Security scanners each report in their own format, and DefectDojo is the self-hosted platform that imports those reports and keeps a single, triaged list of findings. Reports in mixed formats? More than 350 built-in parsers read output from Burp Suite, ZAP, Trivy, Tenable Nessus, SonarQube, Snyk, and Checkmarx, and Generic Findings Import covers tools without a parser through CSV or JSON files. The same scan every night? Reimport adds new findings, can close the ones that vanished, and reopens the ones that return, while deduplication ties repeat detections inside an asset to their original. Decisions already made? False positive, out of scope, and risk accepted statuses survive reimport, so nobody triages the same noise twice. A deadline on every fix? Severity-based SLA countdowns flag breaches and can notify the users assigned to each asset, and full risk acceptances carry notes, files, and an expiry date that returns findings to active by default. Many teams, many applications? Organizations, assets, engagements, and tests mirror how security work is organized, with permissions that cascade downward. Pipelines that should report themselves? The REST API and CI/CD engagements import results automatically, and findings push to Jira as tickets. Someone outside security wants a summary? Dashboards track metrics, and a widget-based report builder produces HTML reports that print to PDF. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.

With over 35,000 GitHub stars and 460 contributors, Medusa is the headless commerce framework that gives development teams full ownership of their e-commerce backend without license fees, per-transaction charges, or revenue sharing. The modular architecture ships over 18 domain modules covering products, collections, categories, inventory, pricing, carts, orders, payments, fulfillment, promotions, customers, users, API keys, and stock locations, each independently usable and replaceable. REST and GraphQL APIs expose every commerce operation to any frontend framework — official starters exist for Next.js with community options for Nuxt, Remix, and Gatsby. The React-based admin dashboard provides out-of-the-box order management, product maintenance, promotions configuration, B2B accounts, and multi-warehouse inventory, extensible via the Admin SDK for custom views and workflows. The workflow engine orchestrates long-running commerce processes like checkout, fulfillment, and returns with compensating transactions for reliability. Over 200 official and community plugins integrate Stripe, PayPal, Klarna, Algolia, Meilisearch, SendGrid, Mailchimp, Contentful, Sanity, and Klaviyo. Native multi-region and multi-currency support handles tax-inclusive pricing, region-specific payment and fulfillment providers, and localized storefronts from a single backend. Enterprises including Viessmann, Makro PRO, and INSPIRED Pet Nutrition run Medusa in production. Self-hosting deploys via Docker or directly on Node.js with PostgreSQL and Redis. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

The movie half of the *arr stack: Radarr is a .NET collection manager that automates acquiring films for Usenet and BitTorrent users the way Sonarr does for TV. Add a movie once and Radarr handles the rest: it monitors indexers and RSS feeds, grabs a matching release the moment one appears, sends it to SABnzbd, NZBGet, qBittorrent, Deluge, Transmission, rTorrent, or another connected download client, then imports, sorts, and renames the file into your library structure. Quality profiles are the control surface - define allowed resolutions and a cutoff, and Radarr keeps upgrading files automatically, replacing a DVD rip when a Blu-ray release lands. Custom formats go further, scoring releases by codec, HDR metadata, release group, streaming source, or arbitrary regex so the copy you want always wins the pick. Failed downloads retry with another release automatically; a manual search shows every candidate and explains why one was skipped. Release parsing recognizes director's cuts, special editions, AKA titles, and hardcoded subs. Plex and Kodi integration handles notifications, library refreshes, and metadata like posters, trailers, and subtitles, and a calendar view tracks upcoming releases. It pairs naturally with Jellyseerr for request management and shares its API conventions with the whole *arr ecosystem.

With over 13,000 GitHub stars and active monthly releases, Mailcow delivers a production-ready mail server infrastructure through Docker Compose orchestration of twelve integrated containers. The stack pairs Postfix as the MTA handling SMTP traffic with Dovecot for IMAP and POP3 retrieval featuring the Flatcurve full-text search engine, while Rspamd provides machine-learning-powered spam filtering with Bayesian classification, DKIM signing, and ARC support. ClamAV scans attachments for malware including Office document macro analysis via Olefy, and SOGo serves as a responsive webmail client with CalDAV, CardDAV, and Microsoft ActiveSync synchronization. The admin panel manages multiple domains, per-user spam score thresholds, quarantine review, black and whitelists, temporary spam aliases, mailbox quotas, and TLS enforcement policies for both inbound and outbound messages. Security features include two-factor authentication via TOTP, WebAuthn, and Yubikey OTP, a Fail2ban-like Netfilter integration for brute-force protection, and automatic SPF, DKIM, and DMARC configuration. The ACME container handles Let's Encrypt certificate generation with DNS-01 challenge support, while Postfix TLS-Pol provides MTA-STS and DANE/TLSA resolution for encrypted transport. Built-in imapsync enables periodic migration from remote mailboxes, and the REST API allows programmatic management of all server resources. MariaDB stores user data, Redis caches configuration and sessions, and Unbound provides local DNSSEC-validating DNS resolution. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Most wikis die of flat page-and-tag sprawl; BookStack's defining decision is enforced structure - an MIT-licensed PHP/Laravel platform (over MySQL) where content lives in a hierarchy of shelves, books, chapters, and pages, the way a physical library works. A shelf maps to a department, a book to "Engineering Runbooks," a chapter to "Database Procedures," a page to the actual document. That opinionation removes the "where does this go?" friction and keeps knowledge bases tidy as they grow. Editing works both ways: a clean WYSIWYG editor for most users, a Markdown editor with live preview for those who prefer it - switchable per page. Full-text search spans all books or scopes to one, with direct links to individual paragraphs, and include tags let you embed one page's content inside another so shared blocks update everywhere at once. Every edit creates a diffable, revertible revision. Page templates standardize recurring formats, tags add cross-cutting categorization, and built-in diagrams.net integration draws architecture diagrams in place. Authentication covers email/password plus OIDC, SAML2, LDAP, and social login; a full role and permission system locks content down per shelf, book, or page. Pages and books export to PDF, HTML, plain text, and Markdown, a REST API automates content, and the whole thing runs happily on the cheapest VPS you can find.

With 23,600 GitHub stars, 13 million monthly PyPI downloads, and 425+ contributors automating over 200 million data tasks monthly for Fortune 50 companies like Progressive Insurance and disruptors like Cash App, Prefect is the most widely deployed open-source workflow orchestration framework for Python — turning any script into a resilient production pipeline with a single @flow decorator while eliminating rigid DAG structures entirely. The durable execution engine persists task results and automatically resumes from failures without replaying expensive upstream work, guaranteeing exactly-once execution for any Python function. Event-driven automation triggers workflows from webhooks, cloud events, or state changes through a real-time event bus that detects what happens or fails to happen across your entire data platform. Work pools decouple workflow code from infrastructure, enabling seamless switching between Docker, Kubernetes, AWS ECS, Azure Container Instances, GCP Cloud Run, and serverless environments without modifying pipeline logic. Native Ray and Dask task runners extend execution across clusters for compute-intensive workloads. The self-hosted server provides a monitoring dashboard with flow run timelines, task state visualization, scheduling, and automation configuration. The third-generation engine reduces overhead by over 90 percent compared to Prefect 2, supporting batch, event-driven, interactive, and background task workflows. Deploy via Docker Compose with PostgreSQL, Redis, server, background services, and worker containers, or use official Helm charts for production Kubernetes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

With over 6,500 GitHub stars, HolaOS bills itself as an "open agent computer" that reimagines the traditional operating system as a shared workspace where humans and AI agents collaborate across files, browsers, and 100+ integrated tools simultaneously. Unlike chat-only interfaces, HolaOS places live application UIs—Notion-style editors, browsers, custom workspace apps—side by side with the agent conversation, so operators always see what agents are doing and can intervene at any moment. The persistent memory system stores workspace knowledge locally as Markdown files and embedded vectors via SQLite vec, enabling RAG-powered recall that survives session boundaries without the typical context window bloat. Safe Session Compaction reserves roughly 70% of the model context window for fresh reasoning while folding older history into structured checkpoints that retain goals, constraints, progress, and decisions. Agents connect to Linear, GitHub, Slack, Jira, HubSpot, Gmail, and dozens more through one-click OAuth, automatically fetching relevant signals and converting scattered app data into working memory. BYOK support for Claude, GPT, and Gemini models lets operators use their own API keys at zero markup, while built-in Kimi K3 and GLM-5.2 models provide ready-to-use alternatives. Skills package reusable workflows that any agent can invoke on demand, and scheduled triggers enable autonomous digests, monitors, and reports. The runtime supports independent server deployment alongside the desktop client. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Modified Apache 2.0 licensed.

The open-source PaaS with 55,000+ GitHub stars and the largest one-click service catalog in its class — Coolify gives you the Vercel push-to-deploy workflow on a dedicated server you control. Connect a GitHub, GitLab, Bitbucket, or Gitea repository and every push builds and deploys automatically via Nixpacks, a Dockerfile, or Docker Compose, with Traefik or Caddy reverse proxying, automatic Let's Encrypt certificates, and per-branch preview deployments with their own URLs. Databases — PostgreSQL, MySQL, MariaDB, MongoDB, Redis — provision in a few clicks, and a catalog of 280+ one-click service templates covers WordPress, n8n, Grafana, MinIO, Plausible, Ollama, and more. One dashboard manages the entire server, with Docker Swarm available for clustering multiple nodes. Backups go to any S3-compatible storage with one-click restore, and a full API supports CI/CD integration. All configuration lives on your own server, so resources keep running even if you stop using Coolify — no vendor lock-in by design. Running on a dedicated VPS with guaranteed CPU, RAM, and SSD, full root access via SSH and browser console. Apache 2.0 licensed.

CKAN lets governments, research institutions, and companies publish data as a searchable catalog, where every dataset carries its description, license, tags, and downloadable files. Organizations own their datasets, and members, editors, and admins get different rights, so a dataset can stay private until someone with publishing rights releases it. Visitors narrow results with faceted filters on tags, formats, and organizations, or write fielded queries with wildcards and fuzzy matching. Resource pages preview spreadsheets in a grid and, when the data fits, as maps and charts, and they also display images, PDFs, and HTML. The DataStore keeps tabular resources as queryable tables, serving filtered rows with range conditions and nested AND/OR logic. Everything the web interface does is also available through the Action API. Groups gather related datasets, and custom metadata fields extend each record. Per-dataset activity streams document how data changes, and follow buttons feed a personal news feed. Files can be stored on local disk or, with extensions, in S3, Google Cloud Storage, or Azure Blob Storage. Extensions add geospatial search, harvesting for federated portals, multilingual metadata, and more chart types, and themes restyle the portal to match your brand. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Backed by over 36,000 GitHub stars and 120 contributors with 123 releases since 2022, 1Panel has rapidly become the go-to open-source alternative to cPanel and Plesk for modern Linux server management. The platform delivers a clean Vue.js dashboard powered by a Go backend using the Gin framework, providing visual management of Docker containers, images, networks, and volumes without touching the command line. Its curated app marketplace offers one-click installation of 165+ trusted open-source applications including Nextcloud, Bitwarden, Umami analytics, WordPress, and NocoBase, each running in isolated containers for maximum security. Native AI capabilities set 1Panel apart from every competing panel: deploy Ollama LLMs directly from the dashboard, spin up OpenClaw personal agents, monitor GPU utilization, and manage AI models through a unified interface. Website management includes automatic domain binding, Let's Encrypt SSL certificate provisioning, and Nginx configuration with zero manual setup. Security runs deep with built-in firewall rules, fail2ban integration, container isolation, WAF protection, and comprehensive audit logging enabled from day one. Automated backups support AWS S3, Cloudflare R2, and local storage with one-click restore from any snapshot. The panel supports Debian, Ubuntu, CentOS, and Rocky Linux across x86_64, aarch64, armv7l, ppc64le, and s390x architectures. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Deployed at thousands of enterprises across financial services, healthcare, government, and telecommunications, Apache NiFi is the industry-standard platform for building automated data pipelines through a visual drag-and-drop browser interface that requires zero coding for common integration patterns. The flow-based programming model connects over 300 built-in processors covering relational databases via ExecuteSQL and PutDatabaseRecord, Apache Kafka with PublishKafka and ConsumeKafka, HTTP endpoints through InvokeHTTP and ListenHTTP, cloud storage for AWS S3, Azure Blob, and Google Cloud Storage, SFTP/FTP file transfers, and JSON, XML, CSV, and Avro transformations. Data provenance tracking logs every routing decision, transformation, and delivery for every FlowFile, creating a searchable lineage graph from source to destination with full content replay capability for auditing and debugging. Guaranteed delivery uses configurable backpressure thresholds, prioritized queuing with latency or throughput optimization, and automatic retry with exponential backoff, ensuring no data loss even during downstream outages. The zero-leader clustering architecture distributes processing across nodes with automatic load balancing, while site-to-site protocol enables secure data transfer between NiFi instances across network boundaries. Security includes OpenID Connect and SAML 2.0 single sign-on, role-based access control with fine-grained policies per component, and TLS encryption for all communication. Custom processors can be written in Java and packaged as NAR bundles, or implemented directly in Python through the native scripting framework. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With MediaWiki, the wiki software behind Wikipedia, a team writes one shared knowledge base in plain wikitext or a visual editor while every revision stays saved for comparison and rollback. Page history names the author and edit summary of each change, and a side-by-side diff shows exactly what moved before anyone reverts. Talk pages hold threaded discussions with inline replies, notifications announce mentions and thanks, and watchlists flag the pages you follow. Namespaces, categories, redirects, and reusable templates give a large wiki its structure, and Lua modules written for Scribunto power infoboxes. Uploaded images get automatic thumbnails and a full-screen lightbox. Bundled extensions add PDF handling and math rendering for documentation that needs more than text. Group-based permissions decide who may read, edit, protect, or delete. A wiki can stay open to everyone or sit behind a login. AbuseFilter, CAPTCHAs, blocklists, and two-factor sign-in help fend off spam and account takeovers. Vector 2022 brings a sticky table of contents and an optional dark mode. The interface is localized in over 350 languages. Bots and scripts log in, read, search, and edit with the Action API. Use it for company handbooks, engineering runbooks, course notes, fandom encyclopedias, and public reference sites. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-2.0-or-later licensed.

Cockpit puts Linux server administration in a web browser, rendering storage, networking, containers, and virtual machines as visual panels you click through instead of command-line syntax you memorize. It ships in every major Linux distribution and activates through systemd socket activation, consuming zero resources until someone connects on port 9090. What makes it different from other admin panels: every change through the web interface appears instantly at the command line, and every terminal change reflects in the browser in real time. No abstraction layer sits between the UI and the operating system, which means no configuration drift. Storage management covers disk partitioning, RAID arrays, LUKS encryption, LVM volumes, and NFS shares. Network configuration handles bonds, bridges, VLANs, and firewall zones through visual editors. Native Podman integration pulls images, creates containers, manages pods, and provides terminal access into running processes. KVM/libvirt support handles VM creation, cloning, snapshots, and live migration with console access. A built-in terminal provides shell access when the web interface is not enough, and the journal viewer filters systemd logs by severity and unit. Multi-server management connects additional hosts over SSH, presenting a unified dashboard across your entire infrastructure from one browser tab. Runs on a dedicated RepoCloud VPS with full root SSH access and browser serial console. LGPL licensed.

Born at Brazilian media giant Globo.com, Thumbor answers imaging CDNs like Imgix and Cloudinary with an HTTP service where every image variant is just a URL. Ask for /300x200/smart/your-image.jpg and Thumbor fetches the original, crops and resizes on demand, and caches the result - one source file, unlimited renditions, no batch pre-generation pipeline. The "smart" in the URL is the signature feature: OpenCV-based face detection finds people in the frame and crops around them (no more thumbnails with severed heads), and when no faces exist, feature detection finds visually important corners and computes a weighted center of mass as the focal point. Beyond cropping, a chainable filter pipeline handles brightness, contrast, grayscale, blur, red-eye removal, rounded corners, rotation, watermarks, and format conversion with quality control - applied in order via URL segments. All common image formats work out of the box, and every layer is pluggable: loaders (HTTP, local, S3), storages and result storages (local, S3, Ceph, and community backends), engines, optimizers, filters, and even custom detectors, with the awesome-thumbor list cataloging the ecosystem. URL signing prevents abuse of your processing capacity. Integrations exist for Django, Rails, Node, WordPress, and most frameworks. MIT-licensed, battle- tested for over a decade.

Project AIRI is the most popular open-source AI companion platform — a self-hosted recreation of Neuro-sama that brings AI-powered virtual characters into your world across web, desktop, and mobile. The system renders Live2D, Spine, and VRM 3D character models with auto-blink, eye tracking, and lip-sync driven by real-time voice synthesis, while the xsAI abstraction layer connects to 40+ LLM providers including OpenAI GPT-4, Anthropic Claude, Google Gemini, DeepSeek, and local models via Ollama and OpenRouter. Built from day one on WebGPU, WebAudio, Web Workers, WebAssembly, and WebSocket technologies, the browser version runs entirely client-side with PWA offline support while the server runtime enables persistent memory via PostgreSQL with pgvector embeddings and DuckDB WASM for client-side storage. The Minecraft agent plays autonomously using mineflayer with pathfinding, and a Factorio integration provides cooperative gameplay. Social integrations deploy your companion as a Discord bot joining voice channels, a Telegram bot, and a Twitter/X agent posting and replying autonomously. The desktop Stage Tamagotchi app provides an always-on-screen companion for Windows and macOS, while Stage Pocket brings the experience to mobile. Voice features include client-side speech recognition via VAD, multiple TTS providers including ElevenLabs, and screen vision capabilities. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

MediaMTX sits between cameras and viewers as a self-hosted live media server, taking in video and audio streams over one protocol and handing them back out over another, so one IP camera feed can end up playing in a browser, a phone app, and a recording archive simultaneously. Publish with FFmpeg, GStreamer, OBS Studio, a browser, or a Raspberry Pi camera over RTSP, RTMP, SRT, WebRTC, Media-over-QUIC, HLS, MPEG-TS, or RTP, and read it back on any other protocol without a transcoding pipeline. Run dozens of camera feeds side by side, each on its own path, and keep every path available even while its publisher is offline. Record everything to disk in fMP4 or MPEG-TS as it streams, then play recordings back later through the same server instead of shipping files around. Authenticate publishers and viewers with built-in users, an external HTTP check, or JWT, and use the control API plus Prometheus metrics to wire the server into the rest of your monitoring stack. Forward streams to other servers, proxy cameras behind NAT, and fire hook commands whenever a client connects, publishes, or disconnects, so a doorbell camera can trigger a snapshot or an alert as it starts streaming. Reload the configuration while clients stay connected, and tune everything from the same mediamtx.yml file or environment variables, with no database or runtime dependencies to babysit. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

The most-starred open-source project management platform on GitHub with over 55,000 stars, Plane delivers what Jira, Linear, Monday, and ClickUp charge thousands per year for — issue tracking, sprint planning, documentation, and AI-powered workflows in one unified workspace that you own and control entirely. Work items feature a rich text editor with file uploads, sub-properties, custom states, priorities, labels, assignees, and cross-referencing, organized across five customizable layout views (list, board, table, spreadsheet, Gantt) with Command-K navigation for instant access to anything. Time-boxed Cycles provide sprint planning with automatic burn-down charts, velocity tracking, and scope change detection, while Modules break complex projects into manageable deliverables with progress aggregation. Built-in Pages combine AI-powered documentation with rich formatting, image embedding, and one-click conversion of notes into actionable work items. The AI layer reads across every project, cycle, document, and thread in the workspace — agents take real assignments, triage incoming requests, assign owners, track blockers, and ship status updates automatically. Native integrations connect GitHub, GitLab, Slack, Sentry, Figma, and 50+ tools with bidirectional issue sync and PR tracking, while import pipelines migrate entire workspaces from Jira, Linear, Asana, ClickUp, or Monday in minutes. The REST API with OAuth 2.0, HMAC-signed webhooks, typed SDKs in Node.js and Python, and a native MCP server enable custom automations. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Benchmarked at one million concurrent WebSocket connections and 30 million delivered messages per minute on a single server, Centrifugo is a self-hosted real-time messaging server that integrates with any backend language — Node.js, Python, Go, Ruby, PHP, Java — without requiring architectural changes to your existing application. It handles persistent connections over WebSocket, HTTP-streaming, Server-Sent Events, gRPC, and experimental WebTransport, routing messages through a channel-based PUB/SUB model with automatic reconnection recovery that replays missed messages from hot channel history. Built-in horizontal scaling operates through Redis (including Redis Cluster, AWS ElastiCache, Valkey, KeyDB, and DragonflyDB), NATS, or PostgreSQL brokers, allowing multi-node deployments without external message queues. The server provides JWT-based authentication using HMAC or RSA keys, granular channel permissions, online presence tracking showing who is currently subscribed to a channel, and an RPC proxy that forwards client calls to your backend over HTTP or gRPC. The embedded ReactJS admin web interface displays real-time connection statistics, node information, and provides an interactive API console for publishing messages, managing subscriptions, and inspecting channel history. Official client SDKs are available for JavaScript, Dart, Go, Swift, and Java, with unidirectional transports requiring no SDK at all. Centrifugo also supports delta updates to minimize bandwidth, connection event proxying, and Prometheus-compatible metrics for Grafana monitoring. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.