Stateful serverless actors that run indefinitely, sleep when idle, and persist state across restarts without external database round trips. Rivet provides a vendor-neutral alternative to Cloudflare Durable Objects, delivering long-running processes with co-located in-memory state and per-actor SQLite databases on any infrastructure you choose. The Rust engine comprises four packages: Pegboard for actor orchestration, Gasoline for durable execution, Guard for traffic routing via Envoy, and Epoxy implementing multi-region KV storage through EPaxos consensus. Each actor maintains instant-access in-memory state plus a dedicated SQLite database for relational queries, backed by RocksDB on single nodes or PostgreSQL with NATS pub/sub for multi-node clusters. RivetKit SDKs in TypeScript, Rust, and Python support built-in WebSocket connections, task queues, scheduling, and CRDT-based real-time collaboration. The v2.3 rewrite moved the core runtime from JavaScript to native Rust via WebAssembly, eliminating main-thread blocking across Node.js, Bun, Deno, and Cloudflare Workers. A built-in dashboard provides actor inspection with real-time Prometheus metrics. Deploys as a single Docker container on port 6420 with optional PostgreSQL for persistence. Available on RepoCloud with a dedicated VPS under the Apache 2.0 license.

Instead of scattering provider credentials and vendor-specific SDK logic across dozens of microservices, engineering teams route every LLM call through GoModel, an open-source AI gateway that unifies 34 model providers behind OpenAI-compatible and Anthropic-compatible endpoints. Pointing existing OpenAI or Anthropic SDKs at the gateway unlocks chat completions, the Responses API, Anthropic Messages, embeddings, batch jobs, and realtime audio across OpenAI, Anthropic, Gemini, Bedrock, Azure, Groq, DeepSeek, Ollama, and vLLM. Platform operators publish virtual model aliases that distribute traffic via weighted round-robin or lowest-cost routing while rotating multiple API keys per provider and failing over through circuit breakers during upstream outages. Sticky session routing keeps multi-turn agent conversations on the same target to preserve warm prompt caches, while exact-match and vector semantic caching via Qdrant, pgvector, Pinecone, or Weaviate cut duplicate token costs. Versioned workflows and pre-dispatch guardrails enforce prompt injection rules, rate limits, and hard USD spend budgets across hierarchical tenant user paths before requests are dispatched. The built-in admin dashboard offers live audit logs, per-tenant cost analytics, LiteLLM key migration, an interactive request playground, Model Context Protocol tool aggregation, and OpenTelemetry and Prometheus metrics. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

One OpenAI-compatible endpoint, 1,600+ models behind it: Portkey Gateway sits between your app and every major LLM provider, deciding in real time where each request should go. When a provider times out or returns errors, automatic retries with exponential backoff kick in, and fallback rules quietly move traffic to your second-choice model before users notice anything. Load balancing spreads calls across multiple API keys and providers by weight, conditional routing sends each request down a different path based on its content or metadata, and per-request timeouts cut off providers that hang. Guardrails inspect inputs and outputs as traffic passes through: block banned words, screen for sensitive content, and enforce the checks your compliance team asked for, with dozens of pre-built rules ready to attach. Text is only the start: the same API shape reaches vision models, speech-to-text, text-to-speech, image generation, and realtime websocket APIs, so multimodal features stop multiplying your integration work. Routing policies live in JSON configs you attach per request or per client, which means experiments, cost controls, and provider migrations ship as configuration changes, not redeploys. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Open Compute is a self-hosted Cloudflare Workers-compatible platform that runs your Workers, storage, and AI services on hardware you own, from one binary and one daemon. Deploy the Worker code you already wrote with its config file and framework adapters, then roll back to an earlier immutable deployment when a release misbehaves. Serve traffic locally or over HTTPS through the shared Gateway, with routes you control instead of a vendor account. Each instance stays isolated with its own data directory and credentials, while you switch between registered instances from the same operator view. Bindings cover the platform pieces applications actually need: key-value data, SQL databases, object storage, stateful objects, queues, durable multi-step workflows, scheduled cron, cache, vector search, and AI search. Logs and a live tail show what running Workers are doing right now, and health, backup, and recovery workflows keep a single machine manageable without a cluster. Verified upgrades roll back automatically when something fails, and object bytes can move to S3-compatible storage when local disk is no longer enough. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Where Traefik's built-in dashboard only shows what is running, Traefik Manager lets you change it: add routes, middlewares, and services from forms and wizards instead of editing YAML by hand. A first-run wizard connects to the Traefik API, creates a route for the manager itself, and sets the admin password. After that, the dashboard turns every route into a launchable app card with live health, and the Route Map draws each request from entry point through middlewares to backend. New routes use a slide-in form for HTTP, TCP, or UDP with several domains and backends, sticky sessions, and health checks. 30 middleware wizards handle authentication, rate limiting, headers, CORS, and redirects, and weighted, mirroring, or failover services can be built on their own. For day-to-day monitoring, the Certificates tab tracks expiry from acme.json, the Logs tab turns the access log into clickable analytics, the CrowdSec tab lists attacks and bans, and alerts reach Discord, Slack, ntfy, Telegram, and more. Changes to traefik.yml apply with a one-click restart, every edit is backed up locally and can be pushed to a git repository, and a lightweight agent brings remote Traefik servers into the same interface. Sign in with TOTP two-factor or OIDC single sign-on, in any of 14 languages. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Tools and applications that already speak S3 can use RustFS as their storage backend, so backup jobs, data pipelines, and services keep working while the data stays on infrastructure you control. A built-in web console on port 9001 manages buckets, object uploads and downloads, access keys, users, groups, and IAM policies, with a status page for cluster health, capacity, and scanner activity. Versioning, Object Lock retention, bucket quotas, and server-side encryption with Vault or AWS KMS backends protect objects once they land. Lifecycle rules expire or transition data, and tiering moves cold objects to remote targets such as Amazon S3 or Wasabi. Bucket replication and site replication keep clusters in sync, and event notifications call webhooks when objects change. Single-node mode suits a lab or small server, while distributed mode adds erasure coding, bitrot protection, background healing, and pool expansion or decommissioning as capacity grows. Sign-in works with local users, OIDC single sign-on, or OpenStack Keystone, and FTPS and WebDAV are available by default, with SFTP and the Swift API as opt-in builds. A preview of S3 Tables exposes an Iceberg REST catalog for tools such as DuckDB and PyIceberg, and a documented migration path moves existing MinIO deployments across. Typical uses include backups, container registries, logs and traces, data lakes, and AI training sets. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

With over 14,000 GitHub stars and a growing global network of security deployments, CrowdSec turns every attack on any participating server into protection for the entire community. The security engine operates as a combined IDS/IPS and WAF, analyzing log sources from Nginx, Apache, SSH, WordPress, and over 50 other services to detect brute force attacks, port scans, web vulnerability exploitation, and credential stuffing in real time. When one server detects a new threat, the attacker's IP is shared through the community blocklist, proactively protecting thousands of other installations before the attacker can reach them. The built-in WAF powered by Coraza v3 inspects HTTP requests at the application layer, validates against OpenAPI schemas, and applies custom rules with flexible AND/OR condition mixing for precise threat detection. Bot detection serves challenge pages with client fingerprinting to distinguish legitimate traffic from automated scrapers and scanners. Remediation components block malicious IPs at multiple infrastructure layers including iptables, nftables, Nginx, HAProxy, Cloudflare, and AWS Security Groups through the detect-here-remedy-there architecture. The scenario-based detection system ships with default rules for common attack patterns and supports custom scenarios written in YAML with an expressive filter language. A centralized console provides real-time visualization of alerts, threat intelligence analysis, and management of multiple distributed security engines. GDPR compliant by design, all log analysis happens locally and raw logs never leave your infrastructure. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

3X-UI is the most popular open-source Xray management panel, providing a full-featured web interface for deploying and monitoring proxy and VPN protocols on Linux servers. The Go backend manages Xray-core instances supporting VLESS, VMess, Trojan, Shadowsocks, WireGuard, Hysteria2, HTTP, SOCKS, Dokodemo-door, and TUN inbounds across TCP, mKCP, WebSocket, gRPC, HTTPUpgrade, and XHTTP transports secured with TLS, XTLS Vision, and REALITY. The Clients page tracks each user with individual traffic quotas, expiration dates, concurrent connection limits, and live online status indicators, while one-click share links, QR codes, and a built-in subscription server distribute configurations in multiple output formats. The multi-node architecture manages and scales deployments across multiple servers from a single panel instance. The Panel Settings page configures listen address, port, URI path, session duration, trusted proxy CIDRs, authentication, and Telegram bot integration for remote monitoring and management alerts. Outbound routing supports WARP, NordVPN, custom rules, load balancers, and proxy chaining. Xray Configs provides template-level control over the core configuration, while the API Docs page exposes a complete RESTful API with in-panel Swagger documentation. Data persists in SQLite by default or PostgreSQL for larger deployments, with database export and import from the panel. Fail2ban integration enforces per-client IP limits. On RepoCloud, deploy 3X-UI on a dedicated VPS with Docker, root SSH access, and complete control over your proxy infrastructure, all under the GPL-3.0 license.

Pomerium puts every internal application behind a single identity-aware proxy, so engineers reach dashboards, admin panels, and databases through their browser with no VPN client and no network-level trust. Sign-in flows through your existing identity provider, including Google, Okta, Azure AD, GitHub, GitLab, and any OpenID Connect service, with sessions verified continuously rather than once at login. Each route carries its own policy: restrict the finance tool to the finance group, require a specific email domain for the admin console, or allow read-only paths more broadly. Authorized requests pass identity headers the application can trust, and every access decision is logged for audit. TCP routes extend the same sign-in and policy checks to SSH, PostgreSQL, MySQL, and RDP connections through a small client or a browser-based terminal. In Kubernetes, Pomerium doubles as an ingress controller, applying the same policies to services as annotations on ingress resources. Mutual TLS between the proxy and backends, encrypted sessions, and short-lived credentials replace shared passwords and flat networks. Teams roll it out as one all-in-one binary or split the proxy, authorize, authenticate, and cache services across machines as traffic grows. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Wag is an authentication gateway for WireGuard that lets each device reach only the routes it should, and asks for a second factor before the sensitive ones open. Admins write access policies for everyone, groups, or single users, marking subnets, hosts, ports, and protocols as MFA-required, always allowed, or denied, and the most specific prefix wins, so one allowed address can sit inside a protected range. Devices join with a registration token, and the public endpoint answers with a finished WireGuard profile. Users then confirm a TOTP code, a WebAuthn security key, an OIDC single sign-on login that maps identity provider groups into Wag groups, or a PAM prompt, and repeated failures lock the account. Session lifetime and idle timeouts decide when they must prove themselves again. The browser portal lists users, devices, rules, registration tokens, and webhooks with real-time notifications, while a command line locks devices, resets MFA, and manages administrators. Webhooks turn JSON from an HR or identity system into new tokens or removed users and devices, and clients can fetch the list of guarded routes from a small API. Remote staff, contractors limited to one host, and homelabs are typical uses. When a server fails, the VPN remains reachable through clustering with witness nodes or an external etcd, and certificates arrive through ACME with HTTP-01 or Cloudflare DNS-01. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.

PowerDNS answers the queries; Poweradmin gives you a browser-based control panel for its zones, records, DNSSEC keys, and users, with a REST API for automation. Create master, native, and slave zones, and let zone templates stamp predefined record sets onto new ones. Edit records inline with filters, or open the optional Record Wizard for DMARC, SPF, DKIM, CAA, TLSA, and SRV. Reverse zones link to their forward zones. The batch PTR tool fills whole network ranges, bulk add takes one CSV line per record, and secondary zones can be imported over AXFR. For DNSSEC, manage keys and copy DS and DNSKEY records for your registrar; changes are applied or rectified through the PowerDNS API so signed zones stay consistent. Every record and zone edit is logged with before and after snapshots, and the logs can be filtered and exported. The panel is translated into 43 languages, including right-to-left ones. Permission templates, users, and groups control who touches which zones, sign-in works through LDAP, OIDC, or SAML, and administrators can switch on authenticator-app or email two-factor codes. API keys can be read-only, limited to chosen operations, or restricted to specific zones, and companion projects link Terraform, ExternalDNS, cert-manager, and Certbot. Dynamic DNS clients such as ddclient and inadyn update records through a dyndns2-compatible endpoint. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

One encrypted network for every machine you run: Tunnet links laptops, home servers, cloud instances, and CI runners into a private mesh that behaves like a single LAN. Each enrolled machine gets an overlay IP and a hostname, so ordinary tools like ping, curl, SSH, and the browser just work across home servers, cloud instances, and laptops. Publish an internal app to your peers with Serve, or expose a local service to the public internet with an HTTPS tunnel when you need a shareable link. Send files directly between machines without detouring through cloud drives, email attachments, or fragile copy commands. SSH access follows identity instead of scattered key files, with session recording and no bastion host to maintain. Device posture checks gate which machines may join, and subnet routes, exit nodes, and high-availability gateways extend the fabric to whole networks. Write your ACLs, groups, tags, and SSH rules as Policy as Code in Git, simulate changes offline, review semantic diffs on pull requests, and roll back revisions when a change misbehaves. The Kubernetes operator advertises cluster networks, publishes services to peers, and exposes public HTTPS endpoints through custom resources. Run the full stack yourself, control plane, dashboard, management API, relays, and audit logs included, or skip the server entirely with Direct mode for a zero-server peer-to-peer mesh. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 and MPL-2.0 licensed.

Gately keeps your domain names current, forwards ports, terminates HTTPS, and blocks hostile traffic from one admin console, so a server or home network needs no pile of separate gateway tools. Dynamic DNS updates records at Cloudflare, Alibaba Cloud, Tencent Cloud, DNSPod, Huawei Cloud, Route 53, OVHcloud, Gandi, Namecheap, DuckDNS, and other providers, finding the public address over IPv4 or IPv6 by URL, network interface, or command. Port forwarding relays TCP and UDP with port ranges, failover targets, connection limits, traffic statistics, and PROXY protocol, while SNI routing lets several services share port 443. Certificates are issued and renewed through ACME with DNS-01 wildcards or HTTP-01, then pushed to other hosts over SSH. Web services add per-domain reverse proxies, redirects, and static sites with HTTP/3, WebSocket, load balancing, health checks, rate limiting, caching, and sign-in through OIDC, GitHub, Google, or TOTP-protected shared users. A WAF running the OWASP Core Rule Set and fail2ban-style jails with trap ports and nftables bans guard the edge. Manage Docker containers and Compose projects with one-click upgrades and rollback, open SSH sessions with an SFTP file manager, run ping, traceroute, and speed tests, and receive alerts in Telegram, Discord, Slack, ntfy, or email. An audit log, config history with diff and rollback, encrypted backups, scoped API tokens, and Prometheus metrics round it out. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

FCaptcha guards your forms with an invisible check that spots bots, headless browsers, and AI agents steering real browsers, all from a server you run yourself. Drop the widget into a signup or contact form and it quietly watches how the visitor actually behaves: pointer movement, typing cadence, scroll shape, and dozens of other signals that separate a person from a script. Vision agents that screenshot and click, and computer-use agents driving a browser through automation protocols, leave input traces the scoring engine catches. Self-declaring crawlers get flagged by name, and signed agent requests are verified cryptographically so polite, identified bots can be allowed while anonymous automation is blocked. A proof-of-work challenge adds a liveness gate behind the scenes. Humans see no puzzle at all, in any of 34 languages, and the widget meets accessibility standards for screen-reader and keyboard-only visitors. Your backend verifies each token through the same siteverify contract that Turnstile, reCAPTCHA, and hCaptcha use, so switching providers is a change of address rather than a rewrite. No cookies are set, no visitor data travels to a third party, and nothing phones home. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Open your laptop in a Lisbon cafe and your files at home answer as if the laptop never left the desk: AnywhereLAN stitches your own machines into one private mesh network with stable names like work-laptop.awl, no port forwarding and nothing exposed to internet scanners. There is no coordination server to trust. Peers announce themselves in the libp2p DHT, identify with ed25519 keys and connect directly over QUIC or TCP with TLS 1.3, hole-punching through NAT and borrowing a community relay only when both ends sit behind hostile firewalls. Send a browser out through the house connection with the built-in SOCKS5 proxy on 127.0.0.1:1066, handy on regional blocks and hostile hotel Wi-Fi. Prefer the full tunnel: the VPN gateway routes every IPv4 byte through a chosen peer, so the whole machine presents the exit node's address to the world. Devices join through invite links or QR codes. Every peer approves its friends and grants exit rights individually, and identity is a keypair you hold, so no account recovery email can betray the network. Manage it from the bundled web UI at admin.awl, script it from the awl CLI, watch it through Prometheus metrics on port 8639, and run it on Windows, macOS, Linux servers and Android phones. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MPL-2.0 licensed.

OvenMediaEngine ingests a broadcast feed once and delivers it to every viewer with sub-second delay over WebRTC and Low Latency HLS. Encoders push through WebRTC with WHIP, SRT, RTMP, or MPEG-2 TS, and the server can also pull RTSP sources and schedule pre-recorded files as live channels. The embedded transcoder converts incoming video to adaptive bitrate ladders in VP8, H.264, H.265, or AV1, so phones on weak signals and televisions on fiber each receive a rendition they can play. WebRTC delivery runs through an embedded signalling server and TURN server, with retransmission and forward error correction keeping pictures intact on imperfect networks. LLHLS streams carry DVR rewind, WebVTT subtitles, timed metadata, and DRM through Widevine, FairPlay, and PlayReady. Recordings dump finished streams to files for video on demand, thumbnails capture stills, and push publishing re-streams to other platforms over RTMP and SRT. Origin-edge clustering spreads a popular event across many servers, admission webhooks and signed policies control who may publish and watch, and a REST API plus monitoring endpoints keep the whole service observable. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Give every laptop, server, and cloud VM you own one private address that works from anywhere, and that is exactly the overlay network Nebula builds. Each machine runs a single small binary, presents a certificate signed by your own certificate authority, and joins a peer-to-peer layer-3 mesh where tunnels form on demand between hosts that need to talk. Lighthouse nodes, the piece you park on a VPS, keep track of where every peer can be reached and introduce hosts to each other, so machines find each other without any central VPN concentrator carrying their traffic. UDP hole punching and keepalive packets open direct tunnels through home routers and office NAT, and when two hard NATs refuse to cooperate, a relay host forwards the encrypted traffic until a better path appears. Every host enforces its own firewall, default deny on all overlay traffic, with rules keyed to certificate groups, so laptops in the user-endpoint group can reach a server's web port while other groups cannot. Ordinary hosts need no inbound ports at all, and the same binary runs on Linux, macOS, Windows, phones, and FreeBSD, making the mesh feel identical at home, in a datacenter, or across three clouds. Unsafe routes can even pull an existing office subnet into the overlay, giving legacy hardware that will never run Nebula an address on the private network. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Instead of wrestling with raw command-line flags and YAML configuration files for every device on your self-hosted Headscale mesh VPN, Headplane gives you a Tailscale-style web administration console to manage machines, users, DNS records, and access policies from any browser. From the machines overview, network administrators can inspect connected nodes, view Tailnet IPv4 and IPv6 addresses, rename devices, reassign ownership across users, toggle key expiration, and approve advertised subnet routes or exit nodes in a couple of clicks. Built-in Access Control List (ACL) management lets you edit security policies, define user groups, assign node tags, and configure auto-approvers without manually SSHing into your control server. When someone needs immediate shell access to a remote Linux host on the mesh, the integrated WebSSH console opens an interactive terminal session right inside the browser tab over Tailscale SSH. You can also manage MagicDNS settings, configure split DNS nameservers, and add custom DNS records that automatically reload your Headscale instance. Multi-user administration supports OpenID Connect (OIDC) single sign-on with identity providers like Okta, Authentik, Authelia, and Google Workspace, alongside granular role assignments and pre-authentication key generation for unattended server enrollment. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.