Mox offers a complete mail server stack in a single Go binary requiring no external dependencies. The quickstart command configures a working mail server with SMTP, IMAP4, webmail, and full DNS authentication in under ten minutes. SMTP handling includes a delivery server on port 25, a submission server for authenticated clients, and a queue with automatic retries and DKIM signing. IMAP4rev2 implementation provides full mailbox synchronization with CONDSTORE and QRESYNC for efficient offline clients, NOTIFY for multi-mailbox monitoring, MULTISEARCH across mailboxes, and TLS client certificate authentication via the EXTERNAL SASL mechanism. The built-in webmail provides browser-based reading and composing with message threading, attachments, and HTML rendering without requiring a separate web client. Email authentication implements SPF validation, DKIM signing and verification with automatic key rotation, DMARC policy enforcement with aggregate and failure reporting, DANE with DNSSEC-protected TLSA records, and MTA-STS for certificate verification. Junk filtering combines reputation-based sender scoring with Bayesian content analysis trained per account. The web administration interface manages domains, accounts, DNS records, TLS certificates, delivery queue, and real-time log viewing. Internationalized email addresses with EAI and IDNA support handle non-ASCII domains and mailboxes. Account autoconfiguration publishes settings for Thunderbird autoconfig and Outlook autodiscover. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Send a document, receive a PDF: Gotenberg is a Docker-based, stateless HTTP conversion API trusted in production by thousands of companies and adopted by notable open-source projects. Send files as multipart/form-data, get a PDF back; Chromium, LibreOffice, and fonts are the container's problem, not yours. Headless Chromium handles URLs, HTML templates, and Markdown with pixel-perfect browser rendering: it executes JavaScript, loads web fonts, waits for network idle, a JS expression, or a DOM selector before rendering SPAs, and accepts injected cookies and HTTP headers for authenticated pages. LibreOffice converts 100+ office formats - .docx, .xlsx, .pptx, and legacy formats - with page-range extraction and PDF/A archival conformance. Built-in PDF engines round out the pipeline in every image variant: merge, split, rotate, flatten, encrypt, watermark, stamp, read/write metadata and bookmarks, plus Factur-X/ZUGFeRD e-invoicing and PDF/UA accessibility compliance. Screenshots of URLs and HTML come from the same endpoints. Zero-transfer pipelines stream files directly between S3, MinIO, or GCS presigned URLs and Gotenberg, bypassing your application entirely, and webhooks enable async processing. Statelessness means horizontal scaling is trivial - run as many replicas as your conversion volume demands. Three image variants (full, Chromium-only, LibreOffice-only) trim the footprint to what you actually use.

Standard Notes keeps your notes, files, and tags encrypted on your device before anything touches the network, meaning the server stores only ciphertext it cannot read. Cross-platform sync across desktop, mobile, and web delivers fast, conflict-free updates on unlimited devices with the same zero-knowledge guarantee that only your password can decrypt your content. The V2 server architecture condenses everything into four Docker containers consuming roughly 570MB RAM total (down from 13 containers and 1.7GB in the legacy setup), with startup under one minute. Revision history automatically preserves every version of every note, so recovering deleted text or reverting to a previous state never depends on manual backups. A nested tag system organizes thousands of notes with hierarchical categorization that goes well beyond flat folder structures, while search operates entirely on client-side decrypted content. File attachments of any type encrypt and sync alongside notes with identical end-to-end protection. Multiple editor options span plain text, Markdown with preview, and rich formatting to fit different writing workflows. Two-factor authentication via TOTP with email backup codes adds a second barrier beyond your password. An optional separate container serves the web frontend, providing browser access to your encrypted vault without depending on standardnotes.com infrastructure. With 5,500+ GitHub stars and active development, the project continues expanding editor plugins and sync improvements.

Trusted by Mistral AI, PayPal, Groq, and Synthesia with over 10,300 GitHub stars and Y Combinator backing, Lago is the open-source billing engine that handles usage-based, subscription-based, and hybrid pricing models through a single API-first platform — replacing the need to build custom billing logic or depend on opaque SaaS pricing infrastructure. Real-time event ingestion via ClickHouse processes billable events with deduplication and multiple aggregation methods including count, sum, unique count, max, and weighted sum, while graduated pricing tiers, package-based billing, and percentage-based fees model any pricing strategy from simple subscriptions to complex marketplace commission structures. Automated invoice generation calculates charges according to configurable billing cycles with grace periods, proration for mid-cycle changes, and credit note issuance for refunds and adjustments. Prepaid credits enable pay-in-advance models where customers purchase credit blocks and draw down as usage accumulates, while entitlements tie feature access directly to billing plans for automated provisioning and de-provisioning. Payment orchestration integrates natively with Stripe, Adyen, and GoCardless with automatic retry logic, dunning workflows for failed payments, and multi-gateway routing. Revenue analytics provide cross-stream visibility into MRR, usage trends, churn, and revenue drivers through dedicated API endpoints. The customer portal embeds into your application for self-service invoice access and usage monitoring. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Managing household finances and personal investments becomes completely private with ezBookkeeping, a self-hosted accounting platform that combines multi-currency ledger tracking, automated bank imports, and AI-assisted receipt analysis into a responsive financial dashboard. Users can record daily income, expenses, and asset transfers using hierarchical two-level accounts and customizable tags, attaching photographic receipts and geographic location coordinates to individual entries. The automated data ingestion engine processes bank statements across standardized CSV, OFX, QIF, CAMT, and MT940 files, applying user-defined column mappings and custom conversion scripts to eliminate manual bookkeeping. Financial planners can schedule recurring bills, configure monthly category spending limits, and track asset distribution with interactive charts, trend graphs, and activity heatmaps in the Insight Explorer. Integrated artificial intelligence tools scan uploaded invoice photos to extract line items automatically while a native Model Context Protocol server lets external desktop assistants query balances and audit budgets safely. Security features include time-based two-factor authentication, single sign-on via standard identity providers, and biometric passkey screen locks that secure private monetary ledgers on shared computers. Account owners can export full audit histories to portable spreadsheets, manage multi-currency exchange rate tables, and access clean web interfaces on both desktop monitors and mobile devices. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Thirteen-plus LLM providers, one unified client: NextChat (formerly ChatGPT-Next-Web) is an open-source AI chat interface built on Next.js that spans OpenAI GPT-4, Anthropic Claude, Google Gemini, DeepSeek, Groq, Azure endpoints, and self-hosted backends like Ollama, LocalAI, and RWKV-Runner. Its defining trait is minimalism - the first screen loads in about 100 KB, the desktop client is roughly 5 MB, and there is no database or user system to operate; chat history lives locally in the browser with optional WebDAV or UpStash Redis sync. The Mask system saves reusable prompt-template personas you can share and debug, long conversations auto-compress to fit context windows, and Markdown rendering covers LaTeX, Mermaid diagrams, and code highlighting with streaming responses. Plugins add web search and calculators, MCP support enables external tool calling, and Artifacts previews generated content in a separate pane. Ships as a web app, Docker image, and Tauri desktop builds for Windows, macOS, and Linux, translated into 20+ languages. MIT-licensed.

OpenFGA answers the question 'can this user perform this action on this resource?' in single-digit milliseconds, implementing Google's Zanzibar paper as a production-ready authorization engine adopted by Auth0, Grafana Labs, Canonical, Docker, Agicap, and Read.AI. The server exposes both gRPC and HTTP APIs for authorization queries including Check, ListObjects, ListUsers, Expand, and the high-throughput BatchCheck endpoint that deduplicates and processes multiple authorization decisions in a single request. Authorization models combine relationship-based access control with role-based and attribute-based patterns through a purpose-built DSL that supports contextual tuples, conditional relationship tuples with CEL expressions, and time-based filtering via the ReadChanges API. Storage backends include PostgreSQL 14+, MySQL 8, and SQLite in beta, with an in-memory adapter for development and testing. Official SDKs for Java, .NET, Node.js, Go, and Python provide type-safe client integration, while a Terraform provider enables infrastructure-as-code management of authorization stores and models. The built-in browser playground at port 3000 lets developers visually model authorization schemas, write relationship tuples, and test access control queries interactively before deployment. OpenTelemetry instrumentation integrates with existing monitoring infrastructure, and Helm charts simplify Kubernetes deployment. A VS Code extension provides syntax highlighting and validation for FGA model files, and GitHub Actions automate model testing in CI/CD pipelines. A CNCF incubating project with transparent governance. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

CubeSandbox gives every AI agent its own hardware-isolated MicroVM with a dedicated Linux kernel — not a shared-kernel container but a true KVM virtual machine — booting in under 60ms with less than 5MB of memory overhead per instance, enabling thousands of concurrent sandboxes on a single server via kernel sharing and Copy-on-Write memory. The Rust-built CubeProxy exposes an E2B SDK-compatible REST API on Axum, so existing E2B Cloud applications switch by changing one environment variable with zero client code changes. CubeMaster orchestrates cluster-level scheduling in Go while Cubelet manages node-local sandbox lifecycles including create, run, pause, resume, snapshot, and destroy operations. CubeVS, the eBPF-powered network layer, enforces per-sandbox isolation with LPM trie-based egress policies entirely in kernel space — no userspace context switches — while CubeEgress provides an L7 security proxy with per-domain, per-path, and per-method allowlists plus automatic credential injection that keeps secrets invisible to sandbox code. Hundred-millisecond-granularity snapshots enable checkpoint, rollback, and parallel fork from any saved state. The volume framework supports E2B-compatible pluggable storage with independent lifecycle and cross-sandbox sharing. Production deployment uses Terraform on Tencent Cloud or Helm charts on Kubernetes, K3s, or TKE, with full ARM64 support alongside x86_64 and AutoPause/AutoResume for cost optimization. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Runtipi makes any Linux server a personal app platform where installing services like Plex, Nextcloud, or Home Assistant takes a single click from a curated store of 265+ applications. With 9,500+ GitHub stars and 50 contributors, the React frontend backed by NestJS orchestrates Docker Compose projects for each installed app, automatically generating environment files, compose configurations, and Traefik reverse proxy labels for domain routing and SSL certificate provisioning via Let's Encrypt. The integrated Traefik reverse proxy handles all incoming traffic routing, HTTPS termination, and forward-auth protection for securing applications behind Runtipi's authentication layer without manual configuration. One-click updates notify administrators of new app versions and apply container image upgrades with automatic pre-update backup creation, while the restore feature rolls back application data to any saved snapshot. Custom app stores extend the ecosystem through Git repositories following the Runtipi app definition format, enabling organizations and communities to maintain private catalogs alongside the official store. The Docker Compose override system preserves user customizations across updates, allowing advanced modifications without losing changes. Architecture-aware filtering detects ARM64 or x86 platforms and displays only compatible applications. All apps deploy as standard Docker containers, and compose files can be exported for independent operation without lock-in. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

A single pane of glass for every service you run, arranged by drag-and-drop with no YAML or JSON files: Homarr is the modern dashboard for self-hosted infrastructure. Its grid system arranges apps, widgets, and bookmarks on desktop or touch, backed by an icon picker with over 11,000 icons. What separates Homarr from static launchers is 50+ live integrations: Plex, Jellyfin, and Emby media stats, the *arr suite (Sonarr, Radarr) with a unified release calendar, download clients, Pi-hole and AdGuard Home controls, Proxmox, Home Assistant, OPNsense, and Unifi monitoring. Widgets update in real time over WebSockets (tRPC and Redis under the hood), and a built-in search queries thousands of data points across connected services. Custom widgets extend the reach to any HTTP API without code: define endpoint, auth, and refresh interval in the management UI, then render responses as stat grids, tables, progress bars, status indicators, action buttons, or full custom JSX layouts - with an AI-prompt helper for generating templates. Multi-user support is first-class: credentials, OIDC, or LDAP sign-on, groups with granular permissions, and secrets encrypted with AES-256-CBC. A robust background-job system scales it from a Raspberry Pi homelab to deployments serving hundreds of users.

Think of it as a team messaging platform where every feature beyond core chat is a plugin you can install or remove, inspired by VS Code's extension model but applied to real-time communication. The Moleculer microservice backend scales horizontally across nodes while Socket.io delivers instant message synchronization with text, images, files, mentions, reactions, and rich Markdown formatting. Available plugins provide LiveKit video conferencing, collaborative drawing boards, task management panels, end-to-end encryption, custom themes, and third-party push notification reception without touching core code. Groups use a two-level space system with customizable panel layouts arranged through drag-and-drop, while role-based access control enforces fine-grained permissions across the organization. The Open Platform exposes OAuth for single sign-on across connected applications and a Bot API enabling bidirectional message processing between Tailchat and external services via HTTP requests. Multi-platform clients cover web, Electron desktop with screenshot capabilities, and mobile apps with native push. Docker Compose deployment bundles MongoDB for persistence, Redis for caching and transport, and MinIO for S3-compatible file storage. Deploy on RepoCloud with a dedicated VPS for persistent team infrastructure under the Apache 2.0 license.

Teams tired of paying Salesforce or HubSpot per seat run EspoCRM: an AGPL-licensed PHP application with a fast single-page frontend over a REST API, covering sales, support, and marketing in one uncluttered interface. The sales core is complete - leads, contacts, accounts, opportunities with customizable pipeline stages, kanban views, calendars, meetings, and calls. Email is deeply integrated rather than bolted on: IMAP sync links messages to CRM records automatically, and mass email campaigns run with reusable templates, tracking, and Web-to-Lead forms feeding the funnel. Support teams get case management and a customer portal where clients track their own tickets and access a knowledge base. The real differentiator is the Entity Manager: create custom entities, fields, relationships, and layouts from the admin UI without code, with dynamic logic showing or hiding fields conditionally - EspoCRM is as much a business-application platform as a CRM. Formula scripting handles calculated fields and record automation in the free core; the optional Advanced Pack adds visual BPM process design and workflow rules. Role-based permissions with team and territory scoping, full-text search, reports, and a straightforward REST API for n8n or custom integrations round it out. Runs on PHP 8.3+ with MySQL, MariaDB, or PostgreSQL - unlimited users, zero per-seat fees.

With 20,500+ GitHub stars and over 6,000 organizations running it in production — including a Fortune 100 company ingesting more than 4 PB per day — OpenObserve is the open-source observability platform that replaces your entire Datadog, Splunk, or ELK stack with a single Rust binary deploying in under two minutes. Apache Parquet columnar storage with zstd compression on S3-compatible object storage delivers 140x lower storage costs than Elasticsearch while providing better query performance on a quarter of the hardware. Ingest logs, metrics, and distributed traces via native OpenTelemetry OTLP endpoints with no vendor lock-in. Query logs and traces with standard SQL, metrics with SQL or PromQL — no proprietary query language to learn. The built-in dashboard builder offers 19 chart types including time-series graphs, heatmaps, gauges, tables, and top-K lists with drag-and-drop layout combining data from all signal types. Data pipelines process, enrich, redact, or normalize ingestion streams using Vector Remap Language for real-time transformations including PII redaction and logs-to-metrics conversion. Real User Monitoring captures frontend performance with session replay. The Service Catalog provides topology-based trace analysis with side-panel drill-downs into database queries and error details. Alerting supports real-time and scheduled rules with SQL and PromQL conditions. Native multi-tenancy isolates organizations and streams with complete data separation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPLv3 licensed.

Trusted by over 60,000 organizations worldwide with more than 8,100 GitHub stars since 2010, Graylog has established itself as one of the fastest paths from raw log data to operational visibility, delivering centralized log management, security analytics, and compliance auditing through a purpose-built web interface with sub-second search at scale. The platform ingests logs from virtually any source via syslog, GELF, Beats, raw TCP/UDP, HTTP, CEF, IPFIX, and Netflow protocols, processing each message through configurable pipelines that parse fields, apply transformations, enrich events with GeoIP data from MaxMind or IPinfo lookup tables, and route messages to appropriate streams based on content rules. OpenSearch handles full-text indexing and storage with dynamic shard sizing that automatically calculates appropriate sizes from available node memory, while MongoDB stores configuration metadata including user accounts, roles, dashboards, alert rules, and pipeline definitions. The alerting system integrates with Slack, PagerDuty, and email with customizable notification templates and Replay Search links for immediate investigation context. Version 7.0 introduced MCP server integration for connecting preferred LLMs to perform AI-assisted log analysis and automation, while version 7.1 added Sigma detection rule import from private GitHub, GitLab, and Bitbucket repositories for detection-as-code workflows. The Sidecar agent management system centrally configures and deploys Filebeat, Winlogbeat, and nxlog collectors across infrastructure from the Graylog web interface. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. SSPL licensed.

Undb turns a browser tab into a full-featured database with spreadsheet-style editing, auto-generated REST APIs, and five configurable views for every table. The platform organizes data through Spaces, Bases, and Tables, offering grid view for traditional editing, Kanban boards for workflow tracking, calendar for date-based planning, gallery for image-rich records, and pivot tables for analytical summaries, each with independent filtering, sorting, color coding, and field selection. An ANTLR4-powered formula engine provides Airtable-style calculated fields with proper syntax validation, variadic argument handling, and type-checked function signatures that go beyond simple string interpolation. Every table automatically generates a fully documented OpenAPI REST endpoint with Swagger UI, letting developers integrate Undb data into external applications through standard HTTP methods without additional configuration. The Drizzle ORM abstraction layer supports four database backends (SQLite, PostgreSQL, MySQL, and Turso edge-distributed SQLite) with separate migration configurations for each adapter. Authentication uses Lucia with OAuth2 via Arctic for GitHub login and Oslo for TOTP two-factor authentication. The SvelteKit 5 frontend renders through Houdini's compile-time GraphQL client and TanStack Svelte Query, while the Elysia.js backend compiles into a single executable via Bun's --compile flag, embedding all assets into one portable binary. File attachments store in any S3-compatible backend including MinIO. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Cerbos decouples authorization logic from application code entirely, evaluating human-readable YAML policies in under one millisecond through a stateless Policy Decision Point that requires no application state synchronization or cross-network fan-out. Its custom decision engine benchmarks up to 17x faster than OPA-based alternatives. Access control policies use conditions expressed in Google's Common Expression Language, supporting role-based, attribute-based, and policy-based access control patterns including derived roles, scoped policies, and permissions-aware data filtering that pushes authorization predicates directly into database queries. The PDP exposes both gRPC and HTTP APIs with SDKs for JavaScript, Python, Go, Java, .NET, Rust, PHP, and Ruby, making integration a single function call regardless of tech stack. GitOps-native workflows treat policies as code with Git versioning, CI validation through GitHub Actions, coverage reports, breaking-change detection, and audit logs of every authorization decision for ISO27001, SOC2, and HIPAA compliance. Deployment flexibility spans Kubernetes sidecars, standalone services, systemd daemons, AWS Lambda functions, and WebAssembly-embedded PDPs that run authorization logic directly in browsers, serverless architectures, and edge devices. The Admin API manages policy lifecycle operations programmatically, while the built-in Playground and REPL provide interactive testing environments for policy authoring and debugging. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

"Dead simple static HOMepage for your servER" - Homer's name is the spec. It is a fully static HTML/JS dashboard driven by one YAML file (assets/config.yml): list your services in groups with names, icons, tags, and URLs, and Homer renders a clean, fast landing page for everything you self-host. Because there is no backend, no database, and nothing to maintain, the container is tiny and effectively zero-maintenance - the entire operational surface is a text file you can version-control alongside your infrastructure. Despite the minimalism, the feature set is genuinely useful: smart cards add live data to service tiles via a type key - Pi-hole block statistics, AdGuard Home status, Jellyfin activity, Gatus and Home Assistant states, and dozens more integrations, with configurable periodic refresh. Fuzzy search jumps to any service as you type, keyboard shortcuts drive navigation, and multi-page support with item grouping keeps large homelabs organized. Theming covers built-in light and dark modes plus full custom CSS, tags get color-coded styles, and the whole dashboard installs as a PWA on phones and tablets. Icons come from Font Awesome or your own images. If Dashy is the maximalist dashboard and Homarr the drag-and-drop one, Homer is the minimalist: one YAML file, instant loads, and nothing that can break at 2 a.m.

Trusted by Cal.com, WhiteBIT, and Documenso and backed by 8,800+ GitHub stars, OpenStatus delivers the open-source status page and uptime monitoring platform that replaces Atlassian Statuspage, Better Stack, and Instatus with a single self-hosted deployment. The monitoring engine runs Go-based probes across 28 global regions on three cloud providers checking HTTP, TCP, and DNS endpoints in parallel with configurable intervals and multi-region consensus to eliminate false-positive alerts. Status pages ship with custom domain support, password and email-domain access controls, maintenance windows, grouped monitor components, and subscriber notifications via email and RSS. Incident management provides structured status reports with investigating, identified, monitoring, and resolved timeline phases that publish automatically to affected status pages. The monitoring-as-code workflow supports YAML configuration synced through the CLI, a GitHub Actions integration for CI/CD pipelines, and a Terraform provider for infrastructure-as-code deployments. The typed ConnectRPC JSON-over-HTTP API exposes a published OpenAPI specification with a Node SDK for programmatic access, while an MCP server connects AI assistants like Claude, ChatGPT, and Cursor directly to workspace data. The tech stack combines Next.js with shadcn/ui for the dashboard, Hono for the API server, Drizzle ORM over Turso for application data, and Tinybird for analytics. Private monitoring locations deploy as a single 8.5MB Docker image behind firewalls to check internal services. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.