Unpatched Linux servers expose production environments to critical vulnerabilities, and PatchMon eliminates that blind spot by centralizing package telemetry, security advisory tracking, and automated update orchestration across your entire fleet. Administrators can inspect pending updates across APT, DNF, YUM, APK, Pacman, Zypper, FreeBSD pkg, Windows Update, and winget from one unified queue without opening inbound firewall ports on monitored hosts. Before touching production workloads, operators run dry-run validations to preview exact package transactions, enforce multi-user approval workflows, and schedule rollouts during fixed maintenance windows. During execution, live agent output streams directly to the browser over WebSocket so engineers can watch progress in real time or halt a problematic upgrade mid-flight. Beyond package updates, the platform runs OpenSCAP CIS benchmark and Docker Bench security assessments, inventories running containers and outdated base images, and routes host-down or threshold alerts to Slack, Discord, Microsoft Teams, ntfy, or email. Built-in browser SSH and Apache Guacamole RDP terminals let teams troubleshoot machines directly through the outbound agent tunnel with role-based access control and OIDC single sign-on. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Used by the Rust language community, NASA, Dropbox, and thousands of organizations worldwide with over 25,600 GitHub stars and 1,500+ contributors, Zulip is the only modern team chat app designed from the ground up for both real-time and asynchronous communication through its unique topic-based threading model where every message belongs to a named topic within a channel. This eliminates the context collapse of linear chat by letting teams follow specific conversations without scrolling through unrelated messages, resume threads days later without losing context, and catch up on missed discussions at per-topic granularity. Server 12.0 introduced end-to-end encryption for mobile push notifications, AI-powered search ranking, channel folders for workspace organization, and expanded video conferencing with Jitsi, BigBlueButton, and Zoom integration. Over 100 native integrations connect GitHub, GitLab, Jira, Sentry, PagerDuty, Travis CI, Redmine, dbt, Nextcloud, and n8n with bidirectional notifications, while LLM-driven agents access web-public channels via a standard llms.txt interface. Full-text search covers unlimited message history across all plans, code blocks render with syntax highlighting for 250+ languages, and LaTeX math expressions display inline. The REST API with typed Python and JavaScript SDKs enables custom bots, webhook integrations, and programmatic administration. Import tools migrate entire workspaces from Slack, Microsoft Teams, Mattermost, and Rocket.Chat. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Trusted by thousands of organizations worldwide with over 14,700 GitHub stars, Snipe-IT has been the gold standard in open-source IT asset management since 2013. Built on Laravel 12 with PHP 8.2+, it provides a comprehensive web-based platform for tracking every physical and digital asset in your organization — from laptops and servers to software licenses, accessories, consumables, and components. The check-in/check-out system assigns assets to users with full audit trails, digital signature acceptance, and automated email notifications for checkouts, approaching deadlines, expiring warranties, and low inventory. License management handles multi-seat software with seat-by-seat tracking, compliance monitoring, and expiration alerts. Custom fields let you capture organization-specific metadata, while the advanced search engine supports logical operators including and/or conditions, exact matching with is:value, fuzzy exclusions with not:value, and null checks. SCIM 2.0 integration synchronizes users, groups, locations, companies, and managers from identity providers like Azure Entra ID and Okta. Enterprise authentication supports LDAP, Active Directory, Google Secure LDAP, and SAML 2.0 single sign-on. The reporting dashboard generates custom asset reports with saved templates, depreciation schedules, and audit logs. QR code labels enable instant mobile asset lookup via barcode scanners. The full-featured JSON REST API powers custom integrations, with community-built SDKs, MCP servers, and third-party mobile apps including SnipeMate and Snipe-Scan. Deploy via Docker Compose with MariaDB 11 in minutes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 11,200 GitHub stars and adoption by France's sovereign digital workspace LaSuite serving 20,000+ government users, Grist is the relational spreadsheet that ends the false choice between fragile Excel files and expensive custom database development — storing all data in portable SQLite files while providing true relational structure where VLOOKUPs become actual linked records that update instantly across entire documents. Python-powered formulas replace complex Excel syntax with clear, readable logic using the full Python standard library, while familiar Excel functions remain available for users who prefer them. Granular access rules control permissions at row, column, table, and cell levels — not just entire sheets — enabling multi-department documents where each team sees only their authorized data. The flexible layout system combines spreadsheets, card views, charts, calendars, and custom widgets on configurable dashboard pages that transform raw data into operational interfaces. Real-time collaboration lets multiple users edit simultaneously with automatic snapshot history capturing every change for full audit trails and point-in-time recovery. AI formula assistance connects to OpenAI, Llama, or any OpenAI-compatible endpoint via OpenRouter to generate formulas from natural language descriptions. The REST API and webhooks enable integration with n8n, Zapier, and custom automation, while incremental imports keep external data sources synchronized. Deployable via Docker with OIDC, SAML, and SCIM authentication support. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Define a DocType in Frappe and the framework automatically generates database tables, Python ORM classes, REST API endpoints, form views, list views, and role-based permission rules from that single schema definition. The meta-driven architecture stores schemas as database records, letting administrators add fields, reorder layouts, and modify validation rules through the browser-based Form Builder without redeployment. Server-side Python controllers handle business logic through hook-based lifecycle events while client-side JavaScript manages interactive form behavior, with WebSocket connections providing real-time updates across sessions. The built-in workflow engine defines document state machines with role-gated transitions, email notifications, and conditional action visibility. Pre-configured Desk views include list, form, report, tree, kanban, calendar, and dashboard layouts with drag-and-drop workspace customization. The report builder generates grid reports with configurable columns, filters, grouping, and chart visualizations from DocType data or custom SQL and Python scripts. Background job processing uses Redis queues for email delivery, data imports, and periodic tasks. Virtual DocTypes connect external databases to the framework's UI without data migration. Docker deployment via frappe_docker provides production-ready Compose configurations with MariaDB, Redis, Nginx, and worker containers. The foundation powering ERPNext, HRMS, CRM, and Helpdesk in production. Over 10,500 GitHub stars. MIT licensed.

To protect self-hosted web services behind a unified single sign-on portal without deploying complex enterprise identity suites, Tinyauth acts as an OpenID Certified authentication server and reverse proxy middleware. Homelab operators and infrastructure teams place it in front of internal dashboards, media servers, and administrative tools routed through Traefik, Caddy, Nginx, Nginx Proxy Manager, or LinuxServer SWAG. Users can sign in with local bcrypt-hashed credentials, scan QR codes to enroll time-based one-time password authenticators for two-factor verification, or authenticate through external OAuth providers like GitHub, Google, and Pocket ID. Organizations running centralized directories can bind Tinyauth directly to an LDAP server such as LLDAP or OpenLDAP and automatically synchronize group memberships for role-based authorization. Fine-grained access control rules configured via dynamic Docker container labels or environment variables let administrators whitelist or block specific usernames, OAuth email regex patterns, OIDC groups, client IP CIDR ranges, and URL path prefixes per subdomain. For applications that support native federated login, the built-in OpenID Connect 1.0 discovery endpoint, authorization code flow, and userinfo API allow seamless single sign-on with optional consent skipping for trusted clients. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 78,000 GitHub stars, 270 contributors, and seven years of continuous development tracking upstream VS Code releases within days, code-server has become the definitive way to run a full Visual Studio Code IDE on any remote machine and access it from any browser on any device. The project applies a curated set of patches to Microsoft's VS Code codebase that add password authentication, sub-path hosting behind reverse proxies, self-contained web views that never call out to Microsoft servers, a built-in proxy for accessing ports on the remote machine directly through the VS Code ports panel, and on-disk settings persistence instead of browser storage. The extension ecosystem works with the Open VSX marketplace by default, giving access to thousands of extensions for Python, JavaScript, Go, Rust, Java, and every other language, along with themes, linters, formatters, and debuggers. The integrated terminal provides direct shell access to the server, Git integration handles version control without leaving the editor, and the debugger supports breakpoints, variable inspection, and step-through execution for Node.js, Python, Go, and other runtimes. DevContainer support enables reproducible development environments defined in JSON configuration files. Installation options include a one-line install script, manual package installation, Docker via the official codercom/code-server image, and DevContainer features. Minimum requirements are a Linux machine with 1GB RAM, 2 vCPUs, and WebSocket support. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With 27,000 GitHub stars and 349 releases shipping multiple times per week, Huly replaces four separate SaaS subscriptions — Linear for issue tracking, Notion for documents, Slack for team chat, and Motion for time-blocking — with a single self-hosted platform that charges nothing per seat. The issue tracker provides projects, sprints, roadmaps, custom workflows, and Kanban views with bi-directional GitHub and GitLab synchronization that keeps issues and pull requests in lockstep across both systems. Collaborative documents use CRDT-based real-time editing for wikis, meeting notes, and technical specs with nested page hierarchies and rich embedding. Team messaging delivers channels, direct messages, threaded conversations, reactions, and pinned messages in a Slack-equivalent interface that lives alongside your project context. The time-blocking planner schedules tasks into calendar slots with drag-and-drop, integrating directly with your issue backlog so nothing falls through cracks. A virtual office module provides audio and video rooms for standups and pair programming with external guest access. HR features handle team management, office hours, and PTO tracking. The architecture runs 30+ microservices on CockroachDB for ACID-compliant storage, Elasticsearch for full-text search, MinIO for file attachments, and Redpanda for event streaming. Desktop apps ship for macOS, Windows, and Linux alongside mobile apps for iOS and Android. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. EPL-2.0 licensed.

Describe a component in natural language and watch it render: OpenUI, from Weights & Biases, is an open alternative to Vercel's v0. Type a prompt like "a dark-themed dashboard with a sidebar and charts" and the LLM renders working HTML with Tailwind styling live in the browser. You then iterate conversationally, asking for changes until the design is right, and convert the result to React, Svelte, or Web Components for use in a real project. The backend is Python with LiteLLM routing, so it works with OpenAI, Anthropic, Gemini, Groq, and Mistral API keys, or fully offline against local Ollama models, including vision models like LLaVA that can generate UI from screenshot input - feed a screenshot and the model reproduces or riffs on an existing interface. Generated markup is inspectable at any point, with light and dark mode toggles, theme selection, and responsive previews across device sizes. The practical effect is compressing the mockup-review-revise loop from hours to minutes: a described layout renders in seconds and iterates through follow-up prompts, and because output converts to real framework code, prototypes feed directly into production codebases instead of staying trapped in a design tool. Self-hosting keeps unreleased product interfaces and prompts on your own server, and LiteLLM routing lets you pick the model per task - a cheap fast model for rough drafts, a stronger one for final passes, or free local models for unlimited experimentation.

Configure each indexer once, not five times: Prowlarr is the indexer hub of the *arr stack, removing the most tedious duplication in a media automation setup. Instead of configuring the same torrent trackers and Usenet indexers separately in Sonarr, Radarr, Lidarr, Readarr, and Mylar3, you add each one once in Prowlarr and it syncs them to every connected app automatically, complete with category mappings; with Full Sync enabled, adding or removing an indexer propagates everywhere, and a tracker URL change is a one-place fix. Coverage is the deepest available: 500+ torrent trackers with definitions added constantly, 24 native Usenet indexers, generic Newznab and Torznab support for anything else, and custom Cardigann YML definitions with JSON and XML parsing for obscure sources. Built on the same .NET/React base as its siblings, it also earns a place as a search tool in its own right: unified manual search queries every indexer simultaneously at a category level, and you can push multiple releases straight to your download clients without touching Sonarr or Radarr. Health checks and status notifications flag failing indexers, per-indexer statistics track success rates and response times so you can cull unreliable sources, and per-indexer proxy support (SOCKS4/5, HTTP, FlareSolverr) handles trackers behind Cloudflare.

Across peer-to-peer music and file-sharing communities, slskd brings the Soulseek network into any modern web browser through a self-hosted client-server daemon that runs continuously without a desktop GUI. Users can run multiple concurrent network searches, filter results by audio bitrate, file extension, free upload slots, or transfer speed, and queue entire album folders for download in two clicks. The real-time transfer monitor groups active downloads and uploads by peer and directory, allowing you to inspect your live queue position, retry stalled files, or clear completed batches at a glance. For library contributors, the share manager indexes local directories with custom regex exclusion rules and configurable user groups that enforce per-group upload slot allocations, bandwidth caps, and automated leecher blacklists. Built-in social tools let you browse remote user directory trees, auto-join public Soulseek chat rooms on startup, and exchange private messages directly inside the web interface. Multi-server operators can even link a central controller to remote relay agents to distribute file sharing and search workloads across separate machines. When transfers finish or system state changes, event-driven integrations can fire custom HTTP webhooks, execute post-processing shell scripts, upload files via FTP, or expose Prometheus metrics and CIDR-restricted REST API endpoints for external media managers. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

The first container registry to reach CNCF graduated status with over 29,000 GitHub stars since VMware open-sourced it in 2016, Harbor transforms the basic Docker Distribution into a hardened enterprise registry with vulnerability scanning, supply chain signing, multi-datacenter replication, and project-level access control out of the box. Trivy scans every pushed image against the NVD, GitHub Advisory Database, and distribution-specific vulnerability feeds, with scan-on-push policies that block deployment of images exceeding configurable severity thresholds. Artifact signing through Cosign keyless signatures and Notation enforces content trust policies ensuring only cryptographically verified images reach production clusters. Policy-based replication synchronizes images and Helm charts between Harbor instances across multiple datacenters using repository, tag, and label filters with automatic retry and bandwidth throttling — enabling hybrid-cloud and disaster-recovery topologies. The RBAC model isolates projects with per-project quotas, robot accounts for CI/CD automation, webhook notifications, and audit logging that tracks every pull, push, delete, and configuration change. LDAP, Active Directory, and OIDC authentication integrate with existing identity providers, while the proxy cache transparently caches images from Docker Hub, Quay, and other upstream registries to reduce pull latency and rate-limit exposure. The RESTful API with embedded Swagger UI, tag retention policies, garbage collection scheduling, and immutable artifact rules complete the lifecycle management. Deploy via Docker Compose or Helm Chart on Kubernetes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Stop hoping your AI coding assistant remembers to plan before it codes, test after it implements, and review before it ships. Archon wraps Claude Code, OpenAI Codex, and other AI agents inside structured YAML workflows that enforce the same development process every single time. Define your pipeline as a directed acyclic graph of nodes (AI tasks, shell scripts, approval gates, loops) and Archon handles the orchestration: resolving dependencies, running independent nodes in parallel, passing artifacts between steps, and isolating every run in its own git worktree so five bug fixes can proceed simultaneously without conflicts. Ship with 17 pre-built workflows covering everything from "idea to merged PR" to automated conflict resolution, or author your own by committing YAML files to your repository's .archon/workflows/ directory. The web dashboard, launched with archon serve, provides a conversation interface with real-time streaming, a visual drag-and-drop workflow builder for creating DAG pipelines, step-by-step progress monitoring for every run, and a unified sidebar aggregating conversations from CLI, Slack, Telegram, and GitHub into one view. An NLP router parses natural language requests and automatically selects the right workflow. Structured JSON output schemas let you enforce typed responses from AI nodes, with validation and auto-repair for providers that lack native schema support. Every workflow file is version-controlled, portable, and reviewable in pull requests, so your entire team runs identical processes from day one. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Trusted by Mistral AI, PayPal, Groq, and Synthesia with over 10,300 GitHub stars and Y Combinator backing, Lago is the open-source billing engine that handles usage-based, subscription-based, and hybrid pricing models through a single API-first platform — replacing the need to build custom billing logic or depend on opaque SaaS pricing infrastructure. Real-time event ingestion via ClickHouse processes billable events with deduplication and multiple aggregation methods including count, sum, unique count, max, and weighted sum, while graduated pricing tiers, package-based billing, and percentage-based fees model any pricing strategy from simple subscriptions to complex marketplace commission structures. Automated invoice generation calculates charges according to configurable billing cycles with grace periods, proration for mid-cycle changes, and credit note issuance for refunds and adjustments. Prepaid credits enable pay-in-advance models where customers purchase credit blocks and draw down as usage accumulates, while entitlements tie feature access directly to billing plans for automated provisioning and de-provisioning. Payment orchestration integrates natively with Stripe, Adyen, and GoCardless with automatic retry logic, dunning workflows for failed payments, and multi-gateway routing. Revenue analytics provide cross-stream visibility into MRR, usage trends, churn, and revenue drivers through dedicated API endpoints. The customer portal embeds into your application for self-service invoice access and usage monitoring. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

CPA Manager Plus is a self-hosted observability dashboard and management panel that tracks every AI request flowing through your CLI Proxy API gateway, breaking down failures, costs, and account health across providers like OpenAI, Anthropic, xAI, and Codex in one interface. When a request fails, drill into the persistent history to see status codes, affected models, latency, and redacted failure evidence without exposing raw response bodies. The cost analytics engine breaks down token consumption and estimated spend by model, provider, account, API key, project, channel, and time range while tracking input, output, reasoning, cache, and service-tier pricing semantics separately. Model prices sync automatically from models.dev with LiteLLM and OpenRouter fallbacks, and you can add local overrides for aliases or internal models. For teams running Codex or xAI accounts, the health inspector reads quota windows, reset evidence, credential state, and workspace status on a configurable schedule, routing credential failures into an action queue for review rather than letting them silently degrade throughput. Deploy the Lightweight Panel to replace your existing CPA management UI without adding another service, or run Full Mode as a single Docker container that adds the Manager Server with persistent SQLite storage for request history, historical analytics, and automated account inspections. Export or import request history as JSONL for external analysis, and back up the SQLite files alongside your encrypted management keys. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 2,100 GitHub stars in its first month and benchmarked at 30-75% lower cost than Claude Managed Agents on enterprise task suites, TrueForge is the open-source agent harness that provides the complete runtime layer for turning any LLM into a working production agent on your own infrastructure. The TypeScript server runs the full execution loop — streaming every step, routing tool calls through MCP servers with centralized header-auth and in-chat OAuth, delegating parallelizable work to isolated subagents, and pausing for human approval on sensitive actions. Context engineering keeps token costs low: deferred tool-schema loading delays MCP schemas until invoked, large-result offloading moves oversized outputs to files, Code Mode processes structured data through sandboxed execution, and automatic compaction summarizes older history at a configurable 50,000-token threshold while preserving the full transcript. The sandbox-as-a-tool architecture provisions isolated Daytona environments only when code execution is required, allowing one server to run many concurrent agents without idle overhead. Agents are configured from shipped YAML catalogs of models, MCP servers, git-backed SKILL.md instruction packs, and sandbox providers, then saved to an Agents Library accessible via the chat UI, TypeScript SDK, or embeddable React UI SDK. Run locally with SQLite via a single npx command, or deploy for teams with Docker Compose or Helm using Postgres and Redis with OIDC authentication. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Built on Elixir's fault-tolerant OTP runtime, Tymeslot delivers the complete scheduling toolkit that Calendly charges for and Cal.com relicensed away from open source in 2026. Share one booking link and let clients pick available slots — your calendar stays synchronized and double-bookings disappear automatically through real-time availability checking against Google Calendar, Microsoft Outlook, and any CalDAV server including Nextcloud. Meeting types support configurable durations, buffer times, and availability windows that clients can book without email back-and-forth. Phoenix LiveView powers the real-time UI with WebSocket connections that update instantly as bookings arrive, without client-side JavaScript framework overhead. The platform attaches Zoom video rooms to confirmed bookings through your own Marketplace app credentials, sends confirmation and reminder emails via SMTP, Postmark, SendGrid, Mailgun, or AhaSend, and supports custom booking page themes with embed options for integration into existing websites. Circuit breakers, connection pooling, and graceful degradation maintain availability during provider outages. Authentication supports local accounts, GitHub OAuth, and reCAPTCHA protection on public booking forms. Self-hosting deploys as a single container with PostgreSQL embedded — no separate database container required. Two named volumes persist uploads and database state, while the same image powers the managed cloud at tymeslot.app so self-hosted users get identical features without a crippled community edition. Deploy via Docker, Cloudron with automatic updates, or Railway from a community template. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

DataHub maps your entire data ecosystem into a searchable, governed catalog where every table, pipeline, dashboard, and metric is discoverable and traceable from source to consumer. Originally built at LinkedIn to manage metadata at hyperscale and proven to handle 10 million+ assets and billions of relationships in production, the platform is now trusted by 3,000+ organizations including Netflix, Visa, Slack, and Pinterest. The Spring Java backend (GMS) exposes both GraphQL and OpenAPI REST endpoints, while the React frontend delivers an intuitive interface for searching, browsing, and governing data assets. The Python-based ingestion framework provides 80+ production-grade connectors extracting deep metadata from Snowflake, BigQuery, Redshift, Databricks, dbt, Airflow, Spark, Kafka, Looker, Tableau, Power BI, Superset, PostgreSQL, MySQL, Hive, Glue, S3, Iceberg, and Unity Catalog through pull-based scheduled crawls and push-based emission via Python and Java SDKs. Automatic table-level and column-level lineage detection uses SQL parsing with 97-99% accuracy, tracing data flows from ingestion pipelines through warehouses to BI dashboards. Real-time metadata streaming via Kafka keeps the catalog continuously synchronized as schemas evolve and pipelines execute. The governance layer provides business glossary management, tag propagation along lineage graphs, domain-based organization, and fine-grained access control policies. DataHub Actions triggers automated responses to metadata changes, enabling notifications, quality checks, and downstream workflows. Elasticsearch powers full-text search with faceted filtering across entities. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.