Written by the Infronest Product & IT Operations Team. We build and operate the helpdesk, ITSM, asset and patch modules used by live customer IT teams, and we run the same Linux, database and mail plumbing described here. Tool details checked against each project's official documentation and licence files in July 2026.
IT Operations
Open Source Ticketing System: 7 Self-Hosted Options (2026)
A practical comparison of osTicket, GLPI, Zammad, FreeScout, UVdesk, Request Tracker and Redmine — licence, strengths, weaknesses and hosting reality for each, plus an honest accounting of what self-hosting a helpdesk actually costs.
An open source ticketing system gives you the code, the data and the ability to host the helpdesk yourself — with no per-agent licence fee and no vendor deciding when your free tier changes. Seven projects are worth shortlisting in 2026: osTicket, GLPI, Zammad, FreeScout, UVdesk, Request Tracker (RT) and Redmine. This guide covers each one's licence, what it is genuinely best at, where it falls down, and what running it actually involves — followed by an honest accounting of self-hosting cost, because the software licence is the smallest line in that budget.
Definition
What is an open source ticketing system?
An open source ticketing system is helpdesk software whose source code is published under a licence that permits you to run, inspect, modify and host it yourself with no per-agent software fee. The credible self-hosted options in 2026 are osTicket, GLPI, Zammad, FreeScout, UVdesk, Request Tracker (RT) and Redmine. In every case you supply the server, database, mail plumbing, TLS, backups and security patching; the project supplies the code, and most also sell a hosted edition or a paid support subscription alongside it.
That is a materially different proposition from the free tier of a commercial product such as Freshdesk or Zoho Desk. A free tier is a funnel: the vendor runs the infrastructure, caps agents or features, and can change the terms at renewal. Open source hands you the code, the database and a genuine exit route — along with the operational responsibility the SaaS vendor had been absorbing on your behalf.
For an IT team with Linux, database and email experience and a named owner for the platform, that trade is usually worth making: no per-agent pricing, unlimited custom fields and workflows, and ticket data that never leaves your network boundary. For a team without those skills, the licence saving is typically consumed by unplanned hours inside the first year — which is the argument this article tries to settle with numbers rather than opinion.
The shortlist
Seven self-hosted open source ticketing systems compared
All seven are actively maintained and all seven are genuinely free to licence. They are not interchangeable: three are classic helpdesks, one is a full ITSM and asset platform, one is an issue tracker pressed into helpdesk service, and one is an email workflow engine of unusual pedigree. Confirm the licence in each repository before you commit — several projects have re-licensed components over the years.
- osTicket (GPL v2, PHP + MySQL) — the default starting point for a small internal helpdesk. Best at: email-to-ticket, departments, help topics, canned responses and SLA plans on a very small footprint. Weakness: an agent interface that has aged badly, thin reporting, no asset inventory and a slow release cadence. Hosting reality: runs on any LAMP stack including budget shared hosting; upgrades are a file replace plus a database upgrade step.
- GLPI (GPL v3, PHP + MySQL/MariaDB) — the strongest all-round choice if you want tickets and IT asset management in one place. Best at: ITIL-shaped service desk (incidents, requests, problems, changes), SLAs and OLAs, approval and validation workflows, a real CMDB, and automatic hardware/software inventory through the GLPI Agent. Weakness: a dense administrative UI with a long learning curve, and a plugin ecosystem of uneven quality where major-version upgrades routinely outpace plugin authors. Hosting reality: LAMP plus an inventory agent on every endpoint; the paid GLPI Network subscription buys support and certified plugins.
- Zammad (AGPL v3, Ruby on Rails + PostgreSQL + Elasticsearch) — the best modern agent experience in this group. Best at: multi-channel intake (email, web form, chat, telephony and social integrations), fast full-text search across tickets and knowledge base, and clean day-to-day ergonomics. Weakness: the heaviest of the seven to run — the project treats 4 GB RAM as a floor and you will want 8 GB once Elasticsearch is doing real work — and the AGPL has obligations if you modify it and expose it as a service to third parties. Hosting reality: install from the official Debian/RPM repositories or Docker Compose, and accept that you now operate an Elasticsearch node too.
- FreeScout (AGPL v3, PHP/Laravel + MySQL) — a faithful open source take on the shared-mailbox model. Best at: small teams that want a clean shared inbox with conversation threading rather than a formal ITSM tool; it runs comfortably on a 1–2 GB VPS. Weakness: the core is free but much of the useful functionality — time tracking, knowledge base, live chat, Kanban view, custom fields — ships as separately priced modules, so budget for them rather than assuming zero. Hosting reality: the cheapest of the seven to run and the simplest to upgrade.
- UVdesk Community (MIT-licensed community edition, PHP/Symfony) — built by Webkul with e-commerce support in mind. Best at: customer support for online retail, with marketplace and storefront connectors plus a workflow automation engine. Weakness: a far smaller contributor community than osTicket or GLPI, patchier documentation, and very little aimed at internal IT service management. Hosting reality: a standard Symfony deployment; verify the current licence terms in the repository before you build on it.
- Request Tracker / RT (GPL v2, Perl + PostgreSQL or MySQL) — in production since 1996 and still the best pure email-workflow engine here. Best at: very high mail volume, arbitrarily complex custom workflows through scrips and custom fields, and — via the RTIR distribution — structured incident response for CERT and security teams. Weakness: the interface looks its age, and Perl expertise is genuinely scarce in most IT teams, which turns customisation into a hiring problem rather than just a time problem. Hosting reality: CPAN dependency management is the main friction; once running, it is exceptionally stable.
- Redmine (GPL v2, Ruby on Rails) — a project and issue tracker, not a helpdesk. Best at: multi-project work with Gantt charts, time tracking, repository integration and per-project roles; a sound fit when your 'tickets' are mostly internal engineering and infrastructure tasks. Weakness: no native email-to-ticket helpdesk, no SLA engine and no end-user portal without plugins (RedmineUP's Helpdesk plugin is commercial), and plugin compatibility is the usual casualty of Rails upgrades. Hosting reality: a standard Rails stack; plan upgrades around your plugin set, not the Redmine release date.
Operations
The hosting and maintenance reality
The runtime you inherit matters more than the feature list. osTicket, GLPI, FreeScout and UVdesk are PHP applications — familiar territory for most teams, patched through your distribution's PHP packages and easy to place behind nginx or Apache. Zammad and Redmine are Ruby on Rails applications with their own dependency chains and background job workers. RT is Perl with CPAN modules. Whichever you choose, someone in your organisation now owns that stack, including language runtime upgrades that arrive on the ecosystem's schedule rather than yours.
The second reality is mail. A ticketing system is only as good as its inbound and outbound email, and self-hosting means you own SPF, DKIM and DMARC records, an IMAP or pipe-based inbound path, bounce handling and sender reputation. Most teams end up paying for an SMTP relay regardless. Getting this wrong is the single most common reason a self-hosted rollout is judged a failure: replies land in spam, and users quietly go back to emailing individual engineers.
The third is upgrades and backups. Minor releases are usually uneventful; major versions are not, particularly for GLPI and Redmine where third-party plugins carry most of the risk. Rehearse every upgrade on a staging copy, take a database dump plus the attachment directory before you start, and — the step teams skip most often — restore that backup somewhere at least once a quarter to prove it works. An untested backup of two years of ticket history is not a backup.
Cost
The true cost of self-hosting a helpdesk
The licence is free; the system is not. Gartner forecasts worldwide information security end-user spending will reach USD 244.2 billion in 2026, and in that climate 'free' software attracts budget scrutiny precisely because its costs migrate from a licence line to a labour line where nobody is counting them. Work through every item below and total it before you compare against a per-agent SaaS quote.
- Server — a general-purpose 4 vCPU / 8 GB cloud instance, adequate for Zammad or a busy GLPI, runs roughly USD 40–60 per month at mainstream provider list prices; osTicket or FreeScout will run on a fraction of that. Add a staging instance if you intend to test upgrades properly, because you should.
- Storage and backups — attachments grow faster than anyone forecasts. Budget off-host, encrypted, versioned backup storage plus the egress cost of an actual restore test.
- Email — an SMTP relay with good deliverability, plus the DNS work and ongoing monitoring for SPF, DKIM and DMARC.
- TLS and DNS — certificates are free with Let's Encrypt, but renewal automation and the alerting that tells you it failed at 2 a.m. are not free of effort.
- Security patching — operating system, web server, database, language runtime and application, on a cadence you enforce rather than one a vendor enforces for you.
- Upgrades — budget half a day for a minor version and realistically a day or more for a major version with plugins, including the staging rehearsal and the rollback plan.
- Paid add-ons — FreeScout modules, GLPI Network support, commercial Redmine plugins, or the SSO and MFA integration that turns out to be a plugin rather than a core feature.
- Staff time — the largest and least visible line. Name an owner with allocated hours. If the honest answer is 'whoever has time', the platform will drift out of patch compliance within a year and the saving becomes a liability.
Security
The security work self-hosting transfers to you
Self-hosting does not make a system more secure by itself; it moves responsibility. Your helpdesk is internet-facing on port 443, authenticates both staff and end users, stores personal data, and accepts file attachments from strangers. That is an attractive target, and the patch clock is now yours: more than 11,000 CVEs were published by March 2026, and the ones that will hurt you sit in the components underneath your ticketing system as often as in the application itself.
Controls to have in place from day one: MFA on every agent account (check whether it is core or a plugin in your chosen tool), rate limiting and a WAF in front of the login page and public portal, attachment scanning, database backups held off the application host, restricted outbound network access from the application server, and log shipping to somewhere that server cannot delete. Subscribe to each project's security announcement channel — several publish advisories only to a mailing list or a GitHub security tab, not into any product console you will be looking at.
The financial argument is unchanged by the licence. IBM's Cost of a Data Breach Report 2025 puts the global average breach at USD 4.44 million. A self-hosted helpdesk carrying two years of unpatched dependencies is not a saving, it is deferred cost with interest. If nobody on the team genuinely wants to own that patching cadence, that is a legitimate and honest reason to choose a hosted product instead.
Selection
Which open source ticketing system should you choose?
Match the tool to the shape of your work and your team's skills, not to its GitHub star count.
- You want tickets and IT asset management together — GLPI. Nothing else here combines a service desk, CMDB and automatic inventory in one free package.
- You want the best day-to-day agent experience and can operate Elasticsearch — Zammad.
- You want a straightforward internal IT helpdesk on minimal hardware — osTicket.
- Your support function is really a shared mailbox for a small team — FreeScout, with the paid modules costed in.
- You are supporting an online store across marketplaces — UVdesk Community.
- You process very high mail volume, or you run a security incident-response function — RT, and RTIR for the IR case.
- Your tickets are mostly engineering tasks tracked against projects — Redmine, accepting that helpdesk behaviour arrives through plugins.
- You have no server owner, no maintenance window and no appetite for patching — none of them. A hosted product will cost less in total, and pretending otherwise is how self-hosted deployments end up abandoned.
Infronest
Conclusion
Infronest is commercial multi-tenant SaaS, not open source. If your requirement is source code access, self-hosting on your own hardware by policy, or freedom from per-agent pricing on principle, one of the seven projects above is the right answer and we would rather say so plainly.
Where Infronest fits is the situation that pushes teams towards self-hosting for the wrong reason: needing several IT systems at once and not wanting to run, upgrade and patch each of them. The helpdesk and ticketing module covers SLA routing, approvals and a knowledge base, and it sits in the same tenant-isolated workspace as 15 other modules — IT assets (procurement, assignment, transfer, maintenance, licences), ITSM (change, problem, service catalogue, CMDB), patch management for Windows and Linux with ring deployment, MDM for Windows, macOS, Linux and Android, RMM/endpoint, server, network and website monitoring, Security and VAPT, vendor management, budgets, access control and RBAC, Git and QA, DevOps CI/CD, and reports and automation. That is roughly the scope you would otherwise assemble from GLPI plus three or four other self-hosted projects, each with its own upgrade path and its own patch clock.
Infronest Technologies Pvt. Ltd. is based in Gurugram, India. Start a 14-day free trial at infronest.com — no credit card required.
Sources
- osTicket, GLPI, Zammad, FreeScout, UVdesk, Request Tracker and Redmine — official project documentation, system requirements and repository licence files (verify licence terms in each repository before deployment)
- IBM — Cost of a Data Breach Report 2025: USD 4.44 million global average breach cost
- Gartner — worldwide information security end-user spending forecast: USD 244.2 billion for 2026
- CVE Program / NVD — over 11,000 CVEs published by March 2026
- Server pricing indicative of mainstream cloud provider list prices for a 4 vCPU / 8 GB general-purpose instance, July 2026
Frequently Asked Questions
- Is an open source ticketing system really free?
- The software licence is free for all seven tools covered here, but running one is not. You pay for the server, backups, an SMTP relay, security patching, upgrade time and, in several cases, paid add-on modules such as FreeScout's extensions or GLPI Network support. For a small team, the largest cost is staff time, which rarely appears in the comparison spreadsheet.
- Which open source ticketing system is best for a small IT team?
- osTicket if you want a conventional internal helpdesk with the smallest possible footprint, or FreeScout if your support is essentially a shared mailbox. Choose GLPI instead when you also need IT asset management and a CMDB, and accept a steeper learning curve in exchange. Zammad gives the best agent experience but expects meaningfully more server resources.
- Can osTicket or GLPI handle SLAs and approvals?
- osTicket supports SLA plans with due dates and escalation on help topics and departments, but has no approval workflow engine or asset inventory. GLPI supports SLAs and OLAs alongside validation (approval) workflows for both incidents and requests, plus change and problem records. If approvals and a service catalogue matter to you, GLPI is the stronger of the two.
- Is self-hosting a helpdesk more secure than using SaaS?
- Not inherently — self-hosting moves the responsibility rather than reducing the risk. You control the data location and network boundary, but you also own patching for the OS, database, language runtime and application, on an internet-facing service that accepts attachments from strangers. With more than 11,000 CVEs published by March 2026, self-hosting is only more secure if someone is genuinely funded to keep it patched.