S-Aloha: a free, self-hosted ITSM platform

Leipa — Mon, 19 Oct 2026 08:09:14 +0000

Running structured IT support in a mid-sized organisation usually means choosing between a proprietary tool billed per user and a patchwork of spreadsheets and mailboxes. S-Aloha is a free (AGPLv3) alternative: a complete ITSM platform that installs with Docker Compose and authenticates against your existing Active Directory.

What it does

Active Directory sign-in. Users log in with their Windows account, roles follow your AD groups, and no password is stored. Visibility is scoped per department, site or entity.
An action-oriented console. Everyone lands on what needs their attention, ranked by severity: major incidents, SLAs at risk, changes to authorise, requests to approve, overdue actions.
Ten ITSM practices that talk to each other. An incident opens a problem, a problem calls for a change, a change touches configuration items, a known error becomes a knowledge article. More than 250 business rules enforce the lifecycles (a change is assessed before it is authorised, an incident is resolved with a code).
Built-in root-cause analysis. Problems come with 5 Whys, Ishikawa 6M and fault-tree analysis, plus corrective actions and a RACI matrix.
Search before you ticket. Hybrid search (keywords plus semantic) surfaces similar cases and knowledge articles before a new record is opened. The semantic part uses a local bge-m3 model in a separate, optional service; without it, search falls back to full text and nothing leaves your infrastructure.
Steering. Health score per service, MTTR, MTTD, SLA compliance, CSV and PDF exports; project management with Scrum, Kanban, V-model, PRINCE2 or hybrid.
Audit trail. Every record keeps its comments and a full history: who changed what, when, old and new values.

NIS 2 self-assessment (not a compliance label)

S-Aloha includes a module to assess your maturity against the French ANSSI framework, the Référentiel Cyber France (ReCyF): scored questionnaire, maturity levels, gaps linked to improvement actions, evidence linked to records, comparison between two assessments and a CSV export for auditors.

To be clear: using S-Aloha does not make an organisation "NIS 2 compliant". It helps you measure where you stand and keep evidence next to your incidents and changes.

What is not there yet

It is a young project. On the roadmap and not yet delivered: regulatory incident reporting (NIS 2 and GDPR), attachments, e-mail notifications, additional imported compliance frameworks, CMDB bulk import and satisfaction surveys. About sixty specified rules are waiting for an implementation.

Try it in five minutes

Docker is the only requirement. Demo mode starts its own directory and loads fictional data, so no Active Directory is needed:

git clone https://github.com/christian-raj/S-Aloha.git && cd S-Aloha
docker compose -f docker-compose.yml -f docker-compose.demo.yml up -d

Open http://localhost and sign in with one of the demo accounts listed in the README.

Demo mode is for evaluation only: public passwords, no LDAPS, no HTTPS. Follow the hardening checklist in the security documentation before any production use.

Stack

Layer	Technology
Frontend	React 19 + Vite, served by nginx
API	ASP.NET Core 10 (LTS) + Entity Framework Core
Data	PostgreSQL 16
Search	PostgreSQL full text + optional `bge-m3` embeddings service
Identity	Active Directory (LDAP) to JWT, Admin / Manager / User roles
Tests	xUnit + Testcontainers, Vitest + Testing Library, CI on every pull request

Licence

AGPLv3: no per-user licence and no vendor lock-in. If you offer a modified version to users over a network, you must give them access to the source (the UI shows a configurable "Source code" link).

Contribute

Each ITIL practice has a specification document: roles, data, lifecycle, numbered rules and acceptance scenarios. Every rule still to implement is a well-scoped pull request.

Issues labelled good first issue and help wanted are ready to pick up.
Documentation is in French, code is in English; issues and pull requests are welcome in English or French.
Commits are signed off (git commit -s, Developer Certificate of Origin).
If you run an IT department, try the demo and tell us about your use cases: they shape the roadmap.

Repository: https://github.com/christian-raj/S-Aloha

Service alohan'ny zavatra rehetra: service before everything else.

DEV Community: Leipa