown
Adaptable
Extend types and fields in the UI, or change the MIT-licensed code to fit your process and infrastructure.
Self-hostable
Docker Compose, PostgreSQL, health checks and migrations are included. Domain setup, secrets, backups and updates remain operational decisions for your instance.
Integrable
A checked-in OpenAPI 3.1 specification and scoped bearer tokens connect Open Inventory to your own apps, scripts and automations.
Evidence, not claims
Inspect the foundations in the repository.
License, deployment definition, API contract, native app, migrations and tests are all source artifacts. The links below lead to the relevant files and directories.
License
The MIT terms, in full
The complete license text is part of the repository. It permits use, modification and redistribution under the conditions stated there.
Operations
Readable Docker configuration
The Compose file defines PostgreSQL, the migration step, persistent volumes and health checks. The Dockerfile shows the production build and its unprivileged runtime user.
Interface
OpenAPI 3.1 checked in
The machine-readable contract describes the versioned bearer-token API next to its implementation.
Native app
iOS source in the same project
The SwiftUI interface and the camera, scanning, upload and API code for the native app live under ios/Inventory.
iOS privacy
Inspectable privacy manifest
The checked-in Apple privacy manifest declares no tracking, no tracking domains and no collected data types. It is source evidence, not an independent privacy audit.
Data model
Versioned migrations
PostgreSQL schema changes are stored as reviewable SQL files in the repository.
Quality
Tests live next to the code
The tests directory contains automatable contract and behavior checks for core server functions.
The linked files show the current state of the code. They do not replace your own operational review or an independent security or privacy assessment.
MIT license
Open means you can inspect, change and extend it.
The short, established MIT license permits private and commercial use, modification and redistribution. The license and copyright notice must remain; the software is provided without warranty.
Read the license on GitHubInspect the code
Audit the flow yourself, or have it reviewed by your team and independent specialists.
Change the code
Adapt the interface, workflows and integrations to the actual processes in your organization.
Run it yourself
Choose hosting, domain, backup strategy and update windows according to your requirements.
Share improvements
Report bugs, discuss changes or submit a pull request to the open-source project.
Explicit data boundaries
Self-hosted means control — not automatically “local only.”
The core system runs on your infrastructure. Which external services receive data depends on your configuration and the features you deliberately use.
Inventory data
Core operation
The application writes structured data to the PostgreSQL database you configure.
Optional external service
You can use an externally operated PostgreSQL service by configuring its URL yourself.
Files and media
Core operation
The Docker setup can store uploads in a persistent local volume.
Optional external service
Openinary can be selected as an external storage provider and then receives the media you upload.
AI-assisted features
Core operation
Without configured provider keys, analysis, photo counting, translation and cover generation remain disabled.
Optional external service
When you deliberately use them, relevant images or content are sent to the configured OpenAI-compatible, Google or Replicate service.
Maps
Core operation
Without a Mapbox token, the map uses configured token-free street and satellite sources.
Optional external service
Map tiles still come from external services; Mapbox or custom URLs can be configured explicitly.
Authentication
Core operation
Local, database-backed accounts and roles work without an external identity provider.
Optional external service
Auth0 can be added deliberately; sign-in data then passes through that external service.
The open-source documentation makes these boundaries explicit. For your deployment, privacy review, secrets, TLS, backups, updates and the choice of trusted providers remain your responsibility.
Docker, Dokploy and Coolify
Three direct routes to your own stack.
On a Docker host, the install script handles secrets, the initial account and the Compose startup. Equivalent, catalog-ready import templates are available for Dokploy and Coolify.
PostgreSQL, migrations, health checks and persistent volumes are included
The install script generates secrets and the bootstrap password automatically
The production process runs as an unprivileged user inside the container
Back up PostgreSQL and uploads together, on a regular schedule
Docker quick start
$ git clone https://github.com/Utzel-Butzel/inventory.git
$ cd inventory
$ ./scripts/install.shThe terminal prints the admin email and the generated bootstrap password. After the first sign-in, change the password under Settings → Users.
Import into Dokploy once
The prepared template includes the application, PostgreSQL, persistent uploads and a health check, and is ready for catalog use.
Open the Dokploy directoryImport into Coolify once
The equivalent service definition uses the same application, database and storage model and is ready for catalog use.
Open the Coolify directoryThe default email for the Docker quick start is
[email protected]. Dokploy and Coolify store the generated password as a secret in their environment view. Open Inventory hashes the bootstrap value before the server starts and removes the cleartext value from the running process. Change the password after the first sign-in; the bootstrap account cannot replace an existing account.Open interface
Open source, with an open integration surface.
The OpenAPI contract is stored as YAML in the repository and a running instance also serves it as JSON.
OpenAPI 3.1
A machine-readable contract for resources, stock, scans, shares, roles and other API areas.
Scoped tokens
Tokens are hashed, scope-limited, optionally expiring and revocable.
Two protection layers
Token scopes limit transport access; roles and conditional rules remain the domain-level authorization layer.
Safe retries
Idempotent mutations protect important capture, stock and iOS flows from duplicate execution.
Develop it in the open
Use it. Inspect it. Improve it.
Open Inventory is an MIT-licensed open-source project. Run your own instance, open an issue or contribute a pull request.