I'm building an open source implementation of the Firebase RTDB server, that will be wire-compatible with Google's. This means that all the (already open sourced) SDKs will work pretty much as is, over REST or websockets. Security rules will also be fully supported. (The only meaningful caveat is that it's just the RTDB, so you need to deal with authentication yourself, and kinda shoehorn it into the existing APIs.)