OpenDocMan is a self hosted document management system with check out and check in version control, per department and per user file permissions, an approval workflow and a full audit trail.
OpenDocMan is an open source, web based Document Management System. It gives an organisation one controlled place to keep documents rather than a shared drive: every file is uploaded into a repository, checked out before it is edited and checked back in as a new revision, so two people can never quietly overwrite each other and the whole revision history stays intact. Access is set per department and per user, with read, write, administer and view rights applied file by file, and an optional review step holds a new or updated document in a queue until an administrator approves it for publication.
Around that core it adds the things a controlled repository needs: categories and file type rules, user defined metadata fields, a searchable full text content index, and an access log recording who viewed, downloaded, checked out or changed each document. It suits teams that need controlled records with an audit trail, such as policies and procedures, contracts, drawings and specifications, without moving that material into a hosted service.
cloudimg ships OpenDocMan fully installed on a hardened nginx, PHP 8.3 and MariaDB stack, so the sign in page answers as soon as the VM finishes its first boot. Security here is unusually load bearing: the upstream web installer has no already installed lock, so a reachable one would let a stranger rewrite the database configuration or drop every table. This image completes the installation at build time over the loopback interface only, then removes the installer from the image entirely and blocks its routes at the web server. The published image carries no known, blank or default login, and the web server does not bind port 80 at all until a one shot first boot service has minted a per VM administrator password and a per VM database password into a root only file. Documents are stored outside the web server root so an uploaded file is never directly fetchable, the database is bound to the loopback interface, the base is fully patched with unattended security upgrades enabled, and every deployment is paired with a step by step deploy guide and 24/7 cloudimg support.
Real screenshots taken while testing this image against its deployment guide.