Third-party licences

NebulaCtrl is licensed under AGPL-3.0-only (ADR 0005). This page records the dependency licence scan run on 2026-10-27 and the rule new dependencies must meet.

Result: no incompatible licence was found in the Go modules that are compiled into the three binaries, nor in the web packages of apps/web. Nothing needs an owner decision.

Rule#

A dependency is acceptable when its licence can be combined with the AGPL-3.0:

Run the scan again before approving a new dependency and before each release.

Go (compiled into nebulactrl-server, nebulactrl-agent, nebulactrl)#

Command (the tool must be built once, because go run cannot cross-compile it; the agent and server ship for Linux):

GOBIN=/tmp/gl go install github.com/google/go-licenses/v2@latest
GOOS=linux GOARCH=amd64 /tmp/gl/go-licenses csv ./cmd/... ./internal/... ./pkg/...

go-licenses v2.0.1 reported 134 licence entries across 112 third-party modules. Summary by licence, counted per module:

No GPL, LGPL, AGPL, SSPL, BUSL, proprietary or non-commercial module is in the build.

Notes:

• MPL-2.0 applies to github.com/riverqueue/river (the job queue and its pgx driver), github.com/cyphar/filepath-securejoin. MPL-2.0 is file-level copyleft: NebulaCtrl links them unmodified, so only changes to those files would have to be published, and the AGPL is a permitted Secondary License.
• github.com/segmentio/asm is reported "no license found" by go-licenses because the licence sits in a file the classifier does not recognise. The file is MIT No Attribution (MIT-0), read directly from the module.
• Apache-2.0 modules that ship a NOTICE file are carried in the top-level NOTICE: aws-sdk-go-v2, smithy-go, go-oidc, skeema/knownhosts and go.yaml.in/yaml/v3. Distribution of the binaries must keep that file.
• The scan was also run over ./tools/... and ./tests/... (including the integration build tag): the only additional module is github.com/stretchr/testify (MIT, with BSD-3-Clause and ISC internals). These are not shipped.
• github.com/tailscale/hujson (BSD-3-Clause, compatible) is added for the optional managed Tailscale ACL push of the server mesh, which edits the user's policy without destroying its comments. It was added after the scan above (2026-10-27) and is not part of the counts; its licence is the upstream project's published BSD-3-Clause and was not re-scanned with go-licenses.
• templates/ is embedded in the server binary. It carries its own attribution file (templates/NOTICE, Apache-2.0 text for Coolify-derived templates and MIT for Dokploy-derived ones); go-licenses therefore reports that package as Apache-2.0. The licences of the applications the templates deploy are recorded per template in its upstream block.

Modules in the build#

Web (apps/web)#

Method: the license field of every package.json in the resolved node_modules tree, starting from the dependencies and devDependencies of apps/web/package.json and following nested dependencies. 260 packages: 91 reachable from dependencies (bundled into the shipped app) and 169 only from devDependencies (build and test tools, not shipped).

Direct dependencies that ship in the app:

Notes:

• No GPL, LGPL, AGPL, SSPL, BUSL, proprietary or non-commercial package is in the tree. Fonts are under the SIL OFL-1.1, which permits bundling.
• Code adapted into the repository keeps its own notice in the source files: lucide-animated icons (MIT, apps/web/src/components/icons/animated/LICENSE) and the dithercn image recipes (MIT, Copyright (c) 2026 Leo and Shadcn Labs (startercn); header comments in packages/dither/src/components/images/look.ts and algorithms.ts, full MIT text in NOTICE). Both are in the top-level NOTICE. dithercn's other catalogue entries are rebuilt in-house from its public documentation and no dithercn package is installed. The nebulactrl/nebula design-system files are the owner's own Apache-2.0 work and are relicensed by the owner under this repository's licence.
• The brand glyphs in apps/web/src/assets/brand-sprite.svg come from simple-icons (CC0). The logos remain trademarks of their owners and are used to identify the products.
• The marketing site apps/site did not exist when this scan was run (no node_modules). Run the same scan when it lands, and every manifest in the repository must carry "license": "AGPL-3.0-only" (with "private": true for unpublished packages).

Images NebulaCtrl deploys are separate works#

NebulaCtrl pulls and runs these container images unmodified, as separate processes that talk to NebulaCtrl over the network or the Docker API. They are not linked into, bundled with or derived from NebulaCtrl, so their licences neither extend to NebulaCtrl nor does the AGPL of NebulaCtrl extend to them. Each keeps its own licence and its own source-offer obligations (which NebulaCtrl does not take on by pulling the image on the user's server).

The licences of Loki, Grafana, SeaweedFS, Headscale, Pocket ID, Authelia and the database engines are the values recorded in internal/platform/catalog.go and internal/databases/engines/catalog.go; the others are the upstream projects' published licences and were not re-verified against each image on 2026-10-27. The licence class of every one-click template is handled separately by the template catalog (permissive, copyleft, source-available, see templates).