Personal, minimalist, database-free bookmarking - Shaarli is a philosophy as much as an app. Everything lives in a single compressed datastore file inside data/: no MySQL, no PostgreSQL, backup by copying one directory. That write-once/read-many file is usually served straight from OS disk caches, which is why a decade-old Shaarli instance with tens of thousands of links still responds instantly. Designed deliberately single-user, it saves URL, title, unlimited-length description, and tags (with autocomplete, renaming, and merging), marks entries public or private, and automatically strips utm_source and fb tracking parameters from saved URLs. That description field is why the community uses Shaarli as far more than bookmarks: a microblog, read-it-later queue, code-snippet base, pastebin, and shared clipboard between machines. Sharing is one click via bookmarklet or Android apps; consumption is per-tag RSS/Atom feeds plus a daily digest feed; search is full-text with tag filtering. A REST API opens it to any client, a plugin and theme system extends the PHP core (Markdown rendering, thumbnails), and import/export uses browser-standard Netscape HTML - your data enters and leaves freely. LDAP login is supported, no telemetry is sent anywhere, and the UI degrades gracefully without JavaScript. The anti-cloud Delicious.

For developers who want a complete visual backend without stitching together separate database, auth, and storage services, Bknd delivers an all-in-one self-hosted Backend-as-a-Service platform with a built-in administrative dashboard. Data schemas evolve visually. Authentication strategies plug in cleanly. Media uploads route straight to object storage. Inside the interactive Admin UI, you can create relational entities, define field validation rules, inspect records, and test generated REST and OpenAPI endpoints on the fly. User management comes ready out of the box with configurable password and OAuth authentication flows, role-based access permissions, and row-level security policies for multi-tenant SaaS products. A unified media manager connects local filesystems, S3 buckets, Cloudflare R2, MinIO, or Cloudinary so applications can handle user avatars, document attachments, and galleries without custom upload pipelines. Visual workflow automation lets you chain triggers, HTTP tasks, and data mutations into repeatable backend flows, while an integrated Model Context Protocol server allows AI agents to query and manage application state directly. You can operate entirely through the visual dashboard, lock down production schemas in code-only or hybrid modes, and connect frontend interfaces using pre-configured login and upload elements. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Holding internet service providers accountable for promised bandwidth requires continuous, automated measurement, and MySpeed turns any server into an always-on connection performance analyzer that tracks download speeds, upload throughput, ping latency, and jitter around the clock. Instead of running manual browser tests only when video calls stutter, you can schedule recurring speed checks using custom Cron expressions and switch freely between Ookla, LibreSpeed, and Cloudflare testing servers to verify routing performance across different upstream networks. Interactive statistics views render gradient speed timelines, ping and jitter graphs, hourly performance breakdowns that expose peak-hour congestion, and standard deviation consistency charts, using smart 300-bucket downsampling so multi-month histories load instantaneously. Failed tests are flagged with visual markers on the timeline, while built-in health checks dispatch instant alerts to Discord, Telegram, Signal, WhatsApp, Gotify, email, or custom webhooks whenever bandwidth drops below your target thresholds or outages occur. Administrators can link multiple remote MySpeed instances into a single dashboard to compare bandwidth across branch offices, pause scheduled runs during heavy file transfers, export historical logs, and scrape real-time telemetry into Prometheus and Grafana. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Host your own email, files, calendars, and passwords on a single server with YunoHost, a server operating system that puts every app behind one web admin and one shared login. Browse a catalog of more than 500 apps, such as Nextcloud, WordPress, and Vaultwarden, filter by quality level, and install in a few clicks, or paste a Git URL for a custom app. Each person signs in once at a portal that shows a tile for every app they may open, and apps with single sign-on skip their own login screen. Groups and per-app permissions control access, including public access for visitors, and the Admins group adds web admin, SSH, and sudo. A full mail stack handles incoming and outgoing email per domain with DKIM signing, and Let's Encrypt certificates renew automatically. The domain screen suggests the DNS records you need and can push them to a supported registrar's API, while free .nohost.me, .noho.st, and .ynh.fr subdomains configure themselves. Backups bundle system settings, mail data, and chosen apps into downloadable archives that can be restored selectively from the admin or the command line. Twice a day a built-in diagnosis checks DNS records, mail setup, and system resources, then emails the admins if anything needs attention, with a firewall editor and fail2ban protection alongside. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Open Agent Builder delivers a visual canvas for orchestrating AI agent workflows without writing Python scripts or managing complex codebases. The React Flow-powered drag-and-drop interface supports seven node types — Agent, Scraper, Transform, If/Else, Loop, User Approval, and MCP Tool — each configurable with provider-specific settings for Anthropic Claude (Haiku 4.5 and Sonnet 4.5), OpenAI GPT-5, Groq, or any OpenAI-compatible endpoint. The LangGraph orchestration engine handles state management, conditional routing, and human-in-the-loop approval gates while Firecrawl integration converts any website into structured, LLM-ready data through scrape, crawl, and map operations. E2B sandboxed code execution powers Transform nodes for secure data manipulation without risking host system integrity. Real-time streaming updates show execution progress node-by-node as workflows run, with Convex providing reactive database synchronization for workflow state and execution history. The TypeScript-first architecture (96.8% TypeScript) built on Next.js 16 App Router with Tailwind CSS delivers a responsive interface across devices. Clerk handles multi-user authentication with JWT integration for secure workspace isolation. Deploy via npm install and environment configuration with Firecrawl, Convex, and Clerk API keys. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Fleet-wide container discovery, live log streaming, and Traefik reverse-proxy routing converge into Dockpeek, a lightweight Docker dashboard built for multi-host server environments. System administrators can launch web applications with one click through automatic port binding detection and integrated Traefik label parsing that extracts public routing hostnames directly from container configurations. The platform monitors multi-host environments through encrypted Docker socket proxies, letting operators inspect running containers, query published network ports, and trigger image updates from a unified control panel. Native Docker Swarm integration auto-detects active cluster managers, mapping swarm services and replicated tasks alongside standalone workloads while flagging degraded service replicas. Built-in log inspectors stream stdout and stderr outputs in real time with line-filtering controls to diagnose crashed services without opening remote SSH terminals. Operators can track image registries for newer digest tags, review pending updates across container fleets, and trigger graceful rolling container recreations directly from the dashboard. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Point Sirius Scan at a network range and it finds live hosts, fingerprints their services, and lists every matching CVE with its CVSS score in a live web dashboard. The Vulnerability Navigator groups findings by severity, filters on CVSS, and exports results for remediation tracking. Scans run on Nmap with NSE scripts kept in sync with upstream, alongside Naabu port scanning. Lightweight remote agents connect back over gRPC from other networks, so segments the central scanner cannot reach still get assessed, and the same agents can run YAML detection templates locally in CLI mode with no server connection at all. An operator console runs PowerShell commands against connected agents and keeps command history beside the scan results. Real-time progress, severity trend charts, host detail pages, and an environment overview show what changed between scans. A REST API on port 9001 with API key authentication feeds results into existing security workflows, while service health monitoring and centralized logging confirm the platform itself is behaving. An installer generates fresh secrets and an initial admin password, and production overlays tighten the deployment further. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 1,600 GitHub stars and a design philosophy that fundamentally rethinks how time tracking should work, Traggo abandons the traditional project-task hierarchy that forces your work into rigid categories and instead lets you tag time spans with arbitrary key-value pairs — project:website, type:coding, client:acme, billable:yes — enabling cross-dimensional analysis that conventional trackers cannot replicate. The Go backend compiles into a single binary that runs alongside a SQLite database and embedded web UI in under 10MB total, consuming approximately 50MB of RAM at runtime and starting in seconds on even the smallest VPS. Tags are the fundamental data model: create any tag key with any set of values, then apply multiple tags to each time span simultaneously to track by project, client, task type, energy level, or any other dimension your workflow demands. Customizable dashboards render pie charts, bar charts, and line graphs from tag-aggregated data, letting you visualize time distribution across any combination of dimensions over configurable date ranges. The calendar view displays time spans as colored blocks across days and weeks, while the list view provides chronological entry browsing with inline editing. Multiple themes including light and dark modes adapt the interface to personal preference, and simple user management with role-based access supports small team deployments. Docker deployment runs a single container exposing port 3030 with multi-architecture support for amd64, arm64, and arm v7. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

When cybersecurity instructors and competition organizers host Capture The Flag tournaments, GZCTF orchestrates isolated per-team challenge containers, dynamic anti-cheat flags, and live exponential scoreboards from a single web platform. Event administrators can configure four distinct challenge modes covering static attachments, team-specific dynamic attachments, shared static containers, and isolated dynamic containers where unique flags are injected into each team's environment at launch. A customizable exponential scoring engine adjusts point values automatically as more teams solve a problem while awarding first, second, and third blood bonuses to top contenders. Built-in flag-sharing detection monitors every submission in real time, flagging suspicious cross-team flag reuse alongside live event streams and container logs. Participants can group into divisions, track their ranking trajectory on interactive score timelines, and upload post-game writeups directly into the portal for organizer review and batch archiving. Built-in network proxying forwards challenge traffic over WebSocket tunnels with optional packet capture so referees can audit exploit payloads during active matches. Multi-language localization, customizable branding, invitation gates, and email domain restrictions adapt the portal to university courses, corporate security drills, or international tournaments. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 140,000 code commits, 1,200+ GitHub stars, and continuous development since 2004 spanning more than two decades of active maintenance through version 18.6.0 released in July 2026, XWiki operates as a second-generation wiki platform that goes beyond static pages by enabling teams to build custom collaborative applications directly inside wiki pages using structured data forms and in-page scripting. The Java backend runs on Apache Tomcat with PostgreSQL, MySQL, or Oracle database storage, serving a responsive web interface with a WYSIWYG editor featuring real-time collaborative editing, link and macro editors, user mentions, inline comments, annotations, and complete version history with diff comparison. The App Within Minutes extension lets non-developers create custom data-driven applications using drag-and-drop form builders that generate filterable live tables for structured data browsing without writing code. Over 900 extensions from the built-in Extension Manager add functionality including blogs, task trackers, forums, diagram editors, and Confluence migration tools. Enterprise integration features include LDAP and Active Directory authentication, SAML and OIDC single sign-on, fine-grained per-page and per-space permissions with nested page hierarchies, and multi-wiki support for hosting multiple independent wikis from a single installation. The RESTful API provides programmatic access to pages, spaces, objects, attachments, and properties with XML and JSON representations. Office document import converts Word and Excel files directly into wiki pages while PDF export generates formatted documents from wiki content. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. LGPL-2.1 licensed.

Write standard SQL queries and watch Shaper turn them into interactive dashboards, scheduled reports, and customer-facing analytics widgets without maintaining a heavy business intelligence stack. Every query maps directly to a visual component through simple type casts like BARCHART, LINECHART, GAUGE, BOXPLOT, or DROPDOWN. Analysts can attach external PostgreSQL and MySQL databases, read Parquet, CSV, JSON, and Excel files straight from S3 object storage, or stream live events into the HTTP ingest API. Interactive filter controls let viewers slice metrics by date ranges, multi-select dropdowns, and dynamic parameter variables that automatically re-evaluate downstream charts. Teams version-control their entire reporting layer as plain SQL files in Git, making dashboard updates auditable in pull requests and simple for AI coding assistants to generate. Product engineers embed white-labeled analytics directly into customer web apps without iframes, issuing per-tenant JWT tokens to enforce row-level data isolation. Need scheduled deliverables for stakeholders? Configure SQL-driven background tasks that transform datasets on a cron schedule, send threshold alerts to Slack or Microsoft Teams, and generate downloadable PDF, PNG, Excel, or CSV reports. External collaborators can also view live metrics through password-protected sharing links. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MPL-2.0 licensed.

Managing dozens of smart locks, dimmers, thermostats, and sensors across a Z-Wave mesh often leaves homeowners blind to routing hops, sleepy battery devices, and firmware bugs; Z-Wave JS UI solves this by delivering a comprehensive browser control panel and MQTT gateway for your USB or network Z-Wave controller. Provision new devices with SmartStart QR scanning or S2 authenticated inclusion, inspect every Command Class parameter, and push over-the-air manufacturer firmware updates straight to switches and sensors. Interactive network topology graphs map live routing neighbors, link quality, and background RSSI signal strength, while built-in health checks and an integrated Zniffer packet analyzer pinpoint RF interference before automations fail. Operators can configure direct node-to-node association groups and multicast broadcast groups so wall switches trigger lights even when the central hub is offline. Scheduled Non-Volatile Memory controller backups and pre-inclusion restore points protect your mesh against hardware failure, and the configurable MQTT Discovery and WebSocket server bridges every entity seamlessly into Home Assistant, OpenHAB, Domoticz, Jeedom, and ioBroker. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Websurfx aggregates results from multiple search engines into one private, ad-free interface that never tracks your queries. Written in Rust, the backend provides memory safety against buffer overflows and data races at the language level while handling concurrent requests across upstream providers like DuckDuckGo and Searx. A built-in re-ranking algorithm scores and merges results by relevance, producing a unified page that draws from many sources while appearing as one coherent search. Safe-search filtering operates across four levels from unrestricted to complete content blocking, with regex-based filter lists for parental controls in schools and organizations. Upstream requests route through configurable proxy chains or Tor, preventing search providers from correlating your queries with a specific IP address. Four Docker image variants target different caching strategies: hybrid Redis plus in-memory for maximum throughput, Redis-only, in-memory-only, or zero-persistence for environments where cached queries must never touch disk. The Lua configuration file controls engine selection, request timeouts, rate limiting thresholds, and production-mode delays that throttle upstream traffic to prevent abuse. Quick-result widgets handle calculations, currency conversions, and unit transformations inline without external redirects. Image search capabilities serve visual discovery for designers and researchers who need media results without surveillance. Runs on a RepoCloud VPS with dedicated resources and full root access. AGPL-3.0 licensed.

Create an invoice, share a secure link, get paid — that's the entire workflow, no client portals or account registrations required. Invio distills billing into its absolute minimum viable surface while still producing legally compliant EU electronic invoices in Factur-X/ZUGFeRD 2.2 BASIC, UBL 2.1, and Italian FatturaPA formats, all embedded as XML attachments inside WeasyPrint-rendered PDFs. The Deno 2 backend uses Hono v4 for HTTP routing with SQLite persistence, while the SvelteKit 2 frontend styled with Tailwind CSS v4 and DaisyUI v5 delivers a responsive interface that stays out of your way. The team access system includes a permission matrix, TOTP-based two-factor authentication, and OIDC integration with configurable auto-provisioning — drop it into existing identity infrastructure without manual user management. Preset products let you build invoices from reusable catalog items. A change history log tracks every modification for audit purposes. Rate limiting protects the API behind reverse proxies. The entire stack ships as a single multi-stage Docker image containing Deno, Bun, Node, WeasyPrint, and all required font packages — zero external service dependencies beyond the container itself. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Unlicense licensed.

Turn your scattered collection of liquor bottles and bar tools into a master mixology station with an intelligent digital cellar. Bar Assistant tracks your personal liquor cabinet, inventory levels, and available mixers against a catalog of more than 500 cocktail recipes. The platform calculates exact alcohol by volume ratings, computes ingredient costs per serving, and dynamically highlights every cocktail you can craft with on-hand supplies. Built-in recipe scrapers extract formula details, measurements, and glassware requirements directly from web links, JSON payloads, or YAML files. Multi-bar workspaces allow home mixologists and commercial venues to separate private collections from communal drink menus while handling complex ingredient substitutions, custom infusions, and shopping lists. Integrated Meilisearch indexing powers instant typo-tolerant searches across spirit categories, flavor tags, and cocktail strengths. Visual cocktail cards display high-resolution drink photography, user ratings, glassware requirements, and step-by-step garnish instructions. Deploy Bar Assistant on RepoCloud with dedicated VPS compute, full root SSH credentials, and in-browser console access, backed by an open-source MIT license.

Created in March 2026 and rapidly gaining traction in self-hosting communities, DockPanel delivers the most feature-dense free server panel available — 811 API endpoints, 153 one-click Docker app templates across 14 categories, and full multi-server management, all running on three Rust binaries consuming under 50MB of combined RAM. The panel handles the complete server lifecycle: sites with automatic SSL via Let's Encrypt, MySQL and PostgreSQL databases in Docker containers, Git push-to-deploy using Nixpacks for automatic language detection without Dockerfiles, blue-green zero-downtime deployments with automatic rollback on failed health checks, DNS management, mail servers, monitoring dashboards, and encrypted backups to S3, SFTP, Backblaze B2, or Google Cloud Storage. Security receives production-grade attention with per-image CVE scanning that gates deployments, a built-in WAF, passkey authentication alongside Argon2 password hashing, HttpOnly JWT sessions with blacklist-on-logout, rate limiting on auth endpoints, and fail2ban integration — all verified through an 18-vulnerability pentest with zero remaining issues. Infrastructure as Code support exports your entire server configuration to YAML, and the developer CLI provides status, diagnose, and export commands for automation. GPU passthrough enables AI workload hosting, reseller accounts support white-label branding for agencies, and ARM64 compatibility covers Raspberry Pi and Oracle Cloud free-tier deployments. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 600 GitHub stars and a featured Show HN launch, Mission Control is the agent-first command center that replaces the chaos of manually shepherding AI agents with structured delegation, approval workflows, and autonomous execution. The Next.js 15 web UI delivers an Eisenhower priority matrix with drag-and-drop quadrants, a Kanban board tracking tasks through Not Started, In Progress, and Done columns, and a goal hierarchy with milestone progress bars — powered by shadcn/ui, Radix UI, and @dnd-kit. Six built-in agent roles — Researcher, Developer, Marketer, Business Analyst, Tester, and You — receive tasks through a token-optimized API compressing context by 92 percent to approximately 50 tokens versus 5,400 unfiltered. The autonomous daemon polls task queues on cron schedules, spawns Claude Code sessions via the official CLI, enforces concurrency limits, and auto-retries with loop detection that escalates to human decisions after three failures. Field Ops extends execution to 64 external services across 16 categories with working X, Ethereum with MetaMask signing, and Reddit adapters, protected by AES-256-GCM encrypted vault with scrypt key derivation, per-service and global spend limits, a circuit breaker, and three autonomy levels. All data lives in local JSON files with Zod validation and async-mutex locking ensuring safe concurrent writes, backed by 193 automated Vitest tests. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

New hires fail from information overload and IT bottlenecks, not lack of goodwill - the observation behind ChiefOnboarding, a free, open-source employee onboarding platform (Django, Celery, PostgreSQL, Redis). Its answer is sequences - drag-and-drop timelines that drip-feed to-do items, resources, courses, forms, and badges to each new hire, triggered by dates or by completing a previous item, so nobody faces everything at once. Onboarding starts before day one: preboarding pages welcome hires early, and colleagues can leave personal messages that appear there. The account provisioning module creates the new hire's Slack, Google, Asana, and other accounts automatically on the scheduled day via a library of integrations plus custom webhooks - the IT ticket queue never gets involved. Everything works through two equivalent interfaces: a full web dashboard and a Slack bot, either usable standalone. Slack can even auto-create new hire accounts when someone joins the workspace and assign default sequences with zero manual action. Colleague tasks with comments and collaboration, a searchable people directory, scheduled introductions, and per-hire timezone awareness (no 3 a.m. notifications) round it out. No trackers, no phoning home - third-party credentials sit in encrypted fields on your server.