Open Source App Cloud Marketplace

Bots that knock on your server's login ports are always turned away by Knock-Knock, a multi-protocol honeypot that shows every attempt on a live dashboard. Honeypots answer on the standard ports for SSH, Telnet, FTP, RDP, SMB, SIP, HTTP, and SMTP, with MQTT, Node-RED, Modbus, S7, and SNMP as optional extras. Authentication is always rejected, so no bot ever gets a shell. Who is knocking? The live feed shows each attempt's country, username, password, ISP, IP, and protocol. From where? A 3D globe marks the origin in one of six styles, including an extruded country heat map. Trying what? Leaderboards rank countries, usernames, passwords, ISPs, and IP addresses, and a trivia panel explains why bots favor certain credentials. A protocol filter re-slices the feed, globe, and leaderboards together; SIP shows dialed numbers and toll-call destinations, and RDP shows hostnames and accounts. Too fast? Press the space bar to pause, right-click any knock for details, or switch on a virtual Geiger counter that clicks as attacks arrive. Want to fight back? Download hourly 30-day and 365-day blocklists with recipes for CSF, CrowdSec, ipset, nftables, and pfSense, or query the optional API for any IP, CIDR range, or ASN. Several honeypot servers can stream into one aggregated dashboard. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

What Nitter was to Twitter and Invidious is to YouTube, Lingva Translate is to Google Translate: a privacy front-end delivering the service's full capability while cutting Google out of the loop between you and your text. Built on Next.js with TypeScript and Chakra UI, it uses the purpose-built Lingva Scraper to fetch translations from Google Translate without your browser ever touching a Google-related service - no cookies, no tracking, no account, while retaining what makes Google Translate hard to give up: 100+ languages with the translation quality of Google's production models, unlike offline engines that trade privacy for accuracy. The clean interface covers automatic source-language detection, text-to-speech audio playback for pronunciations, definitions and examples, and light/dark themes. For developers, every instance doubles as a translation API: a RESTful endpoint at /api/v1/:source/:target/:query returns JSON translations, an audio endpoint serves TTS buffers, and a full GraphQL API at /api/graphql exposes translations, audio, and language lists for richer integrations - all unmetered on your own instance. Deployment is a single stateless container with one environment variable for the site domain; defaults for theme and language pair are configurable. GPL-licensed, and popular as the translation backend for privacy-respecting apps.

For developers who want a complete visual backend without stitching together separate database, auth, and storage services, Bknd delivers an all-in-one self-hosted Backend-as-a-Service platform with a built-in administrative dashboard. Data schemas evolve visually. Authentication strategies plug in cleanly. Media uploads route straight to object storage. Inside the interactive Admin UI, you can create relational entities, define field validation rules, inspect records, and test generated REST and OpenAPI endpoints on the fly. User management comes ready out of the box with configurable password and OAuth authentication flows, role-based access permissions, and row-level security policies for multi-tenant SaaS products. A unified media manager connects local filesystems, S3 buckets, Cloudflare R2, MinIO, or Cloudinary so applications can handle user avatars, document attachments, and galleries without custom upload pipelines. Visual workflow automation lets you chain triggers, HTTP tasks, and data mutations into repeatable backend flows, while an integrated Model Context Protocol server allows AI agents to query and manage application state directly. You can operate entirely through the visual dashboard, lock down production schemas in code-only or hybrid modes, and connect frontend interfaces using pre-configured login and upload elements. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Your users belong in your own database - Authorizer, an open-source authentication and authorization server shipping as a single Go binary, keeps them there. It connects to 13+ backends - PostgreSQL, MySQL, SQLite, SQL Server, MariaDB, MongoDB, Cassandra, ScyllaDB, ArangoDB, DynamoDB, Couchbase, YugabyteDB, PlanetScale, and CockroachDB - so identity data lives beside the application it protects instead of in an auth vendor's cloud. The server is fully OAuth 2.0 and OpenID Connect compliant, including authorization code flow with PKCE, a JWKS endpoint, token revocation, and nine JWT signing algorithms. Login options cover email/password, magic links, TOTP multi-factor, SMS OTP via Twilio, and social providers including Google, GitHub, Apple, Microsoft, and Discord. Authorization goes beyond roles: an embedded OpenFGA engine provides Zanzibar-style relationship-based permission checks in process. APIs are exposed over GraphQL, REST, and gRPC, with SDKs for JavaScript, React, Go, and Python, plus themeable built-in login pages and an admin dashboard. Apache 2.0 licensed.

Mayan EDMS stores, classifies, and retrieves millions of documents with automatic OCR, workflow automation, and audit-ready access controls that organizations have relied on for over a decade. Tesseract integration extracts searchable text from scanned PDFs and images in over 100 languages, transforming paper archives into instantly queryable digital collections without manual data entry. The workflow engine routes documents through approval chains using configurable state machines that trigger notifications, enforce retention policies, and maintain complete audit trails for regulatory compliance. Version tracking preserves every revision with full diff capabilities, while GnuPG digital signatures provide cryptographic proof of authenticity and tamper detection for sensitive records. Role-based permissions combined with object-level ACLs and LDAP integration ensure documents remain visible only to authorized users, down to individual file granularity. Full-text search powered by Whoosh or ElasticSearch handles advanced queries across massive document stores with faceted filtering and relevance ranking. The Django REST Framework API enables programmatic upload, metadata extraction, and workflow triggering from external systems. Beyond simple folder hierarchies, metadata schemas, document types, tags, and cabinet structures provide multi-dimensional classification tailored to how your organization actually works. Background processing through Celery handles OCR, conversion, and preview generation asynchronously, keeping the web interface responsive under heavy ingest loads.

salt.md is an open-source, self-hosted workspace where your team and its AI agents work on the same documents and databases, under the same permissions and with the same history. A slash-menu block editor handles checklists, tables, callouts, columns, code, diagrams, and embeds. Page links, backlinks, and a graph view show how pages connect. Any page can become a collection with typed properties like select, date, person, relation, rollup, and formula, shown as a table, board, list, gallery, calendar, timeline, or form. Ctrl+K searches titles, body text, row values, and the text inside uploaded PDFs. Two people can type in the same paragraph at once with live cursors. Comments, page history, and an activity log record who changed what. Publish a page as a read-only link with an optional password and expiry, or hand people without accounts a form that adds rows to a collection. Agents connect over MCP with 33 tools for searching, writing, building databases, and commenting, using tokens scoped to one workspace or read-only. Signed webhooks, iCalendar feeds, and Google or Microsoft sign-in link it to the rest of your stack. Import Markdown, ZIP archives, or a Notion export, and export pages as Markdown, HTML, or PDF. Use it for handbooks, meeting notes, project boards, and a knowledge base your assistants can read. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Every cable, switch port, VLAN, and rack unit in a homelab or small server room gets a documented place in Rackpad, a self-hosted inventory and operations workspace. Rack elevations show mounted gear, including paired half-width appliances. Switch-panel port maps and aggregate ports show what is patched where. Cables carry type, length, and color, editable in bulk. VLANs, subnets, DHCP scopes, reservations, and zones sit in one Networks workspace, with gateway and DNS protection and a mismatch review for IP assignments. Storage topology follows drives, bays, and pools that span several devices. Wi-Fi controllers, access points, hypervisor hosts, and virtual machines have pages of their own, and Proxmox and Hyper-V hosts can be imported after review. Discovery scans a subnet or any CIDR and stages every finding in an inbox. Per-device checks over ICMP, TCP, HTTP, HTTPS, and SNMP raise alerts by email, Discord, or Telegram. Everything feeds a movable topology map. Markdown runbooks attach to devices, and an audit log records every change. Admin, editor, and viewer roles control access, and OpenID Connect login is optional. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

QuickStack transforms your standalone Linux server or cluster into a self-hosted platform-as-a-service that automatically compiles, deploys, and monitors full-stack applications and relational databases without vendor lock-in. Developers can trigger instant deployments directly from public or private Git repositories, upload custom Dockerfiles, or pull container images straight from private registries with automated webhook synchronization. The built-in application catalog enables one-click provisioning of production databases including PostgreSQL, MySQL, MariaDB, MongoDB, and Redis with preconfigured internal network isolation. Administrators can route traffic across custom domains with automated Let's Encrypt SSL certificate issuance, inspect real-time CPU and memory telemetry, stream container runtime logs, and launch in-browser web terminals. Teams can configure granular role-based access controls with single sign-on authentication, establish zero-trust ingress and egress network security policies, and orchestrate automated volume snapshots directly to S3 object storage. When infrastructure requirements expand, operators can attach additional worker nodes using lightweight join tokens to distribute workloads seamlessly across high-availability compute pools. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GNU GPL v3.0 licensed.

With over 7,500 GitHub stars and 140 contributors, Matterbridge is the Go-powered chat bridge that connects over 20 messaging platforms through a single TOML configuration file, letting teams communicate across platform boundaries without forcing anyone to switch applications. The gateway architecture routes messages bidirectionally between any combination of Discord, Slack, Telegram, Matrix, IRC, Mattermost, Microsoft Teams, XMPP, Rocket.Chat, Nextcloud Talk, Keybase, Mumble, Twitch, WhatsApp, VK, Gitter, Zulip, ssh-chat, and Harmony, with transparent username and avatar spoofing so bridged messages appear native on each platform. Message edits and deletes propagate across bridges, file attachments and inline images transfer between protocols, threading and reply context is preserved where platforms support it, and private group bridging enables confidential cross-platform conversations. Multiple independent gateways can run simultaneously, each bridging different channel sets with different protocol combinations. The REST API enables third-party integrations and custom bridges without modifying the Matterbridge codebase, while the tengo scripting engine allows inline message transformation and filtering. Game chat support bridges Minecraft and Counter-Strike server chat into messaging platforms. Deployment runs as a single static Go binary with zero dependencies, or as the official Docker image with the configuration file mounted as a volume. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Engineering and product teams ship code to production daily with FeatBit, an enterprise feature flag and experimentation platform that controls exactly which user segments, regions, or percentage rollouts see each new capability. When a regression appears in production, operators toggle an instant kill switch, dial back canary weights from full traffic to one percent, or restrict access to internal QA accounts without redeploying containers. Reusable user segments group customers by subscription tier, device property, or custom attributes for consistent targeting across environments. Server-side and client-side SDKs for .NET, Java, Go, Python, Node.js, React, React Native, JavaScript, and OpenFeature synchronize flag states over WebSockets in under 100 milliseconds and evaluate rules locally in memory. Built-in A/B/n experimentation links flag variations to custom conversion events, click tracking, and pageview metrics so teams can validate product hypotheses with live telemetry. Scheduled rollouts, multi-step approval workflows, flag triggers, and webhook integrations with Slack, Datadog, Grafana, New Relic, and OpenTelemetry keep release operations auditable. Role-based access control and single sign-on govern every flag change. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Omni is an open-source workplace AI agent and enterprise search platform that unites your company's scattered tools into a single context-aware workspace where team members can find answers and automate cross-application workflows. Employees can query connected knowledge sources including Google Drive, Gmail, Slack, Jira, GitHub, Confluence, and HubSpot to locate project specifications, customer records, and operational documents without jumping across tabs. The integrated AI assistant answers complex multi-step inquiries, summarizes lengthy email threads, and cites exact source passages so workers can verify factual accuracy before making business decisions. Granular permission inheritance mirrors existing access controls across every connected service, guaranteeing that sensitive personnel files, financial statements, and confidential repositories remain hidden from unauthorized staff. Engineers can construct bespoke data connectors and define automated agent skills through the extensible Python and TypeScript software development kits, triggering multi-service actions directly from interactive chat dialogues. Administrators can monitor background synchronization jobs, inspect audit trails, manage single sign-on access, and configure custom extraction pipelines using centralized operational dashboards. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Every production incident starts the same way: someone asks "what do the logs say?" and the answer takes 45 minutes to find. LogTide collapses that search into seconds with a unified observability platform that indexes logs, traces, and metrics into a single queryable interface, backed by your choice of TimescaleDB, ClickHouse, or MongoDB. The log search interface supports full-text queries across millions of entries with filters for trace ID, session ID, project, service, hostname, and severity level, plus a live tail mode that streams new log lines as they arrive. Distributed traces render as waterfall timelines showing every span, its duration, and cross-service dependencies, while correlated logs for each trace are one click away. The metrics explorer visualizes OTLP gauge and counter data from your applications with system CPU, memory, disk, and network panels that update in near real-time. Where LogTide diverges from standard observability is its built-in SIEM engine: Sigma-compatible detection rules scan incoming logs for security threats like SQL injection, privilege escalation, lateral movement, and C2 communication, surfacing findings on a dedicated security dashboard with severity distribution, detection timelines, and affected service breakdowns. Alerting pushes notifications to Email, Slack, or Discord webhooks when thresholds trip or security rules fire. Native SDKs for Node.js, Python, Go, PHP, Kotlin, and Ruby ship logs with retry logic and circuit breakers, and the platform accepts OpenTelemetry data natively. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

ServerBee delivers complete fleet monitoring from a single Rust binary that embeds both the server and web UI, requiring no external database or heavy runtime. Lightweight agents installed on each node stream CPU, memory, disk, network, load, temperature, GPU, and disk I/O metrics over persistent WebSocket connections to a central server backed by embedded SQLite. The real-time React dashboard presents 17 drag-and-drop widget types across custom layouts, with historical charts spanning one hour to 30 days and monthly traffic statistics with billing-cycle prediction and cost insights including burn rate and per-resource unit cost scoring. Network monitoring covers ICMP, TCP, and HTTP ping probes, service monitors for SSL certificates, DNS records, HTTP keyword matching, TCP ports, and WHOIS expiration, plus network-quality probing across 96 China 3-ISP and international presets with IP-quality and streaming-unlock detection. Remote management features include a web terminal with sandboxed file manager, Docker container stats with logs and events, firewall configuration, and agent auto-update capabilities. Public status pages display 90-day uptime timelines, while alerting supports email and webhook notifications with flexible trigger expressions. A native iOS companion app provides mobile monitoring access. Deploy via Docker or download the single binary for Linux, macOS, or Windows, running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

From the German "zusammen," together: Zusam is a private social space for a group of friends - a self-hosted alternative to the family WhatsApp group or the friends Facebook group, with no ads, algorithms, or data harvesting in between. The AGPLv3 project is deliberately modest in scope and stack: a Symfony PHP backend exposing a REST API over SQLite, with a lightweight Preact single-page frontend, designed for a low server footprint that runs comfortably on small hardware. Groups post messages into shared feeds that handle real life well: video and image uploads (with FFmpeg processing), photo albums for trips and events, and rich link previews with inline embeds for YouTube, Vimeo, Imgur, SoundCloud, Twitch, and Bandcamp - so sharing a song or a clip looks the way it should. When something needs to leave the circle, public link generation exposes a single message to non-members without opening the group. The interface is fully responsive and mobile-friendly, targeting Firefox ESR and recent Chrome. It is the small-web answer to a real question: where does a group chat's shared history live when you want it owned by the group instead of a platform?

Lyftr delivers a self-hosted workout and nutrition tracker that runs on a small VPS — no subscriptions, no vendor lock-in, no "export is a Pro feature" paywalls. The Go backend with Gin framework provides JWT authentication and a REST API while storing everything in a single SQLite database file you can back up with one copy command. The exercise library ships with 800+ movements auto-seeded on first run, letting you build reusable workout programs with target sets, reps, and weights from day one. Active workout mode provides a guided set-by-set flow through your session while Gym Mode offers a full-screen card layout showing one exercise at a time with an integrated rest timer for focused training. The React frontend built with TypeScript and Tailwind delivers a mobile-first interface featuring a dashboard with weekly session KPIs, daily calorie and protein tracking, 12-week consistency heatmap, volume trend charts, and muscle balance visualization with sparklines. Nutrition tracking connects to Open Food Facts for food search with camera-based barcode scanning, logging calories and macros across customizable meal sections. Bodyweight logging with trend graphs supports both lbs and kg units across all data. An Android APK connects to your self-hosted instance for native mobile access. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

DumbAssets delivers a deliberately simple physical asset tracker that does exactly one thing well — keeping tabs on everything you own, from server racks down to individual HDDs, with hierarchical component nesting that mirrors real-world organization. The Node.js backend stores all data in JSON files within a single /data directory, making backups trivial with one folder copy while the PWA-enabled frontend provides responsive access from any device with light and dark theme persistence. Assets track model numbers, serial numbers, purchase dates, warranty expiration dates, and custom descriptions while sub-components nest infinitely — attach a Dell R730 to your server rack, then attach individual drives, CPUs, and NICs to that server with separate warranty and maintenance schedules for each. The Apprise notification engine fires configurable alerts for warranty expirations and maintenance events with direct links back to the specific asset in the web interface. Photo uploads attach visual records to any asset, receipt storage keeps purchase documentation alongside the item it covers, and a flexible tagging system enables cross-cutting organization beyond the hierarchy. PIN authentication with brute-force protection secures the interface, while search covers names, models, serials, and descriptions with sorting by warranty status, tags, components, or alphabetical order. Deploy with a single Docker command mapping port 3000 and one data volume. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL v3 licensed.

"Forget about bouncers" became a real sentence because of The Lounge: a Node.js web IRC client that holds persistent connections to your networks 24/7, logging everything while you sleep, so closing the browser tab never means missing a message or losing your place in a channel. Open it again from any device - desktop, phone, tablet - and you resume exactly where you left off, with full history synchronized. Because it combines bouncer and client in one process, the experience feels like a modern chat app rather than 1990s infrastructure: push notifications for highlights and private messages (with self-generated VAPID keys, so even Web Push needs no third-party service), automatic link previews, inline file and image uploads, and full IRCv3 protocol support. It installs as a progressive web app from any modern browser, so phones get a native-feel client without an app store. Multi-user support means one instance serves your whole team or community, each user with their own networks and history, and LDAP integration ties into existing authentication. A public mode alternatively serves as an open, registration-free web chat for events or support channels. MIT-licensed, born as a fork of Shout, and a fixture of self-hosting stacks since.

To listen to your favorite YouTube channels, video playlists, and Bilibili creators during a commute without keeping a browser tab open, PigeonPod converts video subscriptions into private, standard podcast RSS feeds for any podcast player. Paste a channel URL, playlist link, or single video address to preview uploads and generate a protected feed for Apple Podcasts, Overcast, Pocket Casts, or AntennaPod. You can select audio-only or video output, customize bitrates and formats, and generate Podcasting 2.0 chapter markers for topic scrubbing. Scheduled background sync jobs fetch new releases automatically while on-demand history backfill queues older catalog episodes in bulk. Per-feed keyword rules, duration thresholds, and retention limits keep storage clean by filtering out shorts or marathon livestreams. Upload YouTube or Bilibili cookies for member-only streams, route traffic through custom proxies, and update the yt-dlp engine directly inside the web dashboard. A built-in web player, one-click public episode share pages, and OPML export let you stream in the browser or migrate subscriptions. Media files store on local disk or S3-compatible buckets such as Cloudflare R2 and MinIO, accompanied by YouTube API quota monitors and failure alerts. Multi-user role permissions support shared accounts across eight interface languages. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.