I am working on a central application (AGPL3+) that will control and/or provide access to multiple secondary applications, mostly on other servers. It is trivial for me to provide the source for the central application.
Do I need to provide the source for the secondary applications? (This would be tricky since I don't package them, but I can probably provide a best-effort link.) If not, is there a "rule of thumb" for determining when a secondary application is not secondary, and actually a component of my AGPL application? (Or is it exactly the same as determining dependency/linkage with the GPL?)
Illustrative examples
Is it true that in each of the following scenarios I am not obliged to share the source of the secondary application:
I decide serve the central application with a web interface, using an IIS/Windows stack (proprietary license) plus a custom library I made (my contribution/modification).
The central application adds accounts to a Prosody chat server (Expat/MIT license) that I have modified, and reports on the volume of chat data you have generated. (Users access the Prosody server with the XMPP client of their choice.)
The central application adds accounts to a fictional password manager (GPL3+ licensed) that I have modified, and reports on the number of passwords you have stored. (Users access the password manager via its own web interface.)
Finally, the central application interacts with some other AGPL3+ application that I have modified, here I am obliged to share that source.