Half the architecture sketches on the internet trace back to Excalidraw - the MIT-licensed virtual whiteboard whose hand-drawn aesthetic made technical diagramming feel approachable, at roughly 85,000 GitHub stars. The infinite canvas offers rectangles, ellipses, diamonds, arrows with smart binding and labels, free-draw, text, images, and an eraser, with full undo/redo, zoom, dark mode, and keyboard-first ergonomics. Community shape libraries add thousands of pre-built elements - AWS architecture icons, flowchart stencils, UI wireframe kits - and everything exports to PNG, SVG, the clipboard, or the open .excalidraw JSON format that keeps drawings diffable and portable. Live collaboration works on a share-a-link model with live cursors and a laser pointer for presenting, and it is end-to-end encrypted by design: the room key travels in the URL hash, which never reaches the server, so the WebSocket relay only ever sees ciphertext. The architecture is remarkably light - the app is a static bundle served by Nginx, drawings persist locally in the browser, and the stateless excalidraw-room relay handles multiplayer - so a self-hosted deployment gives unlimited boards and collaborators with near-zero resource cost, replacing per-editor whiteboard subscriptions.

With over 33,000 GitHub stars and a codebase written in 92.9% Rust for maximum performance and memory safety, Tabby is the most widely adopted self-hosted alternative to GitHub Copilot — delivering real-time code completions entirely on your own infrastructure with zero code leaving your network. Deploy a single Docker container on any NVIDIA CUDA, Apple Silicon Metal, AMD ROCm, or CPU-only server and connect VS Code, JetBrains IDEs (IntelliJ, PyCharm, WebStorm, GoLand), Vim, Neovim, and Emacs through native extensions. The completion engine supports a curated registry of models including StarCoder2 (1B to 15B parameters), DeepSeek-Coder, CodeLlama, CodeGemma, Qwen2.5-Coder, and Mistral Code — swappable at runtime through the admin dashboard without redeployment. Repository indexing parses your Git repositories and feeds project-specific types, function signatures, and patterns into completion context via RAG, producing suggestions that understand your codebase rather than generic boilerplate. The Answer Engine provides instant responses to code queries within the IDE, while inline chat enables contextual code editing and explanation without switching windows. The admin dashboard manages per-developer API tokens, usage analytics, and model configuration. Enterprise features include SSO via LDAP, OAuth, and SAML, role-based access control, and audit logging for compliance environments. A single RTX 4090 workstation serves a team of 10-15 developers with sub-500ms completion latency. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 75,000 GitHub stars and native apps across macOS, Windows, Linux, iOS, and Android, AppFlowy is the most widely adopted open-source alternative to Notion — delivering the same block-based workspace model with full data sovereignty. The Flutter frontend renders natively on every platform while a Rust backend powered by Actix-web and Tokio handles CRDT-based real-time collaboration, ensuring sub-second sync across devices with conflict-free concurrent editing. Relational databases support grid, board, kanban, calendar, and gallery views over the same dataset, with two-way relations, rollups, advanced filters, sorts, and formula calculations that cover the majority of Notion's database workflows. The block editor supports 40+ content types including nested pages, toggles, callouts, code blocks with syntax highlighting, embeds, and slash-command insertion. AI integration connects to OpenAI, Anthropic, or local models via Ollama for writing assistance, summarization, and translation — all without sending data off-premises when using on-prem LLMs. Team spaces with workspace-level and per-page permissions, OAuth and SSO authentication through GoTrue, and S3-compatible object storage via MinIO provide enterprise-grade access control and file management. The self-hosted stack deploys through Docker Compose with PostgreSQL for metadata, Redis for caching and pub/sub, and a dedicated background worker for imports and email notifications. Offline-first architecture ensures the desktop app functions without connectivity, syncing changes when the connection resumes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Roughly 40 integrated business apps forming a full ERP: Odoo's open-source suite runs companies end to end. The Community Edition, licensed LGPL-3.0, ships roughly 40 apps covering CRM, sales, invoicing, basic accounting (journals, chart of accounts, taxes, reconciliation), inventory and warehouse management with multi-step routes, manufacturing with BOMs and work orders, purchasing, project management, timesheets, HR, a website builder, and eCommerce. Each app works standalone, but they share one PostgreSQL database and one data model, so a confirmed sale updates stock, triggers procurement, and posts invoices without integration glue. The modular design means you enable only the apps you need and extend with 40,000+ community modules from the Odoo app store covering nearly any vertical requirement. Inventory supports multi-warehouse stock, reordering rules, and lot and serial tracking with barcode-ready operations; manufacturing ties BOMs, work orders, and work-center routing directly to sales demand and stock levels; and the website builder sells straight from your product catalog with payment provider integrations. You can start with just CRM and invoicing on day one and switch on inventory or eCommerce later - new apps integrate with existing data instantly because the schema is shared. The server is Python with an XML/JavaScript view layer, and because data lives in plain PostgreSQL there is no proprietary format: you can query, back up, migrate, and extend business data directly, with unlimited users and no per-seat licensing - where enterprise ERP pricing is per user per month, headcount here costs nothing.

Gaining over 71,000 GitHub stars as one of the fastest-rising knowledge management platforms, AFFiNE merges the document editing capabilities of Notion, the infinite canvas of Miro, and the structured data of Airtable into a single cohesive workspace. The block-based editor built on the custom BlockSuite framework supports rich text, code blocks, embeds, tables, kanban boards, and database views with drag-and-drop composition. The whiteboard mode provides an infinite canvas where users can freely mix documents, sticky notes, shapes, connectors, and hand-drawn elements, enabling visual thinking alongside structured note-taking. Real-time collaboration allows multiple users to edit documents and whiteboards simultaneously with cursor presence, comment threads, and version history. The local-first architecture stores all data on your device by default using CRDT-based synchronization, ensuring offline access and data sovereignty, with optional cloud sync for cross-device availability. Workspaces organize content into hierarchical page trees with full-text search, favorites, tags, and trash management. The platform supports Markdown import and export, PDF export, and HTML export for interoperability. AI features powered by configurable LLM providers enable writing assistance, summarization, translation, and content generation directly within documents. The theming system supports light and dark modes with customizable accent colors. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Licensed under MIT with an open-source self-hosted edition.

Mox offers a complete mail server stack in a single Go binary requiring no external dependencies. The quickstart command configures a working mail server with SMTP, IMAP4, webmail, and full DNS authentication in under ten minutes. SMTP handling includes a delivery server on port 25, a submission server for authenticated clients, and a queue with automatic retries and DKIM signing. IMAP4rev2 implementation provides full mailbox synchronization with CONDSTORE and QRESYNC for efficient offline clients, NOTIFY for multi-mailbox monitoring, MULTISEARCH across mailboxes, and TLS client certificate authentication via the EXTERNAL SASL mechanism. The built-in webmail provides browser-based reading and composing with message threading, attachments, and HTML rendering without requiring a separate web client. Email authentication implements SPF validation, DKIM signing and verification with automatic key rotation, DMARC policy enforcement with aggregate and failure reporting, DANE with DNSSEC-protected TLSA records, and MTA-STS for certificate verification. Junk filtering combines reputation-based sender scoring with Bayesian content analysis trained per account. The web administration interface manages domains, accounts, DNS records, TLS certificates, delivery queue, and real-time log viewing. Internationalized email addresses with EAI and IDNA support handle non-ASCII domains and mailboxes. Account autoconfiguration publishes settings for Thunderbird autoconfig and Outlook autodiscover. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Backed by over 8,700 GitHub stars and OpenID Connect certification, Pocket ID delivers what enterprise identity platforms like Keycloak provide but without the configuration complexity — a passkey-only OIDC provider purpose-built for homelabs and small deployments. The core design decision is radical simplicity: no passwords exist in the system, only WebAuthn-based passkeys using hardware security keys, TouchID, FaceID, or device PINs, making phishing attacks structurally impossible rather than merely discouraged. The Go backend built on the Gin framework serves a compiled SvelteKit frontend as static assets, running as a single Docker container with SQLite as the default database and optional PostgreSQL for larger deployments. User management supports manual creation, signup links, and open registration, with group-based access control that restricts which OIDC clients each group can access and attaches custom claims for downstream role mapping. LDAP synchronization pulls users and groups from OpenLDAP or Active Directory, while SCIM support enables automated provisioning from compatible identity sources. Federated client credentials handle machine-to-machine authentication for service-to-service communication patterns. The audit system logs every authentication event with GeoIP enrichment, sends email notifications for sign-ins from unknown devices, and provides one-time login codes for accessing accounts from devices without passkey support. TLS with HTTP/2 is built in, PKCE adds code exchange protection, and OpenTelemetry provides tracing and metrics integration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD 2-Clause licensed.

Real-time alerts from your own infrastructure to your phone, with no Firebase, Pushover, or third-party push service in the path: Gotify is a simple, self-hosted notification server written in Go. The model is deliberately minimal: senders push messages with a single HTTP POST to the REST API, receivers subscribe over a WebSocket stream, and a clean React web UI manages the pieces. Senders are namespaced as "applications," each with its own token, so your backup script, Uptime Kuma, CI pipeline, and cron jobs each get an identity, an icon, and independently revocable credentials - centralized alerting from many services with per-source management. Messages carry a title, body, and priority level that maps to notification importance on the client. The official Android app (on both F-Droid and Google Play, notable for working entirely without Google Play Services) shows push notifications for new messages; the web UI itself supports Web Push in the browser; and gotify/cli pushes messages from shell scripts with one command. A server-side plugin system adds custom behavior, and the whole thing runs as a single small binary with SQLite by default - near-zero resource footprint. Because dozens of tools (and Apprise) speak Gotify natively, it slots in as the notification hub for an entire homelab or ops stack.

Portabase takes a zero-trust approach to database backups: lightweight Rust/Tokio agents deploy next to each database, encrypt dumps with AES-GCM before data ever leaves the host, and poll the Next.js control plane outbound every five seconds requiring zero inbound firewall rules. This architecture contains blast radius if the dashboard is compromised while supporting ten engines with stable backup and restore: PostgreSQL 12 through 18, MySQL 5.7 through 9, MariaDB 10 and 11, MongoDB 4 through 8, SQLite 3.x, Redis 2.8+, Valkey 7.2+, Firebird 3.0 through 5.0, Microsoft SQL Server 2017 through 2022 including Azure SQL, and Docker volumes on Engine 20.10+. Encrypted backups store on configurable backends including local filesystems, any S3-compatible provider (AWS, MinIO, RustFS), Google Cloud Storage, and Azure Blob Storage. Cron-based scheduling with Grandfather-Father-Son retention policies automates backup lifecycle management, while on-demand restore targets any compatible server for cross-environment recovery. The CLI installs agents with a single command and auto-updates when new versions ship. A RESTful API with MCP server integration enables automation from CI/CD pipelines and AI agent workflows. Developed by a non-profit under Apache-2.0. 1,270+ stars and 174 releases since October 2024. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console.

With 11,400+ GitHub stars and active development since 2019, Gatus is the developer-oriented status page and health monitoring tool that ships as a single statically-linked Go binary in a scratch Docker image under 20 MB — deploying in seconds while monitoring your entire infrastructure across 12 protocols from a single YAML configuration file. Define health checks for HTTP, ICMP, TCP, DNS, gRPC, WebSocket, SSH, UDP, SCTP, STARTTLS, and TLS endpoints with conditions that go far beyond simple ping: evaluate response status codes, body content with JSONPath expressions, response time thresholds, certificate expiration days, DNS record values, and IP address ranges. Each endpoint supports independent alerting through Slack, Microsoft Teams, PagerDuty, Discord, Telegram, Twilio, Mattermost, Google Chat, email, Gotify, Pushover, and custom webhook providers with configurable failure thresholds and descriptions. The built-in status page displays uptime badges, response time graphs, and incident timelines with maintenance window support for planned downtime communication. External endpoints accept push-based health reports from services behind firewalls. Prometheus metrics export via the /metrics endpoint enables integration with existing observability stacks. OIDC and Basic Authentication protect the dashboard. PostgreSQL persistence stores historical uptime data. The official Helm chart supports Kubernetes deployment with liveness probes and PVC storage, while a community sidecar auto-generates endpoint configurations from Kubernetes Ingress and HTTPRoute resources. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 21,000 GitHub stars and six years of steady development through version 3.1.0, Neko transforms any Docker container into a fully interactive browser or desktop environment streamed to web browsers via WebRTC with sub-300-millisecond glass-to-glass latency. The Go backend captures X server display frames using the Pion WebRTC library while the Vue.js frontend renders the remote session with native audio synchronization, delivering a significantly smoother experience than Apache Guacamole or noVNC which rely on image-over-WebSocket approaches. Multiple users simultaneously view and collaboratively control the same session with real-time input synchronization and host-managed control passing between participants. Pre-built Docker images cover Firefox, Chromium, Google Chrome, Tor Browser, Brave, Vivaldi, and Microsoft Edge alongside full desktop environments including XFCE and KDE for running any Linux application. Neko Rooms provides multi-tenant deployment with a REST API for programmatic room provisioning, while Neko Apps extends the platform with additional containerized applications beyond browsers. Sessions persist on the server independently of client connections — close your laptop, reconnect from your phone, and resume exactly where you left off. Optional VPN and Tor integration routes traffic through encrypted tunnels for privacy-sensitive browsing. RTMP broadcasting streams sessions to external platforms. The embeddable client supports iframe integration for custom portals and applications. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Created by the developer behind Uptime Kuma and carrying over 23,000 GitHub stars, Dockge brings the same clean, reactive design philosophy to Docker Compose stack management with a web interface that makes Portainer's compose handling feel like editing YAML in a terminal over SSH. The interactive editor provides syntax highlighting, inline validation, and a live preview of your compose.yaml files while keeping every stack stored as a standard file on disk in /opt/stacks by default, meaning you can seamlessly switch between the web UI and the docker compose CLI without lock-in or proprietary database formats. Real-time WebSocket updates stream pull progress, container start/stop transitions, and build output directly to the browser with no polling delays. The built-in web terminal opens a shell session inside any running container for quick debugging, while the docker-run-to-compose converter transforms single-container run commands into proper compose.yaml definitions with one click. Multi-agent support introduced in version 1.4.0 connects multiple Docker hosts to a single Dockge dashboard, enabling centralized management of stacks distributed across different servers. Image update detection shows which stacks have newer versions available, and one-click updates pull the latest images and recreate containers without manual intervention. The stack is a single Docker container running on Node.js with Socket.IO for reactivity and stores no external database. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Point OBS or a hardware encoder at Restreamer's built-in RTMP or SRT ingest and it serves your website while rebroadcasting to YouTube Live, Twitch, Facebook, Vimeo, TikTok, LinkedIn, PeerTube, and anything else that accepts RTMP, SRT, or HLS - a complete self-hosted live-streaming server from datarhei. That multistreaming normally costs a monthly Restream.io subscription; here it's one FFmpeg process per destination on your own hardware. The web UI is genuinely approachable, with a wizard that walks beginners through camera setup, while professionals get the full surface: multiple audio/video inputs (USB, RTSP network cameras, virtual devices), codec and processing settings, separate audio muxing, and hardware acceleration via Nvidia CUDA, Intel VAAPI, or Raspberry Pi. Serving your own audience is first-class - a built-in Video.js player embeds in your site, a ready-made publication website streams without any embedding work, HLS chunk sizes are tunable, and automatic Let's Encrypt handles HTTPS. Viewer and bandwidth monitoring with limits keeps traffic costs predictable, and it's GDPR-friendly: no third-party provider, no audience data stored. A fully Swagger-documented REST API drives automation. SRT support keeps latency under a second.

Images, text, audio, video, HTML, PDFs, and time series, labeled in one tool with a standardized output format: Label Studio is the open-source data labeling platform for building training datasets. Computer vision tasks cover classification, object detection (boxes, polygons, ellipses, keypoints), and semantic segmentation; audio work spans transcription, speaker diarization, and emotion recognition; NLP handles named entity recognition and document classification with taxonomies up to 10,000 classes; and GenAI workflows support LLM fine-tuning data and RLHF response ranking. Labeling interfaces are fully configurable with an XML-like templating language, so the UI matches the task instead of the reverse. The ML backend SDK turns any model into a connected web server for pre-annotation (model predicts, humans verify), interactive labeling (real-time predictions as annotators draw regions or highlight text), and model evaluation - cutting annotation time dramatically on large datasets. Data imports from S3, GCS, or file uploads; the Data Manager filters and explores tasks; exports convert to the format your ML library expects via label-studio-converter. Multi-user accounts tie every annotation to its author, and webhooks, a Python SDK, and REST API embed labeling into any pipeline. Self-hosting keeps proprietary training data - often a company's most sensitive asset - entirely on your infrastructure.

The Bitwarden server, reimplemented in Rust: Vaultwarden (formerly bitwarden_rs) is the unofficial lightweight edition. It speaks the same wire protocol as the official server, so every official Bitwarden client - browser extensions, iOS, Android, desktop, and the bw CLI - connects without modification, while the server itself runs as a single container against SQLite (or MySQL/MariaDB/PostgreSQL) instead of the official multi-container stack that wants gigabytes of RAM. Features Bitwarden gates behind paid tiers ship free: organizations with collections, groups, member roles, and policies; TOTP code storage; file attachments; Bitwarden Send; Emergency Access; event logs; and admin password reset. Two-factor options cover authenticator apps, email, FIDO2 WebAuthn, YubiKey, and Duo, and OIDC-based SSO landed natively in v1.35.0. Zero-knowledge encryption is unchanged - vault data is encrypted client-side and the master password never reaches the server. Attachments and Sends store on local disk or S3-compatible backends, an admin panel manages users and server settings, and backup is copying one data directory. Suited to individuals and teams up to roughly 50 users.

Getting non-technical friends and family onto a media server is its most tedious chore - Wizarr solves it. Instead of manually creating accounts, dictating server addresses, and explaining which app to install, you send one invite link. When the recipient clicks it, Wizarr creates their account on your server automatically - Plex, Jellyfin, Emby, Audiobookshelf, Komga, Kavita, and Romm are all supported - then walks them through a mobile-first, app-like onboarding wizard: download the right client, sign in, and learn how to request movies through your Overseerr or Ombi instance, with an optional Discord server invite along the way. Invitations are genuinely manageable: set expiration dates, usage limits, passphrases, library-scoped access tiers, and time-limited memberships that end access automatically. The wizard itself is fully customizable - Markdown-based steps managed from the admin UI, organized into pre-invite and post-invite phases (terms of service before joining, app setup after), reorderable bundles assignable to specific invitation types, and combined flows for invites spanning multiple servers. Multi-server and multi-admin support manages several backends from one dashboard, SSO support is plug-and-play, and a REST API with OpenAPI/Swagger documentation covers automation. A Flask/HTMX app in a single Docker container.

Databasement puts scheduled backup and restore for nine database engines behind one polished web interface, deployed as a single Docker container on port 2226. The Laravel and Livewire backend uses native CLI tools for MySQL 5.6 through 9.x, PostgreSQL 12 through 18, MariaDB 10.x through 12.x, Microsoft SQL Server 2017 through Azure SQL, MongoDB 4.2 through 8.0, SQLite 3.x, Firebird 3.x through 5.x, Redis 2.8+, and Valkey 7.2+ with full restore support including cross-server recovery. SSH tunnel connectivity reaches databases behind firewalls via bastion servers with password or private key authentication, and remote agents handle isolated networks by connecting outbound over HTTPS without inbound ports. Scheduling supports arbitrary cron expressions with GFS grandfather-father-son retention alongside simple time-based cleanup. Storage spans local disk, S3-compatible services including AWS and MinIO, Azure Blob, Samba/SMB shares, and SFTP/FTP servers. Scheduled restores automate production-to-staging synchronization on recurring intervals. Failure notifications alert via Email, Slack, Discord, Telegram, Pushover, Gotify, and webhooks with detailed job logs. The REST API and built-in MCP server enable CI/CD pipeline integration and AI assistant access from Claude, Cursor, and VS Code Copilot. 1,700+ stars since November 2025. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Friendica connects to more federation protocols than any other single platform: ActivityPub reaches Mastodon, Pleroma, Misskey, Lemmy, Pixelfed, and PeerTube; the Diaspora protocol bridges that network; and OStatus provides legacy compatibility. But protocol reach is just the foundation. Where most fediverse platforms stop at microblogging, Friendica offers long-form posts, photo albums, event calendars with RSVP, group discussions, and rich multimedia content. BlueSky and Tumblr connectors extend your reach into non-federated networks, while RSS import pulls content from any blog or news source into your timeline. Privacy controls let you scope each post to specific contacts, groups, or public visibility with per-post granularity rather than account-wide settings. Multiple themes customize the interface from Facebook-like layouts to minimal designs, and Fedilab provides native mobile access. Under the hood, the PHP application with MariaDB runs as either an Apache or FPM Docker image with Redis caching and background cron workers handling federation delivery, media processing, and notification dispatch. One of the oldest fediverse projects (1,650+ stars, 160+ contributors since 2010), Friendica has weathered every protocol evolution and platform migration the decentralized web has thrown at it, making it one of the most battle-tested social networking platforms available.