Retool's job, self-hosted: ToolJet is an open-source low-code platform for building internal tools, dashboards, and admin panels. Apps are assembled in a drag-and-drop visual builder with 60+ responsive components, including tables, charts, forms, and lists, and connected to 80+ data sources: PostgreSQL, MySQL, MongoDB, REST and GraphQL APIs, cloud storage, and common SaaS tools. When visual configuration is not enough, you can run JavaScript or Python inline for queries and transformations. A built-in no-code database (ToolJet Database) covers apps that need their own tables without provisioning an external database, Workflows add node-based automation for background jobs with dedicated worker containers and a Redis-backed queue, and multi-page apps with multiplayer editing, inline comments, and mentions support team development. Security is designed for internal data: credentials are AES-256-GCM encrypted, data flows proxy-only through your server so database contents never reach a third-party cloud, and granular per-app access control plus SSO gate each tool. Where Retool-style platforms bill per builder and sometimes per end user, the self-hosted Community Edition serves unlimited builders and users at hosting cost, and full source availability means the platform itself can be forked, audited, and extended. The stack is Node.js and React on PostgreSQL, deployed via Docker.

The first open-source substrate for enterprise knowledge engineering that learns passively and governs itself. The Rust-built backend paired with PostgreSQL and pgvector delivers a bitemporal knowledge graph where every fact carries two timelines: when it held in the real world and when the system came to believe it — enabling full audit trail replay of how understanding evolved. Document ingestion handles PDF, DOCX, PPTX, XLSX, CSV, Markdown, HTML, and plain text with legacy encoding detection, while scheduled syncing pulls from web pages, RSS feeds, GitHub, Jira, Notion, WebDAV, and S3-compatible buckets. Search fuses Tantivy full-text indexing with pgvector semantic vectors using Reciprocal Rank Fusion, streaming answers with inline citations that link directly to source passages. The built-in agent harness drives agentic RAG through conversation — searching documents, walking the knowledge graph at any historical date, and querying mounted databases via Ontology2SQL which achieves state-of-the-art results on BIRD Mini-Dev benchmarks. Five ontology packs ship inside the binary (schema.org, W3C Org, PROV-O, FOAF, IOF Core) with forward-chaining reasoning for transitivity, symmetry, inverses, and relation hierarchy. Entity resolution operates in three stages: exact name matching, embedding similarity, then model-based judgment with every merge reversible. Any OpenAI-compatible endpoint works including DeepSeek, Qwen, Ollama, and vLLM for fully air-gapped deployment. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Backed by Alibaba's AIDC team and carrying over 27,700 GitHub stars, Pixelle-Video turns a single text prompt into a publish-ready short video in approximately three minutes — handling scriptwriting, image generation, voice narration, music selection, subtitle overlay, and final MP4 export in one automated pipeline. The engine supports multiple LLM backends for script generation including GPT-4, Qwen, DeepSeek, and local Ollama deployments, while image and video creation routes through either self-hosted ComfyUI workflows, cloud-based RunningHub pipelines, or direct API connections to DashScope Wan, OpenAI, Seedream, Seedance, and Kling AI. Text-to-speech synthesis uses Edge-TTS, Index-TTS, and other mainstream engines with multi-language voice profiles. Five distinct pipelines cover Quick Create, Standard, Digital Human Avatar broadcasting, Image-to-Video transformation, and Motion Transfer from reference video. The Streamlit web UI on port 8501 provides a visual workflow builder with template selection across portrait (1080x1920), landscape (1920x1080), and square formats, while the FastAPI server on port 8000 exposes a REST API with endpoints for async video generation, task polling, content scripting, TTS and image generation, template listing, and health checks. History persistence tracks all completed generations. HTML-based visual templates support static, image-overlay, and AI-video styles with customizable prompt prefixes. The modular architecture lets operators swap any atomic capability — image model, video model, TTS engine, or VLM — by editing a workflow JSON file without touching Python code. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Create an invoice, share a secure link, get paid — that's the entire workflow, no client portals or account registrations required. Invio distills billing into its absolute minimum viable surface while still producing legally compliant EU electronic invoices in Factur-X/ZUGFeRD 2.2 BASIC, UBL 2.1, and Italian FatturaPA formats, all embedded as XML attachments inside WeasyPrint-rendered PDFs. The Deno 2 backend uses Hono v4 for HTTP routing with SQLite persistence, while the SvelteKit 2 frontend styled with Tailwind CSS v4 and DaisyUI v5 delivers a responsive interface that stays out of your way. The team access system includes a permission matrix, TOTP-based two-factor authentication, and OIDC integration with configurable auto-provisioning — drop it into existing identity infrastructure without manual user management. Preset products let you build invoices from reusable catalog items. A change history log tracks every modification for audit purposes. Rate limiting protects the API behind reverse proxies. The entire stack ships as a single multi-stage Docker image containing Deno, Bun, Node, WeasyPrint, and all required font packages — zero external service dependencies beyond the container itself. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Unlicense licensed.

"Stupid simple software" is the entire philosophy at DumbWare.io, and DumbBudget delivers it: no over-engineering, no complexity, no accounts, no bank connections - just a clean, modern ledger for money in and money out. Log income and expenses, assign categories, and watch real-time balance calculations update as you type. Finding transactions is quick: filter by type, narrow by date range, sort by date or amount. When tax season or spreadsheet analysis calls, everything exports to CSV. Access control matches the philosophy - a single PIN (set via one environment variable) gates the app, backed by real security engineering: rate limiting on PIN attempts, temporary lockout after failures, secure session handling, and no sensitive data in browser storage. Multi-currency support covers the ISO codes, and a SITE_TITLE variable names each instance - deliberately useful, because running separate instances per account or family member is the intended pattern for multi-user needs. The responsive UI ships light and dark themes and installs as a PWA on phones, where expense logging actually happens. Configuration is five environment variables; data persists in one folder. If Actual Budget and Firefly III feel like accounting software, this is the notepad that gets used. GPL-licensed.

GPT Load has become the go-to self-hosted AI gateway for teams managing multiple LLM provider credentials behind a single URL. The Go-built proxy transparently preserves native API formats for OpenAI Chat Completions, OpenAI Responses, Anthropic Messages, and Google Gemini — applications swap one base URL and keep their existing SDK integration untouched. Twenty built-in channels cover official APIs (OpenAI, Anthropic, Gemini, xAI), cloud platforms (Azure OpenAI, AWS Bedrock, Google Vertex AI), model services (DeepSeek, Moonshot AI, SiliconFlow, Zhipu AI, Alibaba Cloud, Volcengine, OpenRouter, Groq), and subscription accounts (Codex, Claude, Antigravity, Grok) using the same credential management, scheduling, and health system. The intelligent key pool rotates among valid credentials using atomic counters for fair high-concurrency distribution, automatically blacklists failing keys after configurable thresholds, and recovers them via scheduled health checks — all transparent to clients. Weighted load balancing distributes traffic across multiple upstream endpoints while per-credential proxies route individual keys through different egress paths. The Vue 3 management dashboard provides real-time statistics, group configuration, key testing, request logs with full debugging context, per-model cost estimates, and route inspection. Docker deployment exposes the management interface and proxy on port 3001 with SQLite by default, MySQL or PostgreSQL optional, and Redis for distributed leader-follower cluster scaling. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With 3,100+ GitHub stars, CyberScraper 2077 replaces brittle CSS selectors and XPath queries with natural language data extraction powered by Large Language Models. Users paste a URL, describe the data they want in plain English, and the AI extracts structured results from any website — no HTML parsing knowledge required. The tool supports three LLM backends: OpenAI GPT models for maximum accuracy, Google Gemini for cost-effective extraction, and local Ollama instances for fully private scraping where URLs and data never leave your server. Built on Python asyncio with Playwright browser automation, it handles concurrent page fetching with content-based and query-based LRU caching to minimize redundant API calls. The Streamlit web interface runs on port 8501 and provides one-click export to JSON, CSV, HTML, SQL, Excel, and direct Google Sheets upload. Tor network integration routes requests through onion routing for anonymous scraping of both clearnet and .onion hidden service sites with automatic circuit management and stream isolation. Stealth mode randomizes user agents, manages cookies, and controls JavaScript execution timing to bypass bot detection systems. Multi-page scraping navigates through paginated results with automatic URL pattern detection. Docker deployment packages all dependencies including Playwright browsers into a single container. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Every unit of income gets a job in Actual Budget - a local-first personal finance app built on envelope (zero-sum) budgeting, where you can only budget cash you actually have, which keeps the plan honest by construction. The data model is a SQLite file that lives on your device and works fully offline; the self-hosted Node.js sync server adds background multi-device synchronization using CRDT-based distributed-systems machinery, browser and mobile access as an installable web app, and automated backups. Optional end-to-end encryption makes the synced data unreadable even to the server hosting it. Transactions enter three ways: manual entry, file import (CSV, QIF, OFX, QFX, CAMT.053), or automatic bank syncing through GoCardless for EU/UK banks and SimpleFIN for US/Canada. Built-in YNAB4 and nYNAB importers migrate complete budget histories, and reports, schedules for recurring transactions, and rule-based transaction cleanup handle the day-to-day. A fully featured local API lets developers script custom importers and automation against their own data. 100% free, open source, and 26k stars strong.

A self-hosted "second brain": Khoj indexes your own files and answers questions from them, parsing Markdown (whole Obsidian vaults included), org-mode, PDF, Word, plain text, Notion pages, GitHub repositories, and images described by a vision model, then embedding everything with sentence-transformers into a vector index for semantic search and RAG with cited sources. Any LLM backend works: local models like Llama, Qwen, or Mistral via Ollama, or cloud models like GPT, Claude, and Gemini. You can build custom agents, each with its own persona, scoped knowledge base, chat model, and tools such as web search and code execution. Scheduled automations run recurring research and deliver newsletters or notifications to your inbox, and research mode performs multi-hop web searches with inline citations. Access it from a browser, the Obsidian plugin, Emacs, desktop, or WhatsApp - all clients connect to the same self-hosted instance, making Khoj one of the few AI assistants Emacs users can point at decades of org files. Semantic search means recall works without exact keywords: "that paper about forecasting with transformers" surfaces the right PDF even when you cannot remember its title. Switching LLM backends never requires re-indexing your documents, and with a local model via Ollama, even inference stays on hardware you control - journals, research, and private notes are never sent anywhere. Python/FastAPI stack, AGPL-licensed, with PostgreSQL storage.

With over 14,000 GitHub stars, 1 million managed identities on Logto Cloud, and continuous releases through version 1.42.0 in July 2026, Logto has emerged as the most credible open-source alternative to Auth0, Clerk, and AWS Cognito by packaging OIDC, OAuth 2.1, enterprise SSO, multi-tenancy, and RBAC into a single MPL-2.0 codebase that self-hosts for free with no per-MAU pricing surprises. Every Logto tenant operates as a fully compliant OpenID Provider supporting PKCE-only public clients, DPoP token binding, and RFC 9068 JWT access tokens. Pre-built sign-in flows handle email, phone, social login via Google, Facebook, Azure AD, and dozens of connectors, passkey authentication, and multi-factor verification through TOTP and WebAuthn. Organizations enable first-class multi-tenancy where users belong to multiple tenants with per-organization RBAC scopes on API resources. Enterprise SSO connects to Okta, Entra ID, and any SAML or OIDC identity provider. SDKs for over 30 frameworks including React, Next.js, Angular, Vue, Flutter, Go, and Python integrate authentication into SPAs, web apps, mobile apps, APIs, machine-to-machine, and CLI tools. The admin console provides user management, audit logs, webhook event subscriptions, and custom domain configuration. Personal Access Tokens and token exchange support AI agent architectures and MCP server authentication. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MPL-2.0 licensed.

A deliberately simple ticketing system standing in for both Zendesk and Jira: Peppermint handles internal staff requests and external customer support alike. The stack is modern full-stack TypeScript: Next.js and React over Prisma and PostgreSQL, which makes it light to run and approachable for developers extending it. Ticket creation is straightforward - a markdown editor with file uploads, assignment, status tracking, and a logical workflow that new agents grasp without a manual. Mailbox integration converts email into tickets automatically: configure SMTP/IMAP per mailbox and incoming messages become trackable tickets. Each client accumulates an interaction history, giving agents context on every past request before replying. Two touches distinguish it from bare-bones ticketing: a built-in markdown notebook with todo lists for internal documentation and knowledge sharing, and OIDC authentication so agents sign in through your existing identity provider - Keycloak, Okta, Authentik, or Azure AD. Configurable webhooks and email notifications push ticket events to third-party services. The UI is responsive from mobile to 4K, and everything works fully offline in air-gapped environments. Docker-native and scalable via Kubernetes, with an active community of 3,000+ GitHub stargazers.

OctoBot provides a free and fully configurable cryptocurrency trading platform that runs on your own server. The bot automates investment strategies across 15+ exchanges including Binance, Coinbase, MEXC, Hyperliquid, Kucoin, OKX, and Bybit, supporting spot, futures, and perpetual markets. The AI trading system connects to any OpenAI-compatible API or local Ollama server, enabling strategies powered by ChatGPT, Llama, Mistral, or any custom model for market analysis and signal generation. TradingView integration accepts PineScript indicator signals and strategy alerts via webhooks, while built-in technical analysis covers RSI, Moving Averages, MACD, Bollinger Bands, and other standard indicators. The modular tentacle architecture allows community-developed plugins to extend strategy logic, evaluators, data sources, and exchange interfaces. The backtesting engine replays historical market data against any configured strategy, reporting profit and loss, drawdown, win rate, and trade-by-trade breakdown before committing real funds. Paper trading provides risk-free live simulation with the same execution logic as production. The web dashboard displays real-time portfolio value, open positions, trade history, and strategy performance with interactive charts. Telegram bot integration enables remote monitoring, notifications, and command execution from mobile devices. Docker deployment runs the full stack in a single container with persistent volume storage for configuration and trade data. On RepoCloud, deploy OctoBot on a dedicated VPS with root SSH access, persistent storage for your trading data and strategy configurations, and complete control over exchange API keys and AI model connections, all under the GPL-3.0 license.

With over 15,000 GitHub stars and nearly nine years of active development, CapRover is the self-hosted PaaS that replaces Heroku's pricing with your own infrastructure while keeping the deploy-and-forget simplicity. The web dashboard manages application lifecycle from deploy through scaling — configure custom domains, environment variables, persistent volumes, instance counts, and nginx templates without touching config files or SSH. The CLI tool enables scriptable deployments with a single command from your terminal or CI/CD pipeline, while webhook-based deployment triggers automated builds from Git pushes. The one-click app marketplace provides over 100 pre-configured services including WordPress, Ghost, PostgreSQL, MySQL, MongoDB, Redis, Grafana, Portainer, and dozens more, each deployed as a Docker container with volumes and environment variables preconfigured. Automatic HTTPS provisions and renews Let's Encrypt certificates for every custom domain with one-click HTTP-to-HTTPS redirects. Under the hood, Docker Swarm orchestrates containers across multiple nodes for horizontal scaling and load balancing, while nginx handles routing with fully customizable EJS-generated configuration templates per application. Deployment supports four methods: CLI push, tarball upload through the web UI, Docker image reference, and Git repository connection. The build system supports Dockerfiles, captain-definition files with build packs, and direct Docker image pulls. NetData integration provides real-time server monitoring dashboards. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Backed by nearly 30,000 GitHub stars and powering millions of meetings through meet.jit.si, Jitsi Meet is the open-source video conferencing platform that runs entirely in the browser with no plugins or downloads required. The WebRTC-based architecture delivers HD audio and video through the Jitsi Videobridge selective forwarding unit, while Prosody handles XMPP signaling and Jicofo manages conference focus and orechestration. End-to-end encryption uses AES-GCM 128-bit keys exchanged via the Olm protocol, protecting audio, video, and screen sharing through the Insertable Streams API in Chromium-based browsers. Moderators can split participants into breakout rooms with individual password protection, enable lobby waiting rooms for admission control, set meeting passwords, and track speaker statistics with per-participant talk time metrics. Virtual backgrounds leverage TensorFlow.js body segmentation with WebGPU and WebGL acceleration, automatically adapting quality through device tier detection. Server-side recording and YouTube live streaming run through Jibri, while Jigasi provides a SIP gateway for PSTN dial-in and speech-to-text transcription. The platform includes in-meeting chat with private conversations, polls, raise-hand functionality, emoji reactions, and tile and speaker view layouts. Mobile applications for iOS and Android complement the web client, and both web and native SDKs enable embedding video conferences into custom applications. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Spree Commerce provides a complete headless ecommerce backend where products, orders, payments, and promotions are managed through typed REST APIs with OpenAPI 3.0 specs and TypeScript SDKs providing autocomplete and type safety. Fifteen years of production history and 15,600+ GitHub stars back a mature ecosystem that ships a production-ready Next.js 16 storefront built with React 19 and Tailwind CSS 4, including multi-region URL routing and Stripe payments supporting Apple Pay, Google Pay, Klarna, and Affirm. Sales Channels model distinct contexts from a single instance: DTC storefronts, wholesale portals, mobile apps, and point-of-sale terminals, each with its own catalog, pricing, and checkout flow. The rules-based promotion engine supports coupon codes, multi-condition discounts, gift cards, and digital product fulfillment. Multi-warehouse inventory tracks stock across locations in real time with reservations and advanced order routing that splits shipments across fulfillment centers. B2B capabilities include customer-specific price lists, storefront access gating, wholesale portals with approval workflows, and quick order forms. The admin dashboard built with Tailwind CSS provides role-based permissions, product management, order processing with refunds, and scaffold generators for custom pages. BSD 3-Clause licensed with zero platform or transaction fees. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console.

Named from the German "Ich schrei sonst" - roughly "or I'll scream" - Isso is a lightweight Python/JavaScript commenting server, a drop-in Disqus replacement for people who noticed what Disqus does to reader privacy and page load times. The design premise is printed right in the docs: comments are not Big Data. So the backend is a single SQLite file rather than a database cluster, and the entire client is one embeddable JavaScript file - 65 kB, 20 kB gzipped - that you drop into any static site, blog, or CMS. Commenters write in Markdown, need no account, and can edit or delete their own comments within a configurable window (15 minutes by default). Spam control comes from an optional moderation queue: held comments stay invisible until you activate them via an admin interface or email notification links. Migration is a first-class feature, with importers for Disqus and WordPress exports, so years of existing threads move over intact. Because everything is server-rendered from your own instance, no third party tracks your readers, and real-world switchers report smaller pages and faster loads than the Disqus embed. MIT-licensed, running since 2012.

Encrypted, incremental, compressed backups on storage you already have - Amazon S3, Backblaze B2, Google Drive, Azure, OneDrive, Dropbox, MEGA, Storj, WebDAV, SFTP, FTP, SMB, or a plain local disk - is what the MIT-licensed Duplicati has quietly done for years. Its security model is Trust No One: every block is encrypted with AES-256 (or a local GPG instance) before leaving the machine, and the passphrase never travels, so the storage provider holds only ciphertext. The block-based storage engine gives the best of both backup worlds: after one initial full backup, only changed data blocks upload - modify a tiny part of a huge file and only that part transfers - yet every backup version restores like a full backup in a single operation, with no incremental chains to replay. Deduplication and compression keep remote storage growth slow even across years of versions. A web interface manages everything: the built-in scheduler keeps backups current automatically, flexible filters select folders, file types, or custom patterns, retention policies prune old versions, and an integrated updater flags new releases. On compatible object-lock backends, immutable (WORM) storage protects backup data from ransomware that reaches the credentials. Runs on Windows, macOS, and Linux, free even for commercial use.

Security-conscious IT departments pick Passbolt for its cryptography: every user holds an OpenPGP key pair, and shared credentials are encrypted individually to each recipient's public key - real end-to-end encryption, not a vault password handed around. All crypto runs client-side in the mandatory browser extension (distributed and signed through the Chrome and Firefox stores, deliberately separating the crypto code from the server that stores ciphertext); private keys and passphrases never touch your instance, and the server admin cannot read a single secret. Authentication uses the challenge-based GpgAuth protocol, secrets are digitally signed to verify sender integrity, and metadata encryption extends protection to resource names and URLs. Day to day it behaves like a polished commercial manager: auto-fill and auto-save in forms, strong password generation, anti-phishing protection, TOTP storage, folder hierarchies shared per-user or per-group with fine-grained permissions and instant cryptographic revocation. Native iOS, Android, and desktop apps ship alongside a JSON API, CLI, and SDKs for CI/CD secret retrieval and rotation. The PHP server runs on MariaDB and is AGPL-licensed open source - including the paid tiers' codebase - with published security audits.