Perhaps I’m misinformed, but my understanding of the AGPL was that if you have AGPL software running on a server, you can still connect to it from proprietary s

Perhaps I’m misinformed, but my understanding of the AGPL was that if you have AGPL software running on a server, you can still connect to it from proprietary software that you don’t open-source; you simply need to open-source any changes you make to the AGPL software itself. So, in OP’s case, if he’s not making changes to iText’s code itself, he’s compliant simply by linking to the commit he’s running (and perhaps fork it in case the original is removed) - no need to open-source his calling code, or have a specific license for it. Batch mode is absolute overkill, unless you’ve customized iText in a way you don’t want to reveal. Of course, if you’re providing a differentiated DBaaS etc. you likely will need to add proprietary modules or authentication inside the binary of the service itself, and AGPL would require you AGPL and distribute those changes. So it’s still a realistically stronger license than a normal GPL, but it’s not a bogeyman, I think? (Not a lawyer, this is not legal advice.)