Self-Hosted Invoicing and Quotes

Finance

An invoicing and quotes system: it manages clients, quotes and invoices. You bring it up on your own machine with Docker Compose, the install finishes by itself on the first start, the admin password is generated at random by a script, and the data stays on your own machine. Derived from a frozen snapshot of an open-source project under the MIT licence; the delivery adds an orchestration file (web, background worker and database), a Dockerfile that builds the image from source, a script that generates the password and a quick-start guide in Traditional Chinese.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness3 / 5

What you need

Few changes needed4 / 5

Who it is for

Freelancers and small businesses who want to manage clients, quotes and invoices themselves and keep the client and billing data on their own machine.

How to start

$ sh scripts/quickstart/init-env.sh
$ docker compose up -d

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview2,000+ paths

▸ai1

instructions.md

▸assets280

app.ts
controllers.json
controllers/
icons/
img/
scss/
webmcp.ts

▸bin3

check
console
phpunit

▸config83

bundles.php
packages/
preload.php
reference.php
routes.php
routes/
services.php
services_test.php

▸docker3

linux-static-build.Dockerfile
package.Dockerfile
quickstart-entrypoint.sh

▸docs141

.claude/
.gitignore
.markdownlint-cli2.jsonc
.vscode/
CLAUDE.md
README.md
bun.lock
docs/
docusaurus.config.ts
i18n/
…

▸frankenphp10

app.go
bin/
build-solidinvoice.sh
build-static.sh
go.mod
go.sum
internal/
logger.go
untar.go

▸helm29

artifacthub-repo.yml
solidinvoice/

▸mate4

AGENT_INSTRUCTIONS.md
config.php
extensions.php
src/

▸migrations42

Version20000.php
Version20001.php
Version20100.php
Version20102.php
Version20200.php
Version20201.php
Version20202.php
Version20300.php
Version20305.php
Version20306.php
…

▸packaging15

aur/
chocolatey/
cloudsmith-setup.sh
install.sh
nfpm.yaml
scoop/
scripts/
snap/
systemd/
winget/

▸public15

.htaccess
apple-touch-icon.png
css/
favicon.ico
fonts/
img/
index.php
js/
robots.txt
swf/

▸scripts11

BUILD_GUIDE.md
BUILD_WORKFLOW.md
README.md
build_binary.sh
build_dist.sh
bump_version.sh
bump_version_dev.sh
create_release.sh
e2e-failure.cjs
link_agents.sh
…

▸src1268

.htaccess
ApiBundle/
AppMode.php
AppRequirements.php
ClientBundle/
CoreBundle/
CronBundle/
DashboardBundle/
DataGridBundle/
FormBundle/
…

▸tests4

Test/
bootstrap.php

▸translations3

email.en.yml
messages.en.yml
validators.en.yml

▫AGENTS.md

▫ATTRIBUTION.md

▫CHANGELOG.md

▫CLAUDE.md

▫CODE_OF_CONDUCT.md

▫CONTRIBUTING.md

▫Caddyfile

▫DESIGN.md

▫Dockerfile.quickstart

▫GEMINI.md

▫LICENSE

▫LICENSE-99LL.md

▫PRODUCT.md

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫SECURITY.upstream.md

▫TRANSLATING.md

▫UPGRADE.md

▫bun.lock

▫captainhook.json

▫composer.json

▫composer.lock

▫delivery-manifest.txt

▫docker-bake.hcl

▫docker-compose.yml

▫ecs.php

▫eslint.config.mjs

▫package.json

▫phpstan-baseline.neon

▫phpstan-test-baseline.neon

▫phpstan.neon

▫phpstan.test.neon

▫phpunit.xml.dist

▫platform.yaml

▫qodana.yml

▫rector.php

▫symfony.lock

▫tsconfig.json

▫webpack.config.js

▫Config and hidden files 48

Latest passing run

Clone → Checkout → Toolchain → Build images → Invoicing install and gate

Pre-purchase Disclosure

What you are buying

A self-hosted invoicing and quotes system: it manages clients, quotes and invoices. After running the password generation script you bring it up with Docker Compose, and the install finishes by itself on the first start.

Derived from an open-source project under the MIT licence, and not the original project itself. Our work: a Dockerfile that builds the image from source, an orchestration file for the web and the background worker, a script that generates the admin password and a quick-start guide in Traditional Chinese.

Delivery is a frozen snapshot: one zip, taken from the product repository at revision 5fc0a54.

Known limitations

The service is bound to port 8765 of the local machine only; TLS and a reverse proxy are yours to bring
The interface language is English by default
No payment service is set up; collecting payments online needs your own payment account, which you set up yourself
No mail sending is set up, and the mail the system produces is not sent
Usage statistics are turned off at install, and error reporting is off by default
The admin account and password are created at the first install only, and later changes to .env are not synchronised
When the install fails, the log prints the database and admin passwords together with the install command
The data lives in Docker named volumes, and docker compose down -v deletes the clients, quotes and invoices
The first start builds the image from source, fetching from registries, apt and package repositories during that time
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit 168ab12. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

5 PASS0 WARN0 FAIL

Source ReviewPASS

Execution surface of the delivery reviewed item by item. Our own additions were read: docker-compose.yml (the published port is bound to 127.0.0.1 only; it refuses to start when the database password or the admin password is missing; the database publishes no port; usage statistics and error reporting are off by default; upstream’s referral prompt is turned off), docker/quickstart-entrypoint.sh (the first start finishes the install by command with usage statistics turned off; it runs the updates when the table version is behind; the background worker starts only once the install is finished), Dockerfile.quickstart (it builds on the source in this repository, and the temporary build-time secret does not carry over to the run stage) and scripts/quickstart/init-env.sh (openssl generates random values, .env is mode 600, and an existing one is not overwritten). We also fixed one place in upstream’s install code: when the database already exists it now compares by the name text and no longer tries to create it again. The rest of the upstream PHP and front-end sources were not read file by file; the basis is the MIT licence and container isolation.

Script SafetyPASS

The scripts on the buyer’s delivery path were each inspected: init-env.sh and the entry script are ours (read); the build goes through Dockerfile.quickstart (read: Composer installs from composer.lock, Bun installs from bun.lock and compiles the assets, the PHP extensions and curl come from the install tool inside the image and from apt, with no download piped straight into a shell). The install command in the entry script carries the database and admin passwords, so they show up in the log when the install fails.

RecencyPASS

This product is a frozen snapshot and does not follow upstream: the upstream source is pinned to the main-line revision taken on the day the product repository was created (see the evidence link), and the product repository is that snapshot plus our own commits.

LicensePASS

SPDX:LicenseRef-99LL-Product

Upstream LICENSE was checked word for word (the evidence link points at the file itself at the pinned version and matches the copy inside the product repository): the standard MIT text, copyright holder Pierre du Plessis. It allows commercial use, modification, derivative works, redistribution and sale; the duty is to keep the copyright notice and licence text (LICENSE and ATTRIBUTION.md ship in the zip); upstream has no NOTICE file. The decision does not rest on GitHub’s licence field. For the product as a whole the 99LL product licence template is attached: upstream’s LICENSE is kept as it is and LICENSE-99LL.md is added as the sale and liability terms for the part we built, with spdx recorded as LicenseRef-99LL-Product.

Dependency LicensesPASS

This records the declared side, not a scan result: the PHP dependencies are declared in composer.json and locked by composer.lock, the front end is declared in package.json and locked by bun.lock, and the packages themselves are fetched from their own repositories when the buyer builds; the base images and the database image come from a registry and the system packages from apt. These dependency trees were not scanned package by package for licences. Upstream has no submodule and no third-party dataset was copied in (see ATTRIBUTION.md).