Your company pays for AI subscriptions nobody can see, scattered across personal accounts and team plans, and Subpool is the self-hosted control plane that pools that authorized capacity and hands every employee one key with limits you govern. Administrators combine subscription and API accounts into pools behind a single managed endpoint, then allocate employee-specific keys across whichever provider accounts are healthy. The console watches account health, remaining subscription capacity, and when each plan window resets, and routing prefers subscription capacity first, falling back to paid API accounts under the very same employee key when a window runs dry. Rate-limit, expire, or revoke any person's access independently, and keep every key-to-account assignment visible and auditable instead of buried in a shared credential nobody can trace. The employee API speaks OpenAI-compatible Responses and Chat Completions, so existing tools point at your pool unchanged, while aggregate input and output token telemetry is tracked per key in provider-native units. For OpenAI accounts, a Costs API estimate shows the remaining grant balance; Bailian Token Plan accounts display their five-hour, weekly, or monthly quota windows. Upstream credentials stay encrypted, and prompts, responses, and source code are never persisted. One Go service with an embedded console and PostgreSQL runs from Docker Compose, with sign-in on port 8081 and the employee API on 8080. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

HitKeep is a sovereign web analytics platform that consolidates cookieless visitor telemetry, conversion funnels, e-commerce revenue reports, and AI engine visibility into a privacy-respecting dashboard that replaces Google Analytics and complex tracking clouds. Marketing teams can monitor inbound visitor journeys without installing intrusive consent banners or violating regional GDPR regulations. Custom conversion funnels and goal milestones track user registrations, checkout transactions, newsletter subscriptions, and software downloads with exact revenue attribution. Integrated Google Search Console synchronization brings organic search queries, keyword impression rankings, and click-through metrics directly alongside real-time pageview logs. A dedicated artificial intelligence visibility dashboard monitors crawling bots, retrieval citations, and direct referral visits originating from ChatGPT, Claude, Perplexity, and other generative search agents. Growth analysts can pose natural language questions to an embedded AI reporting assistant, generating instant cohort breakdowns and engagement trends without assembling complex manual filters. Site operators can configure custom tracking domains, whitelist reverse proxy networks, filter out referrer spam, and schedule automated database backups across persistent storage volumes. Complete data sovereignty controls allow teams to export raw event telemetry into open Parquet and CSV archives or stream metrics into external business intelligence warehouses via webhooks. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Bots that knock on your server's login ports are always turned away by Knock-Knock, a multi-protocol honeypot that shows every attempt on a live dashboard. Honeypots answer on the standard ports for SSH, Telnet, FTP, RDP, SMB, SIP, HTTP, and SMTP, with MQTT, Node-RED, Modbus, S7, and SNMP as optional extras. Authentication is always rejected, so no bot ever gets a shell. Who is knocking? The live feed shows each attempt's country, username, password, ISP, IP, and protocol. From where? A 3D globe marks the origin in one of six styles, including an extruded country heat map. Trying what? Leaderboards rank countries, usernames, passwords, ISPs, and IP addresses, and a trivia panel explains why bots favor certain credentials. A protocol filter re-slices the feed, globe, and leaderboards together; SIP shows dialed numbers and toll-call destinations, and RDP shows hostnames and accounts. Too fast? Press the space bar to pause, right-click any knock for details, or switch on a virtual Geiger counter that clicks as attacks arrive. Want to fight back? Download hourly 30-day and 365-day blocklists with recipes for CSF, CrowdSec, ipset, nftables, and pfSense, or query the optional API for any IP, CIDR range, or ASN. Several honeypot servers can stream into one aggregated dashboard. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Netra watches your network from the side, plugged into a switch mirror port, and turns everything it sees into a live picture of your traffic without ever sitting in the forwarding path. A single binary loads its eBPF collectors in the kernel, so aggregation happens before packets reach user space and multi-gigabit mirror feeds stay observable instead of dropping samples. The dashboard opens on totals, protocol share, and traffic trends, then lets you drill into flows by address, port, domain, or service, check which countries your traffic talks to on a world map, and read the internal topology as a live graph. Domains surface passively from TLS handshakes, public addresses are enriched with country and organization data, and heuristic detectors flag scanning, flooding, and single-host surges, pushing alerts to your team chat with an optional AI-written explanation. You can ask the built-in assistant questions about real recorded history, connect external MCP servers so it can call your own tools while it answers, and stream flows onward to Kafka for other consumers. History rolls into compressed columnar files on a schedule and stays queryable for a month by default. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

WechRSS brings WeChat Official Accounts back into your RSS reader, turning accounts that normally live inside a closed app into ordinary feeds you control. Paste any article link from an account and the tool identifies the publisher automatically, without hunting for obscure account parameters. Connect WeChat Reading by scanning a QR code in the web interface, and the session renews itself when possible so subscriptions keep flowing. Each account gets its own independent feed with its own sync schedule, item count, and on or off switch, so noisy publishers can be slowed down and favourites checked more often. A background scheduler keeps article titles, publication times, covers, and summaries up to date, with sync attempts, successes, and the latest new article all visible at a glance. Everything is stored locally, so your subscription list and credentials never sit on someone else's server. A first-time subscription wizard walks you from QR login to seeing the first article in your reader, saving progress if you get interrupted. Reader-specific links can be generated per account, letting a cloud reader fetch a feed without handing out management access. Health diagnostics flag expired logins, verification requests, and long sync gaps with concrete recovery steps. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Enterprise security stacks assume an enterprise budget; Wildbox assumes a server you already own. It runs your whole security operation as a set of cooperating services behind a single HTTPS gateway: threat intelligence collectors pull indicators from seven public feeds on a schedule, starting with abuse.ch's Feodo Tracker, and every indicator is searchable in one place. Fifty-two security tools sit behind one API, covering DNS, TLS, email security, headers, and port analysis. The cloud posture service runs 22 configuration checks against your live AWS accounts and keeps each scan's report, while the vulnerability service inventories your assets, prioritizes findings by risk, and tracks them through remediation with SLA checks and alert rules. When something needs doing, YAML playbooks execute response workflows as background jobs, and the agents service writes Claude-generated threat-enrichment reports for suspicious indicators when you give it an API key. An osquery-based sensor streams endpoint telemetry from your hosts into the platform, kept separate per team. Users, teams, roles, and scoped API keys live in the identity service, and the backends accept nothing that did not arrive through the gateway, so your security data never leaves hardware you control. Optional Compose profiles add n8n automation and Prometheus monitoring. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Your coding agents are scattered across a laptop, a server, and whatever machine you left running at home, and Agenvo is the self-hosted relay that lets one AI assistant reach all of them through a single MCP endpoint. Ask ChatGPT on your phone to check on Codex running on your server, or have an agent in Herdr on your laptop fix a failing test, from wherever you are. Connectors for Herdr, Codex app-server, Paseo, and Lody dial out to the relay over WSS, so the computers running agents need no inbound ports, no VPN, and no port forwarding. Your assistant sees the agents running in Herdr without restarting them, resumes Codex threads later, and starts new work where it fits: a Codex thread on the server, or Codex, Claude, or Devin in a Herdr pane. When an agent finishes a turn, waits for input, or exits, the relay pushes a change event back, so a watching assistant or ChatGPT dot reads the output and takes the next step. Closing the chat or losing the network does not stop the agents; connectors reconnect on their own, and your assistant picks up from each agent's current state. Deploy the relay on a single VPS with Docker or on Cloudflare, authorize MCP clients with OAuth over Streamable HTTP, and discover targets and method schemas with search before calling execute. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Your own video hosting site that behaves like the big platforms: upload a file, share a link, and anyone can press play. Subatic takes care of everything between those two moments. Drop in a raw video and the transcoding pipeline converts it into web-ready formats, stores the finished files in S3-compatible storage, and publishes a clean watch page with the title and an animated thumbnail that previews the content before a click. Playback streams directly from the storage bucket, so a Cloudflare R2 bucket with caching turns your little server into a video host whose delivery costs stay close to zero as views climb. A public homepage grid showcases your latest uploads with those moving thumbnails, and visitor counts can flow into Umami or Plausible if you want audience numbers without handing viewers to a third-party tracker. Creator accounts handle uploading, and one Docker Compose file brings up the whole stack: the app, the transcoder, MinIO for local object storage and PostgreSQL. A teacher can post course videos without platform rules, a band can share rehearsal footage, and a homelab can keep family clips on hardware in the closet. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Follow the channels you actually chose, and let their newest uploads land on your own disk instead of in an algorithmic feed. Yarrtube tracks public YouTube playlists and whole channels, checks them on a schedule, and downloads fresh videos automatically the moment they appear. The built-in web player lets you watch the collected library from a desktop or a phone browser without ads interrupting. Downloads are organized into media-server friendly folders, so the same collection shows up inside Plex, Jellyfin, or Kodi next to your films and shows. For Plex homes, an optional scan trigger refreshes the library right after a download finishes, so new episodes surface without manual rescans. You control download quality per source and can cap how many videos each channel keeps, which protects limited disk space from runaway back catalogs. Grouping sources into categories and smart playlists keeps a growing archive browsable instead of turning into one long dump. Everything runs from one Docker container with two persistent mounts, one for its small database and one for the video files. A free YouTube Data API v3 key powers the new-upload checks, so setup takes minutes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Your next favorite record is hiding in your listening history, and Digarr is the self-hosted discovery engine that finds it, scores it, and queues it for your library. Connect ListenBrainz, Last.fm, Spotify, Deezer, Discogs, or your Plex, Jellyfin, Emby, or Subsonic server, and Digarr builds a taste profile from what you actually play. An AI provider you choose, from Anthropic, OpenAI, and Gemini to a local Ollama model, proposes candidates, and a weighted scoring system ranks them by consensus, similarity, genre overlap, and your past feedback. Every suggestion lands in a review queue where you can preview tracks, approve, reject, or permanently block artists before anything touches your collection. Approve an artist and Digarr adds them to Lidarr with your quality profile, queues the release in slskd, or exports a playlist to Spotify, Navidrome, Jellyfin, Emby, or Plex. Album-level discovery runs on its own: Release Radar catches new releases from artists you follow, Library Gap-Fill surfaces the studio albums you are missing, and scheduled subscriptions keep fresh candidates flowing in without you lifting a finger. Share the instance with family or friends, each with their own queue and connections, protected by local accounts or OIDC single sign-on, and get notified through webhooks, ntfy, Telegram, or Apprise when new picks arrive. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

If your money is split across a bank app, a brokerage portal, and a half-abandoned spreadsheet, YAFFA, a self-hosted personal finance application, gathers it into one ledger with budgets, scheduled transactions, and forecasts. Record withdrawals, deposits, and transfers across unlimited accounts, and split a single supermarket receipt across categories so it lands in both Food and Household. Suggestions surface your most-used accounts and payees, and each payee's default category fills in automatically. Define rent, salary, or a loan payment once as a scheduled transaction; it appears on the dashboard calendar, enters with one action or records itself, and feeds the forecast. Import bank history from CSV or QIF files with rules for country- and bank-specific formats, and review every row before it is recorded. Optional AI document processing turns a receipt, invoice, or forwarded email into a draft transaction with payee, date, amount, and line items, using your own OpenAI or Gemini key and self-hosted Tesseract OCR for images. Accounts in different currencies roll up into your default currency using daily rates from the free Frankfurter service. Investments track gain and loss, with optional daily prices from Alpha Vantage. The dashboard summarizes accounts and upcoming schedules, the cash flow report can look ahead with a forecast, and Find Transactions filters history by payee, category, tag, or date. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Imagor Studio is a photo workspace where browsing a huge library and editing what you find happen in the same place, and the originals never get touched. The gallery scrolls virtually through thousands of images with no indexing wait, while drag-and-drop moves files between folders and multi-select handles bulk work. Open any image and the editor lets you stack layers: other images as overlays or watermarks, text layers you can style inline, and solid color layers with blend modes and opacity. Adjust color, apply effects, and crop with a live preview, then copy the generated transformation URL and use that rendition anywhere without exporting a file. A look you build once can be saved as a template in portable JSON and applied across the whole library, so a watermark, a resize, and a color grade become one reusable recipe. You can also start from a blank canvas at any dimensions and compose from scratch. Storage stays yours throughout: point it at a local folder, S3, MinIO, or Cloudflare R2 and manage the same library the same way. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Five servers, five cron jobs, five restic scripts nobody quite remembers writing: Arkeep replaces that archaeology with one dashboard where every backup in your infrastructure reports for duty. A small agent on each machine dials out to the central server and waits for work, so nothing listens on an agent port and machines behind NAT or a home firewall enroll just as easily as cloud VPSes. From the web interface you define destinations, which can be local disk, any S3-compatible storage, SFTP, a restic REST server, or more than forty Rclone backends, then build policies that send one backup job to several destinations at once for a genuine 3-2-1 layout. Docker volumes are discovered automatically, and databases stream straight into the backup with pg_dump and mysqldump instead of fragile file copies. Retention and repository integrity checks run per destination on their own schedules. When recovery day comes, you open any snapshot in the browser, browse its files, and restore a single folder in place or somewhere new. Failures announce themselves by email, Slack, Discord, or webhook, or stay silent in Healthchecks.io. Sign-in is yours to choose: local accounts with TOTP two-factor, or single sign-on through any OIDC provider. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Cupdate keeps a watchful eye on every container image you run, reporting which ones are outdated or vulnerable while deliberately never touching the update button itself. Point it at a Kubernetes cluster, a Docker socket, or Podman hosts (local or remote, one or several) and it inventories every image in use with no configuration to write. Each image is matched against its registry to find the newest available version, and the dashboard shows the gap between what you deployed and what you could be running, with release notes inline so the decision to upgrade takes seconds instead of a changelog hunt. Vulnerability data is layered on top from four sources: Docker Scout for Docker Hub images, Clair for participating Quay images, GitHub Advisories for images tied to repositories, and osv.dev correlation for images shipping SBOMs. A dependency graph explains why each image exists in your stack by showing which workloads pull it, which ends the "can I delete this?" guessing game. Subscribe to the RSS feed to hear about new releases passively, query the REST API to drive scripts that update compose files or kustomizations, or surface outdated and vulnerable counts in a Homepage dashboard widget. Prometheus metrics and traces are available when you want the watcher itself watched. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Manga readers use KamiYomu to build a private, self-hosted library: it fetches chapters from the websites they already follow, archives them locally, and serves everything back through a clean web reader on any device. The discovery flow runs on Crawler Agents, small plugins that teach KamiYomu how a particular source site lists series, chapters, and pages, so searching and fetching metadata happens inside the same interface as reading. Downloads land in a structured local archive, and reading picks up where you left off with history, filters for your library, and weekly views that surface new chapters and fresh releases. When a series is complete, export it as CBZ, PDF, or ZIP and take the files anywhere, no account or cloud library involved. Your e-reader and phone apps join through the built-in OPDS catalog, the same standard used by Moon+ Reader and KyBook, while a Swagger-documented API exposes the collection to your own scripts. Scheduled jobs keep watched series current in the background, checking sources and pulling new chapters without you babysitting tabs. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Google Browser Scraper is a self-hosted SERP API that gets Google results from a real Chrome browser and your own residential proxy, because plain HTTP scraping is refused and a fresh browser on a fresh IP is refused almost as fast. It warms a sticky proxy session with ordinary browsing first, lets the browser pass Google's checks, and then switches to a hybrid mode that fetches results pages directly over HTTPS with the browser's own cookies, at about 0.4 MB and 1.4 seconds per search on a warm IP. Every page comes back as SERP-style JSON with organic results, ads, related questions, related searches, pagination, the AI Overview, and local results. If a proxy IP starts serving poisoned pages for some other query, the scraper catches it within a few pages, drops that IP, and asks the query again on a fresh one. Captchas and blocks are reported as captchas and blocks, never disguised as an empty result set, so your pipeline knows when to retry or rotate. Run it as a CLI for keyword files, import it as a Python library, serve it as a local HTTP API, or expose the MCP server so AI agents get live Google search. Every run ends with a traffic and cost summary per thousand pages, and any sticky residential proxy works, with NodeMaven sessions handled for you. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

HabitSync treats habit tracking as a team sport, because willpower alone rarely survives February. Set each habit up the way life actually works: daily, weekly, monthly, on chosen weekdays, or at a custom interval, with a target value to reach or a ceiling to stay under for the habits you are trying to quit. Logging takes one tap, or a long press when today's effort deserves a custom number or a stopwatch. Share a habit with a partner, a sibling, or the whole household and everyone's progress sits side by side, which turns "did you go to the gym" into a question the dashboard answers. Monthly challenges raise the stakes with community voting, leaderboards, and medals for the top performers, while gentle automation watches your back: scheduled reminders when a habit goes unlogged, an alert when your completion slips under a threshold, and a quiet nudge when a friend overtakes you. Years of Loop Habit Tracker history import instead of being abandoned, and the installable web app keeps the streak one tap away on any device. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.

Open Walnut replaces your scattered terminals and notes with one self-hosted command center where a CEO agent and a lead for each project run your Claude Code sessions like a small company. You talk to the CEO; each project lead plans the work, spawns worker sessions, checks their output, and only brings you the questions that actually need a person. Every session sits in its own column with live output, permission controls, terminals, and files, and sessions survive browser disconnects, dropped SSH connections, and server restarts. Codex, Gemini, OpenCode, and Goose sessions join the same columns, on your laptop or on remote dev boxes reached over SSH. Finished work comes back as a per-session diff: comment on individual lines and send the review straight back into the session that wrote it. Around the agents sit your tasks with subtasks, dependencies, and due dates, Markdown notes with wiki links and backlinks, a calendar, and long-term memory that a background job keeps consolidated. Search covers notes, tasks, sessions, and memory together, mixing keyword matching with local embeddings, so nothing you told it last month gets lost. Routines run one-time, interval, and cron jobs; plugins add whole apps, tools, and skills; and paired phones reach the same console through device tokens. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.