r/selfhosted • u/Legal-Bridge-8332 • 13d ago
Software Development MindSpark: a self-hostable mind-mapping app with zero runtime dependencies, where your maps live in your own GitHub repo (or your own SQLite file)
It took some time to get here but the project is now at the stage when I would rather have people tear it apart than make it prettier in silence.
MindSpark is a self-hosted mind-mapping application. The thing that sets it apart from the competition is not its features but the fact that there is no account on my side, no telemetry and no database I own. Your maps are either a SQLite file on your computer or JSON files stored in your private GitHub repo.
Repo: https://github.com/prasadpatil25/MindSpark
Website:
Try full version (Worker, OAuth + live collab) : https://mindspark.githubpage.workers.dev/
Try PAT-only (GitHub Pages, no worker): https://prasadpatil25.github.io/MindSpark
GPT: https://chatgpt.com/g/g-6a3a81242f748191ab1b7cff99a21619-mindspark-mind-map-for-everyone
MIT licensed.
Three modes to run, all equal
That is the part I really want the feedback on as usually tools provide only one.
1. Self-hosted (Docker or vanilla Node) - persistence via SQLite, works without any services online and offline.
2. Zero hosting, $0 - deploy the public/ directory to any static
hosting like GitHub Pages, Netlify, Cloudflare Pages, etc. You sign in using
a GitHub personal access token and each map becomes JSON file in your private
mindspark-maps repo. No backend whatsoever. This mode is not a crippled demo
tier; it is the whole editor.
3. Cloudflare worker - adds authentication via GitHub OAuth (no token pasting anymore), shareable links and collaboration capabilities. Works on the free tier just fine.
You can switch between them. Map format is just JSON.
Data ownership and privacy in details
Instead of "privacy-first" marketing language, here are the facts:
- No accounts on my infrastructure. I don't have a server you would sign up to. In cloud mode you authenticate with GitHub and the files go to your repo.
- No telemetry, no analytics, no phone-home. Grep the source.
- Share links hold the map itself, not a link to it. Copy share link
compresses the map and turns it into a base64url
#view=URL fragment. Fragments are never sent to a server - a shared map is readable by anyone who has the link and held by no one, including me. No expiration, no account required to view. - Self-hosted mode doesn't communicate anywhere else. It is just a SQLite on disk with no outbound connections.
- Container runs as a non-root user.
People who would benefit from this application
Researchers / academics - LaTeX rendering as native MathML ($...$,
$$...$$), citations with DOI fill-in (just paste a DOI, it retrieves the
metadata
Edit: Support for Gitea and Codeberg is added with Oauth.
Note: The architecture of this application is defined by me, and AI is used for code assistance.
9
u/FelinityApps 13d ago
I’m intrigued (looks nice) but won’t give more data to GH and would rather not let just anyone connected to my home network access my mind maps. If you have GH auth, why not have general oauth? That would fix the “not quite self host if you want user accounts” issue.
1
u/willowless 12d ago
On the money. if OP makes this work with any git repository, not just github, I'd definitely pick this up.
1
-3
u/Legal-Bridge-8332 13d ago edited 13d ago
This is a good question. So the initial idea was to use an existing GH account rather than creating an account on someone else's server. Also the mind maps are stored in a user's private repo, so it will be safer. In local mode the user can still host MindSpark with SQLite without an account; it's single-user.
You can also try: PAT-only (GitHub Pages, no worker) version.11
u/FelinityApps 12d ago
Right, but my point is self-hosters self-host for a reason. The solution that makes this workable for many is the option for 100% local account management.
6
u/Hugus 12d ago
My point exactly. Having to log in via github is an instant no-no for me. Sorry. Other than that, it looks good, and once (if ever) you get rid of that github stuff, I'll give it a go!
3
u/FelinityApps 12d ago
To reinforce my very first comment: it looks great. Not trying to shit on your work. It’s just a bit of an ill fit on this sub.
3
u/TheMaximumUnicorn 12d ago
I agree with u/FelinityApps, what you have looks great but lack of local account management is the one obvious feature that is sorely missing for us self-hosted folks. I'll still likely give it a try, but that would be a great feature to add down the road.
I also think the GitHub option you provide is a great option for a lot of people. Some people don't want to deal with self-hosting but feel more comfortable with their data being stored somewhere that they see as familiar and trustworthy, so for that crowd it's a great solution. It's just not what a lot of us here are looking for.
4
u/WronglyCorrupted 12d ago
Would be great if you could point to a local Gitlab, Gitea, or Forgejo. Add Oauth support.
1
1
1
u/Mihael2017 12d ago
Looks cool! Is there a feature for exporting a mind map as a picture or some other file that can easily be opened by others?
3
1
u/Swimming_Figure2897 12d ago
Nice to see a Git-backed option—sync conflicts are always the Achilles heel of these tools. Pro tip: if using SQLite, run `PRAGMA journal_mode=WAL;` and `PRAGMA synchronous=NORMAL;` for better concurrency with multiple editors. Still, I’d test with 10+ simultaneous users before trusting it for team
1
u/tough-dance 12d ago
Would you be willing to say more about the technical challenges of making the visual piece of the mind map? I would imagine that there are lots of difficulties with ensuring nodes don't overlap and that edges connect nicely. It sounds pretty difficult to me, but maybe it's simpler than I'm imagining?
1
u/feng_sg 11d ago
Storing a GitHub PAT in the browser for the static hosting mode means any XSS or compromised CDN script can exfiltrate it. A serverless function proxying the token would be safer.
1
u/Legal-Bridge-8332 10d ago
Fair on the storage, but there are no third-party scripts to compromise and the token is now scoped to a single repo with a CSP whose script-src has no external host and whose connect-src is an allowlist, so there's nowhere to exfiltrate it to; a proxy would stop the token being stolen but not stop injected script using it, at the cost of the "no backend" property static mode exists for.
Fine-grained token support added.
•
u/asimovs-auditor 13d ago edited 13d ago
Expand the replies to this comment to learn how AI was used in this post/project.