Salesforce's core workflow, open-source and on your own server: Twenty is a modern CRM built as exactly that alternative. It ships the standard CRM objects out of the box: people, companies, opportunities, notes, and tasks, displayed in table and kanban views with drag-and-drop and real-time updates. Its defining technical feature is a metadata-driven data model: you define custom objects and fields in the UI, and the backend regenerates its GraphQL schema at runtime, so a new object gets working queries, mutations, filters, and sorting within seconds, with no migrations to run - adapting the CRM to your sales process never requires code changes. A REST API is auto-generated from the same schema, GraphQL subscriptions push real-time updates, and webhooks fire on record changes for external integration. A visual workflow builder automates actions like notifications and field updates, TypeScript-based apps extend the platform with custom logic and frontend components, and email and calendar sync pulls Gmail messages and meetings onto contact timelines so communication history sits next to the record. The stack is NestJS with TypeORM, PostgreSQL, Redis, and BullMQ on the backend, React with Jotai on the frontend. Self-hosting on RepoCloud means unlimited users with no per-seat licensing - the pricing model that penalizes growing teams on commercial CRMs - and your pipeline, contacts, and deal history live in your own PostgreSQL database rather than a vendor's.

API keys hardcoded in repos, database passwords pasted into CI variables, .env files emailed between developers - Infisical, the open-source platform for secrets, certificates, and privileged access management, is the answer to all three. Secrets live in versioned stores scoped by project, environment, and path, with fine-grained identity-aware access control and full audit logging on every read and change. Delivery covers every consumption pattern: CLI injection into local dev, SDKs for Go, Node.js, and Python, an HTTP API, agents, a Kubernetes Operator, and secret syncs that push to GitHub, GitLab, AWS Secrets Manager, and Vercel. Automatic rotation replaces credentials for PostgreSQL, MySQL, MSSQL, LDAP, AWS IAM, and Azure on a rolling schedule - new credentials issue while old ones stay temporarily valid, so nothing breaks mid-rotation. Dynamic secrets go further, generating ephemeral, time-bound database credentials on demand, and SSH access replaces static keys with short-lived CA-signed certificates that expire automatically. Secrets scanning catches hardcoded credentials in code and pipelines, certificate management automates X.509 issuance and renewal, and a built-in KMS handles encrypt/decrypt with central key control. Self-hosting keeps the keys to everything else on your own infrastructure.

Sixty-thousand-plus GitHub stars make Uptime Kuma the most popular self-hosted monitoring tool - MIT-licensed, Node.js, and the standard replacement for UptimeRobot, Pingdom, and Freshping. It watches a dozen monitor types: HTTP(S) endpoints with keyword and JSON-query content validation, TCP ports, ICMP ping, DNS records, WebSockets, Docker containers via the socket, Steam game servers, MQTT brokers, gRPC services, and push-based heartbeats for cron jobs and internal workers. Checks run at intervals as tight as 20 seconds - versus UptimeRobot's 5-minute free tier - with unlimited monitors and unlimited data retention. When something fails, alerts fan out through 90+ notification channels: Slack, Discord, Telegram, email with LiquidJS templating, PagerDuty, OpsGenie, ntfy, Gotify, Matrix, and dozens more via native providers plus the Apprise library. Unlimited public or password-protected status pages - mappable to specific domains and organized into monitor groups - communicate health to customers, with maintenance windows that suppress alerts during planned work. The reactive dashboard graphs response times, tracks SSL certificate expiry with advance warnings, supports proxies and 2FA, and ships in dozens of languages. One Docker container with a SQLite volume covers an entire infrastructure.

Browse trending titles, search anything, request it in two clicks: Jellyseerr gives Jellyfin, Emby, and Plex users a beautiful storefront for the media library. Born as the Overseerr fork that added Jellyfin and Emby support (the projects have since unified as Seerr), it handles the full request lifecycle - users authenticate with their existing media-server accounts, pick individual seasons or movies in a clean interface, and admins approve or decline from a simple queue, including on mobile. Approved requests flow straight to Sonarr and Radarr, which handle acquisition automatically, with support for separate 4K server instances. Regular library scans keep availability accurate, so users see instantly what already exists instead of requesting duplicates. A granular permission system controls who can request what - auto-approval for trusted users, quotas and limits elsewhere - and override rules adjust request routing by user, tag, or other conditions. Watchlist and blocklist functions curate discovery, notifications reach email, Discord, Telegram, Slack, Pushover, and Pushbullet, and both PostgreSQL and SQLite are supported. Localized into many languages, it turns "can you add this movie?" texts into a self-service system that runs itself.

Adobe Acrobat and Smallpdf, answered by a self-hosted Java web application: Stirling PDF processes every file with its 60+ tools on your own server and deletes it after the task completes. Nothing is uploaded to a third party, which is the whole point for contracts, invoices, and medical records. The toolbox covers page operations (merge, split at page numbers or scanned dividers, rotate, reorder, crop, extract), conversion in both directions between PDF and Word, Excel, PowerPoint, images, HTML, and Markdown, OCR that turns scans into searchable PDFs via Tesseract/OCRmyPDF (including PDF/A archival conversion), and security tools for passwords, permissions, watermarks, signatures, and true UI-driven text redaction. A built-in viewer handles annotation, drawing, and text or image insertion, and V2 added stateful processing - upload once, chain multiple tools - plus undo/redo history. For automation, nearly every tool has a REST API endpoint, no-code pipelines combine operations into custom logic chains, and watched folders process files automatically. Enterprise deployments get SSO, user management, and audit logging; the interface ships in 40+ languages. With 84K+ GitHub stars it is the most popular PDF tool in self-hosting, replacing $20/month Acrobat subscriptions with flat infrastructure cost.

Teams tired of paying Salesforce or HubSpot per seat run EspoCRM: an AGPL-licensed PHP application with a fast single-page frontend over a REST API, covering sales, support, and marketing in one uncluttered interface. The sales core is complete - leads, contacts, accounts, opportunities with customizable pipeline stages, kanban views, calendars, meetings, and calls. Email is deeply integrated rather than bolted on: IMAP sync links messages to CRM records automatically, and mass email campaigns run with reusable templates, tracking, and Web-to-Lead forms feeding the funnel. Support teams get case management and a customer portal where clients track their own tickets and access a knowledge base. The real differentiator is the Entity Manager: create custom entities, fields, relationships, and layouts from the admin UI without code, with dynamic logic showing or hiding fields conditionally - EspoCRM is as much a business-application platform as a CRM. Formula scripting handles calculated fields and record automation in the free core; the optional Advanced Pack adds visual BPM process design and workflow rules. Role-based permissions with team and territory scoping, full-text search, reports, and a straightforward REST API for n8n or custom integrations round it out. Runs on PHP 8.3+ with MySQL, MariaDB, or PostgreSQL - unlimited users, zero per-seat fees.

Getting non-technical friends and family onto a media server is its most tedious chore - Wizarr solves it. Instead of manually creating accounts, dictating server addresses, and explaining which app to install, you send one invite link. When the recipient clicks it, Wizarr creates their account on your server automatically - Plex, Jellyfin, Emby, Audiobookshelf, Komga, Kavita, and Romm are all supported - then walks them through a mobile-first, app-like onboarding wizard: download the right client, sign in, and learn how to request movies through your Overseerr or Ombi instance, with an optional Discord server invite along the way. Invitations are genuinely manageable: set expiration dates, usage limits, passphrases, library-scoped access tiers, and time-limited memberships that end access automatically. The wizard itself is fully customizable - Markdown-based steps managed from the admin UI, organized into pre-invite and post-invite phases (terms of service before joining, app setup after), reorderable bundles assignable to specific invitation types, and combined flows for invites spanning multiple servers. Multi-server and multi-admin support manages several backends from one dashboard, SSO support is plug-and-play, and a REST API with OpenAPI/Swagger documentation covers automation. A Flask/HTMX app in a single Docker container.

"Forget about bouncers" became a real sentence because of The Lounge: a Node.js web IRC client that holds persistent connections to your networks 24/7, logging everything while you sleep, so closing the browser tab never means missing a message or losing your place in a channel. Open it again from any device - desktop, phone, tablet - and you resume exactly where you left off, with full history synchronized. Because it combines bouncer and client in one process, the experience feels like a modern chat app rather than 1990s infrastructure: push notifications for highlights and private messages (with self-generated VAPID keys, so even Web Push needs no third-party service), automatic link previews, inline file and image uploads, and full IRCv3 protocol support. It installs as a progressive web app from any modern browser, so phones get a native-feel client without an app store. Multi-user support means one instance serves your whole team or community, each user with their own networks and history, and LDAP integration ties into existing authentication. A public mode alternatively serves as an open, registration-free web chat for events or support channels. MIT-licensed, born as a fork of Shout, and a fixture of self-hosting stacks since.

Grammar, punctuation, and style errors a dictionary lookup can't see: LanguageTool is open-source proofreading powered by a Java rule engine covering English, German, Spanish, French, Portuguese, Dutch, and 25+ other languages. Self-hosting the HTTP server is how you get Grammarly-class checking without sending every sentence you write to a third party - a real concern when the text being proofread is confidential email, legal drafts, or unreleased documentation. Your instance exposes the standard /v2/check API, so the official ecosystem plugs straight in: browser extensions for Chrome and Firefox accept a custom server URL, and integrations exist for VS Code, LibreOffice, Obsidian, Vim, Emacs, and many editors. Notably, self-hosting restores free browser-extension checking that the hosted service moved behind a premium subscription - your server, no character limits, no paywall. Detection quality is tunable: optional n-gram datasets (multi-gigabyte language models for en, de, es, fr, nl) teach the engine word-order and confusion-pair errors like there/their and brakes/breaks, and a fastText model improves automatic language identification. Everything runs offline once models are downloaded. The core is LGPL, the API is documented with Swagger, and rules are community- maintained and constantly expanding.

A recipe manager that feels like a consumer product rather than a homelab experiment: Mealie pairs a FastAPI backend with a reactive Vue frontend for the most polished self-hosted meal planning around. The killer feature is the recipe scraper: paste a URL from hundreds of supported cooking sites and Mealie imports the ingredients, steps, times, and photos automatically. Structured HTML/JSON paste, a Markdown-capable manual editor, and imports from other recipe apps (like Tandoor) cover everything else. Meal planning uses a drag-and-drop calendar with breakfast, lunch, dinner, and snack slots, plus rule-based random recipe insertion - constrain the pool by tags or categories per meal type or weekday. Shopping lists link recipes so all ingredients land in one place, organized into supermarket sections, and update in real time for everyone in the household. The multi-tenancy model is genuinely thought through: isolated Groups can host multiple tenants, and Households within a group share recipes and organizers while keeping meal plans and shopping lists private. Cookbooks group recipes by your own criteria, a cooking mode stays readable on a phone propped against the backsplash, and 35+ language translations ship built-in. A fully documented REST API and scheduled webhooks (e.g., today's meal plan to Home Assistant) make it automatable, with SQLite or PostgreSQL storage and automatic backups.

Forum software rebuilt on the modern web stack: NodeBB runs the classic bulletin-board format - categories, threads, local accounts - in real time, on Node.js over MongoDB, Redis, or PostgreSQL. WebSockets stream new posts into open topics as they're written and deliver instant notifications for follows, likes, and subscriptions; built-in chat supports side-by-side private conversations. The headline of recent versions is core ActivityPub federation: your forum can follow, share, and converse with other NodeBB instances, Mastodon, Lemmy, and anything else that speaks the protocol, turning an isolated community into a fediverse node. Everything beyond the common core is a plugin - more than 500 plugins and themes install in one click from the admin panel, covering SSO providers, search backends like Elasticsearch and Solr, galleries, calendars, and more. The theming engine extends base templates with SCSS/CSS on Bootstrap 5, plus a drag-and-drop widget system and custom HTML/CSS/JS injection. Operators get a real-time analytics dashboard, human-readable SEO-friendly URLs with semantic markup, multilingual UI, and full read and write REST APIs for integration. Mobile-first rendering means the same install works everywhere. For communities that outgrew phpBB but don't want Discourse's weight, NodeBB is the natural middle.

Private npm packages without shipping code to the public registry or paying for npm Enterprise: Verdaccio is the standard lightweight, zero-config private registry and caching proxy. It runs as a single Node.js process with its own tiny embedded database; no external database is required to start. Point npm, yarn, or pnpm at it and everything behaves as expected: install, publish, unpublish, dist-tags, and deprecation all work against the standard npm endpoints. The uplink system is where it earns its keep: packages not found locally are fetched from configured upstreams (npmjs.org, yarn, JFrog, Nexus, or another Verdaccio), cached as tarballs, and served locally thereafter - cutting CI latency and surviving registry outages. Multiple uplinks chain for failover, and per-package glob patterns in config.yaml route scopes to specific upstreams while controlling access, publish, and unpublish rights per group. You can even override a public package by publishing a patched version under the same name locally. A plugin architecture swaps in auth backends (htpasswd default, LDAP and others available), storage drivers (S3, Google Cloud Storage), middleware routes, and metadata filters. With official Docker images and a Kubernetes Helm chart, it slots into any pipeline in minutes.

The utilities engineers otherwise scatter across a dozen ad-laden websites - 80+ of them - live together in IT-Tools, one fast, polished web app. Crypto covers JWT decoding, MD5 through SHA-512 hashing, HMAC and bcrypt generation, RSA key pairs, and password strength analysis. Converters handle JSON to CSV, YAML, and TOML, Base64 files, URL encoding, HTML entities, color formats, and Docker run commands to Compose files. Generators produce UUIDv4, ULID, BIP39 mnemonics, QR codes (including Wi-Fi QR), and tokens; text tools include a regex tester, diff viewer, slug and case converters; web utilities parse URLs and user agents, look up HTTP status codes and MIME types, and inspect Open Graph metadata; plus a cron parser, chmod calculator, and more. The privacy argument is the point: JWTs contain user IDs, hashes derive from passwords, JSON dumps hold PII - exactly the inputs you least want a third-party utility site to log. IT-Tools is a frontend-only static bundle (Vue/TypeScript, GPL-3.0, 39k+ GitHub stars) served by Nginx in one container, so everything runs client-side on your infrastructure with nothing transmitted anywhere. New tools ship roughly monthly, and a scaffolding script makes adding custom ones straightforward.

Schema design with no account and a few clicks: drawDB is the browser-based entity-relationship diagram editor and SQL generator - an AGPL-3.0 React project with over 37,000 GitHub stars. Draw tables with columns, data types, defaults, and constraints; connect fields to create foreign-key relationships; group tables into labeled subject areas; and annotate with notes. When the design is ready, one export produces CREATE TABLE DDL - with constraints, indexes, and foreign keys - targeted at MySQL, PostgreSQL, SQLite, MariaDB, SQL Server, or Oracle. Diagrams can be database-specific, unlocking every native type plus dialect features like PostgreSQL enums and composite custom types, or generic for portability across all supported flavors. The reverse direction works too: paste existing DDL into the import dialog and drawDB renders your live schema as a navigable diagram - the fastest way to document an inherited database. Versioning and migration-script generation track schema evolution, full editor ergonomics (undo/redo, copy/paste, duplicate, themes) keep iteration fast, and diagrams export as PNG, SVG, or shareable JSON. Everything runs client-side against browser storage - no backend database connection needed - so the self-hosted Docker deployment is a featherweight static app that keeps proprietary schema designs entirely on your infrastructure.

No database anywhere in the stack: Grav, the leading flat-file CMS, builds every page from a folder of Markdown and YAML on PHP, Symfony components, Twig templating, and Doctrine caching. That architecture is the whole argument: content is Git-versionable, rsync-able, and lock-in-free; pages render in well under 100ms without database round-trips; and backup means copying a directory. Content authors write Markdown (or plain HTML), configure with readable YAML, and define custom page structures via blueprint files that generate editing forms automatically. The optional Admin panel adds a polished editing layer: dashboard with site activity, page management with a syntax-highlighted editor and live preview, drag-and-drop media uploads, one-click plugin/theme updates, and normal/expert modes for form-based or raw YAML editing. The ecosystem runs deep - hundreds of open-source plugins and themes installed through the GPM package manager, with an event-hook architecture that gives plugins full control over the request lifecycle, and downloadable skeletons providing entire pre-built sites. Grav 2.0 modernizes the stack (PHP 8.3+, Symfony 7, Twig 3) and adds a first-party REST API, an MCP server for AI agents, and a SvelteKit single-page admin with real-time collaborative editing. Ideal for docs, blogs, and marketing sites. MIT-licensed.

Machine translation with no Google, no Azure, no per-character billing, and no text leaving your infrastructure: LibreTranslate is a free, open-source translation API that runs entirely on your own server. The engine underneath is Argos Translate, which runs OpenNMT neural models with SentencePiece tokenization and Stanza sentence-boundary detection, all offline. Models install as portable .argosmodel packages covering dozens of languages - English, Spanish, French, German, Chinese, Japanese, Russian, Arabic, Hindi, Portuguese, and many more - and Argos handles automatic pivoting: with es-to-en and en-to-fr installed, it chains them to translate es-to-fr without a direct model. The API is a straightforward HTTP POST to /translate with source and target language codes, returning JSON - simple enough that the ecosystem has clients in every major language and integrations across tools like Weblate and Mastodon. Beyond plain text it translates HTML while preserving markup and handles whole file uploads (documents in, translated documents out), plus automatic language detection when the source is unknown. A clean bundled web UI serves interactive translation for end users, and optional API keys with rate limits control access. AGPL-licensed and trainable with custom models, it is the standard answer when translation must be private, unmetered, and self-contained - GDPR-sensitive text never touches a third party.

A personal Strava on your own server: Endurain is a self-hosted fitness platform that keeps your complete workout history, GPS routes, and health data out of a vendor's cloud. It ingests the standard device formats (.gpx, .tcx, and preferred .fit with full sensor data) via manual or bulk upload, and syncs directly with Strava and Garmin Connect so migrating years of history is straightforward - Garmin sync covers activities, gear, and body composition. The dashboard shows activity feeds with weekly and monthly statistics, routes on maps, and distance, speed, and training-volume trends over time, with definable goals that update automatically. Gear tracking is notably deep: log wetsuits, bicycles, shoes, racquets, skis, and snowboards, assign default gear per activity type, and track individual components like bike chains against replacement mileage. Multi-user support with admin and user roles, follower features, per-activity privacy settings, and configurable sign-up (email verification, admin approval) make it usable for clubs and coaches as well as individuals. Auth is serious for a fitness app: MFA TOTP, OIDC/SAML SSO, and email-based password resets via Apprise. The stack is Vue.js over a Python FastAPI backend with PostgreSQL, plus weight, steps, and sleep logging, imperial/metric units, multi-language support, and third-party app integration.

Google Workspace and Microsoft 365, replaced by a platform you actually control: Nextcloud is the self-hosted digital workspace. Files is the core: file storage and sync across desktop, mobile, and web clients, with sharing, versioning, and collaboration built in. Around it, Talk provides private text chat, audio/video conferencing with screen sharing, SIP integration, and persistent voice rooms; Groupware bundles calendar, contacts, and mail with delegation support; and Office offers two collaborative suites - the Collabora-based option with deep ODF support, and Euro-Office, whose local-processing architecture delivers strong Microsoft Office compatibility and fast browser rendering with reduced server load. The Nextcloud Assistant threads AI through the platform via a context-aware sidebar, Whiteboard covers visual collaboration, Flow handles automation, and an app ecosystem of hundreds of extensions adds everything from Kanban boards to end-to-end encryption. Hub 26 brings a lighter UI with a unified app switcher and Nextcloud Governance for organizations under strict regulatory requirements. This is the flagship of data sovereignty: your files, chats, calendars, and documents live on your server, under your jurisdiction, with GDPR compliance by architecture rather than by contract.