Dockhand is a Docker management platforms, offering a modern alternative to Portainer with free OIDC SSO and vulnerability scanning that competitors gate behind paid tiers. Real-time container management provides start, stop, restart, and remove operations with live resource monitoring across CPU, memory, and network usage on a dashboard with real-time metrics. The visual Docker Compose editor enables stack creation and modification with syntax highlighting, while Git integration deploys stacks directly from repositories with webhooks and auto-sync for GitOps workflows. Vulnerability scanning powered by Grype and Trivy analyzes container images against CVE databases, with configurable auto-update scheduling that can trigger updates based on vulnerability severity criteria. The Hawser Go agent enables management of remote Docker hosts in Standard mode for LAN environments or Edge mode using outbound WebSocket connections for hosts behind NAT, firewalls, or dynamic IPs without exposing inbound ports. Interactive terminal sessions provide shell access into running containers, while the file browser enables uploading, downloading, and editing files directly within containers. Image management includes registry browsing, pull operations, and layer inspection alongside network and volume administration. The security-focused architecture builds its own OS layer from scratch using Wolfi packages via apko with every package explicitly declared. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSL 1.1 licensed, converting to Apache 2.0 in 2029.

Homelable turns your entire homelab into a live, interactive network canvas where every device, link, and service shows its real-time status at a glance. Run an nmap-powered network scan against your subnets and the tool fingerprints services, queues unknown devices for review, and drops approved hosts onto a drag-and-drop canvas with 15 native node types covering routers, switches, hypervisors, NAS boxes, IoT sensors, and more. Import your full Zigbee2MQTT mesh (controllers, routers, end devices with link quality indicators) and Z-Wave JS device trees in one click, preserving the actual RF topology without manual wiring. Proxmox integration pulls in hosts, VMs, and LXC containers so you can nest virtual machines inside their parent hypervisor node on the canvas. The Rack Canvas mode documents the physical side of your lab: create racks with configurable U-height, mount gear into slots, and patch ports across devices to track your cabling. Health checks run every 60 seconds using ping, HTTP, HTTPS, TCP, SSH, or Prometheus scrape endpoints, with WebSocket push delivering green, red, or pending status pulses directly to the canvas. Split your infrastructure across multiple canvases organized by site, rack, or purpose, and share a read-only Live View URL with anyone on your network. A built-in Model Context Protocol server lets AI assistants like Claude query and modify your topology through natural language. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

The de facto dashboard of observability: Grafana is the open-source frontend that turns the data stores you already run into interactive graphs. It does not store metrics itself; it connects to the data stores you already run and turns their contents into interactive dashboards. Supported sources number over 150 via plugins: Prometheus, Loki, Tempo, InfluxDB, Elasticsearch, MySQL, PostgreSQL, Microsoft SQL Server, AWS CloudWatch, Azure Monitor, Google Cloud Monitoring, and many more. Dashboards are built from a large library of panel types (time series, heatmaps, tables, gauges, logs) with template variables for reusable, parameterized views. Unified alerting evaluates rules against any connected data source, not just Prometheus, and routes notifications to Slack, PagerDuty, email, and other channels with grouping and silencing - unlike Prometheus Alertmanager, a single rule can combine a Loki log pattern, a PostgreSQL query result, and a CloudWatch metric. Dashboards serialize to JSON and data sources configure via provisioning files, so the entire observability setup can live in Git and deploy repeatably across environments. Explore mode adds ad-hoc querying outside dashboards, with split view for correlating a metric spike against the matching log lines, and access control spans organizations, teams, folder permissions, and OAuth, LDAP, and SAML integration. Written in Go and TypeScript, AGPL-licensed. Self-hosting gives you unlimited users, dashboards, and queries at flat hosting cost, without Grafana Cloud's usage-based pricing.

Replace a dozen household subscriptions with one app that keeps your family's tasks, calendars, meals, budget, and shopping in a single private place you control. Nineteen modules cover the daily rhythms of a household: assign chores with deadlines and priorities, plan the week's dinners and push the ingredients to a shared shopping list in one tap, track income and expenses by category with automatic subscription renewal warnings, and log health activities from vitals to medications. Two-way sync connects to Google Calendar via OAuth, iCloud and Nextcloud via CalDAV, and Outlook via Microsoft Graph, so every family member's phone shows the same schedule without switching apps. CardDAV keeps contacts in sync with external address books. The budget module handles accounts, loans, split expenses, and per-category planning with savings goals and month-over-month comparisons. Documents attach to tasks, receipts link to transactions, and a checked-off grocery item books itself back into the pantry inventory with its quantity. A Kanban board, recurring task schedules, and a rewards ledger that pays out points for completed chores keep kids and adults accountable. Wall mode turns a kitchen tablet into a glanceable family dashboard, and the Immich screensaver shows your own photos when the screen goes idle. API tokens and a built-in MCP endpoint let AI agents and third-party tools interact with every module programmatically. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 24,000 GitHub stars and active development since 2014, Firefly III is the self-hosted personal finance manager that gives you complete control over your financial data without ever contacting external servers. The double-entry bookkeeping system tracks every transaction with source and destination accounts, ensuring accurate balance calculations and audit trails across checking, savings, credit card, cash, and asset accounts. Budget management sets monthly spending limits by category with visual progress tracking and rollover support for unused allocations. Rule-based transaction automation applies categorization, tags, and budget assignments automatically based on configurable conditions matching description, amount, source, and destination patterns. Recurring transactions schedule regular bills, subscriptions, and income entries with automatic creation on configured dates. Piggy banks divide savings accounts into virtual sub-accounts for goal tracking with target amounts and deadlines. Financial reports include income versus expense summaries, budget performance charts, category breakdowns, tag reports, and net worth tracking with weekly, monthly, and yearly time ranges. Multi-currency support handles any currency with configurable exchange rates for international finance tracking. The REST JSON API covers nearly every feature for integration with external tools, import utilities, and the companion Firefly III Data Importer for bank statement processing. Two-factor authentication provides account security. Self-hosting deploys via Docker containers or directly on PHP 8.5+ with MySQL or PostgreSQL. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

CrowdSec Web UI provides a centralized web console for monitoring intrusion detection telemetry, managing firewall remediation decisions, and auditing security events across multiple CrowdSec security engines. Administrators can connect several CrowdSec Local API endpoints simultaneously, aggregating threat intelligence and active bans into a unified visual interface. The dashboard displays geographic origins of attacking IP addresses, active remediation durations, and specific scenario triggers such as brute-force authentication attacks or web vulnerability probes. Operators can search through historical alert logs, inspect raw HTTP request details, and drill down into individual IP behaviors to differentiate authentic threats from false positives. Manual intervention tools let security teams enforce custom IP bans, adjust expiration timers, or immediately revoke erroneous bans across all connected bouncers with a single click. Integrated notification pipelines dispatch real-time security alerts to external destinations including ntfy, Gotify, and MQTT message brokers whenever critical thresholds are breached. Built-in Prometheus metrics dashboards visualize processing latencies, parser throughput, and decision counts over customizable time windows. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Managing Kubernetes shouldn't require every developer to become a Kubernetes expert — KubeSphere wraps cluster operations, CI/CD, service mesh, and observability into guided web workflows that operations teams configure once and developers consume without kubectl. The LuBan extensible architecture treats each capability as an independently installable extension plugging into a lightweight microkernel: enable DevOps without service mesh, add monitoring without the app store, compose exactly what your organization needs. Multi-cluster management provides a centralized control plane for provisioning and operating clusters across cloud providers, data centers, and edge locations with unified identity and resource quotas. The DevOps extension integrates Jenkins for graphical pipeline creation with S2I and B2I workflows, while Argo CD powers GitOps continuous deployment with real-time sync status. Istio-based service mesh provides traffic management, canary deployments, circuit breaking, and distributed tracing through the console without CLI knowledge. Prometheus monitoring with custom dashboards, Fluentd log collection with multi-tenant search, and alerting via Slack and email complete the observability stack. Multi-tenant workspace hierarchy enforces resource quotas and fine-grained RBAC roles across teams. A built-in Helm-based app store handles lifecycle management across clusters. KubeKey deploys production-grade clusters on bare metal or VMs with air-gapped support. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Automate transactional and marketing messages across email, SMS, mobile push, WhatsApp, Slack, and custom webhooks from a single visual journey canvas. Dittofeed provides the capabilities of Customer.io or Braze while keeping customer PII within your own infrastructure and eliminating volume-based pricing entirely. The drag-and-drop journey builder creates multi-trigger automations with branching logic, wait nodes, random cohort splits for A/B testing, and local timezone delivery without writing code. User segments combine trait conditions, event history, and array-based filtering through AND/OR operators with real-time evaluation. Template authoring supports both a low-code visual editor and direct HTML/MJML input, with templates reusable across journeys and one-off broadcasts. Data flows in through Segment integration, Reverse ETL connections, or the REST API with Web, Node.js, and React Native SDKs. Message delivery routes through SendGrid, Amazon SES, Twilio, or SignalWire with per-channel analytics tracking opens, clicks, bounces, and unsubscribes. Authentication supports Keycloak, AWS Cognito, and GCP OAuth for enterprise SSO. Embeddable iframe and headless React components let SaaS platforms white-label journey builders into their own products. Deploy on RepoCloud with a dedicated VPS for full GDPR compliance under the MIT license.

CRM mechanics applied to your actual relationships instead of a sales pipeline: Nametag is a Personal Relationship Manager (PRM). It exists to fix the things you keep forgetting: when you last talked to an old friend, their kids' names, the birthday you missed twice. Contacts are tracked with flexible attributes - names, birthdays, important dates, and free-form notes for everything else - and organized into custom groups. Where it goes beyond a contacts app is relationship mapping: you define how people connect to each other (family, friends, colleagues, or custom relationship types), and an interactive D3.js-powered graph renders your entire personal network so you can see clusters and connections at a glance. Staying in touch is automated: scheduled reminders fire for birthdays, important dates, and reach-out nudges, with optional email delivery via a Resend API key for password resets and reminder notifications. Built with Next.js, it is mobile-responsive, ships with full dark mode, and supports multiple languages including English and Spanish. Because it is self-hosted, there are no account tiers or contact limits - unlimited people and relationships, with every note about your personal life stored on your own server rather than a social-graph company's cloud. A lightweight, single-container deployment makes it one of the easiest personal tools to run.

Moltis gives individuals and teams a completely private personal AI agent server that bridges conversational assistants to everyday messaging platforms while executing real-world computing tasks inside secure execution environments. Users can interact with autonomous agents across Telegram, Discord, WhatsApp, Slack, Matrix, and browser interfaces to draft correspondence, automate research, and schedule recurring cron tasks. The system coordinates multi-agent delegation by spinning up specialized sub-agents with dedicated roles for code generation, pull request reviews, quality assurance testing, and technical documentation. Built-in sandboxing isolates tool operations within container boundaries or WebAssembly modules, ensuring shell commands, web scraping routines, and script executions cannot alter underlying operating system files without explicit permission. Native Model Context Protocol integration allows operators to attach external data endpoints, database connectors, and custom command-line utilities without rewriting core routing logic. Persistent memory preserves conversational context and document embeddings across multiple sessions, allowing assistants to recall prior discussions, user preferences, and project guidelines indefinitely. Administrators can configure granular tool approvals, manage WebAuthn passkey authentication, and review real-time WebSocket communication logs through an embedded control panel. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 29,000 GitHub stars and deep integrations into LangChain, LlamaIndex, and CrewAI, Chroma has become the default vector database for developers building retrieval-augmented generation pipelines and AI agent memory systems. Its core API consists of just four functions — create, add, query, and delete — making it the fastest path from zero to semantic search, while the underlying Rust engine handles tokenization, embedding, HNSW indexing, and similarity scoring automatically. Chroma supports dense vector search via HNSW with configurable distance metrics including L2, cosine similarity, and inner product, sparse vector search using SPLADE, full-text BM25 keyword search, and regex matching, all combinable in hybrid queries through a single unified interface. Metadata filtering at query time uses MongoDB-style operators including $eq, $ne, $gt, $lt, $in, and logical combinators $and and $or, enabling precise result scoping without post-processing. The multimodal pipeline powered by OpenCLIP embeds text and images into a shared vector space, allowing cross-modal retrieval where text queries return relevant images and vice versa. Deployment options range from embedded mode via PersistentClient for notebooks and prototypes, to client-server mode with Docker for production, to Chroma Cloud for serverless scalability. Official Python and JavaScript SDKs provide identical APIs, and embedding function integrations support OpenAI, Cohere, Hugging Face, Google, Ollama, and custom models. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Authentication that lives inside your application rather than behind a redirect to an external identity provider - SuperTokens takes a fundamentally different architecture from Auth0 and AWS Cognito. Three tiers make that work - frontend SDKs (React, Angular, Vue, vanilla JS, React Native) render overridable login UI and manage tokens; backend SDKs (Node.js, Python, Go) expose auth endpoints on your own API domain; and SuperTokens Core, the piece you host here, is the stateless HTTP service handling core auth logic, password hashing, token signing, and database operations against PostgreSQL. The recipe system keeps features decoupled: use email/password, social login, passwordless (magic links, OTP), phone-password, multi-factor authentication (TOTP, WebAuthn), user roles, and microservice auth - individually or combined; you can even use SuperTokens purely for session management alongside another login provider. Sessions are where it shines: rotating refresh tokens with theft detection, automatic access-token refresh, CSRF protection, and secure cookie handling out of the box - the details that become vulnerabilities when hand-rolled. Verification happens locally in your backend via cached JWT signing keys, so the Core stays off the hot path. Self-hosted means no user limits, free forever, with all user data in your database. Apache-licensed.

Powering mission-critical infrastructure at OpenAI, Cursor, Replit, Lovable, Retool, and Snap with over 22,000 GitHub stars, Temporal is the durable execution platform that originated from Uber's Cadence project — built by the creators of AWS SQS, AWS SWF, and Azure Durable Functions with nine years of production-proven reliability. The workflow-as-code model lets developers write business logic in Go, Java, Python, TypeScript, .NET, PHP, or Ruby using native SDKs, while the Temporal Server automatically persists state at every step, replays from failures, retries activities with configurable backoff policies, and manages task queues without developers writing reconciliation logic. Workflows support signals for external event injection, timers for scheduled delays, child workflows for decomposition, and queries for real-time state inspection — all backed by deterministic replay over an event-sourced history that guarantees exactly-once semantics. The Web UI provides visual workflow execution inspection with event timelines, pending activity monitoring, namespace management, and worker health dashboards. Persistence supports PostgreSQL, MySQL, or Apache Cassandra for horizontal scalability, with Elasticsearch or OpenSearch for advanced workflow visibility queries. Multi-cluster replication enables global failover across data centers. The self-hosted stack deploys via Docker Compose with the auto-setup image, PostgreSQL, Web UI, and admin tools — operational within 30 minutes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

The most-starred open-source project management platform on GitHub with over 55,000 stars, Plane delivers what Jira, Linear, Monday, and ClickUp charge thousands per year for — issue tracking, sprint planning, documentation, and AI-powered workflows in one unified workspace that you own and control entirely. Work items feature a rich text editor with file uploads, sub-properties, custom states, priorities, labels, assignees, and cross-referencing, organized across five customizable layout views (list, board, table, spreadsheet, Gantt) with Command-K navigation for instant access to anything. Time-boxed Cycles provide sprint planning with automatic burn-down charts, velocity tracking, and scope change detection, while Modules break complex projects into manageable deliverables with progress aggregation. Built-in Pages combine AI-powered documentation with rich formatting, image embedding, and one-click conversion of notes into actionable work items. The AI layer reads across every project, cycle, document, and thread in the workspace — agents take real assignments, triage incoming requests, assign owners, track blockers, and ship status updates automatically. Native integrations connect GitHub, GitLab, Slack, Sentry, Figma, and 50+ tools with bidirectional issue sync and PR tracking, while import pipelines migrate entire workspaces from Jira, Linear, Asana, ClickUp, or Monday in minutes. The REST API with OAuth 2.0, HMAC-signed webhooks, typed SDKs in Node.js and Python, and a native MCP server enable custom automations. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Backed by nearly 30,000 GitHub stars and powering millions of meetings through meet.jit.si, Jitsi Meet is the open-source video conferencing platform that runs entirely in the browser with no plugins or downloads required. The WebRTC-based architecture delivers HD audio and video through the Jitsi Videobridge selective forwarding unit, while Prosody handles XMPP signaling and Jicofo manages conference focus and orechestration. End-to-end encryption uses AES-GCM 128-bit keys exchanged via the Olm protocol, protecting audio, video, and screen sharing through the Insertable Streams API in Chromium-based browsers. Moderators can split participants into breakout rooms with individual password protection, enable lobby waiting rooms for admission control, set meeting passwords, and track speaker statistics with per-participant talk time metrics. Virtual backgrounds leverage TensorFlow.js body segmentation with WebGPU and WebGL acceleration, automatically adapting quality through device tier detection. Server-side recording and YouTube live streaming run through Jibri, while Jigasi provides a SIP gateway for PSTN dial-in and speech-to-text transcription. The platform includes in-meeting chat with private conversations, polls, raise-hand functionality, emoji reactions, and tile and speaker view layouts. Mobile applications for iOS and Android complement the web client, and both web and native SDKs enable embedding video conferences into custom applications. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

FalkorDB is the first queryable property graph database to leverage sparse adjacency matrices and linear algebra for graph traversal, replacing traditional pointer-chasing with GraphBLAS-accelerated computation. Originally the RedisGraph engine, it was relaunched as FalkorDB in 2023 and rewritten from C to Rust in 2026 for improved memory safety and performance. The database supports the OpenCypher query language with proprietary extensions, translating queries into linear algebra expressions that exploit AVX hardware acceleration. Indexing options include full-text search, vector similarity for embedding-based retrieval, and range indexing, while connectivity supports both the RESP protocol for Redis clients and the Bolt protocol for Neo4j-compatible tooling. The GraphRAG SDK enables ingestion of documents in text, PDF, and Markdown formats into knowledge graphs, with schema-guided entity extraction, hybrid retrieval combining vector and graph traversal, relationship expansion, and cited answers for LLM applications. Official client libraries cover Python, Node.js, Java, Rust, Go, PHP, and C#. Multi-tenant support handles over 10,000 concurrent graphs with zero overhead and full isolation. Docker deployment runs the falkordb/falkordb image on ports 6379 for the database server and 3000 for the built-in browser UI, with persistent volume storage and optional authentication. A production falkordb-server image excludes the browser for lighter deployments. On RepoCloud, deploy FalkorDB on a dedicated VPS with root SSH access, persistent storage for your graph data, and complete control over authentication, thread count, and memory configuration, all under the SSPLv1 license.

Upload files, get a share link, let it expire: PsiTransfer is a self-hosted WeTransfer with no accounts, no logins, and no third-party cloud with size caps and metadata harvesting. The engineering focus is large files over imperfect networks. Uploads use the tus.io resumable protocol, so a dropped connection on a multi-gigabyte video resumes exactly where it stopped once you're back online; downloads support HTTP range headers for the same resilience, and everything streams, so file size is bounded by your disk rather than memory. Files organize into upload buckets with retention you control: expire after a set time (up to weeks) or after a one-time download, with automatic cleanup when links lapse. Recipients need nothing installed - they open the link, preview files in modal views, and grab everything as a zip or tar.gz archive with one click. Buckets can be password-protected (AES-encrypted download lists), and security-through-obscurity is done properly: bucket URLs use hashed UUID tokens and stored filenames are replaced with UUIDs. An optional admin page (enabled by setting an admin password) lists bucket information and storage. The Vue.js frontend ships under 100 KB gzipped and is fully responsive. Honest caveat from the author: no end-to-end payload encryption yet. BSD-licensed, Docker-ready.

With over 14,000 GitHub stars and enterprise adoption by security-conscious organizations, Coder transforms how development teams provision, manage, and secure their coding environments. Every workspace is defined as a Terraform template, meaning infrastructure engineers can standardize development environments across EC2 instances, Kubernetes pods, Docker containers, or any combination, while developers get self-service provisioning that launches in seconds rather than days of manual setup. The WireGuard-based networking layer establishes encrypted tunnels between developer machines and remote workspaces, providing low-latency access without exposing ports or configuring VPN concentrators. Automatic idle detection shuts down unused workspaces after configurable periods, directly reducing cloud compute costs for organizations running hundreds of developer environments. The Coder Agents feature introduces native AI coding capabilities where the agent loop executes entirely within the control plane on self-hosted infrastructure, keeping LLM API credentials out of individual workspaces and eliminating credential exfiltration risks. Centralized model governance allows platform teams to approve specific AI providers and models, set per-user spend limits, and maintain complete audit logs of all prompts, tool calls, and agent activity. IDE integration supports VS Code through a dedicated extension, JetBrains IDEs via Gateway and Toolbox plugins, and browser-based code-server for web access. The template registry provides pre-built configurations for common development stacks. DevContainer support builds environments from standard devcontainer.json specifications. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.