It's just weird that I couldn't find any info on which kernel they use. Linux seems the obvious choice for the task (most internet facing servers run Linux after all), but my (admittedly very poor) understanding of the GNU licence is that derivative works also needs to be published under the GNU licence? And they're using a different licence..

So.... BSD?

You misunderstand how licensing works. They can build an entirely closed source OS around the Linux kernel if they want. The only thing they'd have to publish is the changes to the kernel itself. I don't see why they'd need to modify the kernel so they'd have to publish absolutely nothing!

But to answer your question, umbrelOS is debian. You're right that they don't advertise that fact anywhere (that I've seen). They use rugpi to build a preconfigured image that includes their changes and their software. All the details are indeed public and open, if you know what you're looking for:

https://github.com/getumbrel/umbrel/tree/master/packages/os