Open-source licences
RespireCloud is proprietary software built with open-source components, used under their licences.
In RespireCloud
RespireCloud is proprietary software of Respiresoft LLC. It includes or links the following open-source components,
used under their licences. Full licence texts ship in licenses/ of every release (generated by the release pipeline).
| Component | Licence | Use |
|---|---|---|
| github.com/hashicorp/go-plugin, go-hclog | MPL-2.0 | module plugin transport |
| google.golang.org/grpc | Apache-2.0 | plugin RPC |
| google.golang.org/protobuf | BSD-3-Clause | plugin contract |
| github.com/nats-io/nats-server/v2, nats.go, nkeys | Apache-2.0 | embedded bus, agent identity |
| github.com/jackc/pgx/v5 | MIT | Postgres driver |
| github.com/santhosh-tekuri/jsonschema/v6 | Apache-2.0 | action schema validation |
| github.com/tetratelabs/wazero | Apache-2.0 | WASM sandbox for third-party panel extensions (w9-16) |
| go.yaml.in/yaml/v3 | MIT / Apache-2.0 | manifests |
| github.com/google/uuid | BSD-3-Clause | ids |
| golang.org/x/{crypto,net,sys,text,time,sync} | BSD-3-Clause | Argon2id, IDNA, syscalls |
| github.com/go-webauthn/webauthn | BSD-3-Clause | passkeys |
| github.com/valkey-io/valkey-go | Apache-2.0 | sessions cache, rate limits |
| github.com/fxamacker/cbor (tests) | MIT | passkey test authenticator |
| github.com/miekg/dns | BSD-3-Clause | DNS validation, zone parsing |
| github.com/coder/websocket | ISC | browser terminal stream |
| qrcode-generator (npm) | MIT | TOTP enrolment QR code in the panel |
| React, Radix UI, TanStack, Tailwind CSS, cmdk, lucide, uPlot, @fontsource (Sora, JetBrains Mono) (npm) | MIT / ISC / OFL-1.1 (fonts) | panel UI |
| SeaweedFS (installed binary) | Apache-2.0 | built-in S3 storage |
| Astro, marked, yaml, lucide-static, sharp (build only), @fontsource-variable (Sora, JetBrains Mono) (npm) | MIT / ISC / Apache-2.0 (sharp) / OFL-1.1 (fonts) | product site (site/; icons inlined in the HTML) |
| restic (installed binary) | BSD-2-Clause | backups |
| rclone (installed binary) | MIT | external storage connections |
| VictoriaMetrics, VictoriaLogs (installed binaries) | Apache-2.0 | metrics and logs |
| PowerDNS, Postfix, Dovecot, Rspamd, nginx, PHP, MariaDB, PostgreSQL, Valkey (distribution packages) | GPL-2 / IPL / MIT / Apache-2.0 / BSD / PHP / PostgreSQL | services installed unmodified (aggregation, ADR 0009) |
| Radicale (CardDAV/CalDAV server, w11-35) | GPL-3.0 | a separate service, off until an administrator enables it (mail.dav.set): the agent installs it from the distribution packages (radicale on Debian and Ubuntu, radicale3 from EPEL on the RHEL family), runs it as its own process with its own configuration, and never links, copies or ships its code. The ~40-line sign-in plugin we write for it (rc_auth.py, generated by the agent) is our own code, loaded by Radicale at run time through its documented plugin interface (aggregation, ADR 0009) |
| github.com/emersion/go-imap/v2, go-smtp, go-message, go-sasl | MIT | webmail gateway: IMAP, SMTP submission, MIME, SASL |
| Coolify one-click templates (coollabsio/coolify @ a963f95) | Apache-2.0 | adapted app templates in modules/containers/catalog (WordPress, Ghost, n8n, Uptime Kuma, Gitea, Nextcloud, Plausible, Metabase, SeaweedFS) |
| github.com/go-acme/lego/v4 | MIT | ACME client (ssl module) |
| github.com/corazawaf/coraza/v3 | Apache-2.0 | web application firewall engine of the web module (w11-21); compiled into respirecloud-agent and run as the separate local service rc-waf (reverse proxy between nginx and a site), not linked into nginx |
| github.com/corazawaf/coraza-coreruleset/v4 (embeds the OWASP Core Rule Set 4, https://github.com/coreruleset/coreruleset) | Apache-2.0 | the rule set rc-waf loads; built from go.sum-pinned source, never downloaded at run time |
| github.com/corazawaf/libinjection-go | BSD-3-Clause | SQL-injection / XSS tokenizer used by the rule set through Coraza (port of libinjection by Nick Galbreath) |
| github.com/libdns/libdns and libdns provider packages (azure, bunny, cloudns, desec, digitalocean, dnsimple, dynu, gandi, googleclouddns, he, hetzner, infomaniak, inwx, ionos, linode, namecheap, namedotcom, namesilo, netlify, ovh, route53, vercel) | MIT (libdns/dnsimple: Apache-2.0) | DNS record adapters of the providers module |
Claude skills in .claude/skills/ |
Apache-2.0 / MIT (see each SOURCE.md) | development context only, not shipped |
Code copied and adapted from permissively licensed projects is listed here as it is added (ADR 0009), with the
source path and commit. GPL/AGPL projects are never copied (study only).
| github.com/oschwald/maxminddb-golang/v2 | ISC | reads the country database file for the unusual sign-in alerts (w11-50); linked into respirecloudd |
| github.com/maxmind/mmdbwriter | ISC (LICENSE-MIT / LICENSE-APACHE shipped in the module) | writes the tiny fixture country database for tests and the lab; imported only by tests and internal/geoip/geoiptest, never by a shipped binary |
Country data (downloaded at run time, not shipped)
IP Geolocation by DB-IP (https://db-ip.com): the "IP to Country Lite" database, dbip-country-lite-YYYY-MM.mmdb.gz
from https://download.db-ip.com/free/, licensed under the Creative Commons Attribution 4.0 International License
(CC BY 4.0, https://creativecommons.org/licenses/by/4.0/). The panel downloads it onto the server on a schedule through the
outbound guard (internal/geoip) and looks addresses up locally; an address is never sent to DB-IP or anyone else. The
credit above is also shown on the panel's Licences page. DB-IP publishes MD5 and SHA-1 checksums on its download page (no
signature); the administrator can pin one in the panel.
Common/breached password list (internal/auth/data/common-passwords.txt.gz)
Derived from SecLists (https://github.com/danielmiessler/SecLists), MIT License, Copyright (c) Daniel Miessler:
Pwdb_top-100000.txt, 100k-most-used-passwords-NCSC.txt, xato-net-10-million-passwords-1000000.txt,
Pwdb_top-1000000.txt, rockyou-75.txt. Entries of 12-64 characters only (shorter ones fail the length rule),
lowercased, de-duplicated and sorted (about 73k entries, 460 KB gzipped). Checked offline, case-insensitively.
| github.com/russellhaering/goxmldsig v1.6.1 (and its dependencies github.com/beevik/etree v1.7.0 BSD-2-Clause, github.com/jonboulle/clockwork v0.5.0 Apache-2.0) | Apache-2.0 | XML signature validation (canonicalisation, digest, signature) for SAML single sign-on (w11-63); linked into respirecloudd |
Adminer 6.1.1 (database tool, w11-61)
Adminer, Jakub Vrana, https://www.adminer.org/ . Dual-licensed Apache-2.0 or GPL-2; RespireCloud takes it under the Apache License 2.0.
It is shipped unmodified as one separate PHP file, pinned in catalog/versions.json (component adminer, sha256
d2cbf80da00f7630304477b4a09f1bd2212bc6c4a53c71df1520a8afce3dc865, English build), fetched at first use through the agent's
download path and run as the hosting account's own user. None of its code is copied into RespireCloud; our own front door
(internal/agent/databases_admin_router.go) is a separate file that includes it. A copy for the lab is in lab/fixtures/.
RespireSoft AI Go SDK (w11-101)
third_party/respiresoft-ai/ is the owner's own github.com/respiresoft/ai-go (nerix-app sdk/go and sdk/vectors), copied unmodified so a
release builds without nerix-app; see third_party/respiresoft-ai/VENDORED.md. Standard library only. It signs requests to and
verifies answers from the RespireSoft AI hub for the "RespireSoft AI" provider of the ai module; linked into the ai module's plugin.
On this website
| Component | Licence | Use |
|---|---|---|
| Astro | MIT | builds this website (not shipped to your browser beyond the pages themselves) |
| Sora, JetBrains Mono (@fontsource) | SIL Open Font License 1.1 | the typefaces on this site and in the panel |
| Lucide icons (lucide-static) | ISC | icons on this site |
| marked | MIT | turns the module notes into these docs at build time |
| yaml | ISC | reads module manifests at build time |
| sharp | Apache-2.0 | makes the WebP screenshots at build time |