Grocy is a household management system, bringing ERP-grade inventory tracking to kitchens, pantries, and homes worldwide. The stock management system tracks products with expiration dates, best-before dates, and opened tracking, while barcode scanning via USB readers or device cameras with Open Food Facts product lookup enables rapid item entry. Minimum stock amounts trigger automatic shopping list entries so frequently used products never run out, and multiple shopping lists can be maintained and shared across household members. Recipe management links ingredients directly to stock inventory, showing at-a-glance fulfillment status and a Due Score that highlights recipes best suited for consuming items approaching expiration. The meal planner organizes daily meals across customizable time periods and adds all missing ingredients to shopping lists with one click. Chore tracking schedules recurring household tasks with assignment to specific members, due date tracking, and completion history logging. Battery management monitors charge cycles for household devices with configurable reminder intervals. Custom fields and userfields extend any entity with additional data, while feature flags disable unused modules to simplify the interface. The RESTful API with integrated Swagger UI at the /api endpoint exposes every operation the web frontend uses, enabling third-party integrations with home automation systems. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Manga, comics, ebooks, and light novels get a streaming-service-style home in Kavita - a fast, cross-platform reading server for the DRM-free collection you share with family and friends. It natively serves CBZ, CBR, CB7, ZIP/RAR/7z archives, raw images, EPUB, and PDF, with hand-crafted web readers per format: webtoon scrolling, single and dual-page spreads with advanced caching for the comic reader, and a book reader with adjustable fonts, spacing, margins, color themes, and column modes. Reading progress tracks per user, so everyone resumes exactly where they stopped on any device. Metadata parses from filenames, ComicInfo.xml, and EPUB fields, feeding index-backed search, smart filters, collections, reading lists with CBL import, and Want to Read queues. Role-based user management covers age restrictions, per-library access, and OIDC authentication. An OPDS feed connects third-party clients - Panels on iOS, Librera on Android, KOReader on e-ink devices - and a comprehensive REST API supports custom integrations. EPUB annotation and highlight support, custom theming, and full localization round it out. Built with .NET and Angular, it handles 50,000+ file libraries without strain; optional Kavita+ adds AniList scrobbling, recommendations, and external metadata.

A private ChatGPT built with Next.js: Lobe Chat is the open-source AI chat interface teams self-host instead. Its main advantage is provider breadth: one interface connects to 40+ model providers, including OpenAI, Anthropic Claude, Google Gemini, Mistral, Groq, AWS Bedrock, Azure, and local models served through Ollama, so you can switch models per conversation and compare outputs. It handles multi-modal work: image recognition, image generation, text-to-speech, and speech-to-text. A plugin system based on function calling and the Model Context Protocol (MCP) adds external tools like web search and code execution. Run it in standalone mode as a single container with settings in browser storage, or in database mode with PostgreSQL and S3-compatible storage for persistent history, multi-user auth, and RAG knowledge bases built from uploaded documents with pgvector retrieval. Because tools arrive through function calling and MCP rather than a proprietary plugin format, custom internal tools can be exposed to the assistant with a standard server over STDIO or HTTP. Hundreds of pre-configured assistant roles import from the community marketplace. For teams the cost model matters: provider API keys billed per token typically undercut a ChatGPT Plus seat per person, and self-hosting keeps API keys, uploaded files, embeddings, and conversation history entirely on your own server.

With 27,000 GitHub stars and 349 releases shipping multiple times per week, Huly replaces four separate SaaS subscriptions — Linear for issue tracking, Notion for documents, Slack for team chat, and Motion for time-blocking — with a single self-hosted platform that charges nothing per seat. The issue tracker provides projects, sprints, roadmaps, custom workflows, and Kanban views with bi-directional GitHub and GitLab synchronization that keeps issues and pull requests in lockstep across both systems. Collaborative documents use CRDT-based real-time editing for wikis, meeting notes, and technical specs with nested page hierarchies and rich embedding. Team messaging delivers channels, direct messages, threaded conversations, reactions, and pinned messages in a Slack-equivalent interface that lives alongside your project context. The time-blocking planner schedules tasks into calendar slots with drag-and-drop, integrating directly with your issue backlog so nothing falls through cracks. A virtual office module provides audio and video rooms for standups and pair programming with external guest access. HR features handle team management, office hours, and PTO tracking. The architecture runs 30+ microservices on CockroachDB for ACID-compliant storage, Elasticsearch for full-text search, MinIO for file attachments, and Redpanda for event streaming. Desktop apps ship for macOS, Windows, and Linux alongside mobile apps for iOS and Android. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. EPL-2.0 licensed.

Comp AI turns the months-long slog of SOC 2, ISO 27001, HIPAA, and GDPR certification into a largely automated process by connecting to your existing infrastructure and continuously collecting the evidence auditors actually ask for. Point it at your AWS account, Google Cloud project, GitHub organization, or any of 580+ supported integrations, and autonomous agents pull configuration snapshots, access logs, encryption status, and policy compliance data on a recurring schedule so your compliance posture reflects reality rather than last quarter's manual export. The AI policy engine analyzes your tech stack, team structure, and risk tolerance to generate organization-specific policies for information security, access control, incident response, data retention, and vendor management; no two companies get the same boilerplate. An open-source device agent runs on employee machines checking disk encryption, firewall status, screen lock settings, password length, and antivirus presence around the clock, flagging failures the moment they occur instead of surfacing them during an audit. Built-in penetration testing agents scan your codebase and API endpoints for vulnerabilities like SQL injection and output audit-ready reports. The vendor risk management module scores third-party services and surfaces compliance gaps before they become findings. A public trust center lets prospects verify your compliance status directly, eliminating security questionnaire bottlenecks. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

ToolHive is an open-source MCP server management platform that lets you run, secure, and orchestrate Model Context Protocol servers in isolated containers, giving AI agents structured access to tools like GitHub, databases, and cloud services without exposing host credentials or network. Every server launches inside its own sandboxed container with a minimal permission file, network access filtering, and encrypted secrets management, preventing misbehaving connectors from reaching beyond their defined scope. The built-in registry provides a catalog of vetted servers you can install with one command, while custom images and package-manager references let you onboard proprietary connectors without writing Dockerfiles. Platform teams deploy the Kubernetes operator to declare MCP servers as cluster resources using Custom Resource Definitions, with automated lifecycle management and multi-namespace isolation. The Virtual MCP Server gateway aggregates multiple backends behind a single endpoint, centralizing OIDC authentication, tool filtering, and composite cross-server workflows so clients connect once instead of juggling separate URLs. An MCP Optimizer analyzes tool schemas via semantic search and surfaces only relevant tools per request, cutting token consumption by up to 85%. OpenTelemetry traces and Prometheus metrics deliver full visibility into tool execution, latency, and request audit trails across every managed server. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With 14,000 GitHub stars and 81 releases since March 2023, Stalwart is the most protocol-complete open-source mail server available — delivering JMAP, IMAP4rev2, IMAP4rev1, POP3, SMTP, CalDAV, CardDAV, and WebDAV from a single Rust binary that compiles to a memory-safe, zero-garbage-collection executable with predictable latency under load. The SMTP server implements DMARC, DKIMv2, DKIMv1, SPF, and ARC for complete message authentication with automatic DKIM key rotation, while transport security enforces DANE, MTA-STS, and SMTP TLS reporting to prevent downgrade attacks. Built-in spam filtering with statistical classifiers, DNS blocklists, and collaborative reputation databases eliminates the need for external Rspamd or SpamAssassin deployments. Encryption at rest protects stored messages with S/MIME or OpenPGP, and automatic TLS certificate provisioning via ACME supports TLS-ALPN-01, DNS-01, and HTTP-01 challenges without manual certificate management. The ManageSieve server enables server-side email filtering rules, while full-text search indexes message bodies and attachments for instant retrieval. Pluggable storage backends support RocksDB for embedded deployments, PostgreSQL, MySQL, and S3-compatible object storage for distributed architectures. LDAP and SQL-based authentication integrate with existing directory services, and the web administration panel manages domains, accounts, quotas, and DKIM keys. Security audited with memory safety guaranteed by Rust's ownership model. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Feature requests, bug reports, upvotes, and a public roadmap: Astuto (Ruby on Rails backend, React frontend) gives users a Canny-style feedback portal so product decisions rest on visible demand rather than the loudest voice in the room. Feedback organizes into as many boards as you want (features, bugs, integrations), each post carrying a custom status you define - "planned," "in progress," "shipped," or whatever matches your process - and those statuses feed a public roadmap view showing users what is actually being worked on. Participation friction is adjustable at both ends: sign-in works with plain email or any OAuth2 provider, anonymous feedback can be enabled for unregistered users, and a moderation queue lets you approve posts before they appear when spam is a concern. Integration hooks are practical rather than sprawling - webhooks fire on events to connect Jira, Trello, or Slack, and a REST API manages the whole feedback space programmatically. Brand customization, an invitation system, private-site settings, and recap emails for administrators complete a deliberately minimal tool: it collects, organizes, and prioritizes feedback well, for free, forever.

The de facto dashboard of observability: Grafana is the open-source frontend that turns the data stores you already run into interactive graphs. It does not store metrics itself; it connects to the data stores you already run and turns their contents into interactive dashboards. Supported sources number over 150 via plugins: Prometheus, Loki, Tempo, InfluxDB, Elasticsearch, MySQL, PostgreSQL, Microsoft SQL Server, AWS CloudWatch, Azure Monitor, Google Cloud Monitoring, and many more. Dashboards are built from a large library of panel types (time series, heatmaps, tables, gauges, logs) with template variables for reusable, parameterized views. Unified alerting evaluates rules against any connected data source, not just Prometheus, and routes notifications to Slack, PagerDuty, email, and other channels with grouping and silencing - unlike Prometheus Alertmanager, a single rule can combine a Loki log pattern, a PostgreSQL query result, and a CloudWatch metric. Dashboards serialize to JSON and data sources configure via provisioning files, so the entire observability setup can live in Git and deploy repeatably across environments. Explore mode adds ad-hoc querying outside dashboards, with split view for correlating a metric spike against the matching log lines, and access control spans organizations, teams, folder permissions, and OAuth, LDAP, and SAML integration. Written in Go and TypeScript, AGPL-licensed. Self-hosting gives you unlimited users, dashboards, and queries at flat hosting cost, without Grafana Cloud's usage-based pricing.

With over 16,500 GitHub stars and a track record powering connected vehicle fleets, smart city sensor networks, and industrial IoT deployments, EMQX is the MQTT messaging platform engineered to handle 100 million concurrent device connections in a single cluster while processing millions of messages per second with sub-millisecond latency. The protocol stack supports MQTT 5.0, 3.1.1, and 3.1 with full QoS 0/1/2 support, shared subscriptions, retained messages, and will messages, plus MQTT over QUIC for faster connection setup, reduced head-of-line blocking, and seamless connection migration on mobile networks. The gateway framework extends connectivity to MQTT-SN, CoAP, LwM2M, STOMP, and ExProto for bridging legacy industrial protocols. The SQL-based rule engine processes and transforms messages in real time with over 50 pre-built integrations including Kafka, PostgreSQL, MySQL, MongoDB, InfluxDB, TimescaleDB, ClickHouse, Redis, AWS Kinesis, GCP Pub/Sub, and Azure Event Hubs. The visual Flow Designer creates data processing pipelines without code. Built on Erlang/OTP with a masterless distributed architecture using Mria for state replication, the cluster separates Core nodes for data consistency and Replicant nodes for client-handling workloads. Authentication supports username/password, JWT, PSK, X.509 certificates, and LDAP with configurable ACL rules. The built-in dashboard provides real-time monitoring of connections, subscriptions, topics, message rates, and cluster health. Deployment runs via Docker, Kubernetes with the EMQX Operator, or native packages. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSL 1.1 licensed.

With over 7,700 GitHub stars and thousands of Cloudflare employees using it daily across every function, Cloudflare OS delivers an open-source AI workspace where every employee gets a personal agent grounded in company context, systems, and skills — not a generic chatbot but a programmable workspace that builds real applications, automates workflows, and connects to internal tools through governed access. The Code Mode agent writes and immediately executes code snippets to perform arbitrary tasks, build full-stack Gadgets with client code, server code, APIs, and durable SQLite state, debug errors, and test results within isolated sandboxes. Gadgets are private application instances running in separate sandboxes — each document, spreadsheet, or tool is its own secure runtime that cannot leak data even to attackers with access to other Gadgets. Blueprints enable sharing application code as templates that others instantiate with independent state, credentials, and resources. Gatekeepers provide security governance giving system owners precise control over what agents can see, change, and when human approval is required before actions execute. Built on Cloudflare Workers using Durable Objects for workspace persistence, Dynamic Workers for Gadget execution, and Facets for access management. Zero Trust security via Cloudflare Access verifies every user and request before granting access. Real-time collaboration lets colleagues use shared Gadgets. Deploy to your own Cloudflare account or self-host on workerd, the open-source Workers runtime, on your own servers. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Social Analyzer scans over 1,000 social media platforms in parallel to discover and correlate user profiles from a single username query, making it the most comprehensive OSINT reconnaissance tool of its kind. Three detection modes cover different accuracy and speed tradeoffs: fast HTTP library checks for rapid sweeps, Selenium WebDriver validation for JavaScript-heavy sites, and a special mode for stubborn edge cases. String analysis generates username permutations and combinations to catch related accounts with slight naming variations. Three interfaces serve different workflows: a Node.js web application on port 9005 with a browser-based GUI, a CLI for scripted batch operations, and Python plus Node.js APIs for embedding into automated investigation pipelines. The QeeqBox OSINT library extracts profile metadata, screenshots, titles, descriptions, and activity patterns, all visualized through Ixora-based force-directed graphs that map relationships between discovered accounts. Tesseract OCR analyzes profile images for additional detection vectors. Search results narrow by country codes, website categories, Alexa ranking thresholds, and confidence levels. Optional Google API and DuckDuckGo API integration adds search engine correlation alongside direct platform queries. Docker deployment bundles Node.js, Firefox ESR, Tesseract, and all dependencies into one container. Trusted by law enforcement and security researchers for digital forensics and identity verification. 23,000+ GitHub stars. AGPL-3.0 licensed.

"Less is more" is Kanboard's stated philosophy, and the free, MIT-licensed PHP application lives it: drag tasks between customizable columns, enforce work-in-progress limits per column, and slice boards horizontally with swimlanes for releases, teams, or priorities. Tasks carry what matters - colors, categories, subtasks with time estimates, Markdown descriptions, comments, attachments, internal links, and due dates - and move or duplicate across projects in one click. A concise query language filters any board dynamically (assignee, category, due date, description), and saved filters become custom views. The automatic-actions engine kills repetitive triage: on events like column moves or task creation, Kanboard reassigns, recolors, recategorizes, or closes tasks by rule. Around the board sit a calendar, per-project analytics (cumulative flow, lead and cycle time), Gantt view, and time tracking. Authentication spans LDAP/Active Directory, Google, GitHub, GitLab, and reverse-proxy headers; a JSON-RPC API, webhooks for creating tasks from external systems, and a CLI cover integration. A large community plugin catalog adds what core deliberately omits. With no external dependencies, it runs happily on anything from a Raspberry Pi up - translated into 30+ languages.

Track every recurring payment you have, from streaming services to SaaS tools, and get AI-powered recommendations on where to cut costs. Wallos manages subscriptions with automatic due date reminders delivered through email, Discord, Telegram, Pushover, Gotify, or custom webhooks so renewal charges never catch you off guard. Multi-currency support handles international subscriptions while the Fixer API converts everything to your primary currency for unified budget visibility. The statistics dashboard breaks down monthly and yearly spending by customizable categories, revealing consumption patterns and highlighting savings opportunities. AI analysis via ChatGPT, Gemini, or a locally-hosted Ollama instance reviews your subscription portfolio and suggests alternatives or consolidation strategies. Logo search automatically fetches brand imagery so your subscription list stays visually organized without manual uploads. Authentication supports OIDC with OAuth for enterprise environments, and the mobile-responsive interface works on any device with customizable themes and multi-language support. The PHP 8.3 application with SQLite backend runs from a single Docker container (bellamy/wallos image) with two persistent volumes for database and logos on port 8282. Deploy on RepoCloud with a dedicated VPS, keeping all financial data private under the GPL-3.0 license.

Backed by 9,200 GitHub stars and venture funding led by Nauta Capital, Nhost is the open-source Firebase alternative that replaces Google's proprietary document store with a relational PostgreSQL foundation from day one. The Hasura integration auto-generates a real-time GraphQL API with subscriptions, role-based permissions, and remote schemas from your PostgreSQL tables, while event triggers and cron triggers automate backend workflows without custom infrastructure. Authentication supports email and password, magic links, phone OTP via SMS, social OAuth providers including Google and GitHub, WebAuthn for passwordless login with Face ID, fingerprints, and YubiKeys, plus two-factor authentication. Since the Q1 2026 release, Nhost Auth also functions as a full OAuth2 and OpenID Connect provider, allowing your Nhost project to issue tokens to third-party applications the same way GitHub or Google do. The S3-compatible storage service handles file uploads with automatic image optimization, virus scanning, and presigned URLs for secure direct downloads. Node.js serverless functions deploy JavaScript and TypeScript backend logic without managing servers, while the Nhost CLI spins up the complete local stack via Docker for development with automatic database migration tracking and Hasura metadata management. The MCP server integration exposes project documentation and data schemas to AI assistants for intelligent query building. SDKs cover JavaScript, TypeScript, React, Vue, Next.js, and Dart for Flutter. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Arcane gives you a single polished dashboard to manage Docker containers, images, volumes, networks, and Compose projects across unlimited remote hosts. The SvelteKit frontend paired with a Go backend delivers real-time resource monitoring with historical graphs, container lifecycle controls including shell exec and live log streaming, and one-click Docker Compose deployment with Git repository synchronization for version-controlled stack definitions. The manager-agent architecture connects remote environments via Direct TCP on port 3553 or Edge mode where agents initiate outbound gRPC/WebSocket connections through NAT and firewalls without requiring inbound ports, all secured with mTLS certificates. Vulnerability scanning identifies security issues in running container images directly from the interface. The backup system enables scheduled container snapshots with configurable retention for disaster recovery. Network and volume administration includes visual relationship mapping between services, and the responsive interface supports dark/light themes with full mobile optimization and community-driven internationalization via Crowdin. 6,500+ stars and 89 releases since April 2025 reflect a rapid development cadence. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.

With over 29,000 GitHub stars and deep integrations into LangChain, LlamaIndex, and CrewAI, Chroma has become the default vector database for developers building retrieval-augmented generation pipelines and AI agent memory systems. Its core API consists of just four functions — create, add, query, and delete — making it the fastest path from zero to semantic search, while the underlying Rust engine handles tokenization, embedding, HNSW indexing, and similarity scoring automatically. Chroma supports dense vector search via HNSW with configurable distance metrics including L2, cosine similarity, and inner product, sparse vector search using SPLADE, full-text BM25 keyword search, and regex matching, all combinable in hybrid queries through a single unified interface. Metadata filtering at query time uses MongoDB-style operators including $eq, $ne, $gt, $lt, $in, and logical combinators $and and $or, enabling precise result scoping without post-processing. The multimodal pipeline powered by OpenCLIP embeds text and images into a shared vector space, allowing cross-modal retrieval where text queries return relevant images and vice versa. Deployment options range from embedded mode via PersistentClient for notebooks and prototypes, to client-server mode with Docker for production, to Chroma Cloud for serverless scalability. Official Python and JavaScript SDKs provide identical APIs, and embedding function integrations support OpenAI, Cohere, Hugging Face, Google, Ollama, and custom models. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

An entire backend in a single Go executable: PocketBase embeds SQLite with realtime subscriptions, authentication and user management, file storage, and an admin dashboard, all behind a REST-ish API. SQLite runs in WAL mode, which outperforms client-server databases for the read-heavy workloads typical of small and mid-sized apps. Authentication supports email/password, one-time passwords, and 15+ OAuth2 providers including Google, Apple, and GitHub, with stateless tokens. Clients subscribe to record changes over server-sent events, and official JavaScript and Dart SDKs cover web, mobile, and Flutter frontends. Collections, rules, and API access permissions are managed visually in the admin UI. When you need custom logic, extend it with JavaScript hooks running in the embedded JS VM of the prebuilt binary, or import PocketBase as a Go library and compile custom business logic into your own single-file backend. File storage attaches uploads to records with thumbnail generation for images and optional S3-compatible external storage. All state lives in one pb_data directory, so backup is a directory copy and upgrade is replacing a binary - one of the lowest-maintenance backends you can run. The contrast with Firebase is the point: where usage-based pricing scales with reads, writes, and bandwidth, PocketBase runs the entire backend at flat hosting cost, and the data is a plain SQLite file you can copy anywhere. MIT-licensed.