Directus

Last reviewed Aug 26, 2026 · 838 words

Directus is free to self-host if your organisation's total finances (revenue plus funding) are under 5 million US dollars a year; above that line the BSL-1.1 licence requires a commercial agreement. For a homelab, a side project or a small business the line never matters, and each release converts to GPL after 3 years anyway, but it is the single fact that separates Directus from the MIT and AGPL tools it competes with, so I lead with it. Past the licence you get a genuinely unusual product: point it at a SQL database you already have and it produces a REST and GraphQL API, a permissions model and an admin app that non-developers can use, without generating a line of code or altering your schema.

What "wraps your database" actually means

Most headless CMSs own their tables and you live inside their conventions. Directus introspects yours. Give it an existing Postgres with 40 tables from a Django app and every one appears in the admin, with foreign keys turned into relational fields and an API endpoint at /items/{table}. Its own bookkeeping lives in a handful of directus_* tables it adds alongside. That makes it the rare tool you can bolt onto a legacy database for an internal admin panel in an afternoon, then remove without a trace. Supported engines are PostgreSQL, MySQL and MariaDB, SQLite, MS SQL, OracleDB and CockroachDB; Postgres is the one the project tests hardest.

The compose file that gets you to the admin app

services:
  directus:
    image: directus/directus:latest
    ports:
      - "8055:8055"
    environment:
      SECRET: replace-with-32-random-chars
      ADMIN_EMAIL: [email protected]
      ADMIN_PASSWORD: change-me
      DB_CLIENT: pg
      DB_HOST: postgres
      DB_PORT: 5432
      DB_DATABASE: directus
      DB_USER: directus
      DB_PASSWORD: directus
    volumes:
      - ./uploads:/directus/uploads
      - ./extensions:/directus/extensions
    depends_on: [postgres]
  postgres:
    image: postgres:16
    environment:
      POSTGRES_DB: directus
      POSTGRES_USER: directus
      POSTGRES_PASSWORD: directus
    volumes:
      - ./pgdata:/var/lib/postgresql/data

Budget 1 GB of RAM as the floor and expect the Node process to sit around 300 to 500 MB idle. The Medium difficulty rating is fair: the install is easy, the permissions model is where you will spend your time.

Permissions are the feature, and the footgun

Roles get per-collection, per-action (create, read, update, delete) rules with field-level filters, and the same rules govern the API and the admin UI. The public role exists by default with no access, which is correct. The footgun is granting the public role read on a collection to make a website work and forgetting that read means every field, including the ones you meant to hide; use field-level restrictions from day one. Flows, the built-in automation, run on the same permission layer, so a webhook-triggered flow cannot exceed the role it runs as.

Flows, Insights and Files are the quiet wins

Three modules ship in the box that people usually bolt on separately. Flows is an event-driven automation builder: trigger on item created, on a cron, on a webhook, or manually from the admin, then chain operations like sending a request, running a small script, or writing back to a collection. It replaces a surprising amount of n8n for data-shaped tasks. Insights is a dashboard builder over your own tables, adequate for "orders per day" panels without exporting to Grafana. Files stores uploads with on-the-fly transforms, so ?width=400&format=webp on an asset URL gives you a resized version without a separate image service. None of the three is best-in-class, but having them behind the same permissions model is what makes Directus feel like a platform rather than an API generator.

Where it sits against PocketBase and Strapi

PocketBase is one Go binary with SQLite, owns its schema, and is the better choice for a solo app that will never touch an existing database. Strapi is the closer rival: also Node, also a headless CMS, but it generates code into your repo and expects developers to own it. Directus wins when the database predates the tool, when non-developers need the admin, or when you want REST and GraphQL from one config. It loses on footprint and on licence clarity for anyone near that 5 million line. The wider dev platforms category covers the Firebase-shaped alternatives if what you need is auth plus realtime rather than a content admin.

What I'd do

Run it on Postgres, never SQLite, from the start; migrating later is the migration you will regret. Set SECRET to a real random string before first boot because it signs sessions. Put it behind a reverse proxy, keep uploads on real storage or an S3-compatible bucket rather than inside the container, and back up the Postgres database plus the uploads directory together, since one without the other is half a restore. For a homelab admin panel over an existing database it is the best tool in its class. For a greenfield hobby backend, take PocketBase and save the 900 MB.