When a regulatory audit, legal discovery request, or employee offboarding requires years of verifiable email records, Open Archiver provides a tamper-evident, self-hosted vault for every message across your organization. Connect Google Workspace domains, Microsoft 365 tenants, personal Outlook OAuth accounts, or standard IMAP servers for continuous background synchronization, or upload historical PST, MBOX, and zipped EML archives in bulk. Every ingested message is deduplicated, compressed, and stored in standard EML format on local disks or S3-compatible object storage while SHA-256 cryptographic hashes verify file authenticity on demand through built-in Integrity Reports. Instant full-text search scans both message bodies and attached PDF or DOCX documents, letting compliance teams reconstruct complete conversation threads and enforce automated retention policies. Granular access control backed by an AWS IAM style policy engine, TOTP two-factor authentication, and an immutable audit trail keeps sensitive correspondence locked down. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Dify turns the notoriously complex process of building production-grade AI applications into a visual drag-and-drop experience that teams can actually ship and maintain. With over 87,000 GitHub stars and backing from prominent investors, the platform has become the go-to open-source LLMOps solution for organizations that refuse to be locked into proprietary AI stacks. The visual workflow canvas lets developers wire together LLM calls, conditional logic, iteration loops, tool invocations, and human-in-the-loop checkpoints without writing boilerplate integration code. Its RAG pipeline engine handles the full document lifecycle from ingestion of PDFs, Word documents, and HTML through configurable chunking strategies, embedding with models from OpenAI or open-source alternatives, vector storage in Weaviate, Qdrant, Pinecone, or pgvector, and hybrid semantic-plus-keyword retrieval with citation tracking. Dify integrates with hundreds of model providers including OpenAI GPT-4o, Anthropic Claude, Google Gemini, Mistral, Llama, and any OpenAI-compatible endpoint like Ollama for fully local inference. The agent framework supports both ReAct and function-calling strategies with 50-plus built-in tools spanning Google Search, DALL-E, Stable Diffusion, WolframAlpha, and custom API definitions. Published apps can be deployed as hosted web interfaces, embedded chat widgets, REST API endpoints, or MCP-compatible tools. Enterprise features include role-based access control, SSO integration, and audit logging. A built-in marketplace enables teams to share and reuse model providers, tools, and workflow templates across projects. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed with an open-source community edition.

Ever Gauzy consolidates ERP invoicing, CRM sales pipelines, HRM employee records, applicant tracking, and project management into one full-stack TypeScript platform, eliminating the need to stitch together five separate SaaS subscriptions. Over 4,300 GitHub stars and 3,800+ releases back a CQRS architecture that separates command and query responsibilities across modules for invoices, expenses, payments, inventory, contacts, leads, deals, employee onboarding, candidate interviews, hiring workflows, sprints, goals, and KPI tracking. Time tracking captures hours via web timer, Electron desktop timer with activity monitoring and automatic screenshot capture, or browser extension, with timesheet submission and approval workflows supporting billable hour classification across Hubstaff and Upwork integrations. The multi-tenant architecture provides automatic tenant scoping with role-based permissions, while dual ORM support through TypeORM and MikroORM with Knex query builder ensures database flexibility across PostgreSQL, MySQL, and MariaDB. REST APIs documented with OpenAPI and Swagger expose every module for headless operation, complemented by an MCP server offering 323 tools for AI assistant integration. The Angular 19 dashboard provides dark, light, corporate, and material themes with i18n across 10 languages via Crowdin. Supports Docker, Kubernetes, Terraform, and Pulumi deployment with Redis caching and OpenSearch full-text indexing. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Comp AI turns the months-long slog of SOC 2, ISO 27001, HIPAA, and GDPR certification into a largely automated process by connecting to your existing infrastructure and continuously collecting the evidence auditors actually ask for. Point it at your AWS account, Google Cloud project, GitHub organization, or any of 580+ supported integrations, and autonomous agents pull configuration snapshots, access logs, encryption status, and policy compliance data on a recurring schedule so your compliance posture reflects reality rather than last quarter's manual export. The AI policy engine analyzes your tech stack, team structure, and risk tolerance to generate organization-specific policies for information security, access control, incident response, data retention, and vendor management; no two companies get the same boilerplate. An open-source device agent runs on employee machines checking disk encryption, firewall status, screen lock settings, password length, and antivirus presence around the clock, flagging failures the moment they occur instead of surfacing them during an audit. Built-in penetration testing agents scan your codebase and API endpoints for vulnerabilities like SQL injection and output audit-ready reports. The vendor risk management module scores third-party services and surfaces compliance gaps before they become findings. A public trust center lets prospects verify your compliance status directly, eliminating security questionnaire bottlenecks. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With 20,500+ GitHub stars and over 6,000 organizations running it in production — including a Fortune 100 company ingesting more than 4 PB per day — OpenObserve is the open-source observability platform that replaces your entire Datadog, Splunk, or ELK stack with a single Rust binary deploying in under two minutes. Apache Parquet columnar storage with zstd compression on S3-compatible object storage delivers 140x lower storage costs than Elasticsearch while providing better query performance on a quarter of the hardware. Ingest logs, metrics, and distributed traces via native OpenTelemetry OTLP endpoints with no vendor lock-in. Query logs and traces with standard SQL, metrics with SQL or PromQL — no proprietary query language to learn. The built-in dashboard builder offers 19 chart types including time-series graphs, heatmaps, gauges, tables, and top-K lists with drag-and-drop layout combining data from all signal types. Data pipelines process, enrich, redact, or normalize ingestion streams using Vector Remap Language for real-time transformations including PII redaction and logs-to-metrics conversion. Real User Monitoring captures frontend performance with session replay. The Service Catalog provides topology-based trace analysis with side-panel drill-downs into database queries and error details. Alerting supports real-time and scheduled rules with SQL and PromQL conditions. Native multi-tenancy isolates organizations and streams with complete data separation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPLv3 licensed.

Confluence and Notion both want your team's documentation in their cloud; Docmost, an open-source collaborative wiki platform, keeps it on your server. The centerpiece is a Notion-style block editor with CRDT-based real-time collaboration: multiple people edit the same page simultaneously and changes merge without conflicts or overwrites. Content lives in spaces - per team, project, or department - with nested page trees, role-based permissions, groups, inline comments, page history with restore, and full-text search across everything. The editor covers tables, code blocks, callouts, KaTeX math, and file attachments, and diagramming is built in rather than bolted on: Mermaid, Draw.io, and Excalidraw all render inside pages, alongside embeds for Airtable, Loom, Miro, and more. Migration paths include Notion, Markdown, HTML, and ZIP archive imports (Confluence, PDF, and DOCX importers ship in the Enterprise edition, along with SSO via SAML/OIDC/LDAP and MFA). The stack is TypeScript with PostgreSQL and Redis, deploys via Docker Compose, runs in air-gapped environments with no external dependencies, and is translated into 10+ languages. The AGPL-3.0 community edition carries no per-seat fees; the project has passed 20,000 GitHub stars since its 2024 launch.

Continuous infrastructure monitoring meets automated SSL expiration tracking in Kuvasz, a self-hosted uptime platform that alerts DevOps teams before outages disrupt production operations. Operators can configure granular health checks across HTTP endpoints, ICMP ping targets, and raw TCP ports with custom polling intervals down to seconds. Automated SSL inspectors track certificate validity, issuing early warning notices before cryptographic chains expire and disrupt production traffic. A push monitoring system receives incoming heartbeat signals from background cron jobs, database backups, and recurring automation scripts, triggering alerts whenever expected pings fail to arrive on schedule. Multi-channel dispatchers route incident notifications through Slack, Discord, Telegram, Microsoft Teams, PagerDuty, and custom webhook payloads with adjustable failure count thresholds to eliminate transient false alarms. Maintenance windows let teams schedule planned downtime through one-off intervals or recurring cron expressions, automatically muting notifications during deployment cycles. Public and private status pages publish categorized system health metrics, historical latency charts, and incident timelines to keep internal stakeholders and end users informed. An integrated Model Context Protocol server allows AI assistants to query monitoring states and toggle checks directly via conversational interfaces. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Super Productivity eliminates the context switching between issue trackers, calendars, and timer apps that fragments developer focus, pulling tasks from Jira, GitHub, GitLab, Gitea, OpenProject, Linear, ClickUp, Trello, and Azure DevOps into one local-first interface. With 21,000+ stars and availability across web, desktop, Android, and iOS, it syncs issue status, subtasks, and time logs bidirectionally so sprint planning and worklog submission happen without leaving the app. CalDAV integration pulls calendar events into your task timeline for visual timeboxing. Built-in Pomodoro and Flowmodoro timers enforce focused intervals with configurable break schedules. Data stays under your control in browser IndexedDB by default, with optional AES-encrypted sync via WebDAV, Nextcloud, Dropbox, or the SuperSync server ensuring no task data touches infrastructure you do not own. The extensible plugin system supports JavaScript-based custom panels, automations, and MCP plugins for AI workflows. A REST API on port 3876 enables external script integration for desktop automation. Time tracking generates exportable timesheets compatible with corporate reporting systems. The Docker container serves the Angular PWA through Nginx on port 80, consuming roughly 50 MB of RAM. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Dockhand is a Docker management platforms, offering a modern alternative to Portainer with free OIDC SSO and vulnerability scanning that competitors gate behind paid tiers. Real-time container management provides start, stop, restart, and remove operations with live resource monitoring across CPU, memory, and network usage on a dashboard with real-time metrics. The visual Docker Compose editor enables stack creation and modification with syntax highlighting, while Git integration deploys stacks directly from repositories with webhooks and auto-sync for GitOps workflows. Vulnerability scanning powered by Grype and Trivy analyzes container images against CVE databases, with configurable auto-update scheduling that can trigger updates based on vulnerability severity criteria. The Hawser Go agent enables management of remote Docker hosts in Standard mode for LAN environments or Edge mode using outbound WebSocket connections for hosts behind NAT, firewalls, or dynamic IPs without exposing inbound ports. Interactive terminal sessions provide shell access into running containers, while the file browser enables uploading, downloading, and editing files directly within containers. Image management includes registry browsing, pull operations, and layer inspection alongside network and volume administration. The security-focused architecture builds its own OS layer from scratch using Wolfi packages via apko with every package explicitly declared. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSL 1.1 licensed, converting to Apache 2.0 in 2029.

Sixty-thousand-plus GitHub stars make Uptime Kuma the most popular self-hosted monitoring tool - MIT-licensed, Node.js, and the standard replacement for UptimeRobot, Pingdom, and Freshping. It watches a dozen monitor types: HTTP(S) endpoints with keyword and JSON-query content validation, TCP ports, ICMP ping, DNS records, WebSockets, Docker containers via the socket, Steam game servers, MQTT brokers, gRPC services, and push-based heartbeats for cron jobs and internal workers. Checks run at intervals as tight as 20 seconds - versus UptimeRobot's 5-minute free tier - with unlimited monitors and unlimited data retention. When something fails, alerts fan out through 90+ notification channels: Slack, Discord, Telegram, email with LiquidJS templating, PagerDuty, OpsGenie, ntfy, Gotify, Matrix, and dozens more via native providers plus the Apprise library. Unlimited public or password-protected status pages - mappable to specific domains and organized into monitor groups - communicate health to customers, with maintenance windows that suppress alerts during planned work. The reactive dashboard graphs response times, tracks SSL certificate expiry with advance warnings, supports proxies and 2FA, and ships in dozens of languages. One Docker container with a SQLite volume covers an entire infrastructure.

With over 1,200 GitHub stars, 12,000+ commits, and more than a decade of active development distributed under the AGPL-3.0 license, Cozy Cloud operates as a comprehensive personal data hub that goes far beyond file storage by connecting your documents, contacts, calendars, banking transactions, energy bills, and productivity tools into a single self-hosted platform where no third party profiles you. The cozy-stack Go binary handles file storage, CouchDB document management, job scheduling, app serving, and the REST API in a single process consuming approximately 150MB of RAM idle. Sandboxed konnectors import data from 50+ external services — banks, utility providers, telecom operators, cloud drives — running as isolated jobs via nsjail to prevent untrusted code from accessing other user data. The built-in app store serves web applications in subdomain-isolated environments with Content Security Policy headers, each app communicating exclusively through the documented REST API. Real-time synchronization via PouchDB replication and WebSocket keeps files, contacts, and documents consistent across desktop clients, mobile apps for iOS and Android with automatic photo backup, and the web interface. Security features include automatic Let's Encrypt TLS certificates, Argon2id password hashing, optional TOTP two-factor authentication, and GDPR-compliant data export via the CLI. Each user receives their own isolated instance with independent storage, database, and application configuration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

GCHQ open-sourced its "Cyber Swiss Army Knife", and CyberChef became the web app security analysts, incident responders, and CTF players reach for when data needs decoding, decrypting, or dissecting. Its interface is four panes: paste or drag input (files up to 2GB), search a categorized library of hundreds of operations, drag them into a recipe with arguments, and read the output. Operations span Base64, hex, and XOR encoding; AES, DES, and Blowfish encryption; classical ciphers from Caesar to Railfence; hashes and checksums; compression; regex and string extraction of IPs, domains, and URLs; timestamp conversion; and parsers for IPv6, X.509 certificates, and more. Recipes chain arbitrarily - convert from a hexdump then decompress, decrypt AES pulling the IV from the cipher stream, or let the Magic operation auto-detect several layers of nested encoding. Auto Bake re-runs the recipe live as input or arguments change, Step executes one operation at a time for debugging, and flow control (forks, subsections, registers) applies different operations to different parts of the data. Recipes save to files or share as URLs encoding the full pipeline. Crucially, CyberChef is entirely client-side JavaScript - nothing uploads anywhere - and self-hosting guarantees an unmodified copy inside your own network, where malware artifacts belong.

Alf.io handles the complete conference and event lifecycle from ticket distribution through check-in to financial reporting, built for organizers who refuse to surrender attendee data to third-party ticketing platforms like Eventbrite or Tito. Built on Java 17 with Spring Boot and PostgreSQL with row-level security policies, the project has earned over 1,500 GitHub stars from privacy-conscious event organizers across Europe and beyond. Payment processing supports Stripe for credit cards, Mollie for iDEAL, Bancontact, KBC/CBC, and Przelewy24, plus Revolut, PayPal, bank transfers, on-site collection, and configurable custom offline payment methods with localized instructions. Multi-tier ticket categories enable early bird, VIP, standard, and free registrations with promotional codes, group discounts, and waiting lists that automatically notify next-in-queue when cancellations occur. Customizable registration forms collect attendee data beyond standard fields, while EU VAT management validates tax IDs through the VIES web service and supports Italian e-invoicing with automatic PDF invoice generation attached to confirmation emails. The Alf.io Scan mobile app for iOS and Android performs QR code check-in at venue entrances, and the Alf.io-PI project provides Raspberry Pi-powered offline-capable check-in stations that form encrypted clusters for high-throughput badge printing at large events. Apple Wallet integration delivers digital passes via PassKit. The extensions system integrates with CRMs, accounting platforms, Slack, Telegram, and Mailjet. Multi-language support covers nine languages. Deploy via Docker with PostgreSQL. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPLv3 licensed.

Homelable turns your entire homelab into a live, interactive network canvas where every device, link, and service shows its real-time status at a glance. Run an nmap-powered network scan against your subnets and the tool fingerprints services, queues unknown devices for review, and drops approved hosts onto a drag-and-drop canvas with 15 native node types covering routers, switches, hypervisors, NAS boxes, IoT sensors, and more. Import your full Zigbee2MQTT mesh (controllers, routers, end devices with link quality indicators) and Z-Wave JS device trees in one click, preserving the actual RF topology without manual wiring. Proxmox integration pulls in hosts, VMs, and LXC containers so you can nest virtual machines inside their parent hypervisor node on the canvas. The Rack Canvas mode documents the physical side of your lab: create racks with configurable U-height, mount gear into slots, and patch ports across devices to track your cabling. Health checks run every 60 seconds using ping, HTTP, HTTPS, TCP, SSH, or Prometheus scrape endpoints, with WebSocket push delivering green, red, or pending status pulses directly to the canvas. Split your infrastructure across multiple canvases organized by site, rack, or purpose, and share a read-only Live View URL with anyone on your network. A built-in Model Context Protocol server lets AI assistants like Claude query and modify your topology through natural language. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

ProjectSend gives every client a private, signed-in page on your own server where only the files you assigned to them appear, so contracts, photo shoots, and quarterly reports skip the third-party file-sharing service. You upload once, then share a file or a whole folder with one client, a group, or anyone holding a public link, with an optional expiry date or download limit. Clients search, preview, and download files one by one or as a zip, whole folders included, comment on a document so questions stay beside it, and send files back within the quota you set. Uploads of up to 2 GB travel in resumable pieces, so a dropped connection pauses a transfer instead of ruining it. Folders, categories, custom client fields, and linked file versions keep a growing library tidy, while roles with granular permissions let staff work without becoming administrators. The activity log and download history record who received what and when, and the log exports to CSV. Sign-in works with email and password, LDAP, or Google and Microsoft accounts, with optional two-factor authentication. Your logo, watermark, themes, and editable email templates carry your brand, and the interface is translated into 16 languages. Optional virus scanning quarantines suspicious uploads, and a REST API with scoped tokens automates uploads, sharing, and account management. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-2.0-or-later licensed.

What Trello fans wanted Trello to stay: Kan (kan.bn) is a minimalist, frills-free kanban board capturing the original vision before the enterprise pivots - and then adds the things 2025 actually demands. The core is exactly right: drag-and-drop cards across lists, labels and filters to find work fast, comments for discussion on cards, checklists, a detailed activity log tracking every change, and reusable board templates. Workspaces gather your team with member invites and role management, and board visibility controls decide who can view or edit each board. Migration is first-class: a built-in Trello importer brings existing boards over, so switching costs an afternoon, not a quarter. The standout differentiator is the bundled Model Context Protocol server exposing 46 tools across workspaces, boards, lists, cards, comments, checklists, labels, and members - meaning Claude Desktop, Cursor, Copilot, or any MCP client can read and manage your boards in natural language: "move everything assigned to me into Done" becomes a sentence, not a click marathon. The stack is modern TypeScript - Next.js, tRPC, Drizzle ORM over PostgreSQL, Better Auth (credentials or OAuth), Tailwind - with optional SMTP email and S3 file storage. Unlimited boards, lists, and cards; AGPL-licensed.

Google Analytics without the cookie banner or the maze of menus: Rybbit puts web and product analytics for every site you run on one readable dashboard, hosted on your own server. Pageviews, sessions, unique users, bounce rate, session duration, traffic sources, campaigns, devices, and countries update in real time beside a live visitor count. Session replay lets you watch the visits behind the numbers, and user profiles tie identified visitors to their sessions and events. Funnels pinpoint where conversions leak, journeys chart the paths people take through a site, retention reports show who comes back, and goals track conversions from page visits, custom events, and autocaptured clicks. Custom events carry JSON properties, filters slice every report across more than 15 dimensions, saved segments reapply them in one click, and location tracking drills from country to region to city on interactive maps, with optional 3D globe views through a Mapbox token. Error tracking connects JavaScript failures to the affected sessions, so a spike in errors leads straight to the visits that explain it. One install serves unlimited sites and organizations with role-based access, public dashboards share a site's stats through a link, and a tracking script of about 11 KB compressed collects data with no cookies and no consent banner. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Stop handing your daily food diary, body weight history, and biometric sleep data to ad-funded fitness clouds: NutriTrace brings complete calorie, macro, micronutrient, and wellness tracking to your own server with an offline-capable web PWA and native Android app. Log meals across customizable slots using live Open Food Facts and USDA FoodData Central lookups, barcode scanning, AI nutrition label OCR, or direct recipe imports from Mealie and CookTrace. Calorie and macro targets adjust automatically through three goal engines, including an inspectable Adaptive TDEE algorithm that regresses 35 days of intake against scale weight at 7,700 kcal per kilogram. Connect Fitbit via Google Health, Garmin, Withings, and Android Health Connect to pull steps, heart rate variability, sleep stages, and body composition into unified Sleep, Readiness, and Resilience scores. An integrated Trace AI assistant and Smart Log let you log meals by voice, text, or meal photo, while the opt-in Model Context Protocol server exposes 20 read, write, and management tools to Claude Desktop, Cursor, and Codex. Multi-user households get OpenID Connect SSO and one-step migration from MyFitnessPal, Cronometer, Lose It, and Waistline. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.