Gately keeps your domain names current, forwards ports, terminates HTTPS, and blocks hostile traffic from one admin console, so a server or home network needs no pile of separate gateway tools. Dynamic DNS updates records at Cloudflare, Alibaba Cloud, Tencent Cloud, DNSPod, Huawei Cloud, Route 53, OVHcloud, Gandi, Namecheap, DuckDNS, and other providers, finding the public address over IPv4 or IPv6 by URL, network interface, or command. Port forwarding relays TCP and UDP with port ranges, failover targets, connection limits, traffic statistics, and PROXY protocol, while SNI routing lets several services share port 443. Certificates are issued and renewed through ACME with DNS-01 wildcards or HTTP-01, then pushed to other hosts over SSH. Web services add per-domain reverse proxies, redirects, and static sites with HTTP/3, WebSocket, load balancing, health checks, rate limiting, caching, and sign-in through OIDC, GitHub, Google, or TOTP-protected shared users. A WAF running the OWASP Core Rule Set and fail2ban-style jails with trap ports and nftables bans guard the edge. Manage Docker containers and Compose projects with one-click upgrades and rollback, open SSH sessions with an SFTP file manager, run ping, traceroute, and speed tests, and receive alerts in Telegram, Discord, Slack, ntfy, or email. An audit log, config history with diff and rollback, encrypted backups, scoped API tokens, and Prometheus metrics round it out. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Google Browser Scraper is a self-hosted SERP API that gets Google results from a real Chrome browser and your own residential proxy, because plain HTTP scraping is refused and a fresh browser on a fresh IP is refused almost as fast. It warms a sticky proxy session with ordinary browsing first, lets the browser pass Google's checks, and then switches to a hybrid mode that fetches results pages directly over HTTPS with the browser's own cookies, at about 0.4 MB and 1.4 seconds per search on a warm IP. Every page comes back as SERP-style JSON with organic results, ads, related questions, related searches, pagination, the AI Overview, and local results. If a proxy IP starts serving poisoned pages for some other query, the scraper catches it within a few pages, drops that IP, and asks the query again on a fresh one. Captchas and blocks are reported as captchas and blocks, never disguised as an empty result set, so your pipeline knows when to retry or rotate. Run it as a CLI for keyword files, import it as a Python library, serve it as a local HTTP API, or expose the MCP server so AI agents get live Google search. Every run ends with a traffic and cost summary per thousand pages, and any sticky residential proxy works, with NodeMaven sessions handled for you. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Put one governed doorway in front of every service you run: Apache ShenYu is an API gateway that proxies, secures, and manages traffic for HTTP, Dubbo, gRPC, WebSocket, and MQTT backends from a single entry point. Every request flows through an ordered, hot-pluggable plugin chain, so you compose exactly the behavior each route needs instead of accepting a fixed gateway feature set. Selectors give you coarse, service-level routing and rules refine it down to individual methods, matched against headers, paths, and parameters. Authentication and edge security come from JWT, OAuth 2.0, request-signing, and WAF plugins, while rate limiting, circuit breaking, and load balancing protect fragile upstreams from traffic spikes. You reshape calls in flight with request, response, and parameter mapping, and convert protocols so a gRPC or Dubbo service answers ordinary HTTP clients. Newer releases add AI gateway plugins that proxy LLM calls with prompt processing, token limits, and sensitive-word filtering, plus an MCP server plugin for exposing tools to AI agents. The ShenYu Admin console on its own port manages plugins, selectors, rules, users, and permissions, then pushes changes live to every gateway replica over WebSocket, ZooKeeper, Nacos, etcd, or HTTP long polling. Metrics, tracing, and logging plugins stream operational data to Kafka or Elasticsearch, and client SDKs for Java, Go, Python, and .NET let services register themselves automatically. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Providing an intuitive control plane for modern reverse proxy infrastructure, CaddyUI enables system administrators to manage proxy hosts, automated TLS certificates, and traffic routing without hand-editing configuration files. Operators can create and adjust reverse proxy destinations, URL path rewrites, custom headers, and redirection rules using structured forms that validate against the proxy engine before saving. The platform coordinates automatic ACME certificate requests and renewals, displaying live certificate expiration timelines, validation stages, and internal self-signed certificate authority options for local network services. Fleet management tools synchronize proxy rules across multiple distributed server instances, preventing configuration drift across staging and production clusters. Automated post-deployment health checks verify upstream endpoint availability, HTTP status codes, and latency thresholds, instantly rolling back to the previous configuration if an expectation fails. An integrated observability suite delivers real-time visitor traffic analytics, geographic maps, HTTP response code breakdowns, and single-click client IP blocking to counter malicious probing attempts. Administrators can schedule automated database backups, configure multi-user access with role permissions, and integrate CrowdSec threat intelligence to protect backends. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Created to eliminate the configuration fragmentation plaguing multi-device Homelab setups and small-team infrastructures, NetsGo merges what typically requires three separate tools — a tunnel daemon, a management panel, and a monitoring stack — into a single Go binary that starts with one command and listens on one port. The server exposes HTTP, TCP, and UDP tunnels, a built-in Web console for node management, a REST API for automation, and real-time traffic statistics with per-client bandwidth limiting, all sharing default port 9527 so firewalls and reverse proxies need only a single rule. Version 0.1.11 introduced Client-to-Client P2P tunnels via WebRTC DataChannel with three selectable transport strategies — Server relay, Prefer P2P with automatic fallback, and P2P only — reducing latency for direct connections while maintaining the centralized control plane. The management console displays every connected client's online status, authentication tokens, tunnel configuration, active transport mode, P2P candidate gathering progress, and cumulative byte-level traffic counters updated every second. Unlike frp or rathole which delegate management to external plugins or configuration files, NetsGo provides built-in client key generation, tunnel target migration between nodes, SOCKS5 proxying, IP-whitelist console access, and one-command server upgrades. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

New API is a Go-powered LLM gateway that funnels over 40 AI providers, from OpenAI and Anthropic to Google Gemini, Azure, AWS Bedrock, DeepSeek, and Mistral, through a single OpenAI-compatible endpoint with intelligent routing and enterprise cost controls. Bidirectional format conversion translates between OpenAI Chat Completions, Claude Messages, and Gemini GenerateContent APIs transparently, so clients call any provider using their preferred format while the gateway handles the rest. Routing logic supports weighted random channel selection, priority-based failover, and automatic retry on provider errors to maximize uptime. The React admin dashboard shows usage charts, token consumption tracking, per-model cost breakdowns, and real-time request monitoring. Multi-tenant architecture includes three role levels, token-based authentication, per-user quota management, and a three-phase billing system with tiered pricing via a custom expression language. Multimodal support covers text completion, vision, embeddings, text-to-speech, speech-to-text, image generation, and creative task providers like Midjourney-Proxy and Suno-API. The interface ships in five languages including English, Chinese, Japanese, and French. Docker deployment runs with SQLite or MySQL for persistence. 45,000+ GitHub stars. AGPL-3.0 licensed.

Your scanner still emails PDFs, your backup scripts still send nightly reports, and none of them will ever learn OAuth 2.0: Email OAuth 2.0 Proxy learns it on their behalf. It listens on local IMAP, POP, and SMTP ports on your server, and when a client logs in the old-fashioned way with a username and password, the proxy swaps that exchange for a modern SASL XOAUTH2 token before the connection ever reaches the provider. The client never knows anything changed, so ancient mail apps, embedded devices, monitoring tools, and hand-rolled scripts keep sending and fetching mail through Outlook, Office 365, Gmail, Google Workspace, Fastmail, Yahoo, AOL, and any other provider that demands OAuth 2.0. The hop from your client to the proxy stays simple, while the proxy opens a fully encrypted TLS connection upstream, including STARTTLS negotiation for SMTP relays that require it. One proxy instance serves many accounts at once, with each mailbox mapped to its own local port and its tokens cached under a password you control. Optional plugins can even rewrite traffic in flight: strip Microsoft Defender Safe Links back to their real URLs, stop duplicate sent messages, or swallow test mail into a black hole. Setup is a single configuration file covering server ports, per-account scopes, and token endpoints, and the proxy then runs quietly as a headless service. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Authelia is the leading open-source SSO and multi-factor authentication server for self-hosted infrastructure. The Go backend compiles to a single binary or Docker container image, serving a TypeScript React web portal that handles first-factor username and password login, second-factor authentication via TOTP, WebAuthn FIDO2 security keys, passwordless passkeys, and Duo mobile push notifications, and an OpenID Connect 1.0 and OAuth 2.0 identity provider with device code flow, JWE encrypted ID tokens, custom claims policies, and network-scoped authorization criteria. The forward authentication model integrates with Nginx auth_request, Traefik ForwardAuth, HAProxy, Caddy, Envoy, SWAG, and Skipper reverse proxies, injecting Remote-User, Remote-Groups, and Remote-Email headers into authorized requests. Granular access control rules match subject, groups, request URI, HTTP method, and network to enforce one-factor and two-factor policies per route. The user backend supports LDAP with attribute mapping, connection pooling, and bind mode, or YAML file-based authentication with Argon2id hashed passwords. Session state stores in Redis for high availability across clustered deployments, while persistent data lives in SQLite, MySQL and MariaDB, or PostgreSQL. Brute force protection locks accounts after configurable failed attempts, and email-based identity verification handles password resets and device registration. Dark, light, and OLED themes with i18n localization customize the portal appearance. On RepoCloud, deploy Authelia on a dedicated VPS with Docker, root SSH access, and complete control over your authentication infrastructure, all under the Apache-2.0 license.

Your AI coding agent has your API keys in its environment and unrestricted network access, which means one prompt injection away from sending those secrets anywhere. Pipelock closes that gap by sitting as a proxy between your agents and every outbound connection, scanning the actual content of HTTP, WebSocket, MCP, and Agent-to-Agent traffic before it leaves your server. An 11-layer scanner pipeline checks every request against 62 credential patterns covering AWS, GCP, Azure, GitHub, OpenAI, Anthropic, SSH keys, and database URLs, then inspects every response for prompt injection using 29 detection patterns with six-pass normalization that catches base64-encoded, leetspeak, and whitespace-obfuscated payloads. The MCP proxy wraps any Model Context Protocol server (stdio, HTTP, or WebSocket) with bidirectional scanning that detects tool description poisoning and mid-session rug-pull changes via SHA-256 fingerprinting. Every scanning decision produces a cryptographically signed action receipt that third parties can verify offline without trusting the agent or the vendor. The Operator Console provides a web dashboard for reviewing evidence scorecards, receipt timelines, agent sessions, enforcement decisions, and fleet posture at a glance. Cross-request taint tracking catches slow-drip exfiltration attempts that spread a secret across multiple calls. Canary tokens plant synthetic secrets that trip alerts the moment an agent tries to exfiltrate them. Pre-built Prometheus metrics and a Grafana dashboard provide real-time visibility into traffic volumes and block rates. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

BitRouter is a context-aware LLM router that learns which model delivers the cheapest successful outcome per workflow step, cutting agent costs by up to 80% while maintaining 96% quality versus all-frontier baselines. Point any agent runtime at http://localhost:4356 with a one-line OPENAI_BASE_URL change and BitRouter routes to OpenAI, Anthropic, Google, Groq, DeepSeek, Mistral, Moonshot, MiniMax, Nvidia, and any OpenAI-compatible endpoint simultaneously, normalizing authentication, streaming, and cross-protocol translation between wire formats. The act-observe-evaluate-learn loop traces every hop with cost, tokens, and latency attribution, scores each decision against a versioned policy-lock.yaml, then tightens routes automatically with no LLM judge in the path. Native MCP gateway auto-discovers tools from connected servers and makes them routable and governed alongside model calls. Agent Client Protocol integration enables the TUI to manage Claude Code, Codex, OpenCode, OpenClaw, Gemini, and Copilot sessions in real time with inline tool-call approval and live streaming. Built-in guardrails inspect, redact, or block risky content before requests leave your network. Virtual keys scope API access per agent or user without exposing upstream credentials. Per-agent spend caps and loop guards contain runaway cost automatically. Multi-account failover reroutes mid-run so rate limits never re-pay completed work. Ships as a single Rust binary via npm or Cargo. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Inference Gateway puts a single OpenAI-compatible API endpoint in front of OpenAI, Anthropic, Groq, Cohere, Ollama, DeepSeek, Google, Mistral, MiniMax, Moonshot, Nvidia, and llama.cpp, so your application code never changes when you switch models or providers. The Go binary starts on port 8080 and normalizes authentication, streaming protocols, and response formats across all backends transparently. Native Model Context Protocol support auto-discovers tools from connected MCP servers and injects them into LLM requests without client-side management, enabling server-side tool execution across any provider that supports function calling. Agent-to-Agent protocol integration allows distributed agent communication through a declarative Agent Definition Language that generates production-ready Go or Rust servers from a single YAML manifest. The dedicated Kubernetes Operator manages Gateway, Agent, MCP, and Orchestrator custom resources with automatic HPA scaling, OIDC authentication, and service discovery that rebuilds MCP configurations when the discovered server set changes. Prometheus metrics and OpenTelemetry tracing provide full request-level observability across the entire inference pipeline. Middleware controls enable per-request provider selection, model routing, and fallback strategies. Official SDKs in Go, Python, TypeScript, and Rust provide typed client interfaces with streaming support. Docker Compose deployment requires only environment variables for API keys. A CNCF Sandbox applicant. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Meridian puts all of your Emby reverse proxy sites, playback routes, and day to day operations into one clean management panel instead of a pile of hand-written proxy configs. Each Emby site gets its own entry through a path, a dedicated port, or a subdomain, with primary and backup routes that switch automatically when one goes down. Three playback modes let video stream directly to clients while logins, posters, and API calls continue through the proxy, so bandwidth lands where it should. Accounts for each site are stored with passwords and expiry dates, renewal reminders arrive ahead of time, and account details can be imported or exported as JSON and CSV. Traffic trends, per-site quotas, rate limits, and static resource caching keep busy sites under control, while log filtering and connection diagnostics show exactly where a request went wrong. Certificates are handled through Cloudflare wildcard issuance and renewal, or by uploading your own, and encrypted backups protect the whole configuration. Routine administration can even happen from Telegram, checking daily reports, adding or pausing sites, and renewing accounts from chat. The whole panel runs as one small program with a built-in database and works comfortably from a phone. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Anyone who pays for Claude Code, Codex, and Gemini CLI separately ends up juggling three endpoints, three sets of keys, and three kinds of rate-limit surprise, and CliRelay collapses all of that into one self-hosted gateway with a control panel. Clients speak the OpenAI Chat or Responses, Anthropic Messages, or Gemini protocol, and CliRelay translates each request for whichever upstream account is healthy. Channel groups limit where each key may send traffic, round-robin, fill-first, and session-sticky scheduling spread it, and cooldowns with automatic failover move requests off accounts that have run out of quota. Add upstreams from the /manage console through browser sign-in, device codes, or bulk credential import, covering Claude, Codex, Gemini, Antigravity, Vertex AI, AWS Bedrock, Grok, Qwen, Kimi, and any OpenAI-compatible service. Portal accounts own client keys with daily, period, and lifetime quotas, RPM and TPM limits, and per-model pricing. A monitor center scores health and charts live traffic, P50 to P99 latency, and time to first token, while every request lands in a searchable log with tokens, latency, and cost. Tenants, roles with resource.action permissions, content moderation profiles, an outbound proxy pool, and an audit trail make shared deployments workable, and the console speaks English, Simplified Chinese, and Russian. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

zrok puts services that live behind NAT and firewalls onto the public internet with a shareable URL, without opening a single inbound port. The machine being shared dials out to an OpenZiti overlay network, so a web app on your desk, a Raspberry Pi at home, or a staging box inside a corporate network becomes reachable through your instance while its firewall stays closed. One command shares an HTTP service publicly; add a name from one of your namespaces and the URL stays stable even when you move the backend to a different machine, and an ephemeral name can be promoted to a reserved one when a quick demo turns into a keeper. Private shares skip the public internet entirely and reach only the users you grant, including raw TCP and UDP services, while web and drive backend modes publish static sites or whole folders, with OAuth, password auth, and an interstitial warning page available on public shares. The long-running agent keeps every share and access under one process, restarts the named ones after a reboot, and offers a localhost console for point-and-click sharing; the account-wide web console maps your environments, shares, and accesses as a navigable graph or a sortable table with live activity. Operators get invite-based accounts, InfluxDB-backed usage metrics, and configurable limits that warn or cut off accounts that exceed their quotas. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Routerly is the one front door for every AI model your apps use: point your OpenAI or Anthropic client at it, and it chooses the right model for each request, enforces your budget, and keeps the receipts. Nothing in your code changes except the base URL, and from that moment streaming chat completions and messages flow to OpenAI, Anthropic, Gemini, Mistral, Cohere, xAI or your own Ollama models behind a single token. Nine routing policies score every candidate in parallel: cheapest, fastest, healthiest, most capable, biggest context, least rate-limited, fairest, most budget left, and one that asks a small model to judge which model fits the task. When the winner errors or times out, the next candidate takes over automatically, and the recorded routing trace shows exactly why each model won or lost. Guardrails can block or log content that breaks your rules, and phone numbers, card numbers, SSNs, IBANs and emails can be scrubbed out before anything reaches a provider. Every call is logged with tokens, USD cost and latency, and hard limits per model, project and token reject overspending requests before a provider can charge for them. Projects keep separate tokens, model lists and budgets for each team or tool, role-based permissions decide who may change what, and alerts land in Slack, email, webhooks or PagerDuty when budgets or providers misbehave. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Rustunnel turns a service running on your laptop or private network into a public HTTPS, TCP, or UDP endpoint without opening inbound ports on the machine where it lives. Point the client at a local port and share the public address for webhook testing, a quick demo, an AI agent tool, SSH access, a game server, or an IoT device that cannot accept inbound connections. Give tunnels custom subdomains on your own wildcard domain, terminate HTTPS with automatic Let's Encrypt certificates, and keep client traffic encrypted from edge to local service. Put several backends behind one subdomain or TCP port and let TCP or HTTP health probes remove sick members before visitors hit them. When two peers can reach each other directly, start a P2P tunnel with NAT hole punching and QUIC, with relay fallback when the direct path fails. Watch sessions, tunnel health, traffic, and request logs from the live dashboard, inspect headers and bodies in the local request inspector, and replay a captured call while debugging a webhook. Manage tunnels, tokens, groups, captured requests, and history through the REST API, scrape Prometheus metrics, review audit logs, or let an MCP-compatible coding assistant create and close tunnels in plain language. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

TLSPROXY puts automatic Let's Encrypt TLS in front of every service on your server, so many names can share one port while each backend gets exactly the encryption treatment it needs. Terminate TLS and hand plain text to a local service. Pass raw TLS straight through when the proxy should see nothing. Or terminate and re-encrypt towards a TLS backend, with client certificates checked on the way in. QUIC and HTTP/3 connections terminate here too, and Encrypted Client Hello keeps even the handshake private. Certificates arrive and renew by themselves through http-01 and tls-alpn-01 challenges, PROXY protocol headers preserve real client addresses, and SNI routing with round-robin balancing spreads names across backends. People get in with OpenID Connect, SAML, or passkeys; the same sign-in can mint short-lived SSH user certificates, and built-in certificate authorities manage client and backend credentials for you. Static sites can be served straight from disk, TPM-backed keys keep private material in hardware, and a built-in console shows what the proxy is doing. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

KrakenD processes over 18,000 requests per second on a single instance while consuming under 50MB of RAM at 1,000 concurrent connections, operating as a stateless API gateway that requires no database whatsoever. The Community Edition has earned over 2,600 GitHub stars by outperforming database-dependent alternatives like Kong and Tyk in independent benchmarks. Written entirely in Go, it uses declarative JSON or YAML configuration files that integrate directly into GitOps workflows for version-controlled infrastructure management. The gateway aggregates responses from multiple backend services into a single API call, transforms request and response payloads with field filtering, grouping, and mapping, and applies zero-trust security policies including JWT validation, OAuth 2.0, CORS, HSTS, clickjacking protection, and XSS prevention. Traffic management features include multi-layer rate limiting at both the router and proxy levels, circuit breakers for backend fault isolation, spike arrest policies, and concurrent call support that requests the same data from multiple backends in parallel for improved response times. Telemetry integrates with OpenTelemetry, Prometheus, Grafana dashboards, Datadog, Zipkin, and Jaeger for distributed tracing and metrics collection. The gateway extends through Go plugins, Lua scripting, Martian modifiers, and Google CEL expressions for custom request processing logic. AI workload routing supports OpenAI, Anthropic, Gemini, and other model endpoints with built-in fallback, retries, and load balancing. Deploy via Docker with the devopsfaith/krakend image as a single binary. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.