Just a correction (still not a legal advice ) - GPLv3 doesn't require you to release the source if you're only running the modified version and not distributing it. I think it was called "ASP loophole" and was "fixed" in AGPL. NodeBB isn't using AGPL, but GPLv3, so the "loophole" remains.
However in this case if you were modifying core NodeBB and selling that to the client you'd probably need to release your modifications publicly under the same license.
But if you're just running the core NodeBB and modifying it with plugins, themes, etc. you don't need to do any of that. You haven't made any modification to the software, just used some software that's using its APIs. It's covered under "Basic Permissions" in GPLv3 with the most relevant part being:
This License explicitly affirms your unlimited permission to run the unmodified Program.