$ docker run -d --name ideon -p 3000:3000 -v ideon-data:/app/storage -e SECRET_KEY=$(openssl rand -hex 32) ghcr.io/3xpyth0n/ideon:latest

Updated11 hours ago

LanguageTypescript

Setup difficultyEasy

Stars: 666
Port: 3000 (HTTP and WebSocket traffic of the app (APP_PORT default))

Docker

ghcr.io/3xpyth0n/ideon

Overview of an Ideon workspace: blocks for notes, repos and tasks laid out on the canvas

Ideon dashboard with projects and the spatial canvas

Structured blocks holding repositories, links, files and notes

Spatial organisation of blocks on the infinite canvas

What is Ideon?

Ideon is a collaborative workspace tool that lays a project out on a spatial 2D canvas instead of folders and tabs, aimed at teams and individuals who want repositories, notes, links, tasks and people visible together. Everything on the canvas is a block: Markdown notes, Mermaid diagrams, files, links, Git repositories, Kanban boards and database blocks can be placed, connected and grouped freely. Several people can edit the same project at once, with live cursors and CRDT-based sync, and projects can be shared by email invite or read-only public link. The workspace keeps historical snapshots you can browse and rewind, and every write is recorded in a tamper-evident, hash-chained audit trail. Canvas state can be synced to a Git repository as versioned files under a hidden .ideon directory, and webhook and cron blocks run server-side automations. An MCP endpoint and API keys let AI agents read and manipulate the canvas. It runs via Docker (single container with SQLite, or a compose stack with PostgreSQL), a one-line installer script, or a one-click Easypanel template; the AGPLv3 code sits on GitHub with free self-hosting, plus paid managed cloud and enterprise tiers.

Should you self-host Ideon?

Ideon scores 50/100 on selfhost.directory (how scoring works) and ranks #5 of 9 in Whiteboarding. It has 666 GitHub stars.

It shipped 17 stable releases in the past year. The latest, v1.0.0, came out on 15 October 2026. New versions land roughly every 8 days.

Setup is easy: most people get it running in one sitting. An official Docker image is available. It is AGPL-3.0-licensed and written mostly in Typescript.

Its closest alternative on selfhost.directory is Plane (86/100, 61 611 stars). It scores higher overall, so compare the two before you pick. See Ideon vs Plane side by side.

Features

Git repository and issue embedding
Git versioning of canvas
Infinite spatial canvas
Kanban Boards
Magic link passwordless login
Markdown Notes
MCP server for AI agents
Mermaid diagram rendering
Public read-only share links
Real-time multiplayer collaboration
Role-based Access Control
Single sign-on (OAuth, OIDC, SAML)
Tamper-evident audit trail
Webhook and cron automation blocks
Workspace snapshots and rewind

How to configure Ideon

APP_PORT3000App Host port to expose the app (container listens on 3000)
App Host port to expose the app (container listens on 3000)
APP_URLhttp://localhost:3000Public base URL of the app (used for invitations and SSO auth)
Public base URL of the app (used for invitations and SSO auth)
AUTH_PROXY_AUTO_PROVISIONfalseCreate a new account automatically on first proxy-authenticated request.
Create a new account automatically on first proxy-authenticated request.
AUTH_PROXY_ENABLEDfalseProxy / Header Authentication Automatic sign-in via trusted reverse proxy headers (nginx mTLS, Traefik, Authelia, etc.) Only enable when Ideon is reachable exclusively through the proxy; never expose port 3000 publicly.
Proxy / Header Authentication Automatic sign-in via trusted reverse proxy headers (nginx mTLS, Traefik, Authelia, etc.) Only enable when Ideon is reachable exclusively through the proxy; never expose port 3000 publicly.
AUTH_PROXY_HEADER_EMAILx-remote-emailHeader carrying the email address (required).
Header carrying the email address (required).
AUTH_PROXY_HEADER_USERx-remote-userHeader carrying the username or display name (optional, used for provisioning).
Header carrying the username or display name (optional, used for provisioning).
AUTH_PROXY_SECRETShared secret the proxy MUST send in the X-Proxy-Secret header on every request. Generate with: openssl rand -hex 32 Configure nginx: proxy_set_header X-Proxy-Secret "your-secret-here";
Shared secret the proxy MUST send in the X-Proxy-Secret header on every request. Generate with: openssl rand -hex 32 Configure nginx: proxy_set_header X-Proxy-Secret "your-secret-here";
AUTH_URLOverride for Auth.js base URL.
Override for Auth.js base URL.
DB_HOSTideon-dbPostgreSQL host or service name (Docker Compose: ideon-db)
PostgreSQL host or service name (Docker Compose: ideon-db)
DB_NAMEideonPostgreSQL database name
PostgreSQL database name
DB_PASSPostgreSQL password
PostgreSQL password
DB_PORT5432PostgreSQL port (default 5432)
PostgreSQL port (default 5432)
DB_SSLSet to true to enable TLS for Postgres.
Set to true to enable TLS for Postgres.
values: true|false
DB_USERideonPostgreSQL username
PostgreSQL username
DEV_ALLOWED_ORIGINSComma separated origins to allow for CORS in development.
Comma separated origins to allow for CORS in development.
ENV_FILE.envEnv file consumed by docker-compose (defaults to .env).
Env file consumed by docker-compose (defaults to .env).
GIT_ALLOWED_HOSTSGit Integration Comma-separated list of allowed internal hosts for Git stats fetching (bypasses SSRF protection) Example: gitlab.internal,10.0.0.5
Git Integration Comma-separated list of allowed internal hosts for Git stats fetching (bypasses SSRF protection) Example: gitlab.internal,10.0.0.5
LOG_LEVELinfoServer log level. Defaults to `debug` when `NODE_ENV=test`, otherwise `info`. Options: debug|info|warn|error|fatal
Server log level. Defaults to `debug` when `NODE_ENV=test`, otherwise `info`. Options: debug|info|warn|error|fatal
NEXT_PUBLIC_LOG_LEVELerrorPublic client log level. Only affects client-side logging and is bundled into the client. Options: debug|info|warn|error
Public client log level. Only affects client-side logging and is bundled into the client. Options: debug|info|warn|error
PGID1001Optional: Group ID for file ownership.
Optional: Group ID for file ownership.
PUID1001Optional: User ID for file ownership.
Optional: User ID for file ownership.
SECRET_KEYSecurity Primary master key used to derive security secrets. USAGE: - Signs user session JWTs. - Authenticates internal API bypass requests. - Derives data encryption keys (if used, data becomes unreadable on rotation). ROTATION IMPACT: High. Will invalidate all active sessions immediately. Use a strong, random string (e.g., openssl rand -hex 32)
Security Primary master key used to derive security secrets. USAGE: - Signs user session JWTs. - Authenticates internal API bypass requests. - Derives data encryption keys (if used, data becomes unreadable on rotation). ROTATION IMPACT: High. Will invalidate all active sessions immediately. Use a strong, random string (e.g., openssl rand -hex 32)
SHELL_MAX_SESSIONS2Shell Block Maximum concurrent shell sessions per project (default: 2)
Shell Block Maximum concurrent shell sessions per project (default: 2)
SMTP_FROM_EMAILSMTP Sender email address
SMTP Sender email address
SMTP_FROM_NAMESender display name
Sender display name
SMTP_HOSTSMTP host
SMTP host
SMTP_PASSWORDSMTP password
SMTP password
SMTP_PORTSMTP port (e.g., 587 for STARTTLS)
SMTP port (e.g., 587 for STARTTLS)
SMTP_USERSMTP user
SMTP user
SMTP_USE_TLStrueUse TLS (true/false)
Use TLS (true/false)
SQLITE_PATH./storage/dev.dbPath to the SQLite file when DB_HOST is not set.
Path to the SQLite file when DB_HOST is not set.
TIMEZONEUTCCanonical timezone for server logs ONLY
Canonical timezone for server logs ONLY