Self-Hostable Form Back End – OSS Alternative to Formspree
github.com
github.com
I paid $25 a few years ago (can't even remember when) and I still have 47k out of the 50k submission credits I bought.
But I love to see a self-hostable alternative available, especially one that's as easy to use as running a `docker-compose` command. Sometimes you just need that control.
For example in my case, I would get app support emails all day and night, and even if I had DND enabled, I would wake to 3-6 emails that accumulated over night and my mornings would get hectic instantly. I would forget to eat for a long time and my mood would be irritable all day.
I had to place my own small API in front of Formspark to delay the emails for specific times of the day to avoid this. Something like FormBee would allow me to alter this in the server code directly instead of building yet another API.
I would like to have a moment in my life to write down how we have done it.
You have the form data being placed into a table, or being sent somewhere external?
We have implemented a multitenant table for multiple websites, depending on which site has been contacted a different webhook is triggered for notification.
We are succesfully using Nocodb as a Headless CMS too (for +10 microsites)
Other things I've considered:
- Appwrite might be another one to look into (might be able to put some or all of these behind cloudflare for another layer).
- Post to some kind of workflow, like n8n and move on from there.
- Use a simple API gateway, pretty easy to isntall Tyk, Kong, etc that can detect malicious traffic.
Some examples:
* "Set up return email to return an email to users who submit your forms." - this is pretty clear what it means, but the phrasing is a bit awkward. -> "Set up automated response email for form submissions"
* "Allowed Domains": allowed for what? Allowed to receive form submissions from?
* When giving numbers (e.g. under API Usage), suggest adding units (e.g. "submissions") to the end.
* "Recipient Email" This seems a bit too ambiguous. suggest something more like ->"Address for receiving form submissions"
With the self-hosted service, I guess that's up to the hoster but likely something you'll run into on your hosted version.
Sometimes rate limiting individual sessions, and IPs, and combinations of them, and even using fingerprinting on suspected sessions of certain kinds.. to discover in some cases that a lot of small walls can sometimes cause some automated bots to move on.
I'm always happy to chat through some of the details individually.
I had a form that got about one spam message per day. In late 2021, I added a trivial hidden-by-CSS “If you are human, leave this field blank (required)” <input name=username> honeypot. (More details: <https://news.ycombinator.com/item?id=37058847>.)
For two and a half years, this filtered out all spam, except for one message in early 2023.
But I started this comment with “may not” because since 2024-02-10, I’ve received approximately 268 spam messages, of a few different patterns (still all very easy to identify visually). So some refinement of the idea may be needed. (I have no idea how many more have been filtered out; I never bothered tracking that. But I imagine that it’s still doing something useful.)
This is, of course, low-value-target stuff, scattergun spam rather than targetted spam.
From my experience with coding parts of Un-static [1], the advantage of having a single source for submissions for thousands of forms, is that you can filter out these more easily as well. As you can create partial fingerprints. Then just compare similarity between incoming submissions on other forms. And of course start blocking if you receive a scatter-gun message that matches partial fingerprints received across an increasing number of form endpoints.
I am curious: how low maintenance is this?
Is this something that can be hosted for long periods of time without security interventions and updates?
Is it fire and forget?
I've been looking for self hostable: encryption before emailing and encryption at rest for form submissions dat saved in a server DB eg sql with wordpress moved to something else,
anyone having suggestions (things free or under $29 / mth) I'm all ears.
Email is in my profile if you have any questions. Technically the HIPAA plan starts at $99/mo but I'll give you a discount code to get you to $29 if you give a try and are willing to jump on a call and do a feedback session with me after trying it.
(You can also try it for free before signing up for anything)
Lambda is great though! We should add some Lambda boilerplate to our docs to make it easy to self host form submission with Lambda.