Penpot

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me the design workspace instead of paying for Penpot's hosted plan: files, versions and sharing, on my own machine.

Read this first, and take it seriously: Penpot is open source and self-hosting it is the sensible answer here. What the fee buys is a managed instance with real-time collaboration, backups and support. Writing a design tool from scratch is a multi-year project and this prompt does not pretend otherwise. What follows is how to host it well and build the workspace layer around it — and, at the end, the much smaller thing worth building instead if all you need is handoff.

SELF-HOSTING IT PROPERLY
- The application, its database and its object storage, each with real limits and a health check
- Backups of the database and the object store, nightly, off the machine, with a tested restore. Design files are irreplaceable work
- Enough memory: the exporter and the renderer are the hungry parts, and a workspace that fails when somebody exports a large board is a workspace nobody trusts
- Behind single sign-on if a team is using it, and behind a VPN if it never needs to be public
- An upgrade routine that is rehearsed: snapshot, upgrade, verify a file opens, and a way back if it does not

THE WORKSPACE LAYER WORTH BUILDING AROUND IT

STACK
- Node 20+ with Fastify, server-rendered HTML
- SQLite through better-sqlite3, WAL mode, with FTS5
- Caddy in front

THE DATA MODEL
- files: id, external_id, name, project_id, thumbnail_path, updated_at, updated_by, text_index
- versions: id, file_id, label, snapshot_path, bytes, author_id, at — a named point you can return to
- shares: id, file_id, page_id, token, permission, password_hash, expires_at, revoked_at, views
- comments: id, file_id, page_id, x, y, author, body, resolved_at, created_at
- assets: id, kind, name, value_json — the design tokens, which are the part developers actually need
- exports: id, file_id, kind, config_json, path, at

WHAT THE LAYER DOES
- Search across every file by name and by the text inside it, which is what turns a folder of design files into a library. This is the single most useful thing to add
- Named versions with a thumbnail, so 'the version we showed the client in March' is a link rather than an archaeology exercise
- Share links with a permission, a password and an expiry, revocable, for people who must not have an account
- Comments pinned to a coordinate, with an email notification and a link straight to the pin
- Nightly export of every file to its open format into a directory, which is a backup that does not depend on the application being able to start

HANDOFF, WHICH IS THE PART DEVELOPERS CARE ABOUT
- Design tokens exported as CSS custom properties, JSON, and whatever the codebase uses — colours, spacing, type scale, radii, shadows
- Generated from the file's own styles rather than typed by hand, so they cannot drift
- A page showing every token with its value and a contrast matrix for the colours, measured rather than eyeballed
- Asset export in a batch: every icon as SVG, every image at the sizes needed, named consistently, into a directory the build can consume
- That token pipeline is worth more to a small team than any collaboration feature, and it is a weekend rather than a year

THE MUCH SMALLER THING, IF HANDOFF IS ALL YOU NEED
- If the actual requirement is 'developers need the colours, the spacing and the icons', do not host a design tool at all
- A tokens file in the repository as the source of truth, a generated documentation page, and an export from the designer's tool into it. Everyone stays in the tool they prefer and nothing is licensed
- Say this out loud before starting, because most of the time it is the right answer

OPERATIONS
- .env: DATABASE_PATH, STORAGE_PATH, BASE_URL, SESSION_SECRET, PENPOT_URL, PENPOT_TOKEN, SMTP_URL
- Migrations on boot, each once
- Nightly backup of both this layer and the application it wraps
- Health endpoint that checks the application, its storage and the last successful export

WHAT MATTERS MOST
Backups and the token pipeline. Rehearse a restore of a real design file before the team depends on this, and generate the tokens from the file rather than by hand. Do not, under any circumstances, start writing a vector editor.

Give me the compose files for the self-hosted application, the workspace layer, the token exporter, migrations, .env.example, and a README that opens with the honest scope and the handoff-only alternative.