Powering authentication for over 15,000 GitHub stargazers and production deployments across startups and enterprises alike, SuperTokens delivers the complete login infrastructure that Auth0, Firebase Auth, and AWS Cognito charge premium prices for — entirely open source under Apache 2.0 with no per-user limits. The Java-based core service runs as a lightweight HTTP microservice that connects to PostgreSQL or MySQL and handles email-password login, passwordless magic links and OTP via email or SMS, social OAuth with Google, GitHub, Facebook, Apple, and any custom OIDC provider, phone-password authentication, and time-based one-time password multi-factor authentication. Session management uses rotating refresh tokens with anti-CSRF and anti-session-fixation protections, verifying tokens locally in your backend SDK without network round-trips to the core. Frontend SDKs for React, React Native, Angular, Vue, and vanilla JavaScript provide pre-built UI components for login, signup, email verification, and password reset flows, all customizable through an override system that lets you add pre- and post-API logic, custom hooks, and user event handlers. The built-in user management dashboard enables administrators to view users, reset passwords, revoke sessions, modify roles, and manage email verification status. Multi-tenancy and organization support powers B2B SaaS applications with tenant-level authentication configuration and Enterprise SSO via SAML and OIDC. Migration tools support bulk importing millions of existing password hashes, TOTP secrets, and role mappings. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

A web interface for a folder of Markdown files - Flatnotes is exactly that, and the discipline of that design is why people love it. Every note is a plain .md file in a single flat directory: no database, no proprietary format, no hierarchy to maintain, no export step if you ever leave. Edit notes in the browser or open the same files in VS Code or Obsidian, sync them with Syncthing or rsync while the app is running - the Whoosh-powered search index synchronizes incrementally, so external edits just show up. The interface is a clean Vue.js app with both WYSIWYG and raw Markdown editing modes (TOAST UI Editor), instant full-text search behind the "/" shortcut with partial-match support, wikilinks for cross-note references, and automatic tag extraction from #hashtags in note bodies. Light and dark themes and a mobile-responsive layout make it pleasant everywhere. Authentication is flexible for a personal tool: none, read-only, username/password, or TOTP two-factor. A documented REST API covers create/read/update/delete for automation. The operational story is the quiet selling point - the only state is the notes folder and a rebuildable index, so backup is copying a directory. For a personal notepad that respects your data, Flatnotes nails minimal.

With over 17,700 GitHub stars and continuous development since 2015, Calibre-Web has become the definitive self-hosted digital library solution for book enthusiasts who want beautiful web access to their Calibre collections. The responsive Bootstrap 3 interface delivers instant browsing, searching, and filtering across titles, authors, tags, series, book formats, and languages, with custom shelves for organizing personal reading collections. In-browser reading supports EPUB, PDF, TXT, CBR, CBT, CBZ, and DJVU formats with a configurable EPUB reader featuring multiple themes and page location tracking, while one-click email delivery sends books directly to Kindle, Kobo, and other E-Readers without leaving the interface. Native Kobo sync lets Kobo device owners synchronize their entire Calibre library wirelessly, maintaining reading progress and bookmarks across devices. Metadata management includes editing capabilities with automatic metadata downloading from Google Books, Amazon, and other configurable sources, plus eBook format conversion through Calibre binaries for on-the-fly EPUB, MOBI, AZW3, and PDF conversion. User management provides fine-grained per-user permissions controlling download access, upload rights, editing capabilities, and content visibility based on categories or Custom Column values. Authentication supports local accounts, LDAP directory integration, Google and GitHub OAuth, proxy authentication, and Magic Link login for easy E-Reader access. The OPDS catalog feed enables any compliant E-Reader app to browse and download from the library. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Known as the open-source Mixpanel alternative that respects user privacy, OpenPanel delivers a unified web and product analytics platform combining Mixpanel's behavioral analysis with the simplicity of Plausible and full data ownership through self-hosting. Cookieless tracking eliminates consent banners entirely while still capturing events, page views, sessions, user journeys, funnels, retention cohorts, and custom properties with full GDPR compliance by design. The 2.3 KB async script loads without blocking page rendering, and 16 official SDKs cover Next.js, React, Vue, Astro, Remix, Nuxt, Angular, Svelte, React Native, Swift, Kotlin, Python, PHP, Laravel, Express, and REST API for custom integrations. Real-time dashboards display live visitor counts, active sessions, and event streams as they happen. Custom chart builders create tailored visualizations from any tracked event with breakdowns by property, time period, and user segment. Session replay reconstructs individual user journeys showing every page visited, event triggered, and interaction recorded. Funnel analysis identifies conversion drop-offs with step-by-step breakdown and property filtering. Retention analysis measures how often users return with customizable time windows and cohort comparisons. A/B testing and variant tracking enable experiment measurement directly within the platform. Event notifications alert when specific events occur or thresholds are crossed. The self-hosted deployment uses Docker Compose with ClickHouse for high-speed analytical queries, PostgreSQL for metadata, and Redis for real-time processing — deployable on any VPS or Kubernetes cluster. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Stalwart replaces the traditional Postfix + Dovecot + SpamAssassin + calendar-server stack with one Rust binary that speaks every standard mail and collaboration protocol natively. JMAP, IMAP4rev2, POP3, SMTP, CalDAV, CardDAV, and WebDAV all run inside the same process — no glue scripts, no sidecar daemons, no version conflicts between components. The pluggable storage architecture lets operators choose RocksDB for single-node deployments, FoundationDB for distributed clusters, PostgreSQL, MySQL/MariaDB, or SQLite for the data store, S3/MinIO/Azure Blob for message blobs, and Elasticsearch or Meilisearch for full-text search, with Redis or the internal engine backing rate limiters and session state. Security features include S/MIME and OpenPGP encryption at rest, automated DKIM key generation with DNS publication, DANE and MTA-STS transport security, automatic ACME TLS provisioning, granular ACLs, rate limiting, and IP banning. The browser-based admin console manages accounts, domains, groups, mailing lists, SMTP queues, DMARC/TLS-RPT/ARF reports, and every configuration object without touching a config file, while the self-service portal at /account gives end users password reset and encryption key management. Multi-tenant support with per-tenant quotas enables hosting-platform deployments, and coordinator-less clustering via Zenoh or NATS scales horizontally by adding nodes. Deploy via Docker or the standalone binary. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL v3 licensed.

With 14,000 GitHub stars and 81 releases since March 2023, Stalwart is the most protocol-complete open-source mail server available — delivering JMAP, IMAP4rev2, IMAP4rev1, POP3, SMTP, CalDAV, CardDAV, and WebDAV from a single Rust binary that compiles to a memory-safe, zero-garbage-collection executable with predictable latency under load. The SMTP server implements DMARC, DKIMv2, DKIMv1, SPF, and ARC for complete message authentication with automatic DKIM key rotation, while transport security enforces DANE, MTA-STS, and SMTP TLS reporting to prevent downgrade attacks. Built-in spam filtering with statistical classifiers, DNS blocklists, and collaborative reputation databases eliminates the need for external Rspamd or SpamAssassin deployments. Encryption at rest protects stored messages with S/MIME or OpenPGP, and automatic TLS certificate provisioning via ACME supports TLS-ALPN-01, DNS-01, and HTTP-01 challenges without manual certificate management. The ManageSieve server enables server-side email filtering rules, while full-text search indexes message bodies and attachments for instant retrieval. Pluggable storage backends support RocksDB for embedded deployments, PostgreSQL, MySQL, and S3-compatible object storage for distributed architectures. LDAP and SQL-based authentication integrate with existing directory services, and the web administration panel manages domains, accounts, quotas, and DKIM keys. Security audited with memory safety guaranteed by Rust's ownership model. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Hoarder (now Karakeep) is a bookmark manager that actually fights link rot: every page you save gets archived at capture time using Monolith, so the content survives even when the original URL dies. Beyond archival, an AI layer powered by OpenAI or local Ollama models auto-tags everything by analyzing page content. Prefer full privacy? Ollama keeps all inference on your server with zero external API calls. Full-text search through Meilisearch indexes the actual scraped content of every bookmark, not just titles and tags, so you find articles by what they say rather than labels you half-remember. Save links with automatic metadata extraction, plain text notes, uploaded images, and PDF documents, all organized into shareable lists with collaborative access. Browser extensions for Chrome and Firefox make saving a one-click operation from any page. Migrating is painless with importers for Chrome, Pocket, Linkwarden, Omnivore, and Tab Session Manager. LLM summarization condenses saved pages into brief overviews for quick scanning. The AI layer is entirely optional: Hoarder works perfectly as a manual bookmark manager, with intelligence adding convenience rather than imposing a requirement. SSO integration and responsive dark mode round out the package.

With over 27,000 GitHub stars and an ecosystem of 1,900+ plugins covering every major cloud provider, database, and SaaS platform, Kestra is the orchestration engine that brings Infrastructure as Code principles to workflow automation — defining complex multi-step pipelines in readable YAML that execute across any language, runtime, or infrastructure boundary. The built-in VS Code-style editor provides syntax highlighting, auto-completion, real-time validation, and an AI Copilot that generates workflow YAML from natural language descriptions. Tasks execute in Python, Node.js, Go, R, Shell, SQL, or any Docker container, with event-driven triggers listening for file arrivals on SFTP and cloud storage, messages from Kafka, Redis, Pulsar, AMQP, MQTT, NATS, AWS SQS, Google Pub/Sub, and Azure Event Hubs in real time. The topology view visualizes workflow DAGs with execution state, duration, and output artifacts for each task node. Namespaces organize workflows into isolated environments with configurable secrets, while subflows enable modular composition with inputs, outputs, and conditional branching. Retry policies, timeouts, error handlers, and automatic backfills for missed schedules ensure reliability across production workloads. Git integration pushes workflows directly to branches from the UI with CI/CD pipeline support for automated deployment. The REST API enables programmatic workflow management, execution triggering, and resource provisioning. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 33,000 GitHub stars and a codebase written in 92.9% Rust for maximum performance and memory safety, Tabby is the most widely adopted self-hosted alternative to GitHub Copilot — delivering real-time code completions entirely on your own infrastructure with zero code leaving your network. Deploy a single Docker container on any NVIDIA CUDA, Apple Silicon Metal, AMD ROCm, or CPU-only server and connect VS Code, JetBrains IDEs (IntelliJ, PyCharm, WebStorm, GoLand), Vim, Neovim, and Emacs through native extensions. The completion engine supports a curated registry of models including StarCoder2 (1B to 15B parameters), DeepSeek-Coder, CodeLlama, CodeGemma, Qwen2.5-Coder, and Mistral Code — swappable at runtime through the admin dashboard without redeployment. Repository indexing parses your Git repositories and feeds project-specific types, function signatures, and patterns into completion context via RAG, producing suggestions that understand your codebase rather than generic boilerplate. The Answer Engine provides instant responses to code queries within the IDE, while inline chat enables contextual code editing and explanation without switching windows. The admin dashboard manages per-developer API tokens, usage analytics, and model configuration. Enterprise features include SSO via LDAP, OAuth, and SAML, role-based access control, and audit logging for compliance environments. A single RTX 4090 workstation serves a team of 10-15 developers with sub-500ms completion latency. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With 7,400+ GitHub stars and a feature set that replaces seven separate SaaS subscriptions — Pingdom for monitoring, StatusPage.io for status pages, PagerDuty for on-call, Incident.io for incident management, Datadog for APM, Loggly for logs, and Sentry for error tracking — OneUptime delivers every tool your reliability team needs in a single open-source platform that is genuinely 100% open source under Apache 2.0 (not open-core). Uptime monitoring runs synthetic checks against websites, APIs, ports, SSL certificates, and DNS records from distributed global probes with configurable intervals and thresholds. Branded status pages publish automatically when monitors detect issues, notifying subscribers via email, SMS, webhook, or RSS without manual intervention during an outage. On-call scheduling routes alerts through escalation policies to the right engineer via phone call, SMS, push notification, Slack, or Microsoft Teams. The incident management workflow handles declaration, triage, communication, resolution, and post-mortem generation in a unified timeline. APM collects traces and metrics via native OpenTelemetry integration — no proprietary agents required — while log management provides full-text search and alerting. An AI agent continuously monitors telemetry data, identifies root causes, and opens GitHub pull requests with proposed fixes for review. Deploy via Docker Compose or Kubernetes Helm charts with a Terraform provider for infrastructure-as-code configuration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

With over 11,000 GitHub stars and now backed by Datadog while remaining fully Apache 2.0 licensed, Quickwit delivers the search performance Elasticsearch users expect at a fraction of the infrastructure cost by moving the index to object storage instead of expensive local SSDs. The Rust-based engine, built on the Tantivy search library with SIMD-accelerated vectorized processing and zero garbage collection overhead, achieves sub-second search latency directly against Amazon S3, Azure Blob Storage, Google Cloud Storage, or any S3-compatible backend like MinIO and Ceph. The Elasticsearch-compatible REST API covers ingest, search, query DSL, and aggregations, enabling existing log shippers including Vector, Fluent Bit, and Syslog to migrate without rewriting configurations. Native OpenTelemetry Protocol endpoints accept logs and traces via gRPC, while Jaeger integration provides a drop-in distributed tracing backend. Ingestion from Apache Kafka, Amazon Kinesis, and Apache Pulsar supports streaming pipelines with multi-index partitioning, and the schemaless JSON indexing mode eliminates the need for upfront schema definitions. Stateless searchers and indexers scale horizontally on Kubernetes or bare metal, with a control plane that distributes indexing tasks and a janitor that manages retention policies and GDPR-compliant deletions. The built-in web UI displays search results and cluster state, while the official Grafana data source enables log exploration dashboards. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 14,000 GitHub stars and a mission to become the world's most trusted document-signing tool, Documenso delivers a beautifully designed electronic signature platform that organizations can self-host for complete data sovereignty. The signing workflow handles everything from simple one-party signatures to complex multi-recipient documents with configurable roles including signers, approvers, viewers, and CC recipients, each with distinct permissions and notification flows. Document templates enable reusable signing packages with pre-configured fields and recipient patterns, eliminating repetitive setup for contracts, NDAs, and onboarding documents that teams process regularly. The PAdES-standard implementation ensures digital signatures are legally compliant and cryptographically verifiable, with complete audit trails documenting every action from document creation through final signature. Direct link signing allows recipients to access documents without email, enabling embedded signing experiences within existing applications and websites. The REST API provides programmatic document creation, recipient management, and webhook notifications for integrating signature workflows into CRM systems, HR platforms, and custom business applications. Team management features organize users into groups with role-based permissions, custom branding per team, and centralized billing for organizations with multiple signing workflows. SSO integration supports standard authentication providers for enterprise identity management. The TypeScript codebase built on Next.js and Prisma with PostgreSQL makes customization and contribution accessible to modern web developers. Zapier integration connects Documenso to thousands of third-party applications for automated document routing. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Undb turns a browser tab into a full-featured database with spreadsheet-style editing, auto-generated REST APIs, and five configurable views for every table. The platform organizes data through Spaces, Bases, and Tables, offering grid view for traditional editing, Kanban boards for workflow tracking, calendar for date-based planning, gallery for image-rich records, and pivot tables for analytical summaries, each with independent filtering, sorting, color coding, and field selection. An ANTLR4-powered formula engine provides Airtable-style calculated fields with proper syntax validation, variadic argument handling, and type-checked function signatures that go beyond simple string interpolation. Every table automatically generates a fully documented OpenAPI REST endpoint with Swagger UI, letting developers integrate Undb data into external applications through standard HTTP methods without additional configuration. The Drizzle ORM abstraction layer supports four database backends (SQLite, PostgreSQL, MySQL, and Turso edge-distributed SQLite) with separate migration configurations for each adapter. Authentication uses Lucia with OAuth2 via Arctic for GitHub login and Oslo for TOTP two-factor authentication. The SvelteKit 5 frontend renders through Houdini's compile-time GraphQL client and TanStack Svelte Query, while the Elysia.js backend compiles into a single executable via Bun's --compile flag, embedding all assets into one portable binary. File attachments store in any S3-compatible backend including MinIO. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Its author, a student and WakaTime fan, didn't want to pay $9/month for data about his own keystrokes - so Wakapi was born, a self-hosted, WakaTime-compatible backend for coding statistics. The compatibility is the killer design decision: the official WakaTime plugins for VS Code, JetBrains IDEs, Vim, and dozens of other editors work unmodified - just point the plugin's API URL at your Wakapi instance with your personal key, and heartbeats flow to your server instead of a third party's. Duration inference matches WakaTime's own algorithm, with a configurable timeout (10 minutes by default). From that stream Wakapi builds statistics and plots across projects, languages, editors, hosts, and operating systems, plus the fun extras: public leaderboards (optionally login-gated, with configurable aggregation windows), badges for GitHub readmes, and weekly email reports. A REST API serves your data programmatically, Prometheus export feeds your existing Grafana, and a WakaTime relay mode can mirror heartbeats to both services during migration - with one-click import of historical WakaTime data. Written in Go, it is lightning fast and light enough for the smallest instance, storing to SQLite, PostgreSQL, or MySQL, with configurable data retention for GDPR peace of mind. Deliberately smaller than WakaTime, deliberately yours.

"Dead simple static HOMepage for your servER" - Homer's name is the spec. It is a fully static HTML/JS dashboard driven by one YAML file (assets/config.yml): list your services in groups with names, icons, tags, and URLs, and Homer renders a clean, fast landing page for everything you self-host. Because there is no backend, no database, and nothing to maintain, the container is tiny and effectively zero-maintenance - the entire operational surface is a text file you can version-control alongside your infrastructure. Despite the minimalism, the feature set is genuinely useful: smart cards add live data to service tiles via a type key - Pi-hole block statistics, AdGuard Home status, Jellyfin activity, Gatus and Home Assistant states, and dozens more integrations, with configurable periodic refresh. Fuzzy search jumps to any service as you type, keyboard shortcuts drive navigation, and multi-page support with item grouping keeps large homelabs organized. Theming covers built-in light and dark modes plus full custom CSS, tags get color-coded styles, and the whole dashboard installs as a PWA on phones and tablets. Icons come from Font Awesome or your own images. If Dashy is the maximalist dashboard and Homarr the drag-and-drop one, Homer is the minimalist: one YAML file, instant loads, and nothing that can break at 2 a.m.

Backed by 27,700+ GitHub stars and actively developed with the v0.9.x architectural overhaul introducing an event-driven plugin ecosystem, ArchiveBox delivers the open-source self-hosted web archiving platform that preserves websites, bookmarks, social posts, media, source code, and research material in durable formats before link rot, platform shutdowns, and censorship erase them permanently. Feed it URLs one at a time or schedule automated imports from browser history, RSS feeds, Pocket, Pinboard, Instapaper, Wallabag, Shaarli, JSON, CSV, HTML bookmark exports, and browser extension captures. Each snapshot stores redundant copies as original HTML, rendered single-file HTML via SingleFile, full-page PDF, screenshot PNG, WARC archive, article text via Readability, favicons, HTTP headers, media files via yt-dlp, git repository clones, and structured metadata in SQLite. The Docker Compose deployment bundles Chrome, wget, curl, yt-dlp, SingleFile, and Readability parsers with automatic dependency management and isolation. Interact through the self-hosted web UI with search, tagging, and admin controls, the comprehensive CLI for batch operations, the REST API for programmatic access, or the Python API for custom integrations. The new abx-plugins system enables community extractors with per-plugin configuration, while the append-only-log architecture provides resumable crawls and audit trails. S3, B2, and Google Cloud storage backends sync archives to remote storage via rclone. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 13,000 GitHub stars and active monthly releases, Mailcow delivers a production-ready mail server infrastructure through Docker Compose orchestration of twelve integrated containers. The stack pairs Postfix as the MTA handling SMTP traffic with Dovecot for IMAP and POP3 retrieval featuring the Flatcurve full-text search engine, while Rspamd provides machine-learning-powered spam filtering with Bayesian classification, DKIM signing, and ARC support. ClamAV scans attachments for malware including Office document macro analysis via Olefy, and SOGo serves as a responsive webmail client with CalDAV, CardDAV, and Microsoft ActiveSync synchronization. The admin panel manages multiple domains, per-user spam score thresholds, quarantine review, black and whitelists, temporary spam aliases, mailbox quotas, and TLS enforcement policies for both inbound and outbound messages. Security features include two-factor authentication via TOTP, WebAuthn, and Yubikey OTP, a Fail2ban-like Netfilter integration for brute-force protection, and automatic SPF, DKIM, and DMARC configuration. The ACME container handles Let's Encrypt certificate generation with DNS-01 challenge support, while Postfix TLS-Pol provides MTA-STS and DANE/TLSA resolution for encrypted transport. Built-in imapsync enables periodic migration from remote mailboxes, and the REST API allows programmatic management of all server resources. MariaDB stores user data, Redis caches configuration and sessions, and Unbound provides local DNSSEC-validating DNS resolution. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

The fediverse's answer to YouTube comes from French non-profit Framasoft: PeerTube is a TypeScript/Angular video platform where hundreds of independently operated instances federate over ActivityPub into one network. Videos you publish are discoverable across the whole video fediverse, and viewers can follow your channels from Mastodon or any ActivityPub platform - or plain RSS - without needing an account on your instance. The namesake innovation attacks video hosting's core cost problem: alongside HLS delivery, an optional WebRTC-based P2P layer lets concurrent viewers' browsers share video segments with each other, so a video going viral distributes its own bandwidth demand instead of crushing your server; instance redundancy extends this by letting friendly instances cache each other's videos. Livestreaming is first-class - stream via OBS or any RTMP software, host permanent streams, enable replays, and interact through live chat. Creators get channels, playlists, analytics, built-in video editing (trim, watermark), and an embeddable player for any website. There are no ads, no data mining, and no recommendation algorithm engineered for watch-time - the project's explicit design stance. Admins control federation policy, P2P settings, and theming; a plugin system extends the rest. AGPL-licensed, 300+ contributors, in active development since 2015.