With over 13,000 GitHub stars and active monthly releases, Mailcow delivers a production-ready mail server infrastructure through Docker Compose orchestration of twelve integrated containers. The stack pairs Postfix as the MTA handling SMTP traffic with Dovecot for IMAP and POP3 retrieval featuring the Flatcurve full-text search engine, while Rspamd provides machine-learning-powered spam filtering with Bayesian classification, DKIM signing, and ARC support. ClamAV scans attachments for malware including Office document macro analysis via Olefy, and SOGo serves as a responsive webmail client with CalDAV, CardDAV, and Microsoft ActiveSync synchronization. The admin panel manages multiple domains, per-user spam score thresholds, quarantine review, black and whitelists, temporary spam aliases, mailbox quotas, and TLS enforcement policies for both inbound and outbound messages. Security features include two-factor authentication via TOTP, WebAuthn, and Yubikey OTP, a Fail2ban-like Netfilter integration for brute-force protection, and automatic SPF, DKIM, and DMARC configuration. The ACME container handles Let's Encrypt certificate generation with DNS-01 challenge support, while Postfix TLS-Pol provides MTA-STS and DANE/TLSA resolution for encrypted transport. Built-in imapsync enables periodic migration from remote mailboxes, and the REST API allows programmatic management of all server resources. MariaDB stores user data, Redis caches configuration and sessions, and Unbound provides local DNSSEC-validating DNS resolution. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

With over 7,100 GitHub stars and 200 contributors since 2016, Mailu has become one of the most popular self-hosted email solutions, delivering a complete production-ready mail server stack as pre-configured Docker containers that eliminate weeks of manual setup. The platform bundles Postfix for SMTP and Submission with auto-configuration profiles for Thunderbird, Outlook, and mobile clients, Dovecot for IMAP and POP3 with full-text search across email attachments, Rspamd for intelligent spam filtering with auto-learn Bayesian classification, greylisting, SPF and DMARC validation, and ClamAV for antivirus scanning of attachments with configurable malicious file blocking. The web administration interface provides global admin controls, per-domain delegation, user quota management, domain aliases, custom routing rules, and announcement capabilities. Users access self-service features including aliases, auto-reply, auto-forward, fetched accounts from external mailboxes via fetchmail, and Sieve filter management through ManageSieve. Security features include enforced TLS on all connections, automatic Let's Encrypt certificate provisioning, outgoing DKIM signing, DANE and MTA-STS support for transport security, and Snuffleupagus PHP hardening for the web interface. The setup wizard at setup.mailu.io generates complete Docker Compose configurations tailored to specific deployment requirements. All components are free and open-source software with zero proprietary dependencies and no tracking. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Mox offers a complete mail server stack in a single Go binary requiring no external dependencies. The quickstart command configures a working mail server with SMTP, IMAP4, webmail, and full DNS authentication in under ten minutes. SMTP handling includes a delivery server on port 25, a submission server for authenticated clients, and a queue with automatic retries and DKIM signing. IMAP4rev2 implementation provides full mailbox synchronization with CONDSTORE and QRESYNC for efficient offline clients, NOTIFY for multi-mailbox monitoring, MULTISEARCH across mailboxes, and TLS client certificate authentication via the EXTERNAL SASL mechanism. The built-in webmail provides browser-based reading and composing with message threading, attachments, and HTML rendering without requiring a separate web client. Email authentication implements SPF validation, DKIM signing and verification with automatic key rotation, DMARC policy enforcement with aggregate and failure reporting, DANE with DNSSEC-protected TLSA records, and MTA-STS for certificate verification. Junk filtering combines reputation-based sender scoring with Bayesian content analysis trained per account. The web administration interface manages domains, accounts, DNS records, TLS certificates, delivery queue, and real-time log viewing. Internationalized email addresses with EAI and IDNA support handle non-ASCII domains and mailboxes. Account autoconfiguration publishes settings for Thunderbird autoconfig and Outlook autodiscover. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Stalwart replaces the traditional Postfix + Dovecot + SpamAssassin + calendar-server stack with one Rust binary that speaks every standard mail and collaboration protocol natively. JMAP, IMAP4rev2, POP3, SMTP, CalDAV, CardDAV, and WebDAV all run inside the same process — no glue scripts, no sidecar daemons, no version conflicts between components. The pluggable storage architecture lets operators choose RocksDB for single-node deployments, FoundationDB for distributed clusters, PostgreSQL, MySQL/MariaDB, or SQLite for the data store, S3/MinIO/Azure Blob for message blobs, and Elasticsearch or Meilisearch for full-text search, with Redis or the internal engine backing rate limiters and session state. Security features include S/MIME and OpenPGP encryption at rest, automated DKIM key generation with DNS publication, DANE and MTA-STS transport security, automatic ACME TLS provisioning, granular ACLs, rate limiting, and IP banning. The browser-based admin console manages accounts, domains, groups, mailing lists, SMTP queues, DMARC/TLS-RPT/ARF reports, and every configuration object without touching a config file, while the self-service portal at /account gives end users password reset and encryption key management. Multi-tenant support with per-tenant quotas enables hosting-platform deployments, and coordinator-less clustering via Zenoh or NATS scales horizontally by adding nodes. Deploy via Docker or the standalone binary. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL v3 licensed.

Mail-in-a-Box turns a single Ubuntu server into a fully functional email system with one setup command, installing and configuring Postfix for SMTP, Dovecot for IMAP, Roundcube for webmail, and Z-Push for Exchange ActiveSync push notifications in an automated sequence that would take days to replicate manually. The DNS server auto-configures the full suite of email authentication records: SPF, DKIM, DMARC, DNSSEC with DANE TLSA, MTA-STS, and SSHFP. Getting all of these right is what separates email that lands in inboxes from email that lands in spam, and most manual installations never achieve the complete set. Nextcloud integration adds CardDAV contact sync and CalDAV calendar sharing across devices. Let's Encrypt certificates provision and renew automatically for every hosted domain. The web control panel manages users, aliases, custom DNS records, and automated backups, protected by TOTP two-factor authentication. Daily health checks verify that services run correctly, ports remain open, TLS certificates stay valid, and DNS records resolve properly, alerting you before delivery problems develop. Multiple domains and users operate from one installation with internationalized domain name support. Built-in HTTPS static site hosting uses the TLS infrastructure already in place. Runs on a dedicated RepoCloud VPS with guaranteed resources, root SSH, and browser serial console for complete email sovereignty. CC0 public domain licensed.

Mayan EDMS stores, classifies, and retrieves millions of documents with automatic OCR, workflow automation, and audit-ready access controls that organizations have relied on for over a decade. Tesseract integration extracts searchable text from scanned PDFs and images in over 100 languages, transforming paper archives into instantly queryable digital collections without manual data entry. The workflow engine routes documents through approval chains using configurable state machines that trigger notifications, enforce retention policies, and maintain complete audit trails for regulatory compliance. Version tracking preserves every revision with full diff capabilities, while GnuPG digital signatures provide cryptographic proof of authenticity and tamper detection for sensitive records. Role-based permissions combined with object-level ACLs and LDAP integration ensure documents remain visible only to authorized users, down to individual file granularity. Full-text search powered by Whoosh or ElasticSearch handles advanced queries across massive document stores with faceted filtering and relevance ranking. The Django REST Framework API enables programmatic upload, metadata extraction, and workflow triggering from external systems. Beyond simple folder hierarchies, metadata schemas, document types, tags, and cabinet structures provide multi-dimensional classification tailored to how your organization actually works. Background processing through Celery handles OCR, conversion, and preview generation asynchronously, keeping the web interface responsive under heavy ingest loads.

Receipts, contracts, and letters that arrive as pixels rather than text: Papermerge is a document management system built specifically for scanned documents. Upload a PDF, TIFF, JPEG, or PNG and OCR runs automatically, with a real-time status indicator beside the document title; under the hood it drives OCRmyPDF and Tesseract, supporting 130+ languages and producing a new document version with a selectable, searchable text layer you can download. Full-text search runs across everything, with multiple search-engine backends (Xapian by default). The interface deliberately mimics a modern desktop file browser: dual-panel commander, drag and drop, hierarchical folders, and colored tags on documents and folders. Page management fixes what scanners get wrong - delete blank pages, rotate, reorder, merge, extract, and move strayed pages between documents, powered by PikePDF. Document types act as categories, each with its own custom metadata fields, so invoices carry vendor and amount while contracts carry parties and dates. Versioning preserves every state of a document. Multi-user support includes groups, group ownership, permission management, and document/folder sharing between users and groups, and an OpenAPI-compliant REST API automates ingestion from scanners or scripts. Apache-licensed, ideal for long-term digital archives.

Convert paper archives, email attachments, and PDF records into an organized digital repository with Docspell, an open-source document management system that automates optical character recognition, metadata extraction, and full-text search. Users can ingest receipts and invoices through network scanners, monitored IMAP email mailboxes, mobile uploads, or drag-and-drop browser tools. The background processing pipeline executes optical character recognition via Tesseract, enhances image contrast with unpaper, and extracts text from Word documents and PDFs. Machine learning algorithms analyze document syntax to predict correspondents, suggest relevant organization tags, and identify due dates automatically. Team members can search their entire filing cabinet using complex Boolean queries and full-text indexing powered by Apache Solr or PostgreSQL. Administrators can configure multi-user collectives with isolated permissions, define custom metadata attributes, set up webhooks, and share time-limited document download links. Users can also merge multi-page scans, track processing job queues, and export curated document collections for tax filings or legal audits. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GNU AGPL v3.0 licensed.

A pile of paper becomes a searchable digital archive under Paperless-ngx, the community-maintained document management system. The pipeline is what makes it work: drop a file into the consumption folder (or let it poll an email inbox), and a worker hashes it for duplicate detection, routes it by type, runs OCRmyPDF with Tesseract (100+ languages) on anything without a text layer, and produces an archivable PDF/A with invisible selectable text embedded - so Ctrl+F works on your scans. Then the smart part: a scikit-learn classifier (TF-IDF plus multi-label prediction) trained on your own tagged documents automatically assigns tags, correspondents, and document types to new arrivals, alongside rule-based exact, keyword, and regex matching for deterministic cases. Full-text search includes relevance ranking, match highlighting, autocomplete, and "more like this" similarity search. Apache Tika integration extends consumption to Word, Excel, PowerPoint, and LibreOffice formats. The Django/Angular app adds custom fields, saved views on a customizable dashboard, bulk editing, workflow automation triggered on upload or matching, shareable public links with expiration, and a robust permissions system with per-document access control. Metadata lives in PostgreSQL with Redis-queued Celery workers processing documents in parallel. Your tax records, invoices, and contracts stay on your server - searchable in seconds, never in someone else's cloud.

Somewhere between the shoebox and the inbox, Papra keeps receipts, warranties, and leases in a self-hosted archive you can actually search. Upload a photographed receipt and built-in OCR reads its text, so a search for the store name finds it later. Searches combine name:, content:, tag:, created:, and has: filters with AND, OR, NOT, and parentheses, and any query can be saved as a sidebar view. Tagging rules label uploads by name or content and can be applied to documents already stored. Optional AI auto-tagging works with a cloud provider or a local model such as Ollama. Custom properties add searchable typed fields such as text, number, date, yes or no, and select. Organizations keep a household's or a team's archive apart, with owner, admin, and member roles. Share links let outsiders open a document without an account, with optional passwords and expiry dates, and each link can be switched off. Forward an email to a generated address, or drop files into a watched folder, and documents arrive without opening the app; both are opt-in. Deleted files wait 30 days in the trash, and optional encryption protects stored files. Sign in with email, GitHub, Google, or a custom OAuth2 provider, and script the archive through the API, SDK, CLI, or webhooks. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 70,000 GitHub stars and billions of documents indexed across enterprises like Uber, Netflix, and Wikipedia, Elasticsearch is the world's most deployed search engine, powering everything from application search to security analytics and AI-driven retrieval. Built on Apache Lucene, its inverted index architecture delivers sub-second full-text search across terabytes of data with BM25 relevance scoring, configurable analyzers for 30+ languages, and fuzzy matching for typo tolerance. The kNN vector search API uses the HNSW algorithm for approximate nearest neighbor queries on dense and sparse embeddings up to 4,096 dimensions, while reciprocal rank fusion enables hybrid search that combines lexical and semantic signals in a single query. Elasticsearch's aggregation framework supports metric, bucket, and pipeline aggregations for real-time analytics directly on indexed data without separate OLAP infrastructure. The cluster distributes data across shards with automatic rebalancing, replica allocation, and cross-cluster search for multi-datacenter deployments. Kibana provides the visualization layer with dashboards, Lens visual editor, Canvas for pixel-perfect reports, and Discover for ad-hoc log exploration. Ingest pipelines with processors like grok, dissect, GeoIP enrichment, and inference handle data transformation at index time, and ES|QL brings pipe-based query syntax with joins and columnar processing. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL v3 licensed.

OpenSearch is a search and analytics platforms, powering full-text search, log analytics, observability, and AI-powered vector retrieval at petabyte scale. The distributed engine provides BM25 full-text search alongside k-NN vector search using NMSLIB, Faiss, and Lucene libraries, enabling semantic search, hybrid search combining keyword and vector scoring through normalization processors, neural sparse search, and retrieval-augmented generation workflows with built-in ML Commons for model hosting. OpenSearch Dashboards delivers interactive visualization with Discover for log exploration, custom dashboards, alerting, anomaly detection using Random Cut Forest algorithms, and Security Analytics with detection rules mapped to MITRE ATT&CK. Native Prometheus integration with full PromQL support unifies metrics alongside logs and traces in a single observability interface, while Data Prepper handles telemetry ingestion from OpenTelemetry collectors, Fluent Bit, and Logstash-compatible pipelines. SQL and Piped Processing Language queries with a visual PPL builder enable analysts to query data without learning the native DSL. Index State Management automates index lifecycle with rollover, shrink, and delete policies, while cross-cluster replication and searchable snapshots on S3-compatible storage provide disaster recovery. Scoped API keys, field-level security, document-level security, and audit logging deliver enterprise-grade access control. Docker Compose deploys multi-node clusters alongside the Kubernetes operator for orchestrated production environments. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 11,000 GitHub stars and now backed by Datadog while remaining fully Apache 2.0 licensed, Quickwit delivers the search performance Elasticsearch users expect at a fraction of the infrastructure cost by moving the index to object storage instead of expensive local SSDs. The Rust-based engine, built on the Tantivy search library with SIMD-accelerated vectorized processing and zero garbage collection overhead, achieves sub-second search latency directly against Amazon S3, Azure Blob Storage, Google Cloud Storage, or any S3-compatible backend like MinIO and Ceph. The Elasticsearch-compatible REST API covers ingest, search, query DSL, and aggregations, enabling existing log shippers including Vector, Fluent Bit, and Syslog to migrate without rewriting configurations. Native OpenTelemetry Protocol endpoints accept logs and traces via gRPC, while Jaeger integration provides a drop-in distributed tracing backend. Ingestion from Apache Kafka, Amazon Kinesis, and Apache Pulsar supports streaming pipelines with multi-index partitioning, and the schemaless JSON indexing mode eliminates the need for upfront schema definitions. Stateless searchers and indexers scale horizontally on Kubernetes or bare metal, with a control plane that distributes indexing tasks and a janitor that manages retention policies and GDPR-compliant deletions. The built-in web UI displays search results and cluster state, while the official Grafana data source enables log exploration dashboards. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

SnappyMail is a fast, privacy-respecting webmail client that connects to any existing IMAP and SMTP server, booting in under a second with a JavaScript payload of just 138 KB under Brotli compression (down from RainLoop's 8 MB fork origin). No database is required: all configuration and user data persists as flat files in a single volume, making Docker deployment trivially simple with the roughly 30 MB image consuming approximately 50 MB of RAM. Built-in PGP encryption supports three backends: OpenPGP.js v5 with ECDSA and EDDSA key generation, GnuPG integration, and Mailvelope browser extension compatibility, eliminating the need for separate encryption plugins. The integrated Sieve script editor enables users to create mail filtering rules, vacation auto-responders, and forwarding conditions directly within the web interface when connected to ManageSieve-capable servers on port 4190. Multi-domain administration allows a single instance to serve users across multiple IMAP servers with per-domain authentication routing. The admin panel manages extensions, security settings, branding customization, and domain configuration. GDPR-friendly by design, it removes all social media integrations, Gravatar lookups, and external tracking present in RainLoop. Dark mode strips background and font colors from email messages. The modified Squire HTML editor replaces CKEditor for composing rich-text messages. Scores 99% on Lighthouse performance. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Two decades of continuous development made Roundcube the standard-bearer of open-source webmail - a PHP IMAP client that gives any mail server a polished, application-like interface in the browser. It connects to whatever IMAP/SMTP stack you run - Dovecot, Postfix, a hosted mailbox - and delivers the full desktop-client experience: drag-and-drop message management, threaded conversation views, full MIME and HTML mail handling, find-as-you-type address book with groups and LDAP connectors, multiple sender identities, full-text search, and spell checking in dozens of languages. The default Elastic skin is genuinely responsive, working as well on a phone as a desktop, and the entire UI is skinnable. The plugin API is where deployments get shaped: managesieve exposes server-side filter management in the UI, enigma brings PGP encryption and signing via GnuPG, markasjunk trains spam filters, zipdownload batches attachments, password lets users change credentials, and attachment_reminder catches the classic forgotten-attachment email - among hundreds of community plugins. Built-in caching keeps large mailboxes fast, IMAP ACLs and shared folders support team setups, and XSS protection is engineered into the rendering pipeline. It scales from a single personal mailbox to unlimited users, backed by MySQL, MariaDB, PostgreSQL, or SQLite. GPL-licensed with regular security releases.