OpenGrokBot gives you always-on AI teammates that live on your own hardware, each with a computer of its own. Every teammate is a folder with a persona and hard boundaries, a thread in your sidebar, and a contained machine with its own browser profile, workspace, and persistent memory that survives between asks. You manage the crew from a workbench-style web client: message one teammate or the whole group, watch its browser screen live, set routines like a morning digest, and check what each one used today. The safety model is the point: credentials live inside the teammate's own browser profile, so at a login wall it asks you to take over its screen instead of asking for a password; standing instructions change only through a diff you approve; and a teammate cannot approve its own holds. Teammates hand work to each other under an allowlist with a hop limit, optional daily token ceilings stop spending for the rest of the day, and a stop button kills even a shell command mid-flight. Computers can be a Docker container per teammate, or Docker-free local browsers with sandboxed commands. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Sign up for a new service and you face a familiar choice: hand over your real email and get spam-listed forever, or generate a throwaway alias that dies when you close the tab. AliasVault eliminates that trade-off by combining a password manager with a built-in email server, so every website gets a unique identity (random email, generated name, strong password) and incoming emails land directly in your encrypted vault rather than your primary inbox. Creating a new alias takes one click: the system generates a random address on your configured domain, a fake identity with name and birthdate, and a cryptographically strong password, all stored in a zero-knowledge encrypted vault that even the server administrator cannot read. Browser extensions for Chrome, Firefox, Edge, Safari, and Brave detect login forms and autofill credentials or prompt you to create a new alias on the spot. Native iOS and Android apps with biometric unlock provide mobile access to your vault and integrate with the operating system's autofill framework. The built-in TOTP authenticator generates time-based one-time codes without needing a separate app. Import existing credentials from other password managers through standard export formats, and export your vault data at any time for full portability. Self-hosting via Docker with your own email domain gives you complete control over where alias mail is received and stored, with no third-party dependencies. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 4,300 GitHub stars and a v3 release adding built-in user management, team views, and multi-language support, Kubero has established itself as the most feature-complete open-source Heroku alternative running natively on Kubernetes. The platform operates as a Kubernetes operator with two containers — kubero-ui and the operator — storing all state in etcd without an external database. Developers push code via Git integration with GitHub, GitLab, Bitea, or Gitea, and Kubero automatically builds using Buildpacks, Nixpacks, Runpacks, or Dockerfiles, then deploys to the configured domain with SSL via cert-manager. CI/CD pipelines support up to four staging environments — review, test, staging, and production — with per-stage environment variable isolation and ephemeral review apps that spin up on pull request open and tear down on close. The template catalog includes over 170 pre-configured applications like WordPress, Grafana, and PostgreSQL deployable in one click, while managed add-ons provide highly available PostgreSQL, Redis, MySQL, Kafka, CouchDB, Elasticsearch, and MongoDB alongside your applications. Security features include Trivy vulnerability scanning, GitHub and OAuth2 single sign-on, basic auth, and a role-based permission system with API tokens. The NestJS backend with Vue.js and Vuetify frontend provides application metrics, real-time logs, a built-in web console for container access, scheduled cronjob management, and deployment notifications via Discord, Slack, or webhooks. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

BrightBean Chat is a self-hosted chat automation platform that builds visual flows once and runs them across Instagram, WhatsApp, Messenger, Telegram, SMS, and email, so your audience automations live on your server instead of a per-contact subscription. You drag conditions, delays, randomizers, data collection, and message nodes onto a canvas, test the draft while the live version keeps running, then set it live with every save versioned. Flows start from keywords, comment-to-DM triggers, story mentions and replies, follows, ref URLs, QR codes, or calls to the public API. Every channel lands in one shared inbox where teammates assign conversations, label them, schedule replies, and take over from the bot, which pauses the automation for that contact. Contacts carry custom fields, tags, and segments that stay unified across channels, and imports and exports keep the list portable. Broadcasts and multi-step drip sequences check opt-outs and each platform's 24-hour messaging window before sending, pace themselves per channel, and show exactly who will receive a message and who is skipped. Per-node counters track sent, delivered, failed, and clicked, while a bearer-authenticated REST API and signed webhooks hand leads to Make, Zapier, n8n, or your own systems. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Doca puts rich text, Markdown, spreadsheets, slides, and an infinite canvas under one login and one permission model, giving individuals and small teams a self-hosted workspace for writing together. Every format supports real-time co-editing with presence, comments, saved history, and manual snapshots, and rich text and Markdown documents can be restored to an earlier version. Documents live in knowledge libraries with tree navigation, invitations, inherited permissions, share links, and trash, while personal files and shared folders sit on local disk or S3-compatible storage. Knowledge books go further: they subscribe to sources, run an editable workflow, keep source evidence, and route results through human review. A personal AI assistant, powered by whichever model you configure, searches authorized documents, reads PDF and Office attachments, edits images, and prepares browser drafts. MCP services let external AI clients such as Codex use those tools under your permissions. Sign in with a password, OIDC, Google, GitHub, WeChat, or QQ, review registrations before they go live, and send webhooks to other systems. A plugin SDK and marketplace add business modules, and a browser extension clips pages into documents. The interface ships in Chinese and English. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

"Forget about bouncers" became a real sentence because of The Lounge: a Node.js web IRC client that holds persistent connections to your networks 24/7, logging everything while you sleep, so closing the browser tab never means missing a message or losing your place in a channel. Open it again from any device - desktop, phone, tablet - and you resume exactly where you left off, with full history synchronized. Because it combines bouncer and client in one process, the experience feels like a modern chat app rather than 1990s infrastructure: push notifications for highlights and private messages (with self-generated VAPID keys, so even Web Push needs no third-party service), automatic link previews, inline file and image uploads, and full IRCv3 protocol support. It installs as a progressive web app from any modern browser, so phones get a native-feel client without an app store. Multi-user support means one instance serves your whole team or community, each user with their own networks and history, and LDAP integration ties into existing authentication. A public mode alternatively serves as an open, registration-free web chat for events or support channels. MIT-licensed, born as a fork of Shout, and a fixture of self-hosting stacks since.

Every server, embedded board, and edge gateway you manage becomes reachable through one SSH address in ShellHub, even when it sits behind NAT with no public IP and no open inbound port. A small agent on each device dials out to your server, so a box on a customer LAN or a cellular link needs nothing beyond outbound web access. Connect with the stock ssh client by typing [email protected]@server, or open a terminal in the browser, and scp, sftp, rsync, and port forwarding work unchanged. SSH identities tie every key to a named team member, so removing someone ends their access on every device at once. Default-deny access policies grant or block members, roles, users, or API keys by device tag, Linux login, and source address, and can require a fresh browser confirmation before a session opens. Provisioning keys enroll whole fleets through automatic, manual, webhook, or allowlist acceptance, with usage limits, expiry dates, and tags. The Sessions page records who connected to which device, as which login, and from where, and browser terminals can be recorded and replayed. A Docker connector turns containers into devices that policies can grant one by one. Four member roles shape what each person can change, and the HTTP API, API keys, and an MCP server let scripts and AI assistants list devices and review sessions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Every service you run, behind one polished start page: Dashy is the most customizable homelab dashboard, built as a Vue.js homepage. Configuration lives in a single YAML file, but you never have to hand-edit it: an integrated UI editor with real-time validation writes changes back to disk, so both config-as-code and point-and-click camps are served. Status indicators put a live health dot next to every app - HTTP checks or pings on custom intervals, with response time and status details on hover - giving you an at-a-glance uptime overview before anything breaks. Over 50 built-in widgets pull dynamic content from the services you already run: Pi-hole and AdGuard block stats, Proxmox lists, Nextcloud status, Netdata CPU/memory history, Prometheus data, plus weather, RSS, crypto prices, and generic iframe/API-response widgets for anything with an endpoint. Instant fuzzy search launches any app as you type, with customizable hotkeys and web-search fallthrough. Theming is deep: dozens of built-in themes, a UI color palette editor, and custom CSS over CSS variables. Alternate views include a fast-loading minimal startpage and a workspace view that embeds apps side-by-side without leaving the dashboard. Icons resolve from Font Awesome, homelab icon packs, emojis, or auto-fetched favicons. Built-in authentication, multi-page support, cloud backup/sync, and multi-language round out an MIT project with a massive community.

With nearly 8,000 GitHub stars since its December 2024 launch, Kaneo has rapidly gained traction as the minimalist alternative to bloated project management platforms like Jira and Linear. Built on TypeScript with React and Hono, the interface strips away complexity to focus on execution — plan in list view, track in kanban board, and schedule on interactive Gantt chart timelines where dragging bar handles adjusts start and due dates with optimistic UI updates. Native GitHub integration synchronizes issues bidirectionally, links pull requests to tasks, and keeps product planning aligned with development execution without context switching. The built-in Model Context Protocol server at /api/mcp enables AI tools like Claude and Cursor to manage tasks, projects, and labels directly, while the official @kaneo/mcp npm package provides stdio access for local MCP clients. Authentication supports password, magic link, GitHub OAuth, and Google sign-in with organization-level access management. Rich text editing for task descriptions and comments, label-based initiative grouping, priority levels, assignee management, and due date tracking provide focused planning without ceremony. Deploy with the drim CLI for automatic HTTPS and database setup, Docker Compose for custom configurations, or Helm charts for Kubernetes clusters — all requiring just 2GB RAM and PostgreSQL. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

LinkSift is a self-hosted media downloader that turns pasted links into finished MP4 or MP3 files through a calm browser queue you run on your own server. Paste one URL or a whole batch and it first inspects the metadata, showing titles and available qualities before a single byte of media moves. You pick MP4 or MP3, choose the video height the source actually offers, and can even request both outputs from the same link, in which case the audio is extracted from the downloaded video instead of fetched twice. Every job reports its phase, percentage, downloaded bytes, speed, and ETA live, including real encoding progress while the audio is being packaged. Reloading or reopening the tab restores the queue exactly where it was, because a running server job is never re-submitted or cancelled by a closed browser. Finished files save through the normal browser download flow, or into a folder you pick in Chromium-based browsers. A configurable concurrency limit keeps a long batch from saturating your connection, and light, dark, and system themes keep long queues easy on the eyes. There is deliberately no account system or telemetry, so the queue stays a private tool on your network. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Every account you run deserves its own browser identity, and FoxProfile keeps those identities permanently separate instead of letting them bleed into one another. Create a profile once and it remembers its device: screen, GPU, CPU cores, fonts, and canvas noise are generated on first launch and reused on every later one, so the fingerprint a site saw yesterday is the fingerprint it sees tomorrow. Sessions stick too: history, cookies, and logins live in the profile directory, and the tabs you left open reopen where you left them. Each profile carries its own proxy (HTTP, HTTPS, SOCKS4, or SOCKS5, with a built-in checker) while timezone and locale follow the exit IP automatically or stay pinned to your choice, and the Check IP button compares the exit address across three services and flags mismatches or datacenter addresses. Cookies move in and out as standard editor JSON or Netscape files, whole profiles travel as ZIP archives, and bulk actions launch, stop, or delete fleets at once. On a server, the web panel runs profiles headlessly so you can manage them and view their screens from anywhere, the REST API scripts everything, and the MCP server lets AI agents drive the browsers directly. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

WordPress without Gutenberg: ClassicPress, the community-led fork, keeps the TinyMCE classic editor as the default and strips the block editor and Full Site Editing out of core entirely. The result is roughly half WordPress's size - obsolete libraries like jQueryUI, Thickbox, and Flash support are gone, replaced by native HTML5 elements and modern alternatives like SortableJS - which translates to a measurably faster admin and a leaner attack surface. Forked from WordPress 6.2, it remains compatible with the vast plugin and theme ecosystem targeting that lineage (anything not requiring blocks generally works, helped by a blocks-compatibility mode), and the PHP-first WordPress API developers have used for over a decade works unchanged - no React required to extend your CMS. The fork adds its own improvements: built-in media categories and tags with bulk editing, revision management that lets you prune database bloat, native HTML5 dialogs for accessible touch-friendly menus, and recent releases bring APCu object-cache support, vanilla-JS core widgets, and performant translations. Governance is democratic and community-driven rather than corporate. For content sites, business sites, and blogs where the classic editing workflow is the feature, ClassicPress is stability as a philosophy.

Imp runs large AI chat models privately on one NVIDIA RTX 50 or RTX PRO graphics card, exposing them through OpenAI and Anthropic compatible APIs plus a built-in browser chat. Start it with a single Docker command, point it at a model, and the chat opens in your browser with saved conversations and a live readout of generation speed. Coding agents such as Claude Code and Codex connect by changing one base URL, so your editor talks to the model on your own hardware instead of a rented cloud endpoint. Tool calls, structured JSON output, streaming responses, and reasoning models all work over the wire, and requests can be protected with an API key, per-IP rate limits, and concurrency caps. Load GGUF files you already have or NVFP4 and FP8 SafeTensors checkpoints straight from Hugging Face with no conversion step before the first answer. When a model is bigger than the card, mixture-of-experts weights stay in system RAM while the busiest experts are cached on the GPU, so a 123.6 GiB model still answers from a 32 GB card. Supported models can also read images alongside text, and tokenize, health, and model listing endpoints make the server easy to wire into scripts and monitors. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Every Terraform change becomes a pull request with Atlantis, which runs the plan on your server, posts the output for review, and applies only the exact change reviewers approved. Open a pull request that touches Terraform code and Atlantis automatically runs terraform plan, posting the full output as a comment and a commit status your reviewers can inspect line by line. When the change looks right, a teammate comments atlantis apply and Atlantis executes the exact plan that was reviewed, then reports the result back on the same pull request. Each directory and workspace is locked while a pull request is open, preventing two changes from applying out of order, and locks can be inspected or discarded from the web interface. Apply requirements let you demand an approved review or a mergeable branch before anything runs, and optional policy checks evaluate plans against your rules before they can proceed. Repositories describe their projects, workspaces, and custom workflows in an atlantis.yaml file, including pinned Terraform versions, execution order groups, and parallel planning or applying across projects. Because Atlantis runs inside your infrastructure, cloud credentials never leave your network, and every plan, approval, and apply is preserved on the pull request as an audit trail. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Generic AI writing sounds like nobody in particular; BullFlow writes from your own company knowledge instead. It first builds a private knowledge base from your documents, images, audio, and video plus structured records for your company, brand, products, customers, and cases. Ingestion runs entirely on local open models: OCR reads scans, semantic splitting and chunking prepare text, and hybrid vector plus full-text search retrieves passages with their sources and relevance scores shown under every answer. A creation agent then works in one conversation: it searches the knowledge base, drafts articles with images embedded in the text, generates image sets or short videos, and exports finished pieces as PDF or Word. Output adapts to where it is going, long-form articles for article platforms, multi-image posts with matching copy for image feeds. A separate distribution gateway sends one finished piece to many accounts across Chinese and international social platforms, checks account health on a schedule, and returns publish results and metrics by webhook. Around all of that sits a commercial shell: multiple tenants with isolated data, roles from super admin to finance, credit billing measured per token, image, and second, subscriptions, invoices, referral commissions, and a conversion funnel in the operations backend. Scheduled rules can generate and publish on a timetable with nobody watching, and notifications report each completion or failure. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With 13,800 GitHub stars, adoption by OpenAI for ChatGPT's authentication infrastructure serving 800 million weekly active users, and governance under the Ory open-source ecosystem, Ory Kratos provides enterprise-grade identity management as a headless API server that separates authentication logic from user interface — enabling any frontend framework to consume standardized self-service flows for registration, login, recovery, verification, and profile management. Multi-factor authentication supports passkeys, WebAuthn security keys, TOTP authenticator apps, SMS one-time codes, email magic links, and backup recovery codes with configurable Authenticator Assurance Levels enforcing step-up authentication for sensitive operations. Social sign-in connects to any OpenID Connect provider including Google, GitHub, Apple, and Microsoft, plus enterprise SAML 2.0 federation for B2B single sign-on. Customizable identity schemas using JSON Schema define user profiles with flexible trait structures, while pre- and post-flow webhooks enable integration with CRMs, analytics, and compliance systems. The courier system handles email and SMS delivery for verification codes and password recovery links. Session management provides device tracking, forced logout, and configurable lifespans with privileged session elevation. Deploy alongside Ory Hydra for OAuth2/OIDC token issuance and Ory Keto for fine-grained permissions to build a complete identity platform. Docker Compose deployment with PostgreSQL. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Redd-Archiver builds you a private, permanent copy of Reddit's history: feed it public data dumps and it returns a browsable, full-text-searchable archive of the communities you choose. The source material is enormous and already public: the full Pushshift and Arctic Shift Reddit datasets hold over 2.38 billion posts from 40,000 subreddits, the complete Voat archive adds 3.81 million posts, and Ruqqus contributes another half million, all importable by community instead of wholesale. One import into PostgreSQL becomes three possible websites: a static export that runs on any host down to a USB stick, the default hybrid of static pages plus a live search server, or a fully dynamic site that renders straight from the database with flair, domain, score and date filters. Search understands keywords, subreddit, author, date and score operators, and the same archive answers scripts and AI agents through thirty-plus REST endpoints and an MCP server with 29 tools. Monthly Arctic Shift dumps keep everything current: updates import only your tracked subreddits, skip themselves by checksum when re-run, refresh scores, and never let a later deletion overwrite text you preserved. Subreddit rules, descriptions and wiki pages ride along with the posts, eleven themes restyle the result, and the whole thing can hide behind a Tor hidden service or stand on HTTPS with its own domain. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Unlicense licensed.

Frappe Insights delivers a self-hosted business intelligence platform where non-technical users build complex analytical queries without writing SQL. The visual query builder uses Ibis under the hood to compose optimized SQL from drag-and-drop column selections, filters, aggregations, and group-by operations — translating point-and-click interactions into performant database queries across MySQL, PostgreSQL, DuckDB, and BigQuery. The join editor provides a graphical interface for defining multi-table relationships, letting analysts connect data across schemas without understanding foreign keys or join types. The chart builder renders interactive visualizations using Apache eCharts with support for bar, line, area, pie, scatter, funnel, and pivot table chart types — each configurable with axes, colors, legends, and formatting options. Dashboards combine multiple charts into shareable views with layout customization, auto-refresh intervals, and filter propagation across widgets. Data source management handles connection pooling across multiple databases simultaneously, enabling cross-database analysis in single queries. Server scripts extend query capabilities with custom Python transformations for complex business logic that visual tools cannot express. Built on the Frappe Framework's full-stack architecture, deployment uses Docker via the official easy-install script that provisions the complete stack including MariaDB, Redis, and Nginx. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.