AWX transforms Ansible from a command-line tool into a centralized automation hub with a web UI, REST API, and distributed task engine for managing playbooks, inventories, and credentials at enterprise scale. The React-based dashboard provides real-time visibility into job status, inventory health, and execution history while Django REST Framework powers programmatic control over every automation resource. Job templates combine Ansible playbooks, inventories, and credentials into reusable units that chain together in workflow templates using directed acyclic graph orchestration with conditional branching on success, failure, or always-run logic and configurable convergence gates. The RBAC system built on django-ansible-base provides granular permission control over organizations, teams, projects, inventories, and credentials at object-level granularity. Dynamic inventory sources pull host data from AWS EC2, Google Cloud, Microsoft Azure, VMware vCenter, and Red Hat Satellite, while credential management securely stores SSH keys, cloud tokens, and vault passwords with HashiCorp Vault and CyberArk integration for external secret retrieval. Notifications deliver alerts via Slack, email, PagerDuty, Mattermost, IRC, and webhooks, while activity streams log every action for compliance auditing. The Receptor mesh network distributes job execution across isolated container-based execution environments with capacity-aware scheduling and hop-node routing for network-segmented infrastructures. Upstream of Red Hat Ansible Automation Platform. Deploys via Docker Compose with PostgreSQL and Redis or via the AWX Operator on Kubernetes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Termix delivers a unified, self-hosted infrastructure control center that consolidates SSH terminals, remote desktop streaming, and fleet automation into an intuitive browser workspace that replaces proprietary tools like Termius. Administrators connect to Linux servers and desktop environments using embedded RDP, VNC, and Telnet protocols powered by Apache Guacamole without requiring local client installations. The multi-panel terminal interface supports four-way split screens, allowing operators to broadcast keystrokes simultaneously across multiple production hosts or execute saved reusable script snippets with dynamic parameters. Real-time multiplayer session sharing lets engineers invite teammates via secure, time-limited links with configurable read-only or collaborative write permissions for troubleshooting incidents. Advanced networking layers handle SSH jump hosts, SOCKS5 proxy chains, Warpgate relays, and port knocking sequences to access segmented private networks securely. Integrated SFTP file managers provide drag-and-drop file transfers with editable path bars, inline text editing, and folder synchronization across remote machines. Background telemetry monitors CPU loads, memory utilization, disk IOPS, and container statuses, while built-in session recording captures complete terminal sessions for compliance auditing. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

OpenMetadata builds a unified knowledge graph connecting schemas, tables, columns, dashboards, pipelines, ML models, and data products into one searchable catalog accessible at port 8585. The ingestion framework ships 130+ connectors covering Snowflake, BigQuery, Redshift, Databricks, PostgreSQL, MySQL, Kafka, Airflow, dbt, Tableau, Looker, Power BI, Metabase, and Superset, automatically extracting metadata on configurable schedules. Column-level lineage traces data flow across transformations, joins, and aggregations, while built-in data quality testing executes profiling and validation rules as data contracts with automated alerting on failures. Governance features include role-based access control, PII auto-detection, glossary term propagation, and domain-based ownership assignment. The native MCP server and AI SDK expose semantic search, lineage queries, and governance metadata as tools any LLM agent can call, enabling AI systems to discover and reason about enterprise data with full trust context. The architecture requires only PostgreSQL or MySQL plus Elasticsearch, no Kafka, no graph database, and deploys via a single Docker Compose file. Created by the founders of Apache Hadoop, Apache Atlas, and Uber's Databook, the platform has earned over 14,700 GitHub stars and adoption by 3,000+ organizations. Apache 2.0 licensed.

Mail-in-a-Box turns a single Ubuntu server into a fully functional email system with one setup command, installing and configuring Postfix for SMTP, Dovecot for IMAP, Roundcube for webmail, and Z-Push for Exchange ActiveSync push notifications in an automated sequence that would take days to replicate manually. The DNS server auto-configures the full suite of email authentication records: SPF, DKIM, DMARC, DNSSEC with DANE TLSA, MTA-STS, and SSHFP. Getting all of these right is what separates email that lands in inboxes from email that lands in spam, and most manual installations never achieve the complete set. Nextcloud integration adds CardDAV contact sync and CalDAV calendar sharing across devices. Let's Encrypt certificates provision and renew automatically for every hosted domain. The web control panel manages users, aliases, custom DNS records, and automated backups, protected by TOTP two-factor authentication. Daily health checks verify that services run correctly, ports remain open, TLS certificates stay valid, and DNS records resolve properly, alerting you before delivery problems develop. Multiple domains and users operate from one installation with internationalized domain name support. Built-in HTTPS static site hosting uses the TLS infrastructure already in place. Runs on a dedicated RepoCloud VPS with guaranteed resources, root SSH, and browser serial console for complete email sovereignty. CC0 public domain licensed.

QM is Y Combinator's internal multiplayer agent infrastructure that shifts AI agents from personal assistants to shared company operating layer. The headless TypeScript core runs on Node.js with Fastify handling HTTP, Slack integration via Bolt, and a web UI built with Vite and Lit. PostgreSQL stores sessions, memory, queue state, and audit logs. Every person and every Slack channel gets an isolated sandbox with its own durable file system, installed tools that persist across runs, private memory, keychain view, permissions, and background crons. The harness-agnostic architecture routes agent tasks through Pi, OpenCode, Codex, or Claude Code without vendor lock-in, with production implementations swapping via a single wiring file. Three org-level security postures gate execution: Strict requires human approval for every tool call, Auto applies automated content screening, and Dangerous removes all pauses. Skills are scope-owned and shareable by grant, with admin-gated promotion to the entire organization and skill packs importable from Git repositories. The web apps feature lets agents spin up custom internal applications published to specific users. The qm CLI bootstraps operator-owned deployment directories with digest-pinned release images, infrastructure rendering, secret management, and live verification checks for Docker, Fly.io, or AWS ECS Fargate targets. On RepoCloud, deploy QM on a dedicated VPS with PostgreSQL persistence, Docker socket access, root SSH access, and complete control over your multiplayer agent infrastructure, all under the MIT license.

With over 14,000 GitHub stars and a mission to become the world's most trusted document-signing tool, Documenso delivers a beautifully designed electronic signature platform that organizations can self-host for complete data sovereignty. The signing workflow handles everything from simple one-party signatures to complex multi-recipient documents with configurable roles including signers, approvers, viewers, and CC recipients, each with distinct permissions and notification flows. Document templates enable reusable signing packages with pre-configured fields and recipient patterns, eliminating repetitive setup for contracts, NDAs, and onboarding documents that teams process regularly. The PAdES-standard implementation ensures digital signatures are legally compliant and cryptographically verifiable, with complete audit trails documenting every action from document creation through final signature. Direct link signing allows recipients to access documents without email, enabling embedded signing experiences within existing applications and websites. The REST API provides programmatic document creation, recipient management, and webhook notifications for integrating signature workflows into CRM systems, HR platforms, and custom business applications. Team management features organize users into groups with role-based permissions, custom branding per team, and centralized billing for organizations with multiple signing workflows. SSO integration supports standard authentication providers for enterprise identity management. The TypeScript codebase built on Next.js and Prisma with PostgreSQL makes customization and contribution accessible to modern web developers. Zapier integration connects Documenso to thousands of third-party applications for automated document routing. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

The fediverse's answer to YouTube comes from French non-profit Framasoft: PeerTube is a TypeScript/Angular video platform where hundreds of independently operated instances federate over ActivityPub into one network. Videos you publish are discoverable across the whole video fediverse, and viewers can follow your channels from Mastodon or any ActivityPub platform - or plain RSS - without needing an account on your instance. The namesake innovation attacks video hosting's core cost problem: alongside HLS delivery, an optional WebRTC-based P2P layer lets concurrent viewers' browsers share video segments with each other, so a video going viral distributes its own bandwidth demand instead of crushing your server; instance redundancy extends this by letting friendly instances cache each other's videos. Livestreaming is first-class - stream via OBS or any RTMP software, host permanent streams, enable replays, and interact through live chat. Creators get channels, playlists, analytics, built-in video editing (trim, watermark), and an embeddable player for any website. There are no ads, no data mining, and no recommendation algorithm engineered for watch-time - the project's explicit design stance. Admins control federation policy, P2P settings, and theming; a plugin system extends the rest. AGPL-licensed, 300+ contributors, in active development since 2015.

Authentication that lives inside your application rather than behind a redirect to an external identity provider - SuperTokens takes a fundamentally different architecture from Auth0 and AWS Cognito. Three tiers make that work - frontend SDKs (React, Angular, Vue, vanilla JS, React Native) render overridable login UI and manage tokens; backend SDKs (Node.js, Python, Go) expose auth endpoints on your own API domain; and SuperTokens Core, the piece you host here, is the stateless HTTP service handling core auth logic, password hashing, token signing, and database operations against PostgreSQL. The recipe system keeps features decoupled: use email/password, social login, passwordless (magic links, OTP), phone-password, multi-factor authentication (TOTP, WebAuthn), user roles, and microservice auth - individually or combined; you can even use SuperTokens purely for session management alongside another login provider. Sessions are where it shines: rotating refresh tokens with theft detection, automatic access-token refresh, CSRF protection, and secure cookie handling out of the box - the details that become vulnerabilities when hand-rolled. Verification happens locally in your backend via cached JWT signing keys, so the Core stays off the hot path. Self-hosted means no user limits, free forever, with all user data in your database. Apache-licensed.

Powering authentication for over 15,000 GitHub stargazers and production deployments across startups and enterprises alike, SuperTokens delivers the complete login infrastructure that Auth0, Firebase Auth, and AWS Cognito charge premium prices for — entirely open source under Apache 2.0 with no per-user limits. The Java-based core service runs as a lightweight HTTP microservice that connects to PostgreSQL or MySQL and handles email-password login, passwordless magic links and OTP via email or SMS, social OAuth with Google, GitHub, Facebook, Apple, and any custom OIDC provider, phone-password authentication, and time-based one-time password multi-factor authentication. Session management uses rotating refresh tokens with anti-CSRF and anti-session-fixation protections, verifying tokens locally in your backend SDK without network round-trips to the core. Frontend SDKs for React, React Native, Angular, Vue, and vanilla JavaScript provide pre-built UI components for login, signup, email verification, and password reset flows, all customizable through an override system that lets you add pre- and post-API logic, custom hooks, and user event handlers. The built-in user management dashboard enables administrators to view users, reset passwords, revoke sessions, modify roles, and manage email verification status. Multi-tenancy and organization support powers B2B SaaS applications with tenant-level authentication configuration and Enterprise SSO via SAML and OIDC. Migration tools support bulk importing millions of existing password hashes, TOTP secrets, and role mappings. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Securing a SaaS product, running B2B onboarding, or replacing Auth0 and Keycloak with a stack they own - teams needing more than basic auth reach for ZITADEL, an open-source identity and access management platform built in Go. Its multi-tenancy model is the differentiator: a strict Instance, Organization, Project hierarchy isolates data and scopes policy at each level, with identity brokering (pre-built templates for Google, GitHub, Microsoft, Apple, plus generic OIDC, OAuth, SAML, and LDAP), domain discovery that routes users to the right organization by email domain, and delegated management so customers administer their own users and roles. Authentication covers OpenID Connect (certified, including device authorization and token exchange), SAML 2.0 as both IdP and SP, SCIM, FIDO2 passkeys for phishing-resistant passwordless login, and MFA via OTP, email, SMS, and U2F; machine-to-machine flows support JWT profile, PATs, and client credentials. The architecture is event-sourced - every mutation is an immutable event, yielding a complete audit trail - with relational projections for queries and no external session store, so it scales horizontally. API-first with gRPC and REST, extensible via Actions webhooks, and the same codebase self-hosted (Docker Compose or Helm on PostgreSQL) as in the cloud.

With over 15,100 GitHub stars and seven years of battle-tested production use, OneDev replaces entire DevOps toolchains — GitLab, Jenkins, Jira, Artifactory — with a single Java application that runs comfortably on a 1-core 2GB server for medium-sized projects. The platform unifies Git hosting with ANTLR-powered language-aware code search and symbol navigation, pull request workflows with configurable branch protection rules and required reviewers, and customizable issue tracking with scripted state transitions that automatically advance issues when code is committed, builds pass, or deployments complete. The GUI-based CI/CD editor creates pipelines without writing YAML, supporting typed parameters, matrix builds, job templates, cache management, and artifact publishing in a single visual interface. Jobs execute via Docker containers, bare metal shell, Kubernetes pods, or distributed agent pools, with web terminal access for live debugging and the ability to pause running jobs for inspection. Built-in package registries handle Docker images, npm packages, Maven artifacts, NuGet libraries, PyPI wheels, and RubyGems without external infrastructure. AI users can be assigned to issues and pull requests to autonomously implement features, review code, fix CI/CD failures, and resolve merge conflicts. The automated Kanban board supports rule-based card movement, time tracking, timesheets, and service desk ticket creation via email. Cluster deployment enables project replication across servers for high availability and horizontal distribution for scalability. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Forum software rebuilt on the modern web stack: NodeBB runs the classic bulletin-board format - categories, threads, local accounts - in real time, on Node.js over MongoDB, Redis, or PostgreSQL. WebSockets stream new posts into open topics as they're written and deliver instant notifications for follows, likes, and subscriptions; built-in chat supports side-by-side private conversations. The headline of recent versions is core ActivityPub federation: your forum can follow, share, and converse with other NodeBB instances, Mastodon, Lemmy, and anything else that speaks the protocol, turning an isolated community into a fediverse node. Everything beyond the common core is a plugin - more than 500 plugins and themes install in one click from the admin panel, covering SSO providers, search backends like Elasticsearch and Solr, galleries, calendars, and more. The theming engine extends base templates with SCSS/CSS on Bootstrap 5, plus a drag-and-drop widget system and custom HTML/CSS/JS injection. Operators get a real-time analytics dashboard, human-readable SEO-friendly URLs with semantic markup, multilingual UI, and full read and write REST APIs for integration. Mobile-first rendering means the same install works everywhere. For communities that outgrew phpBB but don't want Discourse's weight, NodeBB is the natural middle.

Cockpit puts Linux server administration in a web browser, rendering storage, networking, containers, and virtual machines as visual panels you click through instead of command-line syntax you memorize. It ships in every major Linux distribution and activates through systemd socket activation, consuming zero resources until someone connects on port 9090. What makes it different from other admin panels: every change through the web interface appears instantly at the command line, and every terminal change reflects in the browser in real time. No abstraction layer sits between the UI and the operating system, which means no configuration drift. Storage management covers disk partitioning, RAID arrays, LUKS encryption, LVM volumes, and NFS shares. Network configuration handles bonds, bridges, VLANs, and firewall zones through visual editors. Native Podman integration pulls images, creates containers, manages pods, and provides terminal access into running processes. KVM/libvirt support handles VM creation, cloning, snapshots, and live migration with console access. A built-in terminal provides shell access when the web interface is not enough, and the journal viewer filters systemd logs by severity and unit. Multi-server management connects additional hosts over SSH, presenting a unified dashboard across your entire infrastructure from one browser tab. Runs on a dedicated RepoCloud VPS with full root SSH access and browser serial console. LGPL licensed.

With over 15,000 GitHub stars and nearly nine years of active development, CapRover is the self-hosted PaaS that replaces Heroku's pricing with your own infrastructure while keeping the deploy-and-forget simplicity. The web dashboard manages application lifecycle from deploy through scaling — configure custom domains, environment variables, persistent volumes, instance counts, and nginx templates without touching config files or SSH. The CLI tool enables scriptable deployments with a single command from your terminal or CI/CD pipeline, while webhook-based deployment triggers automated builds from Git pushes. The one-click app marketplace provides over 100 pre-configured services including WordPress, Ghost, PostgreSQL, MySQL, MongoDB, Redis, Grafana, Portainer, and dozens more, each deployed as a Docker container with volumes and environment variables preconfigured. Automatic HTTPS provisions and renews Let's Encrypt certificates for every custom domain with one-click HTTP-to-HTTPS redirects. Under the hood, Docker Swarm orchestrates containers across multiple nodes for horizontal scaling and load balancing, while nginx handles routing with fully customizable EJS-generated configuration templates per application. Deployment supports four methods: CLI push, tarball upload through the web UI, Docker image reference, and Git repository connection. The build system supports Dockerfiles, captain-definition files with build packs, and direct Docker image pulls. NetData integration provides real-time server monitoring dashboards. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 14,000 GitHub stars and a growing global network of security deployments, CrowdSec turns every attack on any participating server into protection for the entire community. The security engine operates as a combined IDS/IPS and WAF, analyzing log sources from Nginx, Apache, SSH, WordPress, and over 50 other services to detect brute force attacks, port scans, web vulnerability exploitation, and credential stuffing in real time. When one server detects a new threat, the attacker's IP is shared through the community blocklist, proactively protecting thousands of other installations before the attacker can reach them. The built-in WAF powered by Coraza v3 inspects HTTP requests at the application layer, validates against OpenAPI schemas, and applies custom rules with flexible AND/OR condition mixing for precise threat detection. Bot detection serves challenge pages with client fingerprinting to distinguish legitimate traffic from automated scrapers and scanners. Remediation components block malicious IPs at multiple infrastructure layers including iptables, nftables, Nginx, HAProxy, Cloudflare, and AWS Security Groups through the detect-here-remedy-there architecture. The scenario-based detection system ships with default rules for common attack patterns and supports custom scenarios written in YAML with an expressive filter language. A centralized console provides real-time visualization of alerts, threat intelligence analysis, and management of multiple distributed security engines. GDPR compliant by design, all log analysis happens locally and raw logs never leave your infrastructure. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Grammar, punctuation, and style errors a dictionary lookup can't see: LanguageTool is open-source proofreading powered by a Java rule engine covering English, German, Spanish, French, Portuguese, Dutch, and 25+ other languages. Self-hosting the HTTP server is how you get Grammarly-class checking without sending every sentence you write to a third party - a real concern when the text being proofread is confidential email, legal drafts, or unreleased documentation. Your instance exposes the standard /v2/check API, so the official ecosystem plugs straight in: browser extensions for Chrome and Firefox accept a custom server URL, and integrations exist for VS Code, LibreOffice, Obsidian, Vim, Emacs, and many editors. Notably, self-hosting restores free browser-extension checking that the hosted service moved behind a premium subscription - your server, no character limits, no paywall. Detection quality is tunable: optional n-gram datasets (multi-gigabyte language models for en, de, es, fr, nl) teach the engine word-order and confusion-pair errors like there/their and brakes/breaks, and a fastText model improves automatic language identification. Everything runs offline once models are downloaded. The core is LGPL, the API is documented with Swagger, and rules are community- maintained and constantly expanding.

Stalwart replaces the traditional Postfix + Dovecot + SpamAssassin + calendar-server stack with one Rust binary that speaks every standard mail and collaboration protocol natively. JMAP, IMAP4rev2, POP3, SMTP, CalDAV, CardDAV, and WebDAV all run inside the same process — no glue scripts, no sidecar daemons, no version conflicts between components. The pluggable storage architecture lets operators choose RocksDB for single-node deployments, FoundationDB for distributed clusters, PostgreSQL, MySQL/MariaDB, or SQLite for the data store, S3/MinIO/Azure Blob for message blobs, and Elasticsearch or Meilisearch for full-text search, with Redis or the internal engine backing rate limiters and session state. Security features include S/MIME and OpenPGP encryption at rest, automated DKIM key generation with DNS publication, DANE and MTA-STS transport security, automatic ACME TLS provisioning, granular ACLs, rate limiting, and IP banning. The browser-based admin console manages accounts, domains, groups, mailing lists, SMTP queues, DMARC/TLS-RPT/ARF reports, and every configuration object without touching a config file, while the self-service portal at /account gives end users password reset and encryption key management. Multi-tenant support with per-tenant quotas enables hosting-platform deployments, and coordinator-less clustering via Zenoh or NATS scales horizontally by adding nodes. Deploy via Docker or the standalone binary. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL v3 licensed.

With 14,000 GitHub stars and 81 releases since March 2023, Stalwart is the most protocol-complete open-source mail server available — delivering JMAP, IMAP4rev2, IMAP4rev1, POP3, SMTP, CalDAV, CardDAV, and WebDAV from a single Rust binary that compiles to a memory-safe, zero-garbage-collection executable with predictable latency under load. The SMTP server implements DMARC, DKIMv2, DKIMv1, SPF, and ARC for complete message authentication with automatic DKIM key rotation, while transport security enforces DANE, MTA-STS, and SMTP TLS reporting to prevent downgrade attacks. Built-in spam filtering with statistical classifiers, DNS blocklists, and collaborative reputation databases eliminates the need for external Rspamd or SpamAssassin deployments. Encryption at rest protects stored messages with S/MIME or OpenPGP, and automatic TLS certificate provisioning via ACME supports TLS-ALPN-01, DNS-01, and HTTP-01 challenges without manual certificate management. The ManageSieve server enables server-side email filtering rules, while full-text search indexes message bodies and attachments for instant retrieval. Pluggable storage backends support RocksDB for embedded deployments, PostgreSQL, MySQL, and S3-compatible object storage for distributed architectures. LDAP and SQL-based authentication integrate with existing directory services, and the web administration panel manages domains, accounts, quotas, and DKIM keys. Security audited with memory safety guaranteed by Rust's ownership model. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.