Trilli: A Fully Open-Source (MIT) Full-Stack Cloud Storage Platform — A Dropbox Alternative

An Unconventional Open-Source Decision

At a time when SaaS founders routinely lock their core code behind "Enterprise Edition" paywalls, one independent developer made the opposite choice: after commercializing his cloud storage platform, he open-sourced the entire codebase under the MIT license — including the platform itself and its operational console, with nothing held back for a paid tier.

The project is called Trilli, and it's positioned as a self-hosted alternative to Dropbox + Google Docs + DocuSign. In other words, it aims to cover three critical enterprise use cases — file storage, online document collaboration, and electronic signatures — with a single open-source system. The author states that he previously ran it as a commercialized SaaS in production, which means this is not a toy-level demo but a battle-tested, mature system.

Trilli Feature Overview: An All-in-One Enterprise Document Infrastructure

Trilli's feature coverage is remarkably comprehensive, addressing nearly every key step in a company's day-to-day document workflow.

Storage & Security: Per-Tenant Encryption at Rest

The most notable aspect is its per-tenant encryption at rest design. The author explicitly emphasizes that storage providers only see ciphertext and cannot access plaintext data. This architecture is especially important in multi-tenant scenarios — it means that even if the underlying storage service is compromised, or the storage provider itself cannot be trusted, tenant data remains protected. For enterprise users handling sensitive contracts and financial documents, this is a hard compliance requirement.

Document Collaboration: Online Editing via Collabora

In-browser Office co-editing is implemented via the Collabora / WOPI protocol. This solution is the commercial branch of LibreOffice Online, capable of delivering a real-time multi-user collaboration experience close to Google Docs, while keeping documents stored on your own server. For teams unwilling to hand business secrets over to Google, this is a practical choice.

WOPI (Web Application Open Platform Interface) is an open protocol standard proposed by Microsoft that defines how web applications interact with document storage services. Through WOPI, Collabora Online can directly read and write files stored on Trilli's server without uploading documents to a third-party server. Collabora Online itself is built on the LibreOffice engine and supports rendering and editing of mainstream Office formats such as .docx, .xlsx, and .pptx — far better compatibility than pure Markdown or plain-text approaches. The deployment cost of this combination is relatively high — Collabora requires running a separate container service — but in return you get a near-commercial document editing experience and full data sovereignty.

Electronic Signatures: PKCS#7 Document Sealing

The electronic signature feature uses PKCS#7 document sealing. PKCS#7 is the industry-standard Cryptographic Message Syntax; sealing a signed PDF with it guarantees the document's integrity and the authenticity of the signature. This gives Trilli's e-signature capability a proper technical foundation for legal validity — rather than simply overlaying an image on a PDF.

The platform also includes file sharing, file-request portals, and a suite of PDF tools, forming a complete document processing pipeline.

PKCS#7 (Public Key Cryptography Standards #7) has been standardized by the IETF as RFC 5652, known as CMS (Cryptographic Message Syntax). It defines standard encapsulation formats for digitally signing, encrypting, and hashing data. In an e-signature context, sealing a PDF with PKCS#7 embeds the signer's digital certificate, signature timestamp, and document hash into the file, so any subsequent tampering with the document content will cause signature verification to fail. This is highly compatible with the PAdES (PDF Advanced Electronic Signatures) standard recognized under the EU's eIDAS regulation. Note that technical compliance is only one necessary condition for legal validity; the legal recognition of electronic signatures in different jurisdictions also involves other factors, such as how the signer's identity is authenticated.

The Full Commercial Operations Layer Is Open-Sourced Too

What truly sets Trilli apart is that even its commercial operations layer has been open-sourced.

The author has included Stripe billing, seat management, usage metering, and a support desk system directly in the repository. This means anyone who picks up this codebase can not only self-host it for internal use, but could theoretically launch a similar SaaS business serving external customers straight away.

In the context of open-source commercialization, this is a bold move. The vast majority of "open-source SaaS" projects follow the Open-Core model — open-sourcing a feature-limited community edition while keeping billing, multi-tenancy, SSO, and other "monetization features" locked in a closed-source enterprise tier. Trilli does the opposite, releasing even the commercial layer that typically forms a competitive moat. From a pure business perspective this carries real risk, but for the open-source ecosystem and the self-hosting community, it's an undeniably sincere contribution.

The Open-Core model is the dominant path for open-source commercialization, adopted by well-known projects such as Elastic, GitLab, and HashiCorp. Its core logic: open-source the baseline functionality to build a user base and community influence, then lock high-value enterprise features (SSO, audit logs, advanced permissions, multi-tenant isolation, SLA support, etc.) behind a paid enterprise tier, creating a conversion funnel from open-source users to paying customers. The fundamental tension in this model is that the stronger the open-source portion, the more active the community — but the harder it becomes to maintain differentiation in the enterprise tier; weakening the open-source portion damages reputation. By choosing to abandon this moat, Trilli's competitive advantage will depend entirely on brand, support quality, and the convenience of its hosted version — not on feature gatekeeping in the code.

Engineering Architecture: A Minimal Go + React + Postgres Stack

The author repeatedly emphasizes that the system is "built to be readable," and the architecture choices reflect this restrained, pragmatic philosophy:

• One Go binary per service: Go's compiled artifacts are self-contained, deployment is simple, and performance is reliable; splitting into microservices keeps module boundaries clear.
• React app embedded in the executable: The frontend is bundled directly into the backend binary, eliminating the complexity of deploying a separate frontend — a single file is all you need to run it.
• Postgres for everything: No complex multi-database stack; a single, mature, stable relational database handles all storage needs.

The common thread across this stack is simplicity, maintainability, and ease of self-hosting. For small-to-medium teams or individual operators, fewer components mean lower operational burden. The repository also provides documentation, environment variable examples, and systemd unit files, further lowering the barrier to deployment.

Roadmap and Community Expectations

At launch, the author explicitly welcomed feedback, Issues, and PRs, and called out the top item on the current wishlist: S3 / MinIO storage backend support.

This request hits the nail on the head. For large-scale deployment in cloud-native environments, integrating with S3-compatible object storage is essentially a must. MinIO, as an open-source S3-compatible storage solution, is also the go-to partner for self-hosted setups. Once this backend lands, Trilli's scalability and production readiness will improve significantly.

Closing Thoughts: How Far Can a Fully Open-Source Commercial SaaS Go?

Trilli's story is hard to categorize neatly. It's neither a pure passion project built for the love of it, nor a carefully engineered Open-Core monetization funnel. Instead, it's a developer who, having fully validated a business model, chose to hand over all the results — both the technical layer and the commercial layer — to the community without reservation.

For teams looking for a self-hosted alternative to Dropbox / Google Docs / DocuSign, Trilli offers a feature-complete, architecturally coherent, production-proven starting point. For observers interested in open-source business models, it's a case worth following closely: how far can a fully open-source commercial SaaS actually go?

Project repository: https://github.com/elevityadmin/trilli