Neko Master watches every connection flowing through your Clash, Mihomo, or Surge gateway and turns the stream into a live map of devices, domains, countries, and proxy nodes, so questions that once needed packet captures get answered at a glance. The dashboard refreshes over WebSocket as traffic moves, charting upload and download trends across thirty minutes, one hour, or a full day. Domain views rank every host your network contacts by traffic and connection count, and IP views add ASN and geographic detail, so an unfamiliar endpoint explains itself instead of raising an alarm. Proxy statistics break traffic down per node and per rule, which makes a saturated exit, a misrouted application, or an underused subscription obvious in seconds. One panel watches several gateways at once: add OpenClash backends directly, or install the one-command agent on OpenWrt, Linux, or macOS machines beside remote gateways and let each agent report home. Because agents open the connection outward, gateways behind NAT still report in, and the panel never reaches into your network uninvited. History persists in SQLite by default, and busy networks can dual-write traffic statistics to ClickHouse for larger histories while configuration stays in SQLite. Token-based access control protects the dashboard, dark mode and an installable PWA keep it comfortable on a phone, and the interface switches between English and Chinese. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

CELERITY Panel puts every Hysteria 2 and Xray VLESS node you run behind one clean web panel, so a fleet of proxy servers behaves like a single service. Add a node and the panel connects over SSH to install the software, certificates, and port hopping for you. Server groups map users to the nodes they may use, and load balancing spreads them by real server load. Cascade topology chains servers together, so clients connect to one node while traffic exits through another, drawn on a visual network map. Traffic rules block advertising domains and unwanted destinations or route selected traffic through custom proxies. Each user receives a subscription link that formats itself for Clash, Sing-box, Shadowrocket, and Hiddify. The dashboard watches online users, traffic volume, and node health in real time, and an in-browser SSH terminal reaches any node without leaving the panel. Programmatic control comes through scoped API keys with IP allowlists and rate limits, signed webhooks announce events as they happen, automatic backups land on S3-compatible storage, and AI assistants can operate the panel through its MCP interface. Two-factor authentication protects the admin login. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

3X-UI is the most popular open-source Xray management panel, providing a full-featured web interface for deploying and monitoring proxy and VPN protocols on Linux servers. The Go backend manages Xray-core instances supporting VLESS, VMess, Trojan, Shadowsocks, WireGuard, Hysteria2, HTTP, SOCKS, Dokodemo-door, and TUN inbounds across TCP, mKCP, WebSocket, gRPC, HTTPUpgrade, and XHTTP transports secured with TLS, XTLS Vision, and REALITY. The Clients page tracks each user with individual traffic quotas, expiration dates, concurrent connection limits, and live online status indicators, while one-click share links, QR codes, and a built-in subscription server distribute configurations in multiple output formats. The multi-node architecture manages and scales deployments across multiple servers from a single panel instance. The Panel Settings page configures listen address, port, URI path, session duration, trusted proxy CIDRs, authentication, and Telegram bot integration for remote monitoring and management alerts. Outbound routing supports WARP, NordVPN, custom rules, load balancers, and proxy chaining. Xray Configs provides template-level control over the core configuration, while the API Docs page exposes a complete RESTful API with in-panel Swagger documentation. Data persists in SQLite by default or PostgreSQL for larger deployments, with database export and import from the panel. Fail2ban integration enforces per-client IP limits. On RepoCloud, deploy 3X-UI on a dedicated VPS with Docker, root SSH access, and complete control over your proxy infrastructure, all under the GPL-3.0 license.

Watching a MikroTik RouterOS v7 router in real time is what MikroDash is for: live traffic, connections, Wi-Fi clients, DHCP leases, and WireGuard peers reach the browser the moment anything changes. Cards drag into any layout, and the arrangement follows your account to every browser. Managing a fleet happens on the Devices page, which shows routers as cards, a list, or a world map with 24-hour connectivity, last backup, open alerts, and pending updates. Rolling out a change starts in Config Management: choose one of 20 ready-made templates or capture your own, then deploy to one router or the fleet with a restore point, a canary router, and an automatic revert if a change cuts MikroDash off. Scheduled backups are kept only when something changed, with a diff and a guarded restore. New sites join through a generated script that calls home over a built-in WireGuard tunnel, even from behind NAT. Alerts reach SMTP, Telegram, ntfy, Discord, Slack, Gotify, Pushover, and Apprise. Troubleshooting stays in the browser with ping, traceroute, torch, bandwidth tests, a packet sniffer, and a RouterOS terminal. Read-only API access covers every page and alert, while roles, OpenID Connect sign-in, and an audit trail of every write govern shared use. Off by default, an optional assistant answers from live router data and asks before changing anything. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

BlockyUI gives your Blocky DNS server a clean browser dashboard for seeing what gets queried, what gets blocked, and how quickly answers come back. Overview cards show total queries, blocked requests, cache hit rate, listed domains, and average response time. Pause blocking for 5, 15, or 30 minutes with one click, or disable it outright, then let it return on its own. Clear the DNS cache and reload allow and deny lists without touching the command line. A queries over time chart switches between 1 hour, 24 hours, 7 days, and 30 days, with filters for a single domain or client. Paginated top lists rank the busiest domains and devices and offer a blocked-only view. The query tool tests how any domain resolves, so a new filtering rule can be checked in seconds. Query logs are searchable and filterable by reason and record type, and they read from MySQL, PostgreSQL, Timescale, SQLite, CSV, or VictoriaLogs. Panels that depend on logging or statistics appear when your Blocky instance supports them, and the dashboard adapts otherwise. Settings live in one YAML file that points at your Blocky server. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

A blocklist working silently in the background is hard to appreciate, so PH Intercept turns your DNS traffic into a live arcade battle: every allowed query flies by as a friendly ship, and every blocked query spawns as an invader your interceptor shoots down. It streams query events live from the API of your existing Pi-hole v6, AdGuard Home, or Technitium server, so the battle on screen is your network's real traffic the moment it happens. Repeat domains level up on screen: friendly shuttles grow into heavy transports and gold capital ships, while blocked domains mutate from crab invaders into orange drones and purple bosses. The interceptor hunts by itself, launching a support drone at five on-screen threats and a second at ten, and it swaps among seven selectable ships, from the Falcon and the Enterprise to the Normandy. The bottom HUD doubles as a control panel: pause blocking for ten seconds, thirty seconds, or five minutes with a synced countdown, watch totals climb, and trigger a gravity list update in place. Client and domain labels can ride beneath each entity, noisy domains disappear through regex ignore patterns, a second DNS server can join in split-screen two-player mode, and viewer settings persist per browser. The backdrop ranges from a starfield plotted from about 12,200 real stars to nebula, synthwave, and custom image modes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Snitch is a self-hosted network monitor and outbound firewall that shows every connection your server makes, which process opened it, and where in the world it goes, then lets you block it on the spot. A live force graph puts your machine at the center with each remote host as a node, while a world map plots geolocated destinations and a sliding timeline keeps the last day of traffic searchable. Every alert is actionable: block the IP, kill or suspend the process, or write a rule that firewalls matched hosts automatically by address, domain, port, country, or ASN. Detection covers port scans, beaconing, DNS tunneling, ICMP tunnels, cleartext ports, and self-signed or mismatched TLS certificates, and an isolation-forest model learns your normal flows and flags outliers. A lockdown switch cuts all public outbound traffic while the LAN stays up, for the moment something looks wrong. Findings can stream to Wazuh, Splunk, or Elastic as syslog and ECS events, or land in Discord, Slack, and Telegram as webhook alerts. Everything stays on your machine: history lives in a local database, geolocation works fully offline, and the interface speaks eight languages. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Network traffic stops being a mystery once ntopng names the hosts, applications, and protocols behind every flow, live in your browser. To find the host saturating an uplink, open the dashboard, which ranks top talkers, countries, autonomous systems, and protocols beside historical charts. To see what a suspicious host is contacting, open its page for traffic, ports, DNS queries, TLS details, and visited sites, plus a map of its conversations. Deep packet inspection recognizes applications such as Facebook, YouTube, and BitTorrent, so charts name the app behind the bytes instead of relying on port numbers alone. The console reads packets from a SPAN port or TAP and NetFlow, sFlow, or IPFIX records from routers and switches through nProbe, so it can cover a single switch or many remote sites. Behavioural checks raise alerts for flows, hosts, and interfaces and send them to email, Discord, Telegram, or webhooks. Active monitoring probes remote hosts over ICMP and HTTP/S, and network discovery lists the devices on your local network. A REST API and Lua scripting pull statistics into your own tools and add custom checks. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Point your routers at Akvorado and every NetFlow, IPFIX, and sFlow record crossing your network becomes a chart you can interrogate. The web console opens on a live summary of flows per second, exporter count, and traffic split by autonomous system, port, protocol, country, and address family. From there, the visualize page turns stored flows into stacked, line, grid, and heatmap time series, plus Sankey diagrams that show how traffic moves between networks, interfaces, and countries. Filters use a simple SQL-like syntax, so a question like which customers pulled traffic over a transit link last night becomes a query, not a support ticket to your future self. Because the outlet polls each exporter with SNMP or gNMI, flows arrive wearing real interface names, descriptions, and speeds instead of raw ifIndex numbers nobody can read. GeoIP lookups attach country and city to addresses, classification rules tag providers, peers, and connectivity types, and optional BMP sessions add AS paths and BGP communities to every flow. Retention is tiered: raw flows keep full detail for recent days while one-minute, five-minute, and hourly rollups stretch summaries across a year of history. A Grafana plugin is available too, so the same flow data can sit on the dashboards your team already watches. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Self-hosted and account-free, LAN Sheriff watches where your devices send their traffic, plots each destination on a live world map, and flags anything that looks suspicious. Click a destination on the Watchtower for its country and city, owning organization, reverse DNS, protocol, port, byte counts, duration, and responsible app or device; filter by device, app, country, organization, or protocol, or scrub back through history. Radio Chatter streams the DNS lookups it can see, surfaces first-seen domains, and labels tracker, ad, telemetry, and malware domains without ever blocking them. The Precinct Map diagrams observed traffic, while the Roster inventories every device by IP, MAC, manufacturer, hostname, inferred type, and services, and alerts you when an unrecognized one joins. The Wanted List applies eight rules, including beaconing, machine-generated domains, port scans, plaintext credentials, and volume anomalies, and explains each finding in a plain sentence rather than a mystery score. Deputy Mode needs no privileges and names the application behind each connection, while Patrol Mode adds packet capture for DNS lookups and traffic volumes. Pair installations with a code to widen your view, export any view as CSV or JSON, and send alerts to webhook, ntfy, Discord, or Slack. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

VyManager puts every VyOS router you run, across every site, into one web control plane with live dashboards and per-site permissions. Organize instances into logical sites, from the datacenter core to the smallest branch office, and add or remove routers without touching a command line. Live dashboards stream interface counters, system information, network graphs, and WireGuard peer status, so a saturated link announces itself before your users do. Configuration adapts to each router's VyOS version, with 1.4, 1.5, and rolling releases supported side by side during the longest upgrade cycle. Access is granted per site with OWNER, ADMIN, and VIEWER roles, API keys authenticate the machines, and SSH credentials stay encrypted at rest. A setup wizard walks a fresh deployment to its first managed router, and light, dark, and custom themes keep the night shift comfortable. For automation, AI assistants can be connected through the companion MCP integration, and the whole stack arrives as Docker Compose services you can redeploy in minutes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

MikroTik Manager is a web control plane for whole RouterOS fleets, built so that a bad VLAN change reverts itself instead of costing you a drive to the site. Before any risky edit, Change Guard saves a restore point on the device and arms a scheduler; if a fresh connection cannot reach the router afterwards, it rolls itself back. Lockout prediction simulates each change against live device state and refuses one that would cut management access, naming the exact port and VLAN at fault. Config Health audits for settings RouterOS accepts but silently ignores. Day to day, a live dashboard tracks availability, wireless clients, and alerts delivered by email, Slack, Discord, Telegram, or ntfy. Switch faceplates, per-port client views, VLAN copy wizards, bulk SSID deployment, RF health charts, rogue AP detection, and a guest Wi-Fi captive portal wizard cover the wired and wireless side. A rule builder handles firewall and NAT, topology maps come from LLDP, CDP, and MNDP, and a built-in NetFlow collector attributes traffic to clients and applications. Firmware rolls out in canary waves that halt on failure, and every configuration snapshot supports diffs and one-click rollback. OIDC single sign-on, TOTP two-factor, role-based access, and scoped API tokens protect the console, while sites group devices per customer network. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Numa is a DNS resolver you run yourself that gives every service on your network a real name, blocks ads and trackers before they load, and keeps your queries private with encrypted DNS. Register a frontend on port 5173 once, and https://frontend.numa opens in your browser with a valid certificate and WebSocket passthrough, no mkcert, no nginx, no editing hosts files. Path-based rules send app.numa/api to a backend on another port, so multi-service projects get one clean address instead of a spreadsheet of port numbers. Tracker and ad domains die at resolution time through the Hagezi Pro blocklist, refreshed daily, and every device that points its DNS at your instance inherits the filtering. Temporary overrides redirect any hostname for testing or debugging and revert on their own, and scripts can create them through the REST API. You choose how answers are found: forward to your existing DNS, resolve recursively from the root servers, or seal queries with Oblivious DNS over HTTPS so no single party sees both your address and your question. Phones and laptops connect over DNS-over-TLS on port 853, a QR-code flow points an iPhone at your resolver in minutes, and mDNS discovery lets one machine reach services registered on another. The dashboard on port 5380 manages services, overrides, and diagnostics, with token sign-in away from loopback. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Resolvr gives your Technitium DNS server the clean, readable dashboard it deserves, turning raw query traffic into an overview you can understand at a glance. Four tabs divide the picture: Traffic charts queries over time with allowed and blocked stacked together and a seven-day heatmap of when your network is busy; Resolution shows where answers come from, cache, upstream, blocked, or authoritative, with response times and a flow diagram of each lookup; Top lists rank your chattiest clients and most-requested domains; and Infrastructure tracks DHCP scope usage, zones, and cache growth. Every chart is a doorway: click one and you land in Query Logs already filtered to what you clicked. Pick any device on the Clients page to see its queries, block rate, DHCP lease, and favourite domains. Query Logs themselves filter by client, name, protocol, response code, and time window, export to CSV, and can live-tail as new lookups arrive. Blocked Zones manages your feeds, your own blocked domains, and a checker that tells you whether a name is blocked and which feed caught it. Run a Technitium cluster and each panel gains a scope chip, comparing nodes side by side or merging their logs into one timeline. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 31,000 GitHub stars and 430 contributors, Homepage has become the definitive self-hosted dashboard for homelab enthusiasts and server administrators who want a single, elegant landing page for all their services. The dashboard renders as a fully static site at build time for instant page loads, while a Node.js backend securely proxies all API requests to prevent exposing service credentials to the browser. Docker integration automatically discovers running containers through label-based configuration, populating the dashboard with service status indicators, health checks, and real-time statistics without manual URL entry. Over 100 native service widgets display live data from popular applications including Plex, Jellyfin, Radarr, Sonarr, Home Assistant, Pi-hole, Portainer, Proxmox, Nextcloud, Gitea, and dozens more, each showing relevant metrics like active streams, download queues, or system health directly on the dashboard. Information widgets provide weather forecasts, system resource utilization, search bars, and date/time displays. The layout system supports multiple columns, tabs, and custom CSS for pixel-perfect arrangement of service groups and bookmarks. Built-in authentication options include OIDC integration and password protection. Quick search functionality enables instant access to bookmarks and services with keyboard shortcuts. Internationalization covers 40+ languages with community-maintained translations. Configuration lives entirely in YAML files for version-controlled, reproducible dashboard setups. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console for complete control. GPL-3.0 licensed with an active community and bi-weekly releases.

Every service you run, behind one polished start page: Dashy is the most customizable homelab dashboard, built as a Vue.js homepage. Configuration lives in a single YAML file, but you never have to hand-edit it: an integrated UI editor with real-time validation writes changes back to disk, so both config-as-code and point-and-click camps are served. Status indicators put a live health dot next to every app - HTTP checks or pings on custom intervals, with response time and status details on hover - giving you an at-a-glance uptime overview before anything breaks. Over 50 built-in widgets pull dynamic content from the services you already run: Pi-hole and AdGuard block stats, Proxmox lists, Nextcloud status, Netdata CPU/memory history, Prometheus data, plus weather, RSS, crypto prices, and generic iframe/API-response widgets for anything with an endpoint. Instant fuzzy search launches any app as you type, with customizable hotkeys and web-search fallthrough. Theming is deep: dozens of built-in themes, a UI color palette editor, and custom CSS over CSS variables. Alternate views include a fast-loading minimal startpage and a workspace view that embeds apps side-by-side without leaving the dashboard. Icons resolve from Font Awesome, homelab icon packs, emojis, or auto-fetched favicons. Built-in authentication, multi-page support, cloud backup/sync, and multi-language round out an MIT project with a massive community.