With 13,800+ GitHub stars and active releases through 2026, Casdoor is the open-source identity platform that ships OAuth 2.0, OIDC, SAML 2.0, CAS, LDAP, SCIM 2.0, WebAuthn passkeys, TOTP multi-factor authentication, and Face ID biometric login in a single Go binary with a React web console — covering every authentication protocol your organization will ever need. Social login connects 50+ identity providers including Google, GitHub, Microsoft Azure AD, Facebook, WeChat, DingTalk, Apple, Twitter, and LinkedIn without custom code. The AI-first architecture includes a Model Context Protocol gateway for AI agent authentication and Agent-to-Agent protocol support for securing LLM-powered workflows. Built-in Casbin integration delivers authorization primitives beyond basic RBAC: attribute-based access control, relationship-based access control, and custom policy models through a unified engine. The organization-scoped multi-tenancy model isolates users, applications, and identity providers per tenant with customizable login pages, branding, and SMTP configuration. SCIM 2.0 endpoints automate user provisioning from HR systems and Active Directory. Official SDKs for Go, Java, Node.js, Python, and PHP accelerate application integration. The RESTful API exposes every resource for programmatic management. Comprehensive audit logs record authentication events and administrative actions. Deploy via Docker Compose with MySQL or PostgreSQL, the all-in-one SQLite Docker image for quick trials, or the official Kubernetes Helm chart for production clusters. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 14,000 GitHub stars and enterprise adoption by security-conscious organizations, Coder transforms how development teams provision, manage, and secure their coding environments. Every workspace is defined as a Terraform template, meaning infrastructure engineers can standardize development environments across EC2 instances, Kubernetes pods, Docker containers, or any combination, while developers get self-service provisioning that launches in seconds rather than days of manual setup. The WireGuard-based networking layer establishes encrypted tunnels between developer machines and remote workspaces, providing low-latency access without exposing ports or configuring VPN concentrators. Automatic idle detection shuts down unused workspaces after configurable periods, directly reducing cloud compute costs for organizations running hundreds of developer environments. The Coder Agents feature introduces native AI coding capabilities where the agent loop executes entirely within the control plane on self-hosted infrastructure, keeping LLM API credentials out of individual workspaces and eliminating credential exfiltration risks. Centralized model governance allows platform teams to approve specific AI providers and models, set per-user spend limits, and maintain complete audit logs of all prompts, tool calls, and agent activity. IDE integration supports VS Code through a dedicated extension, JetBrains IDEs via Gateway and Toolbox plugins, and browser-based code-server for web access. The template registry provides pre-built configurations for common development stacks. DevContainer support builds environments from standard devcontainer.json specifications. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

The movie half of the *arr stack: Radarr is a .NET collection manager that automates acquiring films for Usenet and BitTorrent users the way Sonarr does for TV. Add a movie once and Radarr handles the rest: it monitors indexers and RSS feeds, grabs a matching release the moment one appears, sends it to SABnzbd, NZBGet, qBittorrent, Deluge, Transmission, rTorrent, or another connected download client, then imports, sorts, and renames the file into your library structure. Quality profiles are the control surface - define allowed resolutions and a cutoff, and Radarr keeps upgrading files automatically, replacing a DVD rip when a Blu-ray release lands. Custom formats go further, scoring releases by codec, HDR metadata, release group, streaming source, or arbitrary regex so the copy you want always wins the pick. Failed downloads retry with another release automatically; a manual search shows every candidate and explains why one was skipped. Release parsing recognizes director's cuts, special editions, AKA titles, and hardcoded subs. Plex and Kodi integration handles notifications, library refreshes, and metadata like posters, trailers, and subtitles, and a calendar view tracks upcoming releases. It pairs naturally with Jellyseerr for request management and shares its API conventions with the whole *arr ecosystem.

Real-time collaborative Markdown behind your own firewall: HedgeDoc (formerly CodiMD, descended from HackMD's open-source edition) keeps team notes on team infrastructure. Share a note's URL and collaborators are editing together instantly - live cursors, changes appearing keystroke by keystroke - in a three-mode interface that toggles between raw Markdown, rendered preview, and side-by-side split. The Markdown dialect is extended where engineers need it: Mermaid, Graphviz, and Vega-Lite diagrams, MathJax for equations, syntax-highlighted code blocks, embedded content, and a presentation mode that turns a note into reveal.js slides with a single YAML header. A dropdown permission system controls each note - freely editable, limited to signed-in users, or locked read-only - and published notes become clean read-only pages for wider distribution. Revisions track every change with the ability to revert to any earlier version. The AGPL-3.0 codebase is light enough to run on a Raspberry Pi and deploys via Docker with PostgreSQL, MySQL, or SQLite. Authentication covers LDAP, SAML, OAuth2, and email. It deliberately stays a focused document editor - no page trees or kanban - and does that one job with excellent keyboard-first ergonomics for meeting notes, RFCs, runbooks, and shared scratchpads.

QM is Y Combinator's internal multiplayer agent infrastructure that shifts AI agents from personal assistants to shared company operating layer. The headless TypeScript core runs on Node.js with Fastify handling HTTP, Slack integration via Bolt, and a web UI built with Vite and Lit. PostgreSQL stores sessions, memory, queue state, and audit logs. Every person and every Slack channel gets an isolated sandbox with its own durable file system, installed tools that persist across runs, private memory, keychain view, permissions, and background crons. The harness-agnostic architecture routes agent tasks through Pi, OpenCode, Codex, or Claude Code without vendor lock-in, with production implementations swapping via a single wiring file. Three org-level security postures gate execution: Strict requires human approval for every tool call, Auto applies automated content screening, and Dangerous removes all pauses. Skills are scope-owned and shareable by grant, with admin-gated promotion to the entire organization and skill packs importable from Git repositories. The web apps feature lets agents spin up custom internal applications published to specific users. The qm CLI bootstraps operator-owned deployment directories with digest-pinned release images, infrastructure rendering, secret management, and live verification checks for Docker, Fly.io, or AWS ECS Fargate targets. On RepoCloud, deploy QM on a dedicated VPS with PostgreSQL persistence, Docker socket access, root SSH access, and complete control over your multiplayer agent infrastructure, all under the MIT license.

With nearly 14,000 GitHub stars and over 200 releases, Semaphore UI has established itself as the lightweight yet powerful alternative to enterprise automation platforms like Ansible AWX and Jenkins. Unlike AWX's heavyweight Kubernetes-dependent architecture, Semaphore ships as a single Go binary with zero external runtime dependencies — install it, run setup, and you have a production-ready automation server in minutes. The platform natively orchestrates Ansible playbooks, Terraform and OpenTofu infrastructure code, Terragrunt configurations, PowerShell scripts, Bash commands, and Python automation, all from a clean Vue.js web interface that displays task history, execution logs, and scheduling status at a glance. Semaphore supports concurrent task execution across multiple servers using distributed project runners, enabling horizontal scaling of automation workloads without complex clustering. The built-in inventory management system handles both static and dynamic inventory sources, while four-level RBAC (Owner, Manager, Task Runner, Guest) provides granular access control for team environments. Notifications flow to Slack, Microsoft Teams, Telegram, email, Rocket.Chat, and Gotify, keeping operators informed of failed tasks and deployment status. Integration with HashiCorp Vault secures sensitive credentials, and the comprehensive REST API with built-in Swagger documentation enables programmatic automation. Deploy via Docker Compose, Helm chart for Kubernetes, or native packages for Debian, Ubuntu, and RHEL-based distributions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Engineers who have outgrown Duplicati or rsync scripts tend to appreciate Kopia's design: encrypted, compressed, content-deduplicated snapshots in Go, stored in a repository on any storage you control - S3, Google Cloud Storage, Azure Blob, Backblaze B2, SFTP, WebDAV, or a plain filesystem. Encryption is mandatory and end-to-end: every block is encrypted client-side with AES-256-GCM or ChaCha20-Poly1305 using keys derived from your repository password, and even file names never leave the machine in plaintext. Blocks are packed into 20-40 MB blobs with random names, so the storage provider learns nothing about content or structure. Deduplication is automatic and content-based - identical data across files, snapshots, and even multiple machines backing up to the same repository is stored once. Policies govern everything per-directory: compression choice, retention (hourly through annual), scheduling, and ignore rules. Incremental snapshots are point-in-time records you can mount and browse like a filesystem. This deployment runs the Kopia repository server with its web UI, centralizing backups from multiple client machines over an authenticated API - each client connects with the server URL and certificate fingerprint, and users only see their own snapshots. Error correction, high-latency-tolerant caching, and both CLI and GUI round it out.

Automatisch runs your Zapier workflows on your own hardware - an open-source, self-hosted automation platform built as a direct alternative. Flows are chains of steps: one trigger (a polling or webhook event such as a new GitHub issue, a Stripe payment, or a form submission) followed by action steps that pass data downstream (post to Slack, append a Google Sheets row, update Notion). The visual builder deliberately mirrors Zapier's trigger-action model, so migrating existing Zaps requires no retraining and no programming knowledge. Roughly 60 integrations cover common business services - Slack, GitHub, Google Sheets, Notion, Stripe, Discord - and connections store credentials per service, with multiple accounts per app supported. Every execution runs on your own server: execution history, logs, and payload data never touch a third-party processor, which matters for GDPR, healthcare, and finance workloads. Error handling with retry logic, a REST API for programmatic flow management, and Docker Compose deployment round out the platform. The AGPL-3.0 Community Edition has no feature limits or per-task billing; an Enterprise Edition adds SSO, roles, and audit logs.

With 13,800 GitHub stars, adoption by OpenAI for ChatGPT's authentication infrastructure serving 800 million weekly active users, and governance under the Ory open-source ecosystem, Ory Kratos provides enterprise-grade identity management as a headless API server that separates authentication logic from user interface — enabling any frontend framework to consume standardized self-service flows for registration, login, recovery, verification, and profile management. Multi-factor authentication supports passkeys, WebAuthn security keys, TOTP authenticator apps, SMS one-time codes, email magic links, and backup recovery codes with configurable Authenticator Assurance Levels enforcing step-up authentication for sensitive operations. Social sign-in connects to any OpenID Connect provider including Google, GitHub, Apple, and Microsoft, plus enterprise SAML 2.0 federation for B2B single sign-on. Customizable identity schemas using JSON Schema define user profiles with flexible trait structures, while pre- and post-flow webhooks enable integration with CRMs, analytics, and compliance systems. The courier system handles email and SMS delivery for verification codes and password recovery links. Session management provides device tracking, forced logout, and configurable lifespans with privileged session elevation. Deploy alongside Ory Hydra for OAuth2/OIDC token issuance and Ory Keto for fine-grained permissions to build a complete identity platform. Docker Compose deployment with PostgreSQL. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Deployment decoupled from release: Unleash, the most popular open-source feature management platform on GitHub, is a Node.js server backed by PostgreSQL. Ship code dark, then control who sees it through activation strategies: gradual percentage rollouts, targeting by user ID, IP, hostname, or application name, custom constraints against your own context fields, and scheduled or time-limited releases. Strategies stack - a flag activates if any strategy matches - and strategy variants layer A/B versions on top of the on/off decision. Each flag carries per-environment configurations, so a feature can run at 100% in staging while canarying at 5% in production. Backend SDKs (Node.js, Java, Go, Python, Ruby, .NET, PHP, Rust, and more) fetch configuration and evaluate flags locally, so a flag check adds zero network latency to request paths; frontend SDKs for React, Vue, Svelte, iOS, Android, and Flutter evaluate through a proxy layer. Flag hygiene is built in: flags are typed (release, experiment, operational, kill-switch, permission) with expected lifetimes, and Unleash marks overdue flags as potentially stale and surfaces unknown flags your SDKs request but that don't exist. Self-hosting via Docker keeps flag data, targeting rules, and evaluation infrastructure entirely on your side.

Diaspora lets you run your own social network node that federates with thousands of others, creating a network with no central authority and no advertising engine mining your behavior. The defining feature is aspect-based sharing: organize contacts into groups like Family, Work, and Close Friends, then control exactly who sees each post with granularity that mainstream platforms have never matched. Hashtag-based discovery connects conversations across the entire federation regardless of which pod participants call home, building communities around topics rather than algorithmic engagement bait. The Ruby on Rails backend (now running on Puma with Sidekiq workers instead of the heavier Unicorn configuration) handles federation delivery, media processing, and notifications efficiently. Photo albums, video embedding, Markdown posts, mentions, reactions, and resharing provide familiar social primitives for rich communication. Cross-posting bridges to Twitter and Tumblr maintain your presence on legacy networks while your canonical data lives on your own infrastructure. With 13,700+ GitHub stars and 270+ contributors since its 2010 launch, Diaspora proved early that social media can work without surveillance capitalism. The Docker Compose deployment runs the application alongside PostgreSQL, Redis, Sidekiq workers, and Nginx, providing a production-ready pod for your community.

Sketch a wireframe, get working code: Draw a UI turns hand-drawn layouts into web interfaces. It pairs the open-source tldraw canvas with an OpenAI vision model: you sketch a layout - boxes, labels, buttons, arrows, whatever communicates the idea - select the drawing, and click Make Real. The app snapshots your selection as a PNG, sends it to the vision API with instructions to return a single HTML file styled with Tailwind CSS, and renders the result in an iframe directly on the canvas next to your sketch. The loop is iterative: annotate the generated prototype or redraw parts of it, select both the sketch and the previous result, and generate again - the model receives the earlier HTML as context and produces an updated version. Built by Figma engineer Sawyer Hood as one of the first viral GPT-4 Vision demos and the basis for tldraw's "Make Real", it is a Next.js app that runs against your own OpenAI API key. Self-hosting matters here: the upstream demo ships without authentication, so a private deployment keeps your API key from being drained by strangers. MIT-licensed.

OpenSearch is a search and analytics platforms, powering full-text search, log analytics, observability, and AI-powered vector retrieval at petabyte scale. The distributed engine provides BM25 full-text search alongside k-NN vector search using NMSLIB, Faiss, and Lucene libraries, enabling semantic search, hybrid search combining keyword and vector scoring through normalization processors, neural sparse search, and retrieval-augmented generation workflows with built-in ML Commons for model hosting. OpenSearch Dashboards delivers interactive visualization with Discover for log exploration, custom dashboards, alerting, anomaly detection using Random Cut Forest algorithms, and Security Analytics with detection rules mapped to MITRE ATT&CK. Native Prometheus integration with full PromQL support unifies metrics alongside logs and traces in a single observability interface, while Data Prepper handles telemetry ingestion from OpenTelemetry collectors, Fluent Bit, and Logstash-compatible pipelines. SQL and Piped Processing Language queries with a visual PPL builder enable analysts to query data without learning the native DSL. Index State Management automates index lifecycle with rollover, shrink, and delete policies, while cross-cluster replication and searchable snapshots on S3-compatible storage provide disaster recovery. Scoped API keys, field-level security, document-level security, and audit logging deliver enterprise-grade access control. Docker Compose deploys multi-node clusters alongside the Kubernetes operator for orchestrated production environments. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

MeterSphere is the open-source continuous testing platform that brings test management, API testing, and AI-powered automation into a single self-hosted environment. The Spring Boot Java backend handles test execution with the JMeter engine while the Vue.js frontend delivers a responsive interface for managing test cases, plans, defects, and reports across projects. The built-in AI assistant leverages large language models to auto-generate functional test cases and API interface definitions, reducing manual test creation effort. Test management covers the complete lifecycle from writing and reviewing cases in list or mind-map views, through test plan creation with single plans and plan groups, to defect tracking with customizable templates and workflow rules. API testing combines Postman-like ease of use with JMeter-level flexibility, supporting interface debugging with server-side and local execution, API definition with visual request and response editors, interface mocking with configurable headers and body parameters, scenario automation with visual orchestration, and detailed test reports with automatic generation. The system-organization-project hierarchy supports up to 30 users in the community edition with role-based access control, file management, and configurable notification channels. MySQL stores application data, Kafka handles message queuing, MinIO provides S3-compatible object storage, and Redis manages caching. The plugin marketplace extends testing capabilities and enables DevOps pipeline integration. On RepoCloud, deploy MeterSphere on a dedicated VPS with Docker, root SSH access, and complete control over your testing infrastructure, all under the GPLv3 license.

Matrix's flagship client, built by the protocol's creators: Element brings the decentralized open standard for real-time communication to web, desktop, iOS, and Android. Paired with a Matrix homeserver, it delivers Slack-quality team messaging where you own every message, file, encryption key, and byte of metadata. End-to-end encryption is on by default, built on Olm and Megolm - the Double Ratchet algorithm family Signal popularized, extended for large-room scalability and publicly audited by NCC Group. Messages encrypt per-device with cross-signed device verification, so even a compromised server yields nothing readable. Federation is the defining capability: like email, users on different homeservers converse seamlessly, and 30+ bridges connect Matrix rooms to Slack, Discord, WhatsApp, and Telegram, so moving to sovereign infrastructure doesn't sever contact with anyone. Rooms support threads, reactions, file sharing, and voice and video calls via Element Call. The result is digital sovereignty chosen by governments and enterprises across Europe: your data sits on your server in your jurisdiction, portable to any other Matrix host because the protocol is an open standard. Apache-2.0 licensed, with no per-user fees at any scale.

OpenSEO provides an alternative to the $100+/month SEO suite monopoly by connecting directly to DataForSEO APIs on a pay-as-you-go basis — you bring your own API key and pay only for the queries you actually make. The platform delivers focused workflows for keyword research with volume, difficulty, CPC, intent, and live SERP inspection; rank tracking with historical position monitoring; backlink analysis with referring domain quality scoring; technical site audits that crawl pages and surface issues; competitor insights comparing SERP positions across keyword sets; and AI visibility monitoring that tracks brand mentions, citations, and prompts across AI models. The integrated MCP server exposes all tools to AI coding agents including Claude Code, OpenClaw, Hermes, and Cursor, while Agent Skills provide reusable SKILL.md workflows that guide agents through complex SEO research tasks. Google Search Console integration reads first-party performance data including clicks, impressions, CTR, and position metrics with URL-level index status inspection. The Prompt Explorer compares how different AI models respond to SEO-relevant queries. Self-host via Docker for personal use or deploy to Cloudflare for team access with automatic database backups. The hosted version at openseo.so adds a 28% markup on DataForSEO requests. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 13,000 GitHub stars and active monthly releases, Mailcow delivers a production-ready mail server infrastructure through Docker Compose orchestration of twelve integrated containers. The stack pairs Postfix as the MTA handling SMTP traffic with Dovecot for IMAP and POP3 retrieval featuring the Flatcurve full-text search engine, while Rspamd provides machine-learning-powered spam filtering with Bayesian classification, DKIM signing, and ARC support. ClamAV scans attachments for malware including Office document macro analysis via Olefy, and SOGo serves as a responsive webmail client with CalDAV, CardDAV, and Microsoft ActiveSync synchronization. The admin panel manages multiple domains, per-user spam score thresholds, quarantine review, black and whitelists, temporary spam aliases, mailbox quotas, and TLS enforcement policies for both inbound and outbound messages. Security features include two-factor authentication via TOTP, WebAuthn, and Yubikey OTP, a Fail2ban-like Netfilter integration for brute-force protection, and automatic SPF, DKIM, and DMARC configuration. The ACME container handles Let's Encrypt certificate generation with DNS-01 challenge support, while Postfix TLS-Pol provides MTA-STS and DANE/TLSA resolution for encrypted transport. Built-in imapsync enables periodic migration from remote mailboxes, and the REST API allows programmatic management of all server resources. MariaDB stores user data, Redis caches configuration and sessions, and Unbound provides local DNSSEC-validating DNS resolution. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

A recipe manager that feels like a consumer product rather than a homelab experiment: Mealie pairs a FastAPI backend with a reactive Vue frontend for the most polished self-hosted meal planning around. The killer feature is the recipe scraper: paste a URL from hundreds of supported cooking sites and Mealie imports the ingredients, steps, times, and photos automatically. Structured HTML/JSON paste, a Markdown-capable manual editor, and imports from other recipe apps (like Tandoor) cover everything else. Meal planning uses a drag-and-drop calendar with breakfast, lunch, dinner, and snack slots, plus rule-based random recipe insertion - constrain the pool by tags or categories per meal type or weekday. Shopping lists link recipes so all ingredients land in one place, organized into supermarket sections, and update in real time for everyone in the household. The multi-tenancy model is genuinely thought through: isolated Groups can host multiple tenants, and Households within a group share recipes and organizers while keeping meal plans and shopping lists private. Cookbooks group recipes by your own criteria, a cooking mode stays readable on a phone propped against the backsplash, and 35+ language translations ship built-in. A fully documented REST API and scheduled webhooks (e.g., today's meal plan to Home Assistant) make it automatable, with SQLite or PostgreSQL storage and automatic backups.