Fail2Ban quietly bans thousands of bots on a typical VPS and just as quietly keeps the whole story buried in a log file nobody reads, and Fail2Ban Report digs that story out into a dashboard you will actually open. Shell scripts convert each day of fail2ban.log into JSON, and the web interface lays every ban and unban on a searchable, filterable timeline you can slice by jail, server, or time window. Aggregated statistics for today, yesterday, seven days, and thirty days show which jails absorb the most attacks, while markers flag repeat offenders and escalating ban counts so persistent scanners stand out from one-time noise. Blocklists live per jail and per server as plain JSON, and ban or unban actions execute through UFW, giving you permanent bans that survive independently of jail restarts. Bulk actions handle whole ranges at once, with a pending state until the next sync applies them. Multiple servers feed one console through a pull-based HTTPS endpoint, so a fleet of small machines reports to a single pane without exposing SSH. Optional AbuseIPDB and IP-Info lookups add reputation and region context to any address. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

NetPulse is a self-hosted dashboard that turns a pile of routers, switches, and clients into one live picture of how your network is doing. A single score from 0 to 100 condenses latency, loss, uptime, and temperature, and updates every few seconds. The topology map draws itself from bridge and LLDP data, placing wired and wireless clients under the router and port they actually use. Every device is classified by type, with signal strength, band, and first-seen time. Router cards show model, firmware, CPU, memory, temperature, and live traffic. Scheduled WAN speed tests compare results against your contracted plan, and panels for WireGuard peers and AdGuard Home keep VPN and DNS activity in view. Alerts for overheating, new devices, firmware updates, and WAN outages reach you through push notifications, ntfy, Telegram, or webhooks. Admin and viewer accounts share access, a Wi-Fi channel analyzer scores congestion, and OpenWrt firmware upgrades can be started from the browser. MQTT publishing feeds Home Assistant, and an optional read-only MCP endpoint answers questions from your AI assistant. The interface installs as a phone app and speaks English and Spanish. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Built atop the TauricResearch TradingAgents framework with nearly 100,000 GitHub stars, TradingAgents GUI transforms a CLI-only multi-agent LLM stock analysis pipeline into a polished web application accessible at localhost:5000. The system deploys twelve specialized AI agents — fundamental analysts, sentiment experts, technical analysts, bull and bear researchers, a trader, risk management team, and portfolio manager — who collaboratively debate market conditions through structured LangGraph workflows before producing a final BUY, SELL, or HOLD recommendation. The interface supports ten LLM providers including OpenAI, Anthropic, Google, OpenRouter, DeepSeek, Ollama, xAI, Qwen, GLM, and MiniMax, with a first-run wizard that auto-detects configured API keys and tests connections. A live pipeline visualization shows each agent's status with real-time progress bars, while the tabbed output area separates Live Feed, Reports preview, and Tool calls into dedicated panes. The three-pane Reports tab provides searchable indexing, table-of-contents navigation, and export to Markdown, HTML, or PDF formats. Report length control across Concise, Standard, and Comprehensive modes saves up to 50% on token costs. Multi-session chat allows pinning past reports as grounding context with live token counting and context-window warnings. Three built-in themes — Terminal, Modern, and Bloomberg — persist per browser. Docker Compose deployment maps port 5000 with persistent report storage. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Your e-reader already knows everything about your reading life, and KoShelf turns that KOReader metadata into a beautiful dashboard you can browse from any browser. The library overview gathers currently reading, completed, and unread books and comics, while each item's page collects your highlights, annotations, ratings, and review notes in one place. Reading statistics chart your time and pages with customizable activity heatmaps and weekly breakdowns, and per-item statistics reveal session counts, average session length, and reading speed for every book. A monthly calendar shows what you read on each day, and the yearly recap celebrates completions with monthly summaries of finished items and hours read. Supported books open right inside KoShelf's own reader, with keyboard navigation, a progress scrubber, and inline highlight notes. Metadata entries survive even when the original document disappears, because library archives preserve covers and reading data until the source returns. With writeback enabled in server mode, you can edit annotations, ratings, status, and covers from the browser, protected by revision checks and recoverable backups so external changes are never overwritten blindly. Search by title, author, or series, filter by reading status, and download original files whenever you need them. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. EUPL-1.2 licensed.

Moneat is the open-source observability platform that unifies error tracking, session replay, performance monitoring, logging, uptime checks, synthetics, product analytics, and AI observability into a single self-hosted application — replacing Sentry, Datadog, and Statuspage with one deployment. The Sentry SDK compatibility layer accepts data from @sentry/browser, @sentry/node, @sentry/react, @sentry/nextjs, sentry-sdk for Python, sentry-kotlin, sentry-java, sentry-android, sentry-cocoa, sentry-go, sentry-ruby, and Sentry.NET by updating one DSN endpoint. Datadog Agent compatibility redirects existing fleets by setting dd_url, and native OpenTelemetry OTLP ingestion accepts logs, traces, and metrics from any exporter or Collector. Error monitoring groups exceptions with smart deduplication, session replay records DOM-based user interactions linked to errors, distributed tracing visualizes transaction and span breakdowns with live service maps, and continuous profiling renders flamegraphs in pprof, JFR, and Sentry formats. Uptime monitoring runs HTTP, TCP, and ping checks with public status pages, while synthetics executes API tests, multi-step workflows, SSL checks, and DNS probes. Custom dashboards support drag-and-drop widgets with Grafana import, product analytics provides funnels and retention cohorts, release tracking surfaces crash-free rates with source map upload, and AI observability traces LLM calls end to end. Built on Kotlin and Java with ClickHouse for analytical storage, PostgreSQL for relational data, and Redis for caching, deployment uses Docker Compose with an interactive installer automating secrets and service orchestration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Reloops is a self-hosted creative asset workspace where teams keep every video, design, PDF, audio file, and live website in one library and collect feedback on the files themselves instead of in scattered email threads. Reviewers click anywhere on an image to pin a note to that exact spot, and on video the comments attach to the precise frame, so "fix this bit" always points at the bit in question. Every upload becomes a new version on the same asset, older cuts stay available for side-by-side comparison, and approvals are recorded on the file so nobody ships the wrong export by accident. Clients never need an account: send them a share link or a branded collection and they can watch, comment, and sign off as guests. The library searches the way people remember work, because each asset carries generated descriptions, tags, and metadata filters, so "the approved homepage with the blue button" actually finds something. Day to day, assignments and review queues keep feedback moving, while scoped API keys let agents such as Claude, OpenClaw, Zapier, and n8n upload new versions, post comments, update statuses, and manage share links inside the same workspace. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Drop your screenshot, a base style is applied, style it however you wish, and export - "that's basically it," says Moocup's own author, and the description holds. The workflow is genuinely seconds long. Drag an image in and it lands on an attractive backdrop immediately; from there you adjust backgrounds, gradients, padding, borders, shadows, and framing with live preview until it matches your taste, then export a high-quality image ready for a portfolio page, README, blog post, tweet, or slide deck. There are no accounts, no watermarks, and no upload to anyone's cloud - as a self-hosted static app, your screenshots never leave your infrastructure, which matters when the screenshot shows a proprietary dashboard or unreleased product. It runs entirely in the browser from a tiny nginx container, works on any device, and requires zero design skill: the smart defaults do the heavy lifting, and everything else is optional tinkering.

Watchtower puts AI-driven security assessments into one web console, where sessions probe your attack surface while every request, finding, and piece of evidence is captured as it happens. The AI session console follows the attack surface, session progress, tool calls, and findings as an assessment runs, so you can watch an engagement unfold instead of reading a log afterwards. A built-in proxy workflow records HTTP and HTTPS traffic history with highlighted patterns, and any captured request can be sent to the Repeater for editing, replay, and response comparison. Mobile work is covered too: connect phones over USB or wireless, capture app traffic separately from accessibility control, and import WeChat mini-program packages to configure an assessment session. A public vulnerability intelligence library can be searched by component, severity, and source and kept synchronized locally, giving assessments current context without sending your targets anywhere. Findings are managed by source, severity, and status, each linked back to its supporting evidence, and the report editor assembles them with a live preview, impact notes, and remediation guidance. The dashboard tracks assets, tasks, AI sessions, token usage, and runtime resources, and task admission is budgeted against physical memory so heavy scans do not starve the host. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Your internal services deserve certificates your browsers actually trust, without a spreadsheet tracking when each one expires. mkcertWeb wraps the mkcert tool in a web interface where you generate certificates for any mix of hostnames, wildcards, and IP addresses, then download them as PEM, CRT, or PKCS#12 bundles for servers and client authentication. The certificate list groups everything by state, needs attention, healthy, read-only, or archived, showing days remaining, subject alternative names, and SHA-256 fingerprints at a glance. You can upload existing certificate and key files for viewing, attach a free-text note to each certificate, and archive or restore entries without ever overwriting a certificate of the same name. The root CA page offers downloads and install instructions for macOS, Linux, and Windows, and can generate a fresh CA for a new deployment. Devices enroll through the built-in SCEP server using one-time challenge passwords and templates, with an optional enterprise CA signing manual enrollments. A scheduled monitor checks expiry daily and sends alerts through SMTP email, ntfy, or an HTTP webhook, with test buttons for every channel. Settings save from the browser with secret masking, sign-in supports passwords or OpenID Connect single sign-on, and light and dark themes work down to phone width. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Your internal services deserve padlocks that browsers actually trust, and LocalCA is a small certificate authority you run yourself to issue them. From the web interface you create a self-signed root, install it once on your browsers and client devices, and then mint intermediate and leaf certificates underneath it for each service you host. Proxmox, Pi-hole, Jellyfin, Grafana, and the rest of a homelab stop showing insecure warnings and start presenting certificates your devices accept. The root can carry your own name, so the trust store shows your branding rather than a generic authority. Issued certificates also serve mutual TLS setups, where clients present certificates of their own before a service lets them in. Deployment stays deliberately small: a Docker Compose file brings the application up, ARM images cover Raspberry Pi class hardware, and a configurable time zone keeps expiry timestamps readable for your region. A reverse proxy path prefix is supported for placing the interface behind Traefik or Nginx at an address like /localca. Treat the instance as internal infrastructure, because issued private keys live in its database: keep it on a private network, change the default administrator password immediately, and restrict access to the host. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Ambry is a personal audiobook streaming server that keeps a collection you own on hardware you control, ready to stream to any browser or phone. Upload your audiobook files once, and the library becomes streamable to any device through a browser or the native mobile application. The server reads durations, tags, and chapter markers straight from the audio files, so a long novel arrives with its structure intact instead of as one anonymous ten-hour blob, and the original files are served untouched. First boot walks you through creating the initial administrator account, after which the instance restarts ready for listening. Households can open registration to family members or close it entirely, keeping the library an invitation-only shelf. Forgotten passwords and registration messages go out through the configured mail provider, so account recovery works without manual intervention. The collection itself lives in PostgreSQL with uploads on a persistent volume, and the whole service runs from a container image on a configurable port. Put a commute listen on your phone, a history title on a kitchen tablet, and a shared family library behind one address, all served from hardware you control. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Audit season stops being a six week archaeology dig through shared drives when Conformiti keeps your whole compliance programme in one self-hosted system built for SOC 2, ISO/IEC 27001:2022, and PCI DSS v4.0.1. Its three complete control libraries hold 217 controls with a cross-framework crosswalk, so satisfying one requirement can answer its equivalents elsewhere instead of duplicating work. Evidence lives in a folder tree generated from those libraries, where every document declares which controls it satisfies and every control lists its documents, ending the hunt for proof at fieldwork time. Readiness is calculated rather than vibes: each control scores from implementation status, owner, evidence freshness, and testing, minus a penalty for open risks, and the dashboard tracks that score with daily snapshots. Documents carry review cadences with escalating email reminders before they expire, versions archive instead of overwriting, and uploads can pass through ClamAV scanning. A five by five risk register, vendor register with shared responsibility matrices, periodic access reviews, and a RACI matrix keep the rest of the programme beside the controls instead of in separate spreadsheets. When assessors arrive, you issue them a sealed, signed evidence package for a fixed window that verifies offline, rather than handing over drive access that outlives the engagement. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Nodyx puts forum threads, real-time chat channels, peer-to-peer voice calls, collaborative whiteboards, and a drag-and-drop homepage builder behind one installation script on hardware you control. Create categories and threaded discussions that search engines index, then switch to Socket.IO-powered chat rooms where replies, pins, link previews, and @mentions update instantly. Voice channels connect participants through WebRTC mesh networking, keeping audio between peers without routing through third-party servers; a Rust-based STUN/TURN relay handles restrictive NATs so home-server deployments work without port forwarding. The NodyxCanvas layer adds CRDT-synchronized collaborative drawing with 11 tools, voice-aware cursors, and board-scoped chat, all persisted to PostgreSQL snapshots. Build your community's landing page with a visual editor that places widgets across 11 layout zones, then extend functionality by dropping third-party widget archives into the admin panel or authoring your own with the plain-JavaScript Widget SDK. Private conversations stay end-to-end encrypted with ECDH P-256 key exchange and AES-256-GCM ciphers where the private key never leaves the browser, and the OctoGuard module automates moderation with five matcher types plus configurable actions from muting to banning. For streamers, a native Streamer Hub bridges Twitch chat bidirectionally, provides a drag-and-drop soundboard, generates OBS browser-source overlays, and offers a mobile Stream Deck. Instances discover each other through a gossip protocol, forming a decentralized network without central coordination. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Denpa is a home TV recording server that turns a Linux machine and a TV tuner into a private recorder for Japanese terrestrial and satellite broadcasts, with reservations and browser playback. There are no configuration files: plug in a supported tuner and card reader, press scan, and the tuner type, channels, and program guide set themselves up. Reserve from the guide, or save a search as a rule and matching broadcasts record automatically; a repeated episode is ignored after its first airing is captured. Recordings encode to AV1 or H.264 MKV files (H.265 when a GPU is present) with captions exactly as broadcast, and detected commercials become chapters that playback skips entirely. Playback resumes where you stopped, runs at up to double speed, and clips save on the server with captions intact; programs also download to devices for offline viewing. Live viewing runs about a second behind the broadcast: pausing starts chase playback, alternate audio stays selectable, and BML data broadcasting works in the browser. The companion denpa-tv app reaches Android TV and Fire TV through QR pairing, and an API exposes channels, recordings, and audio-only feeds to Home Assistant and scripts. EPGStation and EDCB users can import rules, reservations, and recordings, and the interface stays closed until you open it to trusted networks or protect it with OIDC login. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Homeio turns a Linux box into a desktop you open in a browser tab, with draggable windows, a dock, a lock screen, and a command palette sitting on top of your Docker apps, files, and disks. The App Store installs Docker Compose stacks from the CasaOS catalog or your own store sources, and each app's ports, volumes, environment variables, and compose file stay editable before and after install. Containers you started elsewhere still appear with live CPU and memory stats, streaming logs with keyword filters, and one-click restarts. The file manager uploads with progress, previews images, audio, video, and PDFs, edits text in a built-in code editor, mounts USB drives and SMB shares, and shares folders over Samba. A real login shell lives in the Terminal window, with exec access into any container, so routine fixes never need a separate SSH client. Cron-style scheduled tasks restart apps, pull images, or run backups on a timer, and scheduled archives of the database, files, and compose stacks restore from the same interface. Tailscale puts the whole desktop on your private network, while Cloudflare Tunnel can publish a single app on a public hostname with its DNS record created for you. Live metrics stream to widgets and the status bar, and notifications flag crashed containers, filling disks, and failed tasks. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Overlook is a read-only status page that tells you at a glance whether your whole homelab is healthy, by pulling live answers from the monitoring, server, network, storage, and media tools you already run. The page leads with what is wrong, listing the checks your existing check engine is alerting on for as long as they fail, so the page and your alerts never disagree. Below that sit Servers, Network, Storage, and Apps, each marked up, degraded, or down with the last 30 results of its checks and its own detail page showing guests, DNS clients, or disk detail. A Today strip gives one figure from every source, such as guests running, DNS lookups, photos added, or the watts your UPS is drawing, while a weekly view lists each area's problems and events across the last seven days. Your apps appear as links with a dot that says whether each one answers, and chores due this week, waiting updates, batteries to change, and requests awaiting approval collect in one place you act on in the tool itself. A browser setup page appears before any config exists, tests each source you enter, and writes the config and secrets files for you. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

ComfyUI's node graph is where workflows are built, not where pictures get made, and HEISS UI is the calm studio that sits on top of your ComfyUI server for the daily prompt, wait, look, tweak loop. Thirty model families work out of the box, from SD 1.5 and SDXL to Flux.2, Qwen-Image, Krea 2, and Wan 2.2, and missing text encoders, VAEs, or node packs each get a Download button, with Get all for the lot. Pick 2K and the model draws at 2048 in one run with no upscale in between, or send any finished picture to 2K or 4K with SeedVR2 in one click. Import your own workflow and it becomes clean controls over the same graph, with usual inputs connected and guesses marked for review. Paint over part of a picture and say what it becomes, and only that part changes, with inpainting across 18 image families and no extra nodes. The gallery auto-groups ten takes of one idea into a single tile, and opens on your phone while your rendering machine does the work. A Hidden vault locks private images behind Touch ID, Windows Hello, or a password; new PNGs can carry Civitai-ready metadata, and Zen mode shows only prompt and picture. Run it beside ComfyUI with Docker or npm on port 8787, or point it at ComfyUI on another machine. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Muxarr cleans up your media library by stripping out the audio and subtitle tracks you will never use, so players stop offering twenty subtitle options and the wrong dub. Tell it which languages you actually watch and read, and it keeps those tracks while dropping commentary, foreign dubs, and redundant subtitles. Nothing is re-encoded: video and audio are copied as they are, so quality is identical and a large film finishes in about a minute instead of hours. Spare audio tracks alone often free ten to thirty percent of a file, which adds up quickly across a big library. Profiles apply different rules per directory, so anime, family films, and western shows can each keep different languages, with priority ordering, per-language limits, and fallback rules like English subtitles only when German ones are missing. Regional variants are understood, distinguishing Quebec French from France French or Latino from Castilian Spanish. When Sonarr or Radarr import something new, a webhook sends it straight to Muxarr, and original language detection makes sure a foreign film keeps its real soundtrack. Track names get cleaned of encoder tags, default and forced flags are fixed, and every output is validated before it replaces the original. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.