Agent Zero equips large language models with a persistent virtual Linux desktop, letting autonomous AI agents write code, research the web, and execute multistep tasks without supervision. Operating within an isolated container, the system opens an interactive XFCE graphical desktop in your browser canvas where the agent interacts with GUI applications like Blender and terminal sessions directly. Its embedded browser features interactive annotation tools, letting you click web elements to inspect stylesheet hierarchies, extract component markup, or submit automated testing instructions. You can cowork on spreadsheets, presentations, and Markdown specifications in real time alongside the agent, preserving document revisions through snapshot time travel. A multi-tier memory architecture backed by FAISS vector indexing and SearXNG web discovery retains problem-solving context across projects, while hierarchical delegation spins up specialized subordinate agents to parallelize complex engineering audits. The platform connects seamlessly to commercial LLMs via OpenAI, Anthropic, or OpenRouter, runs private local models through Ollama, and integrates custom toolkits via the Model Context Protocol and community Plugin Hub. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 9,100 GitHub stars and production deployments powering real-time analytics at companies like SHOPLINE where it reduced API latency by 76.7%, RisingWave is the PostgreSQL-compatible streaming database that collapses the traditional Debezium-plus-Kafka-plus-Flink-plus-serving-database stack into a single Rust-powered system. The platform continuously ingests data from PostgreSQL and MySQL via native CDC connectors that eliminate Debezium middleware, consumes Kafka, Redpanda, Pulsar, and Kinesis topics, accepts webhook events from SaaS applications, and batch-loads historical data from S3 and data warehouses. Standard SQL defines sources, materialized views, and sinks — no new DSL, no Java, and no custom API — while the PostgreSQL wire protocol means psql, DBeaver, pgAdmin, Grafana, Metabase, Superset, Tableau, and every PostgreSQL client library works without modification. Materialized views are incrementally maintained as events arrive, delivering point lookups in single-digit milliseconds without recomputing aggregates from scratch. For long-term retention, RisingWave writes to Apache Iceberg tables with a hosted REST catalog and automated table maintenance including compaction, small-file optimization, and snapshot cleanup, with data queryable by Spark, Trino, DuckDB, and DataFusion. The disaggregated compute-storage architecture uses S3-based state management for elastic scaling, instant failure recovery measured in seconds rather than the minutes-to-hours typical of RocksDB-based systems, and cost-efficient storage tiering. An MCP server enables AI agents to query and operate RisingWave directly. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 14,000 GitHub stars and enterprise adoption by security-conscious organizations, Coder transforms how development teams provision, manage, and secure their coding environments. Every workspace is defined as a Terraform template, meaning infrastructure engineers can standardize development environments across EC2 instances, Kubernetes pods, Docker containers, or any combination, while developers get self-service provisioning that launches in seconds rather than days of manual setup. The WireGuard-based networking layer establishes encrypted tunnels between developer machines and remote workspaces, providing low-latency access without exposing ports or configuring VPN concentrators. Automatic idle detection shuts down unused workspaces after configurable periods, directly reducing cloud compute costs for organizations running hundreds of developer environments. The Coder Agents feature introduces native AI coding capabilities where the agent loop executes entirely within the control plane on self-hosted infrastructure, keeping LLM API credentials out of individual workspaces and eliminating credential exfiltration risks. Centralized model governance allows platform teams to approve specific AI providers and models, set per-user spend limits, and maintain complete audit logs of all prompts, tool calls, and agent activity. IDE integration supports VS Code through a dedicated extension, JetBrains IDEs via Gateway and Toolbox plugins, and browser-based code-server for web access. The template registry provides pre-built configurations for common development stacks. DevContainer support builds environments from standard devcontainer.json specifications. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

The most-starred open-source project management platform on GitHub with over 55,000 stars, Plane delivers what Jira, Linear, Monday, and ClickUp charge thousands per year for — issue tracking, sprint planning, documentation, and AI-powered workflows in one unified workspace that you own and control entirely. Work items feature a rich text editor with file uploads, sub-properties, custom states, priorities, labels, assignees, and cross-referencing, organized across five customizable layout views (list, board, table, spreadsheet, Gantt) with Command-K navigation for instant access to anything. Time-boxed Cycles provide sprint planning with automatic burn-down charts, velocity tracking, and scope change detection, while Modules break complex projects into manageable deliverables with progress aggregation. Built-in Pages combine AI-powered documentation with rich formatting, image embedding, and one-click conversion of notes into actionable work items. The AI layer reads across every project, cycle, document, and thread in the workspace — agents take real assignments, triage incoming requests, assign owners, track blockers, and ship status updates automatically. Native integrations connect GitHub, GitLab, Slack, Sentry, Figma, and 50+ tools with bidirectional issue sync and PR tracking, while import pipelines migrate entire workspaces from Jira, Linear, Asana, ClickUp, or Monday in minutes. The REST API with OAuth 2.0, HMAC-signed webhooks, typed SDKs in Node.js and Python, and a native MCP server enable custom automations. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

AiSOC delivers an open-source AI Security Operations Center that unifies event ingestion, graph correlation, autonomous triage, and purple-team adversary emulation into a single self-hosted console. Security analysts triage alerts across an interactive Investigation Rail that visualizes six-event attack timelines, pivot-path entity graphs, and recommended containment steps. The underlying LangGraph agentic engine reasons over ingested telemetry, querying MITRE ATT&CK frameworks, CISA Known Exploited Vulnerabilities catalogs, and Shodan intelligence while recording every prompt, tool execution, and evidentiary citation in an immutable Investigation Ledger. Incident responders execute automated containment playbooks, including host network isolation, credential revocation in identity providers, and firewall blocklist updates with human-in-the-loop sign-offs. Threat hunters input plain-English hypotheses into the natural-language hunt workbench to generate and execute ES|QL, SPL, and KQL queries against historical telemetry stores. Platform operators connect over seventy vendor connectors spanning CrowdStrike, SentinelOne, Microsoft Defender, AWS Security Hub, Okta, and Cloudflare to normalize streaming events into Open Cybersecurity Schema Framework standards. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Every service you run, behind one polished start page: Dashy is the most customizable homelab dashboard, built as a Vue.js homepage. Configuration lives in a single YAML file, but you never have to hand-edit it: an integrated UI editor with real-time validation writes changes back to disk, so both config-as-code and point-and-click camps are served. Status indicators put a live health dot next to every app - HTTP checks or pings on custom intervals, with response time and status details on hover - giving you an at-a-glance uptime overview before anything breaks. Over 50 built-in widgets pull dynamic content from the services you already run: Pi-hole and AdGuard block stats, Proxmox lists, Nextcloud status, Netdata CPU/memory history, Prometheus data, plus weather, RSS, crypto prices, and generic iframe/API-response widgets for anything with an endpoint. Instant fuzzy search launches any app as you type, with customizable hotkeys and web-search fallthrough. Theming is deep: dozens of built-in themes, a UI color palette editor, and custom CSS over CSS variables. Alternate views include a fast-loading minimal startpage and a workspace view that embeds apps side-by-side without leaving the dashboard. Icons resolve from Font Awesome, homelab icon packs, emojis, or auto-fetched favicons. Built-in authentication, multi-page support, cloud backup/sync, and multi-language round out an MIT project with a massive community.

A complete WhatsApp Business Platform covering messaging, chatbot automation, and voice calling with IVR — a combination most self-hosted projects never attempt. The Fastglue/fasthttp backend processes WhatsApp Cloud API webhooks through PostgreSQL and Redis into a real-time WebSocket layer powering instant chat updates across a Vue 3 frontend built with shadcn-vue and TailwindCSS. Chatbot automation supports keyword triggers, multi-step conversation flows with branching logic, AI-powered responses from OpenAI, Anthropic, or Google models, knowledge base integration via vector stores, and seamless handoff to human agents when the bot gets stuck. The visual IVR builder uses a drag-and-drop node canvas where you wire greeting prompts, DTMF menu capture, HTTP callbacks to external APIs mid-call, business-hours routing by IANA timezone, agent team transfers with hold music, and reusable sub-flows. Every call recording streams encrypted to your S3-compatible bucket with retention you control. Multi-tenant architecture isolates organizations with separate data, roles, and API keys while a unified inbox presents both chat and call conversations to agents in a single dashboard. Meta-approved template management, bulk campaign messaging, analytics tracking, and a full REST API round out the platform. Deploy via Docker Compose with Postgres and Redis included. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL v3 licensed.

With 13,800+ GitHub stars and active releases through 2026, Casdoor is the open-source identity platform that ships OAuth 2.0, OIDC, SAML 2.0, CAS, LDAP, SCIM 2.0, WebAuthn passkeys, TOTP multi-factor authentication, and Face ID biometric login in a single Go binary with a React web console — covering every authentication protocol your organization will ever need. Social login connects 50+ identity providers including Google, GitHub, Microsoft Azure AD, Facebook, WeChat, DingTalk, Apple, Twitter, and LinkedIn without custom code. The AI-first architecture includes a Model Context Protocol gateway for AI agent authentication and Agent-to-Agent protocol support for securing LLM-powered workflows. Built-in Casbin integration delivers authorization primitives beyond basic RBAC: attribute-based access control, relationship-based access control, and custom policy models through a unified engine. The organization-scoped multi-tenancy model isolates users, applications, and identity providers per tenant with customizable login pages, branding, and SMTP configuration. SCIM 2.0 endpoints automate user provisioning from HR systems and Active Directory. Official SDKs for Go, Java, Node.js, Python, and PHP accelerate application integration. The RESTful API exposes every resource for programmatic management. Comprehensive audit logs record authentication events and administrative actions. Deploy via Docker Compose with MySQL or PostgreSQL, the all-in-one SQLite Docker image for quick trials, or the official Kubernetes Helm chart for production clusters. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Used by over 100,000 organizations and ranked first in the Gartner Magic Quadrant for DevOps Platforms, GitLab is the open-core DevSecOps platform that delivers the complete software development lifecycle — from planning and source code management through CI/CD, security scanning, and monitoring — in a single self-managed application. The built-in CI/CD engine executes pipelines defined in YAML with parallel jobs, directed acyclic graph scheduling, multi-project pipelines, and auto-scaling runners on Docker, Kubernetes, or bare metal. Merge requests provide inline code review with approval rules, code owners, merge trains for serialized merging, and five merge strategies including fast-forward and semi-linear history. The integrated container registry stores Docker images alongside code, while the package registry supports npm, Maven, NuGet, PyPI, Conan, Go, and generic packages. Issue boards with epics, milestones, and labels enable agile planning, while the built-in wiki and GitLab Pages provide documentation hosting and static site publishing. Security scanning in the Community Edition includes basic SAST, secret detection, and container scanning running as pipeline jobs. The Omnibus installer bundles Rails, Puma, Gitaly, Workhorse, Nginx, PostgreSQL, Redis, Sidekiq, and Prometheus into a single package installable in minutes, while Docker and Helm chart options support containerized and Kubernetes deployments. GitLab Duo AI assists with code suggestions, merge request summaries, and vulnerability resolution. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

The utilities engineers otherwise scatter across a dozen ad-laden websites - 80+ of them - live together in IT-Tools, one fast, polished web app. Crypto covers JWT decoding, MD5 through SHA-512 hashing, HMAC and bcrypt generation, RSA key pairs, and password strength analysis. Converters handle JSON to CSV, YAML, and TOML, Base64 files, URL encoding, HTML entities, color formats, and Docker run commands to Compose files. Generators produce UUIDv4, ULID, BIP39 mnemonics, QR codes (including Wi-Fi QR), and tokens; text tools include a regex tester, diff viewer, slug and case converters; web utilities parse URLs and user agents, look up HTTP status codes and MIME types, and inspect Open Graph metadata; plus a cron parser, chmod calculator, and more. The privacy argument is the point: JWTs contain user IDs, hashes derive from passwords, JSON dumps hold PII - exactly the inputs you least want a third-party utility site to log. IT-Tools is a frontend-only static bundle (Vue/TypeScript, GPL-3.0, 39k+ GitHub stars) served by Nginx in one container, so everything runs client-side on your infrastructure with nothing transmitted anywhere. New tools ship roughly monthly, and a scaffolding script makes adding custom ones straightforward.

Wanderer provides a privacy-first alternative to AllTrails and Komoot, giving outdoor enthusiasts complete ownership of their GPS data on a self-hosted server. The platform accepts uploads in GPX, KML, FIT, and TCX formats, automatically extracting distance, elevation gain and loss, duration, and speed statistics to build a searchable trail catalogue. The built-in route planner uses the Valhalla routing engine to calculate hiking, cycling, and walking routes directly on the map, while MapLibre GL renders smooth vector tiles from OpenStreetMap data with configurable tile sources and overlay layers. Each trail supports rich metadata including difficulty ratings, categories, waypoints with descriptions, photo galleries, and summit log entries that track completion dates with optional GPS data. Meilisearch powers instant full-text search across trail names, descriptions, and tags, complemented by map-based spatial filtering and advanced date, distance, and elevation filters. The ActivityPub integration follows the same federation protocol as Mastodon, allowing users to follow explorers on other Wanderer instances and see their public trails, comments, and summit logs in a unified feed without requiring cross-instance accounts. The WASM-based plugin system enables third-party extensions for custom integrations. The Docker Compose stack runs three containers — SvelteKit frontend on port 3000, PocketBase backend with embedded SQLite, and Meilisearch — with startup completing in under 90 seconds. On RepoCloud, deploy Wanderer on a dedicated VPS with root SSH access, persistent storage for your trail database and uploaded photos, and complete control over routing, geocoding, and tile server configurations, all under the AGPL v3 license.

With over 47,000 GitHub stars, Cal.diy is the fully open-source community fork of Cal.com that strips away every proprietary license gate and enterprise paywall to deliver a pure MIT-licensed scheduling platform you completely own. The booking engine supports individual event types including recurring events, seated events with capacity limits, and paid bookings through Stripe and PayPal, all backed by customizable availability schedules with date overrides, buffer times, minimum notice periods, and travel schedule support. Calendar synchronization is bidirectional across nine providers — Google Calendar, Outlook and Office 365, Apple Calendar, CalDAV, Lark, Feishu, Zoho, Exchange, and ICS feeds — so every booking automatically appears on your existing calendar while blocking conflicting slots. Video conferencing links generate automatically for Zoom, Google Meet, Microsoft Teams, Webex, Jitsi, Daily.co, Whereby, and Huddle01, eliminating manual link management. The automation layer connects through webhooks, Zapier, n8n, Make, and Pipedream to CRM platforms like HubSpot, Salesforce, and Close, messaging services including Discord, Telegram, and WhatsApp, and analytics tools such as Google Analytics 4, PostHog, and Fathom. The entire application is built on the T3 stack — Next.js for server-rendered pages, tRPC for end-to-end type-safe APIs, Prisma for PostgreSQL database access, and Tailwind CSS for the responsive interface. Unlike Cal.com's open-core model, Cal.diy requires no license key and includes no gated features. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

God's Eye View turns your browser into a real-time spatial intelligence command center, rendering thousands of live aircraft, ships, satellites, earthquakes, traffic flows, and public cameras on a photorealistic 3D Earth powered by CesiumJS and Google Photorealistic 3D Tiles. Click any aircraft to see its transponder telemetry from OpenSky and adsb.lol, including route history, altitude, speed, and callsign; track live vessel positions worldwide through AIS beacon data from AISStream; or follow roughly 840 satellites color-coded by class using orbital elements from CelesTrak. A hands-free voice agent powered by the OpenAI Realtime API lets you ask the planet questions in natural language, and the globe annotates your answer directly in 3D space. Toggle FLIR mode for a thermal camera aesthetic, layer in NASA FIRMS wildfire data, switch between Google 3D, Bing aerial, and OpenStreetMap base layers, or tune into a geolocated world radio dial. Public CCTV cameras are projected into 3D city geometry with viewshed cones and direct-manipulation calibration. The cockpit mode provides a pilot-style briefing surface with mission-specific overlays. Entity inspection panels show detailed metadata for every tracked object, and shareable links let you send any scene configuration to a colleague. Ten of the thirteen live data layers work with zero API keys, while the required Google Maps key offers 1,000 free 3D tile sessions per month. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Mathesar puts a spreadsheet in front of your PostgreSQL database, letting anyone on the team browse, edit, filter, sort, and query tables without writing a line of SQL. Connect it to any existing PostgreSQL instance and immediately navigate schemas, tables, and records through an intuitive grid interface with inline editing, grouping, and summarization. The query builder joins tables across foreign key relationships, creates custom views with aggregations, and exports results to CSV. Rather than inventing its own permission layer, Mathesar maps each user or team to a native PostgreSQL role with granular schema-level and table-level privileges enforced at the database engine level, so there is never a gap between what the UI allows and what the database permits. Record summary templates display human-readable representations of linked records, making foreign key relationships immediately understandable instead of showing raw IDs. Import data from CSV files, create new tables and columns with proper PostgreSQL types including arrays, JSON, and custom domains, and modify schema structure through the web interface. Mathesar scales as well as the underlying PostgreSQL instance with no artificial limits on database size or complexity. Maintained by the Mathesar Foundation, a 501(c)(3) nonprofit, with a permanent commitment against vendor lock-in or licensing changes. Docker deployment connects to existing PostgreSQL instances or a bundled database in minutes. 5,000+ GitHub stars. GPL-3.0 licensed.

With 14,000 GitHub stars and 81 releases since March 2023, Stalwart is the most protocol-complete open-source mail server available — delivering JMAP, IMAP4rev2, IMAP4rev1, POP3, SMTP, CalDAV, CardDAV, and WebDAV from a single Rust binary that compiles to a memory-safe, zero-garbage-collection executable with predictable latency under load. The SMTP server implements DMARC, DKIMv2, DKIMv1, SPF, and ARC for complete message authentication with automatic DKIM key rotation, while transport security enforces DANE, MTA-STS, and SMTP TLS reporting to prevent downgrade attacks. Built-in spam filtering with statistical classifiers, DNS blocklists, and collaborative reputation databases eliminates the need for external Rspamd or SpamAssassin deployments. Encryption at rest protects stored messages with S/MIME or OpenPGP, and automatic TLS certificate provisioning via ACME supports TLS-ALPN-01, DNS-01, and HTTP-01 challenges without manual certificate management. The ManageSieve server enables server-side email filtering rules, while full-text search indexes message bodies and attachments for instant retrieval. Pluggable storage backends support RocksDB for embedded deployments, PostgreSQL, MySQL, and S3-compatible object storage for distributed architectures. LDAP and SQL-based authentication integrate with existing directory services, and the web administration panel manages domains, accounts, quotas, and DKIM keys. Security audited with memory safety guaranteed by Rust's ownership model. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Price drops, restocks, job postings, government announcements, competitor edits - changedetection.io watches web pages and alerts you the moment anything changes, down to PDF text and checksums. Point it at a URL, set a check interval, and precise filters decide what counts as a change: a Visual Selector targets page elements by pointing and clicking, CSS selectors and XPath narrow scope, trigger-text and ignore-text rules (with regex support) cut noise, and JSONPath or jq handles API responses. A dedicated re-stock and price detection mode extracts product metadata and fires on thresholds - alert only when the price drops below your target or the percentage change exceeds a limit. JavaScript-heavy sites render through a real Chrome browser via Playwright, with the ability to execute JS steps first (log in, click, scroll) before extracting text. Notifications reach 85+ services through Apprise - Discord, Slack, Telegram, email, webhooks - optionally with a screenshot of the changed page, and AI-powered summaries (any OpenAI-compatible endpoint, including local Ollama) describe what changed. Per-watch proxies, custom headers, and POST/GET control cover hostile targets. Apache-2.0 licensed with local file-based storage: the URLs you monitor and why stay entirely your business.

The first container registry to reach CNCF graduated status with over 29,000 GitHub stars since VMware open-sourced it in 2016, Harbor transforms the basic Docker Distribution into a hardened enterprise registry with vulnerability scanning, supply chain signing, multi-datacenter replication, and project-level access control out of the box. Trivy scans every pushed image against the NVD, GitHub Advisory Database, and distribution-specific vulnerability feeds, with scan-on-push policies that block deployment of images exceeding configurable severity thresholds. Artifact signing through Cosign keyless signatures and Notation enforces content trust policies ensuring only cryptographically verified images reach production clusters. Policy-based replication synchronizes images and Helm charts between Harbor instances across multiple datacenters using repository, tag, and label filters with automatic retry and bandwidth throttling — enabling hybrid-cloud and disaster-recovery topologies. The RBAC model isolates projects with per-project quotas, robot accounts for CI/CD automation, webhook notifications, and audit logging that tracks every pull, push, delete, and configuration change. LDAP, Active Directory, and OIDC authentication integrate with existing identity providers, while the proxy cache transparently caches images from Docker Hub, Quay, and other upstream registries to reduce pull latency and rate-limit exposure. The RESTful API with embedded Swagger UI, tag retention policies, garbage collection scheduling, and immutable artifact rules complete the lifecycle management. Deploy via Docker Compose or Helm Chart on Kubernetes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Reaching 24,000 GitHub stars within two years of its first commit in July 2024, Beszel delivers Netdata-grade monitoring dashboards from a single Docker container with no Prometheus stack, no external database, and no complex configuration — just a one-binary hub on PocketBase (SQLite embedded) and a sub-15 MB agent per host that auto-discovers Docker and Podman containers on contact. The agent connects outbound via WebSocket or SSH tunnel, requiring zero open ports on monitored servers and zero manual network configuration. Per-host metrics cover CPU usage, memory with swap and ZFS ARC breakdown, disk I/O across multiple partitions, network throughput, load average, sensor temperatures, battery charge, and GPU utilization with power draw for Nvidia, AMD, and Intel cards — features that competitors lock behind paid tiers. S.M.A.R.T. disk health including eMMC wear indicators and Linux mdraid array status surface hardware degradation before failures occur. Container statistics track CPU, memory, and network history per container with automatic discovery as new containers start. Configurable threshold alerts notify via email, Discord, Telegram, ntfy, Pushover, Gotify, Matrix, Mattermost, Signal, Slack, Microsoft Teams, and Twilio when metrics exceed defined limits. Multi-user accounts with OAuth/OIDC authentication let teams share monitored systems with role-based access, while automatic backups persist data to disk or S3-compatible storage. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.