Warpgate is a clientless bastion host and privileged access management gateway that lets engineering teams secure, assign, and audit access to internal SSH servers, databases, Kubernetes clusters, web applications, and remote desktops from a single portal without installing VPN clients. Connect directly from standard tools like OpenSSH, VS Code Remote, psql, mysql, kubectl, or native RDP clients using formatted credentials, or launch browser-based SSH terminals, RDP desktops, and VNC sessions straight from the web interface. Administrators map users and roles to specific internal targets with granular 1:1 permissions, enforcing multi-factor authentication via TOTP and Single Sign-On through OpenID Connect providers like Google Workspace, Microsoft Entra ID, and Okta with automatic group-to-role provisioning. Every interactive terminal command, database query, HTTP request, and remote desktop session is captured in real time so security auditors can watch active connections live or replay historical recordings on demand from the web dashboard. Built-in brute-force defense automatically blocks suspicious IP addresses and locks compromised accounts, while temporary access tickets, just-in-time session approvals, encrypted credential storage, and S3-compatible recording archival support enterprise compliance workflows across multi-node clusters. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Every server, embedded board, and edge gateway you manage becomes reachable through one SSH address in ShellHub, even when it sits behind NAT with no public IP and no open inbound port. A small agent on each device dials out to your server, so a box on a customer LAN or a cellular link needs nothing beyond outbound web access. Connect with the stock ssh client by typing [email protected]@server, or open a terminal in the browser, and scp, sftp, rsync, and port forwarding work unchanged. SSH identities tie every key to a named team member, so removing someone ends their access on every device at once. Default-deny access policies grant or block members, roles, users, or API keys by device tag, Linux login, and source address, and can require a fresh browser confirmation before a session opens. Provisioning keys enroll whole fleets through automatic, manual, webhook, or allowlist acceptance, with usage limits, expiry dates, and tags. The Sessions page records who connected to which device, as which login, and from where, and browser terminals can be recorded and replayed. A Docker connector turns containers into devices that policies can grant one by one. Four member roles shape what each person can change, and the HTTP API, API keys, and an MCP server let scripts and AI assistants list devices and review sessions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Pomerium puts every internal application behind a single identity-aware proxy, so engineers reach dashboards, admin panels, and databases through their browser with no VPN client and no network-level trust. Sign-in flows through your existing identity provider, including Google, Okta, Azure AD, GitHub, GitLab, and any OpenID Connect service, with sessions verified continuously rather than once at login. Each route carries its own policy: restrict the finance tool to the finance group, require a specific email domain for the admin console, or allow read-only paths more broadly. Authorized requests pass identity headers the application can trust, and every access decision is logged for audit. TCP routes extend the same sign-in and policy checks to SSH, PostgreSQL, MySQL, and RDP connections through a small client or a browser-based terminal. In Kubernetes, Pomerium doubles as an ingress controller, applying the same policies to services as annotations on ingress resources. Mutual TLS between the proxy and backends, encrypted sessions, and short-lived credentials replace shared passwords and flat networks. Teams roll it out as one all-in-one binary or split the proxy, authorize, authenticate, and cache services across machines as traffic grows. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Open a browser tab and you are at a real login prompt on your server. Wetty puts a full terminal inside the web page, so SSH access survives firewalls, borrowed laptops, and networks where only HTTPS gets out. The emulator is a complete xterm.js implementation rather than a crippled web console, so colors, Unicode, mouse interaction, and full-screen programs like vim, top, and tmux behave the way they do in a desktop terminal. Websockets carry the session instead of Ajax polling, which keeps keystrokes responsive enough to forget you are in a browser. Point it at any SSH server with host, port, user, and key options, or let it launch the local login prompt when it runs on the machine itself. Visiting /ssh/yourname skips the username question and goes straight to the password prompt for that account. Serve it over HTTPS with your own certificates, restrict which browser origins may connect, run it on a Unix socket behind a reverse proxy, and confine it to a base path when it shares a domain with other tools. A YAML configuration file and environment friendly flags make the same setup reproducible across a fleet, and an official container image keeps installation to one command. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Skiff is a self-hosted SSH manager that remembers every command you ran on your servers and exactly what it printed, so the fix you found at 2 a.m. last March takes seconds to find again. Open a host's history beside its terminal, or search commands and captured output across every host, filter to just the failed attempts, and expand an entry to see its full output. When you edit a small text file, Skiff reads it over SFTP and keeps the before-and-after diff and both versions, so you can see what changed instead of guessing. Useful entries pin to a host's notes, save as reusable snippets, or go back into the terminal with Run again, where you review and press Enter yourself. The browser is only a viewer: sessions live in the Skiff server process, so closing a tab or losing Wi-Fi does not kill your work, and you reattach with recent scrollback intact. Hosts organize into nested folders with favorites and full-text search, existing SSH configs import in one paste, and host keys pin on first connect with a loud warning if one ever changes. Credentials sit in an encrypted vault that locks itself after an idle timeout, team mode shares one vault with per-user logins, and there is no cloud account, telemetry, or agent to install on any target server. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Terminals, remote desktops, and file browsers for every server you run: Nexterm opens them over SSH, VNC, RDP, Telnet, or SFTP from a self-hosted web page. Servers live in folders with tags and custom icons. Connections open as tabs or split views, keep running across browsers and devices, and can hibernate and resume later. The file manager handles SFTP and FTP: drag files in, upload whole folders, search, and edit in place with syntax highlighting. Live metrics track CPU, memory, disk, network, and processes for each host. Snippets store the commands you retype most. Scripts run whole maintenance jobs. Git repositories added as sources bring ready-made ones filtered by operating system. Organizations share servers through role-based permissions, and every action is logged. Record full terminal sessions for audits and training, or send a shared-session link so a colleague can join, read-only or writable. Authentication covers local accounts with TOTP and passkeys, OIDC providers such as Keycloak, Authentik, and Microsoft Entra ID, and LDAP or Active Directory. Saved passwords, SSH keys, and passphrases stay encrypted at rest. A Proxmox integration lists LXC containers and QEMU virtual machines and can start or stop them. An opt-in AI assistant drafts shell commands from plain-language requests. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Termix delivers a unified, self-hosted infrastructure control center that consolidates SSH terminals, remote desktop streaming, and fleet automation into an intuitive browser workspace that replaces proprietary tools like Termius. Administrators connect to Linux servers and desktop environments using embedded RDP, VNC, and Telnet protocols powered by Apache Guacamole without requiring local client installations. The multi-panel terminal interface supports four-way split screens, allowing operators to broadcast keystrokes simultaneously across multiple production hosts or execute saved reusable script snippets with dynamic parameters. Real-time multiplayer session sharing lets engineers invite teammates via secure, time-limited links with configurable read-only or collaborative write permissions for troubleshooting incidents. Advanced networking layers handle SSH jump hosts, SOCKS5 proxy chains, Warpgate relays, and port knocking sequences to access segmented private networks securely. Integrated SFTP file managers provide drag-and-drop file transfers with editable path bars, inline text editing, and folder synchronization across remote machines. Background telemetry monitors CPU loads, memory utilization, disk IOPS, and container statuses, while built-in session recording captures complete terminal sessions for compliance auditing. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

RustDesk Console is a self-hosted management panel for RustDesk that gives administrators one place to oversee devices, address books, access policies, and audit trails across a whole remote desktop fleet. The dashboard opens with overview statistics, trend charts, and real-time monitoring across several metrics. Device pages group machines, track online status, apply batch operations, and force-disconnect a session when something looks wrong. Personal and shared address books carry tags, peer entries, and access rules, so teams can hand out the right connections to the right people. Strategies can be assigned to a device, a user, or a group, with priority resolution deciding which wins and heartbeat delivery pushing settings to clients. Four audit logs record connections, file transfers, security alarms, and console operations for compliance reviews. Sign-in supports TOTP two-factor codes, passkeys, OIDC single sign-on, and email verification. An optional server profile runs hbbs and hbbr beside the console and manages relay nodes from the same interface. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Point your RustDesk clients at CortenDesk and the bare open-source server turns into a managed fleet console with a real address book, real access control, and a remote client that lives in the browser. One container runs the ID server, the relay, and the console together, and existing key pairs and device IDs move in unchanged, so migration is a hostname change rather than a rebuild. The fleet view shows live presence, platform, aliases, owners, and last-seen for every machine, organized into folders that double as the unit of access control. People see only their own devices plus the groups granted to them, and the same scoping is enforced in the RustDesk client API, not just the web pages. Policies push client settings over the heartbeat, covering permissions, password rules, and capture behavior, and enforced policies revert local changes automatically. Five audit logs record connections, file transfers, sign-ins, security alarms, and console actions, all filterable and exportable to CSV. When a browser is all you have, the built-in web client views and controls machines with file transfer, clipboard, audio, and multi-monitor switching, no installer required. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 7,000 GitHub stars and continuous development since 2017 by former Intel engineer Ylian Saint-Hilaire, MeshCentral has become the go-to self-hosted alternative to ConnectWise Control and Splashtop for managing devices remotely without per-seat licensing fees. The Node.js server installs via a single npm command and manages Windows, macOS, Linux, and FreeBSD endpoints through lightweight agents that maintain persistent WebSocket connections for real-time remote desktop, terminal access, and file transfer directly in the browser. Intel AMT integration provides out-of-band hardware management including power control and BIOS access even when the operating system is unresponsive. Device groups organize endpoints by location, customer, or function with granular role-based access control for multi-technician environments. Session recording captures remote desktop interactions for compliance auditing, while Wake-on-LAN powers on machines remotely across subnets. The server supports MongoDB for production deployments handling thousands of agents or the embedded NeDB for smaller setups under 200 devices, with a single 8GB VPS comfortably managing 1,500 concurrent agents. Security features include mandatory TLS with automatic Let's Encrypt certificate provisioning, multi-factor authentication via TOTP and FIDO2, SAML-based single sign-on, IP filtering, and HashiCorp Vault integration for secrets management. The web console provides real-time device monitoring with hardware and software inventory, network topology visualization, and customizable branding. TacticalRMM uses MeshCentral as its remote access layer. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

To protect self-hosted web services behind a unified single sign-on portal without deploying complex enterprise identity suites, Tinyauth acts as an OpenID Certified authentication server and reverse proxy middleware. Homelab operators and infrastructure teams place it in front of internal dashboards, media servers, and administrative tools routed through Traefik, Caddy, Nginx, Nginx Proxy Manager, or LinuxServer SWAG. Users can sign in with local bcrypt-hashed credentials, scan QR codes to enroll time-based one-time password authenticators for two-factor verification, or authenticate through external OAuth providers like GitHub, Google, and Pocket ID. Organizations running centralized directories can bind Tinyauth directly to an LDAP server such as LLDAP or OpenLDAP and automatically synchronize group memberships for role-based authorization. Fine-grained access control rules configured via dynamic Docker container labels or environment variables let administrators whitelist or block specific usernames, OAuth email regex patterns, OIDC groups, client IP CIDR ranges, and URL path prefixes per subdomain. For applications that support native federated login, the built-in OpenID Connect 1.0 discovery endpoint, authorization code flow, and userinfo API allow seamless single sign-on with optional consent skipping for trusted clients. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 24,000 GitHub stars and a rapidly growing community of self-hosters, authentik delivers enterprise-grade identity management that replaces commercial solutions like Okta and Auth0 with a fully self-hosted platform requiring no per-user licensing fees. The platform serves as a unified identity provider supporting SAML 2.0, OAuth 2.0 and OpenID Connect, LDAP for legacy application compatibility, SCIM 2.0 for automated user provisioning, and RADIUS for network device authentication. The visual flow designer enables administrators to create custom authentication workflows combining password verification, multi-factor authentication with TOTP, WebAuthn, and SMS codes, email verification, captcha challenges, and conditional logic based on user attributes or device context. The forward-auth and reverse proxy integration works seamlessly with Traefik, Nginx, Caddy, and Envoy to protect applications that lack built-in authentication. User enrollment flows support self-registration with configurable approval workflows, invitation links, and automatic group assignment. The LDAP outpost exposes user and group data to legacy applications requiring LDAP bind authentication, while the SCIM provider automates user lifecycle management with downstream applications. Multi-tenancy support through brands allows a single authentik instance to serve multiple organizations with independent domains, branding, and authentication policies. The admin interface provides comprehensive user management, group hierarchy, application catalog, event logging with GeoIP enrichment, and system health monitoring. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Licensed under a source-available license with an open-source community edition.

Every self-hosted app asking for its own password is a liability you keep re-creating. Rauthy is a lightweight single sign-on identity provider that gives your whole homelab or organization one secure login through OpenID Connect and OAuth 2, with passkeys at the center instead of passwords. Accounts can be fully passwordless: an email address plus a FIDO2 passkey with user verification, or a password backed by a security key, with magic links and upstream login providers also supported. The admin UI manages users, clients, roles, groups, sessions, API keys, blacklists, and per-client login branding with custom logos and colors, and events stream to email, Matrix, or Slack when something deserves attention. Login endpoints defend themselves with brute-force and credential-stuffing detection, automatic IP blacklisting, rate limiting, and optional geolocation blocking. Beyond web apps, a PAM and NSS module extends the same identities to Linux workstations and SSH logins with ephemeral passwords or public keys, and the OAuth device flow covers headless and IoT devices. It runs as a single efficient service on embedded Hiqlite or Postgres, clusters for high availability, needs only tens of megabytes of memory, and has passed an independent security audit. Dynamic client registration, SCIM provisioning, and DPoP tokens cover modern decentralized login flows. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

LLDAP is a lightweight user directory that lets all your self-hosted apps share one set of accounts and passwords. It speaks just enough LDAP for Nextcloud, Jellyfin, Gitea, GitLab, Grafana, Home Assistant, Proxmox VE, Vaultwarden, and many more to authenticate users against a single source of truth, with ready-made example configurations for more than 80 services. Day-to-day administration happens in a web interface where you create users, set passwords, upload avatars, build groups, and add members from a dropdown. Regular users can sign in to edit their own profile, and once SMTP is configured they can request a password-reset link by email instead of pinging the admin. Custom attributes (text, numbers, dates, or JPEG photos) are defined on the user and group schema pages, which unlocks integrations that expect fields such as uidNumber or homeDirectory, including Linux logins through PAM. Three built-in groups keep privileges tidy: lldap_admin for full control, lldap_password_manager for password resets, and lldap_strict_readonly for read-only service accounts. Group membership is exposed through memberOf filters, LDAPS secures connections when you expose the port, and a GraphQL API plus a bootstrap script let you manage users, groups, and attributes declaratively from JSON files. Pair it with Authelia, Authentik, or Keycloak when you also want single sign-on and multi-factor prompts. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

With 13,800+ GitHub stars and active releases through 2026, Casdoor is the open-source identity platform that ships OAuth 2.0, OIDC, SAML 2.0, CAS, LDAP, SCIM 2.0, WebAuthn passkeys, TOTP multi-factor authentication, and Face ID biometric login in a single Go binary with a React web console — covering every authentication protocol your organization will ever need. Social login connects 50+ identity providers including Google, GitHub, Microsoft Azure AD, Facebook, WeChat, DingTalk, Apple, Twitter, and LinkedIn without custom code. The AI-first architecture includes a Model Context Protocol gateway for AI agent authentication and Agent-to-Agent protocol support for securing LLM-powered workflows. Built-in Casbin integration delivers authorization primitives beyond basic RBAC: attribute-based access control, relationship-based access control, and custom policy models through a unified engine. The organization-scoped multi-tenancy model isolates users, applications, and identity providers per tenant with customizable login pages, branding, and SMTP configuration. SCIM 2.0 endpoints automate user provisioning from HR systems and Active Directory. Official SDKs for Go, Java, Node.js, Python, and PHP accelerate application integration. The RESTful API exposes every resource for programmatic management. Comprehensive audit logs record authentication events and administrative actions. Deploy via Docker Compose with MySQL or PostgreSQL, the all-in-one SQLite Docker image for quick trials, or the official Kubernetes Helm chart for production clusters. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Behind one admin panel, DefGuard runs a WireGuard VPN, an identity provider, and multi-factor authentication, so every person and device proves who they are before reaching your private network. Administrators define VPN locations, assign which users and groups may enter each one, and enforce firewall rules that allow or deny traffic per location, with changes applied to gateways in real time. People enroll remotely through a guided self-service flow, register their own laptops and phones, and connect with desktop and mobile clients that show live connection statistics. Sign-in goes well beyond passwords, because the built-in OpenID Connect provider gives internal tools single sign-on, while TOTP codes, WebAuthn and FIDO2 keys, email tokens, and mobile biometrics gate each connection. Directory teams sync accounts from LDAP and Active Directory, or federate sign-in through Google, Microsoft, and custom OpenID providers, instead of maintaining a separate user list. Every authentication, enrollment, and policy change lands in a searchable activity log, and webhooks plus a REST API let surrounding systems react to access events automatically. Gateways keep enforcing access from a local cache when the control plane is unreachable, and several gateways can front the same location for failover. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Wag is an authentication gateway for WireGuard that lets each device reach only the routes it should, and asks for a second factor before the sensitive ones open. Admins write access policies for everyone, groups, or single users, marking subnets, hosts, ports, and protocols as MFA-required, always allowed, or denied, and the most specific prefix wins, so one allowed address can sit inside a protected range. Devices join with a registration token, and the public endpoint answers with a finished WireGuard profile. Users then confirm a TOTP code, a WebAuthn security key, an OIDC single sign-on login that maps identity provider groups into Wag groups, or a PAM prompt, and repeated failures lock the account. Session lifetime and idle timeouts decide when they must prove themselves again. The browser portal lists users, devices, rules, registration tokens, and webhooks with real-time notifications, while a command line locks devices, resets MFA, and manages administrators. Webhooks turn JSON from an HR or identity system into new tokens or removed users and devices, and clients can fetch the list of guarded routes from a small API. Remote staff, contractors limited to one host, and homelabs are typical uses. When a server fails, the VPN remains reachable through clustering with witness nodes or an external etcd, and certificates arrive through ACME with HTTP-01 or Cloudflare DNS-01. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.

OneTimeSecret turns a password or private note into a single-use link that destroys itself the moment the recipient opens it. Create a secret in seconds from the web form: paste the text, optionally lock it behind a passphrase, and pick how long the link stays alive, from minutes to days. Send the generated link by email straight from the app, or drop it into any chat or ticket where a credential needs to change hands. Because the link burns after one view, a forwarded message or an old thread search cannot leak what was shared; once the recipient reads it, the content is gone for good. An API issues secrets programmatically, so scripts can hand database passwords or access tokens to teammates without writing them into CI logs or shell histories. Use it anonymously for quick one-off shares, or switch on full authentication with accounts, multi-factor authentication, and WebAuthn keys for a controlled internal service. Custom domains let the links carry your own hostname, so recipients see a service your organization operates rather than a public website. Admins manage users, domains, and access from a built-in console suited to teams that hand over credentials every day. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 36,000 GitHub stars and adoption by organizations including Adobe, Shopify, and Roblox, HashiCorp Vault is the industry-standard platform for secrets management, encryption services, and privileged access control across hybrid and multi-cloud infrastructure. The key/value secrets engine stores arbitrary secrets with full versioning, soft-delete, and metadata tracking, while dynamic secrets engines generate on-demand, short-lived credentials for AWS, Azure, GCP, databases including PostgreSQL, MySQL, MongoDB, and MSSQL, and SSH access with automatic revocation after configurable lease periods. The PKI secrets engine dynamically issues X.509 certificates on demand with automatic rotation and ACME protocol support, eliminating manual certificate management workflows entirely. Encryption as a service through the transit secrets engine lets applications encrypt, decrypt, sign, verify, and generate HMACs without managing cryptographic keys directly, supporting AES-GCM-256, ChaCha20-Poly1305, RSA-2048/4096, ECDSA-P256/P384, and ED25519 algorithms. Authentication integrates with LDAP, OIDC/OAuth2, SAML, AppRole for machine-to-machine access, Kubernetes service accounts, AWS IAM, Azure Active Directory, and GitHub tokens. Fine-grained ACL policies use path-based rules with glob patterns and sentinel policies for programmatic enforcement. The integrated Raft storage backend provides high-availability clustering without external dependencies, while alternative backends include Consul, S3, DynamoDB, PostgreSQL, and MySQL. The built-in web UI provides a visual interface for browsing secrets, managing policies, configuring auth methods, and monitoring cluster health. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSL 1.1 licensed.