If I have a publicly accessible web service that uses AGPL software via a REST API in the backend, how does the AGPL apply to the service?
Would I only have to make the AGPL sources of the backend service available to users, or would the AGPL also cover my own service, or is it not relevant at all since the AGPL backend is never directly exposed to the end user?
I think making the backend directly available would definitely require me to provide access to the backend source, and thus providing it indirectly might require me to make the backend source available, but is the AGPL "viral" for the intermediate services, or does it only apply to the AGPL licensed software itself?
The overall access is looks like this:
User's browser <-- HTTP --> My Webapp <-- REST-API --> AGPL application
It is no problem to release the full source of the AGPL application, because it is used unchanged, and any minor changes that might be necessary can be released without any problem. However, I do not want to release my own web application under the AGPL.
I am pretty sure that the REST access is covered by the AGPL, but does the AGPL skip over the webapp, or does it become part of the webapp? If so, the question is which of the two variants applies:
1: User's browser <-- HTTP --> (My webapp <-- REST-API --> AGPL application)
2: (User's browser <-- HTTP --> My webapp) <-- REST-API --> AGPL application
- The webapp and the AGPL application are a new application covered by the AGPL
- The browser and the webapp are a union that accesses the AGPL application and only require the sources of the AGPL app to be public