Self-hosted and plugin-based, DVinyl keeps vinyl, CDs, cassettes, books, movies, video games, LEGO sets, and board games in one catalog, with cover art and metadata fetched for every item. Adding an item takes an ID, a camera scan of its barcode, or a bulk import from Discogs or Goodreads. Each media type is a plugin that switches on per collection, with Discogs behind music, TMDB behind film, IGDB behind games, and Rebrickable behind LEGO. Once cataloged, a collection appears as a grid, a compact table, or virtual shelves with spine view and customizable furniture. Custom lists, track playlists, and a wishlist of items still being hunted sit alongside. Music collections get live value estimates with price history charts, games show completion times, and printable QR codes and barcodes label the physical copies. Separate collections can belong to you, the family, or a room, each with admin, editor, and viewer roles and optional OIDC single sign-on through Authentik, Keycloak, Authelia, or pocketID. Read-only links and QR codes let anyone browse a whole collection or just one section. Fourteen themes in light and dark, a modular dashboard, and a Markdown info page with photos make each instance personal. A no-code editor adds custom item types. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Deploying container updates without blind surprises is what Drydock delivers through a monitor-first inspection plane that evaluates image registries, scans CVE vulnerabilities, and automates rollbacks across distributed Docker infrastructure. Systems engineers track container fleets across twenty-three public and private registries including Docker Hub, GitHub Container Registry, Harbor, and Quay using cursor-based pagination and semver classification. The integrated Update Bouncer runs Trivy and Grype static scanners against incoming candidate layers, blocking deployments that fail configurable CVE severity policies while verifying cryptographic signatures through cosign. Operators configure declarative update schedules with stabilization countdown gates that hold back brand-new releases until defined burn-in periods elapse. When updates execute, Drydock creates pre-upgrade container snapshots and evaluates post-launch container health checks, instantly restoring previous image digests and network configs if failures occur. Distributed Portwing edge agents stream live container output and system logs over encrypted WebSockets, allowing central consoles to coordinate remote daemon updates without opening inbound host firewall ports. Automated event triggers dispatch granular notifications and update payloads across seventeen communication channels including Slack, Discord, Telegram, and Home Assistant MQTT brokers. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

"Somewhat lightweight, low-friction" is how Silicon Notes' author describes the personal knowledge base - written after DokuWiki's editor "drove me mad" and no existing wiki quite fit. The philosophy is that small frequent annoyances compound into cognitive load with no return, so everything here is optimized for frictionless daily use. Notes are written in plaintext Markdown and rendered as clean HTML with Pygments syntax highlighting for code blocks; pages get bi-directional relationships (backlinks), so the knowledge base becomes a connected web rather than a folder tree; and full-text plus title search retrieves anything fast. A table of contents lives in the left sidebar - "where it belongs" - editable while you read without scrolling away. Page history tracks revisions for auditing and rollback, JSON export/import keeps everything portable, and the mobile layout is genuinely usable. The stack is deliberately minimal: Python and Flask with Mistune for Markdown and SQLite for storage - no big frameworks, just a few small dependencies. One honest caveat: there is no built-in authentication, so deploy it behind a VPN, private network, or reverse-proxy auth layer. For a solo engineer's brain, it is exactly enough.

Stormkit delivers a self-hostable PaaS that eliminates vendor lock-in while providing Vercel-class deployment workflows. The Go backend handles build orchestration, hosting, and background job processing while the React frontend provides a complete management dashboard for applications, environments, and team collaboration. Git integration with GitHub, GitLab, and Bitbucket enables push-to-deploy workflows where every commit triggers automated builds with preview links posted directly to pull requests. Serverless functions use filesystem-based routing — each TypeScript or Node.js file in the API directory becomes an endpoint automatically, deploying to AWS Lambda with configurable timeouts. PostgreSQL database schemas ship with automatic migrations, isolated credentials per environment, and secure environment variable injection preventing credential leakage between staging and production. Custom domains provision TLS certificates automatically through Let's Encrypt with support for custom certificates and headers. The environment system creates isolated deployment contexts for production, staging, and development with independent variables, domain bindings, and auto-publish rules per branch. Privacy-respecting server-side analytics track visitors, referrers, and top paths without client cookies or third-party scripts. Role-based access control manages team permissions across applications. Docker Compose deployment provisions the full stack including the API server, hosting service, build runner, and worker server. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

LinkBreeze is a self-hosted link-in-bio platform that lets you publish unlimited, fully themed link pages from your own server instead of renting one by the month. A guided setup wizard covers the admin credentials, profile, and theme, then a floating phone-frame preview refreshes as you edit while autosave stores your changes. Each page gets its own slug, theme, SEO tags, QR code, and analytics, so one install can serve a personal profile, a band, and a shop. Eleven built-in themes cover Aurora, Glassmorphism, Neon Cyberpunk, and Terminal Mono, backed by a token customizer for fonts, backgrounds, card styles, and raw CSS. Links pull in favicons automatically, accept thumbnails, and can be scheduled to appear and vanish on set dates, while embed widgets drop in YouTube, Spotify, SoundCloud, Vimeo, and Bandcamp players. A migration wizard imports profiles from Linktree, Bento, Hopp.bio, LittleLink, or an HTML or JSON export. Visitors can subscribe with an email address that you export to CSV, save your page as a vCard contact, or scan a QR code that downloads as SVG or PNG. Cookieless analytics track views, clicks, referrers, devices, and countries with hashed visitor IPs, and Plausible, Umami, Matomo, or Google Analytics can be added with one paste. The admin panel supports TOTP two-factor authentication, a UTM builder, JSON backup and restore, and seven interface languages. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Paste some text, hit save, share the link - Hasty Paste is a fast, minimal pastebin written in Python on the async Quart framework, named, by its author's own admission, "because you use it so fast without a care in the world." No accounts, no authentication, no friction - built for the everyday case of handing a debug log, config snippet, or stack trace to someone in tech support or a chat channel. Pastes get randomly generated IDs, with an optional "long" ID mode that makes brute-force URL guessing impractical, and expiry times ensure throwaway content actually gets thrown away. Optional Pygments syntax highlighting makes code readable, a dark theme spares your eyes, and the whole interface works without JavaScript - it renders in terminal browsers and under the strictest script blockers. Storage is a custom flat-file system (no database), caching runs internally or through Redis for busier instances, and a REST API plus the companion "Hastily Paste It" CLI script enable piping command output straight into a paste from the terminal. The Alpine-based Docker image is tiny, resource usage is minimal, and the license is AGPL.

For teams that need ISO 27001, NIS2, and GDPR evidence without handing compliance data to a SaaS vendor, ISMS Builder is a self-hosted information security management system for policies, risks, assets, audits, and incidents. Compliance managers move policies from draft through review to approved and archived, and recipients confirm each one through a token link that needs no login. Security officers close gaps in a Statement of Applicability that cross-maps BSI IT-Grundschutz, NIS2, EUCS, the EU AI Act, and the Cyber Resilience Act, with ISO 27001 controls imported from their own licensed copy. Risk owners keep treatment plans, turn Greenbone and OpenVAS reports into risk drafts, and score assets for confidentiality, integrity, availability, and authenticity. Data protection officers run records of processing, processor agreements, impact assessments, data subject requests, a 72-hour timer, and a deletion log with email alerts. The CISO inbox collects incidents, including reports from a public form that needs no login, beside a 30-item NIS2 Article 21 checklist and Article 23 deadline alerts. Auditors work from a findings register, a compliance matrix, and an exportable audit log of every create, update, delete, and login. Administrators enforce TOTP two-factor sign-in, choose among German, English, French, and Dutch, run semantic search locally through Ollama, and publish approved policies to Nextcloud or ownCloud as PDFs. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Created to eliminate the configuration fragmentation plaguing multi-device Homelab setups and small-team infrastructures, NetsGo merges what typically requires three separate tools — a tunnel daemon, a management panel, and a monitoring stack — into a single Go binary that starts with one command and listens on one port. The server exposes HTTP, TCP, and UDP tunnels, a built-in Web console for node management, a REST API for automation, and real-time traffic statistics with per-client bandwidth limiting, all sharing default port 9527 so firewalls and reverse proxies need only a single rule. Version 0.1.11 introduced Client-to-Client P2P tunnels via WebRTC DataChannel with three selectable transport strategies — Server relay, Prefer P2P with automatic fallback, and P2P only — reducing latency for direct connections while maintaining the centralized control plane. The management console displays every connected client's online status, authentication tokens, tunnel configuration, active transport mode, P2P candidate gathering progress, and cumulative byte-level traffic counters updated every second. Unlike frp or rathole which delegate management to external plugins or configuration files, NetsGo provides built-in client key generation, tunnel target migration between nodes, SOCKS5 proxying, IP-whitelist console access, and one-command server upgrades. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

PRISM consolidates passive reconnaissance, credential leak detection, and network asset mapping into a unified operational dashboard to replace fragmented command-line security tools. Analysts can launch simultaneous multi-source investigations against domains, internet protocol addresses, email mailboxes, phone numbers, and online handles to uncover domain registrations, open network ports, cryptographic certificates, and historical web archives. The platform interrogates threat feeds and leak repositories to expose credential leaks, dark web mirrors, and email routing anomalies with automated SMTP mailbox verification. Cross-platform identity engines crawl thousands of social networks and public registries to correlate aliases, discover leaked commit identities, and trace digital footprints across the web. Discovered assets render into interactive entity relationship graphs alongside geographic internet protocol maps to help investigators visualize infrastructure clusters and ownership links. An automated operational security calculator evaluates exposure vulnerabilities across identity, web, and infrastructure vectors, producing an aggregated risk score with granular hardening recommendations. Scheduled watchlists continually monitor target infrastructure, dispatching webhook notifications to chat channels whenever new subdomains, ports, or credential leaks appear. Investigators can export comprehensive audit dossiers as self-contained HTML files, styled PDF documents, or structured spreadsheets. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Built on Elixir's fault-tolerant OTP runtime, Tymeslot delivers the complete scheduling toolkit that Calendly charges for and Cal.com relicensed away from open source in 2026. Share one booking link and let clients pick available slots — your calendar stays synchronized and double-bookings disappear automatically through real-time availability checking against Google Calendar, Microsoft Outlook, and any CalDAV server including Nextcloud. Meeting types support configurable durations, buffer times, and availability windows that clients can book without email back-and-forth. Phoenix LiveView powers the real-time UI with WebSocket connections that update instantly as bookings arrive, without client-side JavaScript framework overhead. The platform attaches Zoom video rooms to confirmed bookings through your own Marketplace app credentials, sends confirmation and reminder emails via SMTP, Postmark, SendGrid, Mailgun, or AhaSend, and supports custom booking page themes with embed options for integration into existing websites. Circuit breakers, connection pooling, and graceful degradation maintain availability during provider outages. Authentication supports local accounts, GitHub OAuth, and reCAPTCHA protection on public booking forms. Self-hosting deploys as a single container with PostgreSQL embedded — no separate database container required. Two named volumes persist uploads and database state, while the same image powers the managed cloud at tymeslot.app so self-hosted users get identical features without a crippled community edition. Deploy via Docker, Cloudron with automatic updates, or Railway from a community template. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Visual drag-and-drop assembly replaces manual text editing in Dock-Dploy, a Docker Compose builder and configuration management suite that turns complex multi-service container topologies into validated YAML manifests. DevOps engineers and self-hosters can visually assemble application stacks by selecting container base images, defining healthcheck probes, mapping bridge networks, and assigning persistent volume mounts through a reactive web interface. An integrated marketplace catalog allows teams to search, preview, and import battle-tested templates for services like PostgreSQL, Redis, and Nginx with one click. Real-time Zod schema validation inspects every service parameter as you type, flagging port collisions, missing environment variables, and malformed volume syntax before deployment. A split-screen CodeMirror editor provides continuous synchronization between graphic form fields and generated YAML definitions with automatic code sanitization and clipboard exports. Beyond Compose stacks, operators can design blueprint templates, generate reverse proxy routing profiles, and assemble recurring cron schedules for automated backup and maintenance routines. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

MikroTik Manager is a web control plane for whole RouterOS fleets, built so that a bad VLAN change reverts itself instead of costing you a drive to the site. Before any risky edit, Change Guard saves a restore point on the device and arms a scheduler; if a fresh connection cannot reach the router afterwards, it rolls itself back. Lockout prediction simulates each change against live device state and refuses one that would cut management access, naming the exact port and VLAN at fault. Config Health audits for settings RouterOS accepts but silently ignores. Day to day, a live dashboard tracks availability, wireless clients, and alerts delivered by email, Slack, Discord, Telegram, or ntfy. Switch faceplates, per-port client views, VLAN copy wizards, bulk SSID deployment, RF health charts, rogue AP detection, and a guest Wi-Fi captive portal wizard cover the wired and wireless side. A rule builder handles firewall and NAT, topology maps come from LLDP, CDP, and MNDP, and a built-in NetFlow collector attributes traffic to clients and applications. Firmware rolls out in canary waves that halt on failure, and every configuration snapshot supports diffs and one-click rollback. OIDC single sign-on, TOTP two-factor, role-based access, and scoped API tokens protect the console, while sites group devices per customer network. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Run every TV, menu board, kiosk, and video wall from one browser dashboard with ScreenTinker, a digital signage CMS you host yourself, with no per-screen license fees. Players cover Android TV, Fire TV, Samsung Tizen, LG webOS, Amazon Vega OS, Roku, Raspberry Pi, Windows, ChromeOS, and any web browser. Upload images and video, turn each PDF page into a slide, or design animated decks in the slide editor with templates, optional voiceover, a music bed, and an optional AI designer that works from a prompt using your own model endpoint. Widgets add clocks, weather, RSS tickers, moderated social walls, live IPTV streams, and iCal or JSON data bound straight into a slide. A weekly calendar handles recurring schedules, priorities, and time zones, and Preview at shows what a given screen will play at any chosen moment. Group screens to push playlists and bulk commands, split displays into zones, or join several panels into a video wall with bezel compensation. Live remote control, CSV proof-of-play reports, and offline email alerts keep a fleet in check, while web and Android players cache content and keep playing through outages. Workspaces, six role levels, optional approval before publishing, OIDC single sign-on, white-label branding on your own domain, and a scoped REST API serve agencies and larger teams. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Where Miniflux strips reading down, FreshRSS gives you knobs - the feature-rich pole of self-hosted RSS, comfortable with thousands of feeds. It's a multi-user PHP aggregator (host family and friends on one instance, with an anonymous reading mode) with the reading workflow refined over a decade: favorites, custom tags, powerful filter and search queries, three reading views, and statistics that reveal each site's publishing frequency - useful for pruning subscriptions. Two properties make it the standard choice. First, the Google Reader-compatible API (plus a Fever API) syncs with virtually every serious RSS client - Reeder, NetNewsWire, ReadYou, FeedMe, Fluent Reader - so your phone reads from your server. Second, native WebSub support means compatible sources (WordPress, Blogger, Medium, Friendica) push new articles instantly instead of waiting for polling. A 50+ extension ecosystem adds what truncated feeds omit - full-text content fetching, reading-time estimates, trending views, auto-unsubscribe for dead feeds - alongside community themes and custom CSS. OPML import/export keeps subscriptions portable, a CLI handles administration, and article sharing posts to many services. AGPL-licensed, running on SQLite, MySQL, or PostgreSQL. Feedly Pro's feature set, minus Feedly's subscription and its algorithms.

When a music library is full of wrong tags, missing covers, and blank ratings, Tagr lets you fix the whole collection from any browser, on desktop or phone. Three roles divide the work on your own server. Admins mount a music folder, press scan, and get a searchable table of every track, with sortable and filterable columns, more than 40 editable fields, and room for custom tags. Taggers make the changes: edit fields inline, swap album art, and match one song or a whole selection against MusicBrainz, ticking which fields to overwrite. Mistakes are cheap, because every edit is stored in a persistent change history with a revert action, viewable per song or per folder. Rule-based smart playlists, such as every track with an empty comment, show what still needs attention. Listeners browse and play without edit rights, using the waveform player, a Recently played view, and optional ListenBrainz scrobbling that each person connects to their own account. Supported formats include MP3, FLAC, WAV, AAC, OGG, M4A, M4B, WMA, AIFF, and Opus, with changes written straight back into the files. Swipe-friendly panels, an installable PWA, and five interface languages make the phone a comfortable place to work. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

BitRouter is a context-aware LLM router that learns which model delivers the cheapest successful outcome per workflow step, cutting agent costs by up to 80% while maintaining 96% quality versus all-frontier baselines. Point any agent runtime at http://localhost:4356 with a one-line OPENAI_BASE_URL change and BitRouter routes to OpenAI, Anthropic, Google, Groq, DeepSeek, Mistral, Moonshot, MiniMax, Nvidia, and any OpenAI-compatible endpoint simultaneously, normalizing authentication, streaming, and cross-protocol translation between wire formats. The act-observe-evaluate-learn loop traces every hop with cost, tokens, and latency attribution, scores each decision against a versioned policy-lock.yaml, then tightens routes automatically with no LLM judge in the path. Native MCP gateway auto-discovers tools from connected servers and makes them routable and governed alongside model calls. Agent Client Protocol integration enables the TUI to manage Claude Code, Codex, OpenCode, OpenClaw, Gemini, and Copilot sessions in real time with inline tool-call approval and live streaming. Built-in guardrails inspect, redact, or block risky content before requests leave your network. Virtual keys scope API access per agent or user without exposing upstream credentials. Per-agent spend caps and loop guards contain runaway cost automatically. Multi-account failover reroutes mid-run so rate limits never re-pay completed work. Ships as a single Rust binary via npm or Cargo. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Telegram Desktop's export is a file you make once by hand; Telegram Archive is a self-hosted backup that keeps saving your chats on a schedule and in real time, then lets you read them in a viewer that looks like Telegram. After one login with the code Telegram sends you, it stores messages, photos, videos, voice notes, stickers, documents, and link previews, saving each file once even when several chats share it. A live listener captures new messages, edits, and reactions as they happen, and a daily full pass fills any gaps. Every edit keeps its earlier text as a version, and with deletion tracking switched on, deleted messages stay in the archive marked as deleted. The viewer offers folders, forum topics, archived chats, pinned messages, polls, shared media, and search across every chat, plus a What changed feed of deletions, edits, and transcripts. Voice notes can be transcribed into searchable text by a server you run or rent. Family or colleagues get logins limited to chosen chats, or a share link that opens a single chat. One archive holds several accounts, a Telegram Desktop export can be imported for older history, and twelve themes suit phones and desktops. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0-or-later licensed.

Authors delete listings, and the 3D models go with them, so Thingport stores its own copy of every printable file you import, in a self-hosted library you control. Ten sites feed the library, including MakerWorld, Printables, Thingiverse, and MyMiniFactory: paste a link or use the browser extension, and a model arrives with its files, photos, description, tags, author, and source link. Synced collections add newly bookmarked models as often as every hour. Files you already own come in as STL, 3MF, STEP, OBJ, or LightBurn uploads, ZIPs, folder trees, or drops into a watched consume folder. Each model gets an interactive 3D viewer with a thumbnail for every plate of a multi-plate 3MF. On first open, a check flags surface holes, non-manifold edges, flipped faces, and loose fragments before you slice. Sort with nested categories, collections, and tags, mark favourites, and find anything with full-text search. Optional AI sorts imports into your categories and tidies descriptions, using a local Ollama model or a cloud API. Open any file in Bambu Studio, OrcaSlicer, PrusaSlicer, Cura, or Creality Print, or download a model, tag, or collection as one ZIP. Every user gets a separate library, with invite-only registration, email verification, and single sign-on. A dashboard shows library statistics, profiles show a year-long activity heatmap, and MCP lets an AI assistant work with the collection. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.