Open Source · AGPL-3.0 · v26.06.1

One platform. Every vendor.

FreeSDN is an open-source, vendor-agnostic network management platform that unifies switches, cameras, VoIP phones, firewalls, and access control under a single dashboard.

Stop juggling vendor portals. One API, one dashboard, one source of truth for your infrastructure. Docker-native. Security-first. OpenAPI-documented.

Live Demo Read the Docs View on GitHub →
FreeSDN
Connected
A

Total Devices

247

Online

231

Alerts

3

Sites

12

Network Traffic

Recent Activity

Switch-01 port 24 up

2m ago

AI: Alert triage complete

5m ago

Plugin installed

12m ago

AP-Lobby offline

18m ago

10

Modules

Network, Cameras, VoIP, Firewall (incl. orchestration), Access Control, Backup, Observability, Hypervisor, Storage, AI

API

OpenAPI Contract

Comprehensive REST API with generated OpenAPI docs and typed response envelopes

Self-hosted

Deployment

Docker-native stack with your credentials and data kept on your infrastructure

No fees

Per-device Pricing

AGPL-3.0 licensed platform with no per-device fees and no phone-home telemetry

RBAC

Access Control

Strict-lower role assignment, per-user site grants, and fail-closed tenant checks

SDK

Plugin System

Typed SDK, Pydantic manifest, permission-declared, namespaced plugins, and trusted-author loading

Works with the gear you already own

TP-Link Omada Ubiquiti UniFi MikroTik RouterOS OpenWrt OPNsense pfSense Hikvision ONVIF FreePBX Grandstream Proxmox VE TrueNAS

12 vendor adapters across networking, firewall, cameras, VoIP, compute, and storage, plus a typed plugin SDK to add your own.

Platform Capabilities

A unified control plane for your infrastructure

FreeSDN is a self-hosted infrastructure controller for evaluation, testing, and homelab use while it moves toward production readiness. It uses a Pydantic-v2 contract layer throughout and is AGPL-3.0 licensed, with no per-device fees, no cloud lock-in, and no phone-home telemetry.

Unified Dashboard

One interface for switches, cameras, phones, firewalls, access control, and backups. Cross-module device correlation shows which switch port a camera connects to and which VLAN a phone uses.

Modular Architecture

10 loaded modules: Network Management, Video Surveillance, VoIP & Telephony, Firewall, Access Control (beta), Configuration Backup, Observability, Compute/Hypervisor, Storage, and AI Assistant (beta). Each has its own models, services, and adapters. Enable only what you need per organization.

Supported Apps & Hardware

Omada, OPNsense, pfSense, MikroTik, Proxmox, Hikvision, FreePBX, Grandstream, UniFi, OpenWrt, TrueNAS, and ONVIF-compatible cameras are labeled by maturity. The UI exposes the capabilities the selected adapter supports.

Layered Security

Argon2id password hashing, TOTP MFA, OIDC + LDAP SSO, strict-lower role assignment, per-user site grants, JWT + CSRF + jti revocation, Fernet credential encryption, central secret redaction on every adapter read, DNS-rebind / SSRF-safe HTTP, and an immutable audit log. Multi-tenancy is enforced at the application layer: organization scoping applied throughout the service layer (fail-closed), with per-user site grants enforced across the reviewed site-scoped modules.

Typed API Contract

A comprehensive REST API covers every managed device type, with OpenAPI generated from Pydantic v2 schemas. Consistent response envelope, cursor pagination, field filtering, sorting, and interactive Swagger UI are available on a running instance.

Multi-Tenant / MSP Ready

Organization-scoped isolation, per-tenant module enablement, per-user site grants, and fail-closed RBAC. Application-layer org-scoped queries run throughout the service layer for managed service providers handling client infrastructure.

Docker-Native Deployment

Core always-on stack: PostgreSQL, TimescaleDB, Valkey, FastAPI, Celery worker, Celery Beat scheduler, pg-backup, and Caddy edge with automatic HTTPS. Optional profiles cover IO workers, monitoring, camera restreaming, connection pooling, off-site DR, metrics, and edge proxying. Non-root execution, resource limits, and named volumes are built in.

Real-Time Events & Alerts

WebSocket push for device status changes, discovery events, and alerts. Celery Beat scheduled polling. Multi-provider notification system. Incident management. SLA-style availability tracking (early access: on-demand reports; FreeSDN itself offers no SLA). Alert rules engine.

Automation & Task Engine

Celery distributed task queue for device polling, discovery scans, configuration sync, firmware updates, scheduled backups, and metrics collection. Auto-retry with exponential backoff. Flower monitoring UI.

Plugin System & SDK

Extend FreeSDN with Python plugins using a typed SDK (DeviceSDK, AlertSDK, EventSDK, SSRF-locked HTTP client). Manifest-driven packaging, Ed25519-signed marketplace, and per-org enablement. Important: the plugin loader is load-time import hygiene: a cooperative trusted-author model, not a security sandbox. ZIP-slip/bomb guards, hash-pinned deps, and per-action permission caps apply.

AI / LLM Integration (Beta)

Multi-provider LLM support for OpenAI, Anthropic, and Ollama via direct httpx. Governance flows from the global kill-switch to per-org policy to PII redaction before any cloud call. Network-aware diagnostics, natural language queries, and full audit trails.

Webhook & Integration Layer

Outbound webhooks with templates, retry policies, and encrypted credentials. Integration adapters for Slack, Teams, PagerDuty, and custom HTTP endpoints. Event-driven delivery with tracking and failure alerts.

Why FreeSDN

Where FreeSDN fits

Single-vendor controllers are excellent within their own ecosystems. FreeSDN's distinct angle is open, vendor-neutral unification: managing many brands across many domains from one pane.

Feature FreeSDN Traditional NMS UniFi Omada Meraki

Multi-vendor control

Bidirectional API

Modular architecture

Open source

Self-hosted

Multi-tenant / MSP

Cameras & NVR

VoIP & PBX

Access control

Firewall management

No per-device fees

Plugin ecosystem

AI / LLM integration

Webhook integrations
Full support
Partial / Limited
Not available

A fair note: UniFi, Omada, and Meraki are mature, polished, vendor-supported platforms that go deep within their own ecosystems, and FreeSDN can manage their gear. This isn't a claim that an open, pre-production project is "better," only a map of where open, cross-vendor unification fits.

Module System

10 self-contained infrastructure modules

Each module is a fully independent domain with its own SQLAlchemy models, Pydantic v2 schemas, service layer, background tasks, and vendor adapters. Modules register at startup and can be enabled or disabled per organization. Click any module for the full breakdown.

Network Management

Built

Manage switches, access points, VLANs, WiFi networks, PoE, and topology across vendor adapters. Interactive port-VLAN matrix, LAG, port mirroring, rogue-AP detection, firmware lifecycle, and config history.

VLAN managementWiFi/SSID configSwitch port controlPoE managementLAG & port mirroringFirmware lifecycle
Explore Network Management

Video Surveillance

Built

Camera and NVR management via Hikvision ISAPI and ONVIF adapters. Live stream (RTSP/HLS/MJPEG/fMP4), recording playback, snapshots, PTZ, LPR, and forensic export with legal hold (SHA-256 archive).

Live view (RTSP/HLS)Recording & playbackPTZ controlLPRForensic exportNVR management
Explore Video Surveillance

VoIP & Telephony

Built

Unified phone fleet and PBX management. Phone provisioning, onboarding, SIP push, and factory reset via the Grandstream adapter. FreePBX management (AMI + ARI + REST): extensions, trunks, ring groups, queues, IVR, voicemail, DIDs, active calls, and CDR.

Phone provisioningExtension managementCall logs (CDR)Ring groups & IVRTrunk configVoicemail
Explore VoIP & Telephony

Firewall

Built

Firewall management (OPNsense production-grade, pfSense, MikroTik, OpenWrt) plus absorbed gateway orchestration: canonical VLANs, drift detection, and multi-controller distribution. Rule CRUD and reorder, NAT, VPN (IPsec/OpenVPN/WireGuard) with stats, and IDS/IPS.

Rule managementNAT configurationVPN (OpenVPN/WireGuard/IPsec)IDS/IPSVLAN distributionDrift detection
Explore Firewall

Compute & Hypervisor

Built

Proxmox VE management via the Proxmox adapter. Cluster overview, node stats, VM and LXC lifecycle, snapshots, backups, storage-pool inventory, SDN zones, and cluster state.

VM lifecycleLXC managementSnapshots & backupsStorage poolsSDN zonesCluster state
Explore Compute & Hypervisor

Observability

Built

Passive asyncio UDP listeners for SNMP traps, Syslog, and NetFlow. All ingested events land in a PostgreSQL store (the collector schema), indexed for dashboards, search, top-talker and protocol breakdowns. Zero-polling: devices push data to FreeSDN.

SNMP trap ingestionSyslogNetFlowPostgreSQL storageTop talkers & protocolsHistorical trends
Explore Observability

Storage

Built

Fabric participant for TrueNAS SCALE and CORE. Modern SCALE (25.04+) connects over a WebSocket JSON-RPC transport with TLS; older SCALE and CORE use the REST API, and the adapter auto-selects on connect. Provides ZFS pool health, disk temperatures, redundancy status, active alerts, and scrub progress as a unified rollup, and handles staged blob writes from other modules through the Fabric layer.

ZFS pool healthDisk temperaturesRedundancy statusActive alertsScrub trackingFabric blob writes
Explore Storage

AI Assistant

Beta

Multi-provider LLM assistant for OpenAI, Anthropic, and Ollama over direct httpx. It runs an agentic loop over a permission-gated tool registry, with governance from a global kill-switch through per-org policy to PII redaction before any cloud call, and an audit trail on every invocation.

Multi-provider LLMAgent toolsAgentic loopPolicy governancePII redactionAudit trails
Explore AI Assistant

Access Control

Beta

Beta, off by default. The data model for doors, credentials, cardholders, and schedules is in place. Door lock and unlock endpoints currently return 501 and no door adapter ships yet; the module is included for early adopters and integration planning.

Door CRUDCardholder managementCredential managementAccess schedulesEvent logsNo door adapter yet
Explore Access Control

Configuration Backup

Built

Portable configuration snapshots (.fsdn archive) covering sites, controllers, devices, users, and automation rules. Scheduled and on-demand, with restore, retention policies, cross-version diff, and AES-encrypted storage (Fernet). This is a config snapshot, not a full-system disaster-recovery image.

Config snapshotsOn-demand backupRestore operationsRetention policiesConfig diffAES encryption
Explore Configuration Backup
Extensibility

Plugin System & SDK

Extend FreeSDN with two-tier extensibility: native first-party modules (full trust) and SDK plugins (permission-declared, SDK-bounded, super_admin install only). The Plugin SDK gives developers typed interfaces, testing utilities, and CLI tools. Install from PyPI with pip install freesdn-sdk.

Trusted-Author Model

The plugin loader applies load-time import hygiene and permission checks. It is not a security sandbox in the OS/container sense. Plugins are cooperative: they are expected to be authored by trusted parties (super_admin installs only). SDK interfaces, SSRF-locked HTTP, and permission gates provide the safety guardrails.

Full SDK Interfaces

Typed interfaces for devices, alerts, events, settings, and HTTP. Your plugin gets a PluginContext with DeviceSDK, AlertSDK, EventSDK, PluginSettingsSDK, and an SSRF-protected HTTP client (blocks internal IPs, private ranges, cloud metadata endpoints).

Manifest Validation

Every plugin declares a plugin.yaml manifest with ID, version, permissions, dependencies, event subscriptions, and settings schema. Validated at install time and at development time via the SDK CLI.

Event-Driven Architecture

Subscribe to any event pattern (device.status.changed, alert.created, etc.) with priority routing. Plugins can emit their own events. Full correlation and causation ID tracing across the event chain.

Ed25519-Signed Marketplace

Package plugins as versioned ZIPs. Marketplace catalog entries are Ed25519-signed by the publisher; unsigned packages are refused by default. SHA-256 verified at install. Per-organization plugin enablement. Super_admin install only.

Developer CLI

freesdn-sdk init, validate, package, and check commands. Scaffold a plugin in seconds, validate your manifest, build a distributable ZIP, and check for import hygiene issues before deploying.

Write a plugin in minutes

Subclass FreeSDNPlugin, implement lifecycle hooks, and use the typed SDK context to interact with devices, alerts, events, and settings. Permissions you declare in the manifest are the ceiling for what the platform will allow.

SDK Interfaces
DeviceSDK

Query and manage devices across all adapters

list, get, get_ports, update

AlertSDK

Create alerts, resolve incidents, manage severity

list, create, resolve, update

EventSDK

Publish and subscribe to domain events

emit, subscribe

PluginSettingsSDK

Per-plugin configuration and encrypted secrets

get, set, get_secret, set_secret

PluginHTTPClient

SSRF-protected HTTP client with timeout limits

get, post, put, delete, patch

plugin.py
from freesdn import FreeSDNPlugin, PluginContext
class OfflineMonitor(FreeSDNPlugin):
"""Alert when devices go offline."""
async def on_start(self, org_id, db=None):
await super().on_start(org_id, db)
self.ctx.events.subscribe(
"device.status.changed"
)
async def on_event(self, event):
if event.payload.get("status") == "offline":
await self.ctx.alerts.create(
title=f"{event.payload['name']} went offline",
severity="critical",
)
terminal
$ pip install freesdn-sdk
$ freesdn-sdk init offline-monitor
$ freesdn-sdk validate .
# Manifest valid. 0 warnings.
$ freesdn-sdk check .
# Import hygiene OK. 0 warnings.
$ freesdn-sdk package .
# Created offline-monitor-1.0.0.zip (2.1 KB)

Runtime Limits

Hard limits enforced by the FreeSDN runtime to prevent resource abuse.

50

Triggers per plugin

50

Actions per plugin

20

AI tools per plugin

50

Python dependencies

50 MB

Max ZIP size

60s

HTTP timeout

Fabric: universal app-interconnect

The Fabric layer (GET /api/v1/fabric/catalog) publishes a single tier-tagged catalog of operations, events, and AI-tool projections from both native modules and SDK plugins. Operators author Connections (event → step chain) that wire any app to any other without custom code. Three built-in sinks (notify / log / webhook), inbound org-key ingestion, outbound webhook, and a community n8n node (n8n-nodes-freesdn). Writes always ride the staged dual-gate.

AI-Powered Operations

LLM Integration & Governance BETA

Bring AI into your network operations with built-in governance. Three cloud and self-hosted providers, 11 platform tools, an agentic loop, and a 3-layer governance model that keeps credentials and PII from reaching the cloud. AI is off by default and must be explicitly enabled.

Supported Providers

Provider Models Status
OpenAI GPT-4o, GPT-4o-mini, and others Ready
Anthropic Claude Sonnet, Haiku, and others Ready
Ollama Llama 3, Mistral, Qwen (self-hosted) Ready

Global Kill-Switch (default OFF)

AI is disabled by default at the platform level. Administrators must explicitly enable it. No AI calls leave the platform until a super_admin opts in, preventing accidental cloud exposure.

Per-Org Policy

Each organization has its own AI policy: DISABLED, LOCAL_ONLY (Ollama only, no cloud), or CLOUD_APPROVED. Orgs cannot exceed the platform-level policy ceiling.

PII Redaction Before Cloud

Sensitive values are stripped from context before any prompt reaches a cloud provider. Device credentials, secrets, and personal data are redacted so they never leave your environment in plain text.

11 Built-in Tools & Agentic Loop

The assistant ships 11 platform tools (device queries, alert management, config review, diagnostics, and more). An agentic loop (up to 5 iterations) lets the model chain tool calls to complete multi-step tasks. Plugins can register up to 20 additional AI tools each.

Built-in Use Cases

Network Diagnostics

Ask AI to analyze device health, explain port errors, and suggest fixes based on real-time telemetry data.

Alert Triage

AI summarizes alert clusters, identifies root causes, and recommends remediation steps across device types.

Configuration Review

Submit config changes for AI review before deployment. Catch VLAN mismatches, routing loops, and security gaps.

Natural Language Queries

Ask questions in plain English: 'Which switches have high CPU?' or 'Show me all offline cameras at Site 3'.

System Architecture

Multi-tier platform design

FreeSDN follows a clean layered architecture: Client to API Gateway to Core + Modules to Adapter Registry to Physical Devices. Each request flows through JWT validation, tenant context injection, rate limiting, and permission checking before reaching business logic.

Architecture Layers

Client Layer

React 19 + TypeScript + Vite 8

React 19.2 SPA, Node 24, TypeScript 6. shadcn/ui components, TanStack Query, Zustand stores

API Gateway

FastAPI + Middleware Stack

JWT + CSRF validation, tenant context, rate limiting, CORS, structured logging

Core Platform

Auth · Devices · Discovery · Events · Audit

Always loaded. Pydantic v2 schema layer, event bus, Celery task queue

Module Layer

10 Domain Modules

Hot-pluggable, isolated, per-org enablement, own DB migrations

Plugin Layer

SDK + Marketplace + Governance

Trusted-author Python plugins (cooperative model, not a security sandbox), typed SDK interfaces, manifest validation, SSRF protection

AI / LLM Layer

Multi-Provider + Token Budgets

OpenAI, Anthropic, Ollama. Tool calling, prompt governance, 3-layer policy, audit trails

Adapter Registry

Adapter SDK · maturity tracked

BaseAdapter ABC, capability mixins, connection pooling, retry logic

Infrastructure

PostgreSQL · Valkey · Celery · TimescaleDB

Celery worker + worker-io split, TimescaleDB time-series

Technology Stack

Python 3.14.5

Backend

FastAPI

API Framework

SQLAlchemy 2.0

ORM

Pydantic v2

Validation

PostgreSQL 18.4

Database

TimescaleDB

Metrics / Events

Valkey 8.1

Cache / Broker

Celery 5.6

Task Queue

React 19.2

Frontend

TypeScript 6

Type Safety

Tailwind CSS v4

Styling

shadcn/ui

Components

Vite 8

Build Tool

Node 24.16

JS Runtime

TanStack Query

Data Fetching

Caddy

Edge / Auto-HTTPS

Supported apps & hardware

FreeSDN labels each integration by maturity so you can decide what to test, pilot, or rely on. Vendors that are not built are intentionally omitted.

Vendor / app Category Protocol Maturity Notes
TP-Link Omada Network (switch/AP/gateway) httpx + OAuth2 Fully supported Reference adapter; deepest coverage.
OPNsense Firewall / gateway / VPN httpx + API Key Fully supported Feature domains use stage + apply.
pfSense Firewall / gateway httpx + API Key Fully supported Shares OPNsense plumbing; API-key auth.
MikroTik RouterOS Router / switch / wireless httpx + REST API Fully supported Full backend; UI covers a subset of domains.
Proxmox VE Compute / hypervisor httpx + API Token Fully supported VMs, CTs, snapshots, backups, HA, SDN, Ceph.
Hikvision Cameras / NVR httpx + Digest (ISAPI) Fully supported ISAPI streaming, PTZ, playback, NVR import.
FreePBX / Asterisk VoIP / PBX AMI / ARI / REST Beta Extensions, trunks, queues, IVR, CDR; limited field testing.
Grandstream VoIP / SIP phones aiohttp CGI Beta Provisioning, status, and fleet operations.
Ubiquiti UniFi Network (switch/AP/gateway) httpx + UniFi API Beta Validated by automated tests; not yet field-tested on physical hardware. REST only.
OpenWrt Router / AP httpx + ubus / rpcd Preview Speaks ubus/UCI; not yet audited. Developer preview.
TrueNAS Storage WS JSON-RPC (TLS) Preview Read-only health, pool, and disk monitoring.
ONVIF-compatible cameras Cameras SOAP over httpx Preview / generic Generic fallback shim for Dahua, Axis, Reolink, Amcrest, and similar cameras.

Adapter SDK: add a vendor in one file

Subclass BaseAdapter, implement the typed interface, register in the adapter registry. The platform handles connection pooling, retry logic, caching, and capability detection automatically.

adapters/my_vendor/adapter.py
from app.adapters.base import BaseAdapter
from app.adapters.capabilities import SwitchCapabilityMixin
class MyVendorAdapter(BaseAdapter, SwitchCapabilityMixin):
"""Your vendor, typed and testable."""
async def connect(self) -> None:
self.session = await self._create_session()
async def discover_devices(self) -> list[Device]:
raw = await self.session.get("/api/devices")
return [self._normalize(d) for d in raw]
async def get_ports(self, device_id) -> list[SwitchPort]:
# SwitchCapabilityMixin interface - typed return
return await self._fetch_ports(device_id)
Enterprise Security

6-layer security model

Security is built into every layer - from application-layer tenant isolation and staged write gates to signed supply chains and HTTP hardening. FreeSDN uses a defense-in-depth approach for environments that handle network credentials.

This release includes automated tests and internal review, but no third-party security audit, live-exploit penetration test, or compliance certification is claimed.

1

Authentication

JWT access tokens (15 min) + refresh tokens (7 days), jti revocation blacklist and token_version invalidation. MFA via TOTP (RFC 6238) with backup codes. SSO via OIDC (working) and LDAP (working) - SAML gated pending XSW-safe verifier. Account lockout after 5 failures with exponential backoff.

Argon2id · 64 MB / t=3 / p=4TOTP MFA + backup codesOIDC + LDAP SSOJWT HS256 + jti revocation
2

Authorization

Role-based access control with strict-lower-than assignment that blocks privilege escalation at the API layer. Five assignable roles (super_admin → org_admin → site_admin → operator → viewer); the permission hierarchy adds two internal-only levels (admin, guest) used for comparison logic but not user-assignable. Scoped API keys act as a hard permission ceiling, even for super_admin.

5 assignable rolesPer-module permissionsScoped API key ceilingResource-level checks
3

Multi-Tenancy

Application-layer org-scoped queries throughout the service layer, combined with per-user site grants enforced across the site-scoped modules. Fail-closed by default - no resource is returned unless the caller's organization is verified.

Org-scoped service layerPer-user site grantsFail-closed enforcementCovered by automated tests
4

Credential & Data Safety

Fernet AES-128-CBC + HMAC-SHA256 encryption for all stored device credentials and secrets. Central redact_secrets (~120 sensitive keys, camelCase-aware) scrubs adapter reads before any response leaves the API. SSRF-safe HTTP via resolve-once + IP-pin (no redirects, metadata/CGNAT blocked).

Fernet credential encryption~120-key secret redactionSSRF / DNS-rebind guardPath-traversal allow-list
5

Write Safety & Audit

Staged dual-gate for every adapter write: ADAPTER_READ_ONLY=false AND force=true must both be set; UI-authored writes are staged to the DB and never touch live devices until an explicit operator apply. Every privileged action is logged with user, org, IP, user-agent, resource, and before/after diff.

Staged dual-gate writesExplicit operator applyImmutable audit logBefore/after diffs
6

Transport & Supply Chain

TLS 1.3 everywhere via Caddy automatic HTTPS. CORS explicit allowlist. Rate limiting per endpoint (429 + Retry-After). CSRF tokens on state-changing requests. Marketplace catalog is Ed25519-signed (unsigned refused by default); agent auto-updates are ECDSA-P256 signed, fail-closed.

TLS 1.3 / Caddy auto-HTTPSCORS + CSRF + CSP/HSTSRate limiting + 429Ed25519 / ECDSA signed supply chain

Role Hierarchy (5 assignable)

Role Score Scope Access Level
super_admin 100 Global Full platform access, all organizations
admin 80 Internal Internal hierarchy level — not user-assignable
org_admin 60 Organization Full access within their organization
site_admin 40 Site Manage assigned sites and devices
operator 20 Site Day-to-day operations, limited config changes
viewer 10 Site Read-only access to dashboards and logs
guest 0 Internal Internal zero-privilege level — not user-assignable

Strict-lower-than role assignment enforced at the API layer - no user can grant a role equal to or higher than their own.

Pre-production / testing release

FreeSDN is under active development and is currently intended for evaluation, testing, and homelab use. It is not yet recommended for production or business-critical deployments. Features, APIs, and data schemas may change between releases. Please validate thoroughly in a non-production environment. Production readiness will be announced in a future release.

Getting Started

Running in 3 steps

FreeSDN ships as a Docker Compose stack. Clone, configure, and launch - the core platform is up in minutes. Pick a scale tier (Lite / Pro / Max) or use the one-command installer.

1

Clone & configure

$ git clone https://github.com/freesdn/freesdn.git
$ cd freesdn
$ cp .env.example .env.pro # or .env.lite / .env.max

Edit the env file to set POSTGRES_PASSWORD, SECRET_KEY, ENCRYPTION_SALT, LOGDB_URL, and REDIS_PASSWORD. The app refuses to boot in production if any of these are missing or set to insecure defaults.

2

Launch the stack

# One-command installer (recommended):
$ ./install.sh
# - or choose a scale tier manually:
$ docker compose --env-file .env.lite up -d
$ docker compose --env-file .env.pro up -d

Core always-on services: postgres, logdb (TimescaleDB), redis (Valkey), api, worker, scheduler, pg-backup, Caddy. Add profiles (monitoring, cameras, pooling, dr, metrics) as needed.

3

Open the dashboard

# Dashboard: http://localhost:8080 (default lite tier; or https://<your-domain> with --domain)
# API Docs: http://localhost:8000/api/v1/docs (dev only)
# Flower: http://localhost:5555 (monitoring profile)

First-run web wizard creates your admin account - no hardcoded default password.

Requirements

Docker 24+
Docker Compose v2+
RAM 4 GB min
Storage 2 GB free

Container Stack

postgres PostgreSQL 18.4
5432
logdb TimescaleDB on PG18
5433
redis Valkey 8.1
6379
api FastAPI / Uvicorn
8000
worker Celery Worker
-
scheduler Celery Beat
-
pg-backup GPG-encrypted backup
-
caddy Caddy (auto-HTTPS edge)
80/443
Open Source

Free as in freedom

FreeSDN is fully open-source under the AGPLv3 (AGPL-3.0-only) license. No artificial limitations, no "community edition" crippling, no surprise licensing changes.

AGPL-3.0 Licensed

No vendor lock-in, no per-device fees, no phone-home telemetry. Fork it, extend it, build services on top of it. The source is yours.

No Per-Device Fees

Monitor a small lab or a large fleet. FreeSDN charges nothing per device. Compare that to commercial per-device licensing.

Self-Hosted

By default, your credentials and data stay on your own infrastructure. No cloud dependency, no SaaS outage risk, fully air-gappable.

Community-Driven

Built by network engineers for network engineers. Feature requests, bug reports, and pull requests are all welcome.

Ready to take control of your network?

Join the community managing their multi-vendor infrastructure with a single, open-source platform.

View on GitHub Quick Start Guide Star on GitHub