Package managers will produce an SBOM for you, the tough part is keeping track of licenses and CVEs. TideLift and BlackDuck (now called something else) work just fine as third party solutions you can run on your self-hosted stuff though.