Adobe Acrobat and Smallpdf, answered by a self-hosted Java web application: Stirling PDF processes every file with its 60+ tools on your own server and deletes it after the task completes. Nothing is uploaded to a third party, which is the whole point for contracts, invoices, and medical records. The toolbox covers page operations (merge, split at page numbers or scanned dividers, rotate, reorder, crop, extract), conversion in both directions between PDF and Word, Excel, PowerPoint, images, HTML, and Markdown, OCR that turns scans into searchable PDFs via Tesseract/OCRmyPDF (including PDF/A archival conversion), and security tools for passwords, permissions, watermarks, signatures, and true UI-driven text redaction. A built-in viewer handles annotation, drawing, and text or image insertion, and V2 added stateful processing - upload once, chain multiple tools - plus undo/redo history. For automation, nearly every tool has a REST API endpoint, no-code pipelines combine operations into custom logic chains, and watched folders process files automatically. Enterprise deployments get SSO, user management, and audit logging; the interface ships in 40+ languages. With 84K+ GitHub stars it is the most popular PDF tool in self-hosting, replacing $20/month Acrobat subscriptions with flat infrastructure cost.

One clean interface in front of Anthropic, OpenAI, Google Gemini, Cohere, and more: Chat Chat is a Next.js front door to the major AI providers, ending the juggling of separate subscriptions, tabs, and UIs per model. Bring your own API keys, pick a provider and model per conversation, and switch between them as the task demands: Claude for long-form reasoning, GPT for code, Gemini for multimodal work - the interface stays identical. Beyond configured presets, custom providers plug in with their own API endpoints and keys, which covers OpenAI-compatible gateways and local inference servers. The design splits into two dedicated modes: a chat interface for conversational work with customizable system prompts, and a search interface that pairs AI processing with query handling for research-style questions. The stack is modern and hackable - Next.js 14, Tailwind CSS, shadcn/ui on Radix primitives, Jotai for state - with full internationalization including English, Chinese, and Japanese. Self-hosting means your conversation history and API keys live on your instance rather than a third-party wrapper service, and pay-per-token API pricing typically beats stacking multiple monthly chat subscriptions. AGPL-licensed and deliberately simple to deploy: one container, environment variables for keys, done.

Machine translation with no Google, no Azure, no per-character billing, and no text leaving your infrastructure: LibreTranslate is a free, open-source translation API that runs entirely on your own server. The engine underneath is Argos Translate, which runs OpenNMT neural models with SentencePiece tokenization and Stanza sentence-boundary detection, all offline. Models install as portable .argosmodel packages covering dozens of languages - English, Spanish, French, German, Chinese, Japanese, Russian, Arabic, Hindi, Portuguese, and many more - and Argos handles automatic pivoting: with es-to-en and en-to-fr installed, it chains them to translate es-to-fr without a direct model. The API is a straightforward HTTP POST to /translate with source and target language codes, returning JSON - simple enough that the ecosystem has clients in every major language and integrations across tools like Weblate and Mastodon. Beyond plain text it translates HTML while preserving markup and handles whole file uploads (documents in, translated documents out), plus automatic language detection when the source is unknown. A clean bundled web UI serves interactive translation for end users, and optional API keys with rate limits control access. AGPL-licensed and trainable with custom models, it is the standard answer when translation must be private, unmetered, and self-contained - GDPR-sensitive text never touches a third party.

Every line an indentable bullet, every bullet a first-class block that can be referenced, embedded, and queried anywhere: Logseq is a privacy-first, local-first knowledge platform built around the block outliner. The daily journal is the system's beating heart - each day opens a fresh date-stamped page where tasks, meeting notes, and fleeting ideas land as blocks without filing decisions, then connect later through [[wikilinks]] with automatic bidirectional backlinks and ((block references)) that transclude any bullet into any page. Everything persists as plain Markdown or Org-mode files on disk - git-friendly, greppable, and owned forever, with sync via iCloud, Dropbox, Syncthing, Git, or an optional end-to-end encrypted service. Built-in tooling goes beyond notes: TODO/DOING task states with scheduling, native PDF annotation with area highlights, spaced-repetition flashcards, whiteboards for visual thinking, Zotero integration for researchers, and Datalog-powered queries that build dynamic views across the entire graph. A marketplace of hundreds of community plugins and themes adds AI chat, Ollama local-model integration, and custom workflows. Written in Clojure/ClojureScript, AGPL-3.0 licensed with 320+ contributors, and completely free - the local-first Roam for people who refuse subscriptions and lock-in.

API keys hardcoded in repos, database passwords pasted into CI variables, .env files emailed between developers - Infisical, the open-source platform for secrets, certificates, and privileged access management, is the answer to all three. Secrets live in versioned stores scoped by project, environment, and path, with fine-grained identity-aware access control and full audit logging on every read and change. Delivery covers every consumption pattern: CLI injection into local dev, SDKs for Go, Node.js, and Python, an HTTP API, agents, a Kubernetes Operator, and secret syncs that push to GitHub, GitLab, AWS Secrets Manager, and Vercel. Automatic rotation replaces credentials for PostgreSQL, MySQL, MSSQL, LDAP, AWS IAM, and Azure on a rolling schedule - new credentials issue while old ones stay temporarily valid, so nothing breaks mid-rotation. Dynamic secrets go further, generating ephemeral, time-bound database credentials on demand, and SSH access replaces static keys with short-lived CA-signed certificates that expire automatically. Secrets scanning catches hardcoded credentials in code and pipelines, certificate management automates X.509 issuance and renewal, and a built-in KMS handles encrypt/decrypt with central key control. Self-hosting keeps the keys to everything else on your own infrastructure.

Over 400 technologies and thousands of smart devices from any manufacturer, unified under one roof: openHAB is the vendor-neutral home automation platform with a pluggable binding architecture. Each binding translates a device or service into openHAB's clean abstraction: Things expose Channels, Channels link to Items, and Items feed a rules engine that runs your home. That engine meets you at your skill level: Blockly gives non-programmers drag-and-drop visual logic, JS Scripting (GraalJS with the openhab-js library) is the modern text-based standard, the classic Rules DSL remains supported, and JSR223 opens the door to Python, Ruby, and Groovy. Time- and event-based triggers, scripts, notifications, and voice control compose into automations of any complexity, and users report decade-old rule sets still running rock solid. The Main UI handles configuration, semantic modeling, and now built-in charting - no external Grafana required. Built in Java on Apache Karaf's OSGi runtime and stewarded by the non-profit openHAB Foundation, it requires no cloud to function: everything runs locally, talking directly to your devices. Optional connectors bridge to Alexa, Google Assistant, and HomeKit, with iOS, Android, and web apps for control from anywhere.

Browse trending titles, search anything, request it in two clicks: Jellyseerr gives Jellyfin, Emby, and Plex users a beautiful storefront for the media library. Born as the Overseerr fork that added Jellyfin and Emby support (the projects have since unified as Seerr), it handles the full request lifecycle - users authenticate with their existing media-server accounts, pick individual seasons or movies in a clean interface, and admins approve or decline from a simple queue, including on mobile. Approved requests flow straight to Sonarr and Radarr, which handle acquisition automatically, with support for separate 4K server instances. Regular library scans keep availability accurate, so users see instantly what already exists instead of requesting duplicates. A granular permission system controls who can request what - auto-approval for trusted users, quotas and limits elsewhere - and override rules adjust request routing by user, tag, or other conditions. Watchlist and blocklist functions curate discovery, notifications reach email, Discord, Telegram, Slack, Pushover, and Pushbullet, and both PostgreSQL and SQLite are supported. Localized into many languages, it turns "can you add this movie?" texts into a self-service system that runs itself.

Matrix's flagship client, built by the protocol's creators: Element brings the decentralized open standard for real-time communication to web, desktop, iOS, and Android. Paired with a Matrix homeserver, it delivers Slack-quality team messaging where you own every message, file, encryption key, and byte of metadata. End-to-end encryption is on by default, built on Olm and Megolm - the Double Ratchet algorithm family Signal popularized, extended for large-room scalability and publicly audited by NCC Group. Messages encrypt per-device with cross-signed device verification, so even a compromised server yields nothing readable. Federation is the defining capability: like email, users on different homeservers converse seamlessly, and 30+ bridges connect Matrix rooms to Slack, Discord, WhatsApp, and Telegram, so moving to sovereign infrastructure doesn't sever contact with anyone. Rooms support threads, reactions, file sharing, and voice and video calls via Element Call. The result is digital sovereignty chosen by governments and enterprises across Europe: your data sits on your server in your jurisdiction, portable to any other Matrix host because the protocol is an open standard. Apache-2.0 licensed, with no per-user fees at any scale.

Images, text, audio, video, HTML, PDFs, and time series, labeled in one tool with a standardized output format: Label Studio is the open-source data labeling platform for building training datasets. Computer vision tasks cover classification, object detection (boxes, polygons, ellipses, keypoints), and semantic segmentation; audio work spans transcription, speaker diarization, and emotion recognition; NLP handles named entity recognition and document classification with taxonomies up to 10,000 classes; and GenAI workflows support LLM fine-tuning data and RLHF response ranking. Labeling interfaces are fully configurable with an XML-like templating language, so the UI matches the task instead of the reverse. The ML backend SDK turns any model into a connected web server for pre-annotation (model predicts, humans verify), interactive labeling (real-time predictions as annotators draw regions or highlight text), and model evaluation - cutting annotation time dramatically on large datasets. Data imports from S3, GCS, or file uploads; the Data Manager filters and explores tasks; exports convert to the format your ML library expects via label-studio-converter. Multi-user accounts tie every annotation to its author, and webhooks, a Python SDK, and REST API embed labeling into any pipeline. Self-hosting keeps proprietary training data - often a company's most sensitive asset - entirely on your infrastructure.

Two decades of continuous development made Roundcube the standard-bearer of open-source webmail - a PHP IMAP client that gives any mail server a polished, application-like interface in the browser. It connects to whatever IMAP/SMTP stack you run - Dovecot, Postfix, a hosted mailbox - and delivers the full desktop-client experience: drag-and-drop message management, threaded conversation views, full MIME and HTML mail handling, find-as-you-type address book with groups and LDAP connectors, multiple sender identities, full-text search, and spell checking in dozens of languages. The default Elastic skin is genuinely responsive, working as well on a phone as a desktop, and the entire UI is skinnable. The plugin API is where deployments get shaped: managesieve exposes server-side filter management in the UI, enigma brings PGP encryption and signing via GnuPG, markasjunk trains spam filters, zipdownload batches attachments, password lets users change credentials, and attachment_reminder catches the classic forgotten-attachment email - among hundreds of community plugins. Built-in caching keeps large mailboxes fast, IMAP ACLs and shared folders support team setups, and XSS protection is engineered into the rendering pipeline. It scales from a single personal mailbox to unlimited users, backed by MySQL, MariaDB, PostgreSQL, or SQLite. GPL-licensed with regular security releases.

Web analytics tools ignore native mobile, desktop, and game apps; Aptabase was built for exactly those. If Firebase Analytics would force a privacy-policy footnote you don't want to write, this is the alternative - session-based metrics with no cookies, no IDFA or GAID, no device fingerprinting, and a daily-rotated salt that makes cross-day re-identification mathematically impossible. That design means GDPR, CCPA, and PECR compliance out of the box and "Data Not Collected" App Store privacy labels without ATT prompts. The SDK coverage is the widest in its category: eleven first-party libraries spanning Swift, Kotlin, Flutter, React Native, Tauri, Electron, .NET MAUI, NativeScript, Unity, Unreal Engine, and JavaScript for web - each MIT-licensed, following platform conventions, and accepting a custom host parameter that points at your instance. Integration is minutes: initialize with an app key, call trackEvent with optional properties, and the dashboard shows sessions, events, app versions, OS breakdowns, and country-level geography. The self-hosted stack is a .NET server over PostgreSQL for metadata and ClickHouse for high-volume event ingestion, giving cloud-parity features under an AGPL license. For indie iOS/Android apps, Electron and Tauri tools, and Unity or Unreal games, it replaces Firebase without the Google entanglement.

Inspect a PostgreSQL database right now, without installing pgAdmin or exposing Postgres to the internet - pgweb answers that recurring need. It's a Go application from Dan Sosedoff, a decade in development, shipped as a single statically-linked binary with zero dependencies - the Docker image is essentially just the executable - that puts a clean browser UI in front of any PostgreSQL 9.1+ server. Connect via URL string or host/port credentials, and browse tables, views, and sequences from the sidebar; selecting a table shows its rows immediately alongside tabs for structure, indexes, and constraints. The Query tab executes arbitrary SQL with query history, and the Explain Query button renders the query plan - estimated cost, row counts, execution strategy - which makes pgweb a quick performance-triage tool, not just a browser. Results and entire tables export to CSV, JSON, or XML in a click. Connectivity is more flexible than its size suggests: native SSH tunneling (password or key) reaches databases behind firewalls, server bookmarks make switching instances instant, and an optional multi-session mode handles several databases concurrently. For a RepoCloud stack full of Postgres-backed apps, one pgweb instance is the universal inspection hatch. MIT-licensed, actively maintained.

With over 45,000 GitHub stars and 100 million Docker pulls, Milvus is the most widely adopted open-source vector database, powering production AI systems at NVIDIA, Salesforce, eBay, Airbnb, and DoorDash. The distributed architecture separates compute and storage with stateless microservices on Kubernetes, horizontally scaling query nodes for read-heavy workloads and data nodes for write-heavy ingestion independently. Milvus 3.0 introduces lake-native retrieval that builds and serves indexes directly over vector data in object storage and open formats including Parquet, Lance, Iceberg, and Vortex without maintaining separate copies. Native hybrid search unifies lexical BM25 full-text retrieval and semantic vector search in a single engine with metadata filtering, eliminating the need for separate search infrastructure. Hardware-accelerated ANN indexing supports IVF, HNSW, DiskANN, and GPU-based indexes with BitQ 1-bit quantization cutting memory usage by 72 percent. SDKs for Python, Go, Node.js, and Java provide programmatic access, while Milvus Lite offers lightweight embedding for local development via pip install. Server-side aggregation, sorting, faceted search, StructArray for nested document structures, and ColBERT multi-vector scoring move ranking and result processing into the engine. The Path Index enables 100x faster JSON filtering with support for 100,000+ collections per cluster for multi-tenant deployments. Self-hosting deploys via Docker Standalone or Kubernetes with Helm charts using S3-compatible, GCS, or Azure Blob storage backends. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

A personal Strava on your own server: Endurain is a self-hosted fitness platform that keeps your complete workout history, GPS routes, and health data out of a vendor's cloud. It ingests the standard device formats (.gpx, .tcx, and preferred .fit with full sensor data) via manual or bulk upload, and syncs directly with Strava and Garmin Connect so migrating years of history is straightforward - Garmin sync covers activities, gear, and body composition. The dashboard shows activity feeds with weekly and monthly statistics, routes on maps, and distance, speed, and training-volume trends over time, with definable goals that update automatically. Gear tracking is notably deep: log wetsuits, bicycles, shoes, racquets, skis, and snowboards, assign default gear per activity type, and track individual components like bike chains against replacement mileage. Multi-user support with admin and user roles, follower features, per-activity privacy settings, and configurable sign-up (email verification, admin approval) make it usable for clubs and coaches as well as individuals. Auth is serious for a fitness app: MFA TOTP, OIDC/SAML SSO, and email-based password resets via Apprise. The stack is Vue.js over a Python FastAPI backend with PostgreSQL, plus weight, steps, and sleep logging, imperial/metric units, multi-language support, and third-party app integration.

Google Workspace and Microsoft 365, replaced by a platform you actually control: Nextcloud is the self-hosted digital workspace. Files is the core: file storage and sync across desktop, mobile, and web clients, with sharing, versioning, and collaboration built in. Around it, Talk provides private text chat, audio/video conferencing with screen sharing, SIP integration, and persistent voice rooms; Groupware bundles calendar, contacts, and mail with delegation support; and Office offers two collaborative suites - the Collabora-based option with deep ODF support, and Euro-Office, whose local-processing architecture delivers strong Microsoft Office compatibility and fast browser rendering with reduced server load. The Nextcloud Assistant threads AI through the platform via a context-aware sidebar, Whiteboard covers visual collaboration, Flow handles automation, and an app ecosystem of hundreds of extensions adds everything from Kanban boards to end-to-end encryption. Hub 26 brings a lighter UI with a unified app switcher and Nextcloud Governance for organizations under strict regulatory requirements. This is the flagship of data sovereignty: your files, chats, calendars, and documents live on your server, under your jurisdiction, with GDPR compliance by architecture rather than by contract.

"As simple as Trello but as feature-rich as Jira" is how the Leantime team frames its goals-focused project management system for non-project managers - built from the ground up with ADHD, autism, and dyslexia in mind, with behavioral science shaping customizable dashboards, time blocking, low-cognitive-load prioritization, and Kanban, list, table, Gantt, and calendar views so each person works the way their brain does. The PHP application (AGPL, Laravel Blade frontend) connects strategy to execution: tasks with unlimited subtasks and dependencies roll up into milestones on a timeline, sprints and retrospectives handle iteration, and strategy-level blueprint boards - Lean Canvas, SWOT, risk analysis, goal and metric tracking - keep the "why" attached to the work. Knowledge lives alongside: wikis and docs, idea boards, comments on everything, file storage on S3 or local disk, even screen and webcam recording. Time tracking with timesheets supports estimation and client billing. Admin features are serious for an OSS tool: per-project permissions, two-factor auth, LDAP and OIDC single sign-on, Slack, Mattermost, and Discord integrations, a plugin system, and an expanding API that now powers a mobile app. Recent releases added multi-collaborator task assignment and low-vision accessibility improvements. Available in 20+ languages.

Half the architecture sketches on the internet trace back to Excalidraw - the MIT-licensed virtual whiteboard whose hand-drawn aesthetic made technical diagramming feel approachable, at roughly 85,000 GitHub stars. The infinite canvas offers rectangles, ellipses, diamonds, arrows with smart binding and labels, free-draw, text, images, and an eraser, with full undo/redo, zoom, dark mode, and keyboard-first ergonomics. Community shape libraries add thousands of pre-built elements - AWS architecture icons, flowchart stencils, UI wireframe kits - and everything exports to PNG, SVG, the clipboard, or the open .excalidraw JSON format that keeps drawings diffable and portable. Live collaboration works on a share-a-link model with live cursors and a laser pointer for presenting, and it is end-to-end encrypted by design: the room key travels in the URL hash, which never reaches the server, so the WebSocket relay only ever sees ciphertext. The architecture is remarkably light - the app is a static bundle served by Nginx, drawings persist locally in the browser, and the stateless excalidraw-room relay handles multiplayer - so a self-hosted deployment gives unlimited boards and collaborators with near-zero resource cost, replacing per-editor whiteboard subscriptions.

The fediverse's answer to YouTube comes from French non-profit Framasoft: PeerTube is a TypeScript/Angular video platform where hundreds of independently operated instances federate over ActivityPub into one network. Videos you publish are discoverable across the whole video fediverse, and viewers can follow your channels from Mastodon or any ActivityPub platform - or plain RSS - without needing an account on your instance. The namesake innovation attacks video hosting's core cost problem: alongside HLS delivery, an optional WebRTC-based P2P layer lets concurrent viewers' browsers share video segments with each other, so a video going viral distributes its own bandwidth demand instead of crushing your server; instance redundancy extends this by letting friendly instances cache each other's videos. Livestreaming is first-class - stream via OBS or any RTMP software, host permanent streams, enable replays, and interact through live chat. Creators get channels, playlists, analytics, built-in video editing (trim, watermark), and an embeddable player for any website. There are no ads, no data mining, and no recommendation algorithm engineered for watch-time - the project's explicit design stance. Admins control federation policy, P2P settings, and theming; a plugin system extends the rest. AGPL-licensed, 300+ contributors, in active development since 2015.