Give every team, project, and application one governed door to AI models instead of scattering raw provider keys across codebases. TokenHub is an OpenAI-compatible gateway that serves chat completions, responses, embeddings, reranking, and image generation, plus Anthropic Messages endpoints, in front of OpenAI, Azure OpenAI, Anthropic, Gemini, DeepSeek, Qwen, Codex subscriptions, local models, and more than 150 provider templates. Administrators publish a model catalog and write routing policies with priority, weight, failover order, and cost or quality preferences, so a provider outage never reaches client code. Users create project-scoped API keys with quotas and concurrency limits, team leaders manage project spaces and members, and each role gets a workspace that matches its job. Usage analytics and request logs attribute every call to a user, project, team, model, and cost center, and provider reconciliation compares internal usage with upstream bills. Sign in through OAuth or OIDC, control access with RBAC, and keep an audit trail of administrative changes. The console switches between English, Chinese, Japanese, and Russian, and includes an API documentation workspace for developers. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Every server, embedded board, and edge gateway you manage becomes reachable through one SSH address in ShellHub, even when it sits behind NAT with no public IP and no open inbound port. A small agent on each device dials out to your server, so a box on a customer LAN or a cellular link needs nothing beyond outbound web access. Connect with the stock ssh client by typing [email protected]@server, or open a terminal in the browser, and scp, sftp, rsync, and port forwarding work unchanged. SSH identities tie every key to a named team member, so removing someone ends their access on every device at once. Default-deny access policies grant or block members, roles, users, or API keys by device tag, Linux login, and source address, and can require a fresh browser confirmation before a session opens. Provisioning keys enroll whole fleets through automatic, manual, webhook, or allowlist acceptance, with usage limits, expiry dates, and tags. The Sessions page records who connected to which device, as which login, and from where, and browser terminals can be recorded and replayed. A Docker connector turns containers into devices that policies can grant one by one. Four member roles shape what each person can change, and the HTTP API, API keys, and an MCP server let scripts and AI assistants list devices and review sessions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

OpenFGA answers the question 'can this user perform this action on this resource?' in single-digit milliseconds, implementing Google's Zanzibar paper as a production-ready authorization engine adopted by Auth0, Grafana Labs, Canonical, Docker, Agicap, and Read.AI. The server exposes both gRPC and HTTP APIs for authorization queries including Check, ListObjects, ListUsers, Expand, and the high-throughput BatchCheck endpoint that deduplicates and processes multiple authorization decisions in a single request. Authorization models combine relationship-based access control with role-based and attribute-based patterns through a purpose-built DSL that supports contextual tuples, conditional relationship tuples with CEL expressions, and time-based filtering via the ReadChanges API. Storage backends include PostgreSQL 14+, MySQL 8, and SQLite in beta, with an in-memory adapter for development and testing. Official SDKs for Java, .NET, Node.js, Go, and Python provide type-safe client integration, while a Terraform provider enables infrastructure-as-code management of authorization stores and models. The built-in browser playground at port 3000 lets developers visually model authorization schemas, write relationship tuples, and test access control queries interactively before deployment. OpenTelemetry instrumentation integrates with existing monitoring infrastructure, and Helm charts simplify Kubernetes deployment. A VS Code extension provides syntax highlighting and validation for FGA model files, and GitHub Actions automate model testing in CI/CD pipelines. A CNCF incubating project with transparent governance. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

SkillHub gives teams a private, npm-style registry for AI agent skills, so a useful skill package is published once, reviewed, versioned, and installed into a compatible agent from the command line. Upload a package from the web console, the CLI, or the REST API, pick PUBLIC, NAMESPACE_ONLY, or PRIVATE visibility, and track releases with semantic versions plus tags such as beta and stable. Team namespaces keep their own members with Owner, Admin, and Member roles and publishing policies, while full-text search filters by namespace, downloads, ratings, and recency and hides whatever a user may not see. Every submission enters a review queue: namespace admins approve or reject team skills, platform admins decide promotions to the global scope, and each governance action lands in the audit log. A built-in Skill Scanner inspects published packages and shows its report on the skill page, with optional behavioral, LLM, VirusTotal, and Cisco AI Defense engines. Members can star and rate skills, follow download counts, receive notifications, and report problem packages. Skill suites bundle several skills into one versioned collection with an entry skill, scoped API tokens serve the CLI and scripts, and the interface speaks English, Simplified Chinese, Russian, and Korean. Packages live on local disk or S3-compatible storage such as MinIO. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Unlike pull-request forges, Gerrit reviews every Git change as a series of patchsets, and nothing merges until the required approvals are in. Developers upload with a plain git push to a refs/for ref, adding push options for topics, hashtags, work-in-progress, or private changes. Each change gets a page listing reviewers, CCs, an attention set that flags who must act next, and submit requirements driven by labels such as Code-Review and Verified, with a quick approve button for the last missing vote. Side-by-side diffs with syntax highlighting take inline comments written in Markdown, saved as drafts and published together. A Checks tab shows CI runs reported by plugins, and integrations reach Jenkins, GitHub Actions, Zuul, and webhooks. Access rights attach to groups and branch patterns, including regular expressions, and inherit from parent projects and All-Projects. Sign-in works with LDAP, OAuth, OpenID, or HTTP single sign-on, and SAML through a plugin. A query language filters changes by status, owner, reviewer, label, file path, and reviewer count. Projects pick a submit strategy: merge if necessary, fast forward only, rebase if necessary, rebase always, merge always, or cherry pick. A REST API, SSH commands, and a plugin system extend the server, and an optional Review Agent chat panel can summarize a change once an AI provider plugin is installed. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Every service you self-host wants its own account database, and Kanidm exists so they can all share one: one identity server where people sign in with passkeys and every application trusts the same login. Users register YubiKeys, Touch ID, Windows Hello, or TPM backed authenticators, and attested passkey policies let administrators restrict sign-in to specific authenticator models in high security environments. Applications connect as OAuth2 or OpenID Connect clients with authorization code, client credentials, PKCE, token exchange, and revocation supported, so your wiki, Git forge, and file sync all delegate sign-in instead of storing passwords. The application portal gives each person one page of tiles for every service they may open, and role based access control decides which groups see which applications and scopes. Older systems that only speak LDAP bind to the read-only LDAPS gateway, while Wi-Fi and VPN gear authenticates through the built-in RADIUS server with MS-CHAPv2 and EAP-TLS. Linux machines join through the Unix client for PAM and NSS authentication, cached offline credentials protected by the machine TPM, and SSH keys distributed from the server to every host. A second server replicates the whole database with strong eventual consistency, every node accepting writes without elections or quorums, so a failed machine never locks your users out of sign-in. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MPL-2.0 licensed.

HFS turns any folder on a server into a file-sharing site that visitors open in a browser, with no upload step and no space or bandwidth cap beyond your own disk. Visitors browse, search, and download single files or whole folders as ZIP archives that start streaming immediately, and interrupted uploads or downloads can resume. A virtual file system lets you arrange and rename what is shared without touching the files on disk, while accounts and per-folder permissions decide who can see, download, upload, or delete. The admin web panel covers HTTPS with built-in certificate generation, bandwidth limits globally or per IP address, geographic blocking by country, and live connection monitoring with disconnect and IP ban. Plugins add thumbnails, share links, LDAP, two-factor sign-in, download quotas, and notifications, and a few lines of JavaScript in the admin panel can change the look or the backend behavior without a restart. The front end speaks 27+ languages, works on phones, and includes a media player for audio and video. Typical uses include sending large files to friends without uploading them first, publishing a download area, and collecting uploads from visitors. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

FileBrowser Quantum is an open-source, self-hosted web file manager that transforms any directory tree or mounted storage volume into a fast, searchable cloud drive accessible from any browser. You can mount multiple independent filesystem sources at once and apply custom include or exclude rules to keep sensitive system folders hidden from everyday browsing. A background indexing engine powers instant as-you-type search across millions of files, letting you filter results by file size, folder size, media type, or modification date in milliseconds. Rich media thumbnails render automatically for videos, office documents, audio album artwork, and interactive 3D models, while integrated OnlyOffice support lets you edit spreadsheets and word processing documents directly inside your browser tab. Built-in WebDAV server support allows desktop operating systems and mobile file apps to mount your remote directories as native network drives. Sharing files with external collaborators takes seconds through customizable public or private links with expiration timers, download limits, password protection, anonymous upload permissions, and custom branding themes. Administrators can authenticate users via OpenID Connect, LDAP, JSON Web Tokens, proxy headers, or local passwords with two-factor authentication, then enforce path-level read, write, and delete rules per user or group. Developers and automation engineers can generate long-lived API tokens and explore the interactive Swagger endpoint to script file transfers and directory provisioning. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

For clubs, associations, and federations, Hitobito replaces the member spreadsheets, sign-up forms, and mailing tools with one web application that mirrors how the organization is actually built. Chapters, regions, committees, and boards sit in a single group tree, and each person holds one or more roles that decide what they can see and change. People tables filter, import, and export to CSV, Excel, vCard, and PDF. Each record carries households, tags, notes, qualifications, and history, and a duplicates view helps clean up double entries. Events and courses accept online registrations, send overflow to a waiting list, and award qualifications that expire or renew by rule. Messages reach mailing lists as bulk e-mail, PDF letters, or SMS, and bounces are collected. The invoicing module issues single invoices and invoice runs, follows each through draft, issued, partially paid, paid, and reminded states, and can import bank payments over EBICS. Administrators edit texts, labels, tags, and course categories without writing code. Other systems sign in through an OAuth 2.0 and OpenID Connect provider and read data through a JSON:API with personal tokens or service accounts. The interface switches between German, English, French, and Italian. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Somewhere in every organisation there is a folder called FINAL_v2 that nobody dares delete, and Drive from La Suite exists to end that. It gives teams a shared file space where uploads land in organised workspaces, versions stay findable through search, and every file or folder carries its own access list. You preview PDFs, images, audio, and video in the browser, and office documents open for editing through Collabora or OnlyOffice without downloading a thing. Sharing reaches outside the organisation too: invite external partners by link, even without an account, and revoke access the moment a project ends. Uploads pass malware scanning before they touch storage, a trash bin restores accidents, and quotas with usage metrics keep big archives honest. Administrators plug in their own OIDC identity provider, so logins follow the same single sign-on as the rest of the stack, while an embeddable file picker lets other internal apps reuse Drive as their document library. Because the data lives in your own S3-compatible storage, sovereignty requests stop being an argument with a vendor and become a setting. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

One endpoint for every MCP server you run: MCPHub gathers local and remote Model Context Protocol servers behind stable URLs, so AI clients connect once and see what you allow. Claude Code, Cursor, and Cherry Studio can use four routes: everything at /mcp, a named group at /mcp/{group}, one server at /mcp/{server}, or semantic tool search at /mcp/$smart. Smart routing runs vector search on PostgreSQL with pgvector and an OpenAI-compatible key, so the model gets a shorter tool list. Servers attach over stdio, SSE, or streamable HTTP, OpenAPI services can be wrapped as MCP tools, and changes apply without downtime. In the other direction, MCP tools can be exported as an OpenAPI 3.0.3 spec for OpenWebUI and other OpenAPI clients. Bearer keys, OAuth 2.0 (client and server modes), and GitHub or Google sign-in in database mode control access, with per-user visibility for servers and groups. Encrypted per-user credentials let one shared server use each person's own key. Logs show tool-call activity, request status, and latency, health checks track each connection, and the dashboard controls which tools, prompts, and resources each server exposes. Large text tool results can be compressed, interactive MCP Apps are proxied through MCPHub routes, and a built-in market lets you browse a server catalog. Typical uses include a team-wide gateway, per-project groups, and direct single-server routes for debugging. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Every employee gets one AI key, and every dollar of model spending gets a name next to it. AIHelms is an admin console and user portal that sits in front of your model providers, so a team can use Claude, DeepSeek, GPT, and local models through one entry point, with IT keeping control. Administrators onboard providers, publish models, and balance traffic across several deployments of the same model, with both OpenAI and Anthropic request formats accepted. Each AI identity carries a model allow-list, quota, rate limits, and an expiry date. Budgets can be set per person, department, project, or model, with soft alerts and hard cut-offs. Internal settlement prices sit beside real provider costs, so departments can be billed with or without a markup. Dashboards show adoption, daily calls, token use, and top users, and weekly or monthly efficiency reports drill down by department. A built-in marketplace registers, approves, and distributes MCP servers and agent Skills, and an AI policy scan flags risky Skills before anyone installs them. Audit logs record every administrator action. Employees see their key, endpoint, models, and monthly spend in the portal. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Hexis gives every AI agent in your company one governed brain: skills, tool manuals, and knowledge stored as files in a git repository you own. Engineers and non-technical teammates browse the same workspace to load plugins, read company context, and propose improvements without touching git themselves. A proposed change shows its exact diff to the owners of the files it touches, and it ships only when they approve, on the branch rules you set. Agents propose too: one that hits a broken skill mid-task can suggest the fix as a change request and wait for a person to decide. Claude Code, Cursor, Cline, Codex, and ChatGPT connect over MCP and discover skills by search at call time, so the context window stays lean. Each agent acts with its user's own permissions, resolved per file, and the credentials behind tools stay in an encrypted vault the agent never holds. Roles and folder-level grants decide who sees what, and your team signs in behind your own SSO. Every save is a commit, so history, blame, and revert come free, and the knowledge base can start from the bundled template in minutes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Wag is an authentication gateway for WireGuard that lets each device reach only the routes it should, and asks for a second factor before the sensitive ones open. Admins write access policies for everyone, groups, or single users, marking subnets, hosts, ports, and protocols as MFA-required, always allowed, or denied, and the most specific prefix wins, so one allowed address can sit inside a protected range. Devices join with a registration token, and the public endpoint answers with a finished WireGuard profile. Users then confirm a TOTP code, a WebAuthn security key, an OIDC single sign-on login that maps identity provider groups into Wag groups, or a PAM prompt, and repeated failures lock the account. Session lifetime and idle timeouts decide when they must prove themselves again. The browser portal lists users, devices, rules, registration tokens, and webhooks with real-time notifications, while a command line locks devices, resets MFA, and manages administrators. Webhooks turn JSON from an HR or identity system into new tokens or removed users and devices, and clients can fetch the list of guarded routes from a small API. Remote staff, contractors limited to one host, and homelabs are typical uses. When a server fails, the VPN remains reachable through clustering with witness nodes or an external etcd, and certificates arrive through ACME with HTTP-01 or Cloudflare DNS-01. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.

LLDAP is a lightweight user directory that lets all your self-hosted apps share one set of accounts and passwords. It speaks just enough LDAP for Nextcloud, Jellyfin, Gitea, GitLab, Grafana, Home Assistant, Proxmox VE, Vaultwarden, and many more to authenticate users against a single source of truth, with ready-made example configurations for more than 80 services. Day-to-day administration happens in a web interface where you create users, set passwords, upload avatars, build groups, and add members from a dropdown. Regular users can sign in to edit their own profile, and once SMTP is configured they can request a password-reset link by email instead of pinging the admin. Custom attributes (text, numbers, dates, or JPEG photos) are defined on the user and group schema pages, which unlocks integrations that expect fields such as uidNumber or homeDirectory, including Linux logins through PAM. Three built-in groups keep privileges tidy: lldap_admin for full control, lldap_password_manager for password resets, and lldap_strict_readonly for read-only service accounts. Group membership is exposed through memberOf filters, LDAPS secures connections when you expose the port, and a GraphQL API plus a bootstrap script let you manage users, groups, and attributes declaratively from JSON files. Pair it with Authelia, Authentik, or Keycloak when you also want single sign-on and multi-factor prompts. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Cerbos decouples authorization logic from application code entirely, evaluating human-readable YAML policies in under one millisecond through a stateless Policy Decision Point that requires no application state synchronization or cross-network fan-out. Its custom decision engine benchmarks up to 17x faster than OPA-based alternatives. Access control policies use conditions expressed in Google's Common Expression Language, supporting role-based, attribute-based, and policy-based access control patterns including derived roles, scoped policies, and permissions-aware data filtering that pushes authorization predicates directly into database queries. The PDP exposes both gRPC and HTTP APIs with SDKs for JavaScript, Python, Go, Java, .NET, Rust, PHP, and Ruby, making integration a single function call regardless of tech stack. GitOps-native workflows treat policies as code with Git versioning, CI validation through GitHub Actions, coverage reports, breaking-change detection, and audit logs of every authorization decision for ISO27001, SOC2, and HIPAA compliance. Deployment flexibility spans Kubernetes sidecars, standalone services, systemd daemons, AWS Lambda functions, and WebAssembly-embedded PDPs that run authorization logic directly in browsers, serverless architectures, and edge devices. The Admin API manages policy lifecycle operations programmatically, while the built-in Playground and REPL provide interactive testing environments for policy authoring and debugging. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

RustDesk Console is a self-hosted management panel for RustDesk that gives administrators one place to oversee devices, address books, access policies, and audit trails across a whole remote desktop fleet. The dashboard opens with overview statistics, trend charts, and real-time monitoring across several metrics. Device pages group machines, track online status, apply batch operations, and force-disconnect a session when something looks wrong. Personal and shared address books carry tags, peer entries, and access rules, so teams can hand out the right connections to the right people. Strategies can be assigned to a device, a user, or a group, with priority resolution deciding which wins and heartbeat delivery pushing settings to clients. Four audit logs record connections, file transfers, security alarms, and console operations for compliance reviews. Sign-in supports TOTP two-factor codes, passkeys, OIDC single sign-on, and email verification. An optional server profile runs hbbs and hbbr beside the console and manages relay nodes from the same interface. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

When a product needs sign-in, teams, permissions, and user analytics, Hexclave (formerly Stack Auth) delivers all of it from one admin dashboard, so nobody on your team hand-rolls another password reset flow. Sign-in methods are switches, each flipped on or off without a redeploy: email and password with secure reset, magic links, passkeys, TOTP two-factor, any of 12 OAuth providers including Google, GitHub, Microsoft, Apple, and Discord, or your own OpenID Connect provider. Sign-up rules allow, reject, or hold accounts by email domain, country, auth method, or fraud risk score. The user directory searches, filters, edits, and exports every profile, custom metadata included. Teams bring workspaces, email invites, and nested roles checked the same way on server and client. API keys belong to users or teams, auto-revoke when leaked, and reveal their secret only once. Themed templates send transactional and marketing email with open and click tracking. Analytics show live active users and session replays and store the SQL queries you write, and every user event can fire a signed webhook with automatic retries. Standard JWTs verify locally against a JWKS endpoint, and SDKs cover Next.js, React, and plain JavaScript. Self-host the dashboard and API on your own server and export your users whenever you like, with no lock-in. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT and AGPLv3 licensed.