Describe what you want in plain language and get real SQL against your real schema: SQL Chat is an open-source, chat-based SQL client from the Bytebase team. Instead of writing queries in a traditional editor, you connect a database and describe what you want in plain language; the AI reads your schema automatically, generates SQL that references real table and column names, executes it, and returns tabular results in the conversation. Follow-up messages refine the query, so exploration becomes a dialogue - narrow a result set, add a join, change an aggregation - without retyping statements. It supports MySQL, PostgreSQL, SQL Server, TiDB Cloud, and OceanBase from one interface, and covers modification as well as reads: insert, update, and delete operations phrased conversationally. Built with Next.js and TypeScript, it deploys as a single stateless Docker container in single-user mode - connection profiles live in the browser, so there is nothing server-side to maintain. A custom AI endpoint setting routes inference through any OpenAI-compatible API, including self-hosted models, and an optional database-backed mode adds accounts and quotas for offering the tool to a team. MIT-licensed.

Describe a component in natural language and watch it render: OpenUI, from Weights & Biases, is an open alternative to Vercel's v0. Type a prompt like "a dark-themed dashboard with a sidebar and charts" and the LLM renders working HTML with Tailwind styling live in the browser. You then iterate conversationally, asking for changes until the design is right, and convert the result to React, Svelte, or Web Components for use in a real project. The backend is Python with LiteLLM routing, so it works with OpenAI, Anthropic, Gemini, Groq, and Mistral API keys, or fully offline against local Ollama models, including vision models like LLaVA that can generate UI from screenshot input - feed a screenshot and the model reproduces or riffs on an existing interface. Generated markup is inspectable at any point, with light and dark mode toggles, theme selection, and responsive previews across device sizes. The practical effect is compressing the mockup-review-revise loop from hours to minutes: a described layout renders in seconds and iterates through follow-up prompts, and because output converts to real framework code, prototypes feed directly into production codebases instead of staying trapped in a design tool. Self-hosting keeps unreleased product interfaces and prompts on your own server, and LiteLLM routing lets you pick the model per task - a cheap fast model for rough drafts, a stronger one for final passes, or free local models for unlimited experimentation.

Sketch a wireframe, get working code: Draw a UI turns hand-drawn layouts into web interfaces. It pairs the open-source tldraw canvas with an OpenAI vision model: you sketch a layout - boxes, labels, buttons, arrows, whatever communicates the idea - select the drawing, and click Make Real. The app snapshots your selection as a PNG, sends it to the vision API with instructions to return a single HTML file styled with Tailwind CSS, and renders the result in an iframe directly on the canvas next to your sketch. The loop is iterative: annotate the generated prototype or redraw parts of it, select both the sketch and the previous result, and generate again - the model receives the earlier HTML as context and produces an updated version. Built by Figma engineer Sawyer Hood as one of the first viral GPT-4 Vision demos and the basis for tldraw's "Make Real", it is a Next.js app that runs against your own OpenAI API key. Self-hosting matters here: the upstream demo ships without authentication, so a private deployment keeps your API key from being drained by strangers. MIT-licensed.

Your users belong in your own database - Authorizer, an open-source authentication and authorization server shipping as a single Go binary, keeps them there. It connects to 13+ backends - PostgreSQL, MySQL, SQLite, SQL Server, MariaDB, MongoDB, Cassandra, ScyllaDB, ArangoDB, DynamoDB, Couchbase, YugabyteDB, PlanetScale, and CockroachDB - so identity data lives beside the application it protects instead of in an auth vendor's cloud. The server is fully OAuth 2.0 and OpenID Connect compliant, including authorization code flow with PKCE, a JWKS endpoint, token revocation, and nine JWT signing algorithms. Login options cover email/password, magic links, TOTP multi-factor, SMS OTP via Twilio, and social providers including Google, GitHub, Apple, Microsoft, and Discord. Authorization goes beyond roles: an embedded OpenFGA engine provides Zanzibar-style relationship-based permission checks in process. APIs are exposed over GraphQL, REST, and gRPC, with SDKs for JavaScript, React, Go, and Python, plus themeable built-in login pages and an admin dashboard. Apache 2.0 licensed.

Website analytics, uptime monitoring, and server status - three tools most teams run separately - combined in Tianji, an open-source observability platform. The analytics layer tracks page views, unique visitors, referrers, and UTM parameters with a lightweight cookie-less script, which keeps collection GDPR and CCPA friendly. The uptime monitor checks availability and latency on configurable intervals, accepts passively reported results, and publishes public status pages for incident communication. Server status agents report CPU, memory, disk, and network metrics with threshold-based alerts, and notifications route through webhooks, Slack, Telegram, and other channels with noise control. It also includes anonymous telemetry for tracking deployments of your own open-source projects, surveys, waitlists, team collaboration, and an OpenAPI interface for integrations and exports. The consolidation is the point: traffic analytics, uptime checks, and server metrics share one interface and one alerting layer, so diagnosing an incident does not mean hopping between Google Analytics, Uptime Kuma, and Prometheus - and the built-in public status pages replace a separate paid Statuspage-style subscription. Because collection uses no cookies with IP truncation and aggregation by default, basic traffic measurement requires no consent banner. Built in TypeScript under the Apache 2.0 license and inspired by Umami and Uptime Kuma, it is deliberately right-sized for independent developers and small SaaS teams whose monitoring needs are real but lightweight.

No cookies, no fingerprinting, no cross-site tracking, no personal data collection - Umami's privacy contract is the foundation of the open-source web analytics platform. IP addresses are hashed rather than stored, which makes it GDPR, CCPA, and PECR compliant by default - the consent banner can come off the site entirely. The tracking script is under 2 KB, roughly 20x smaller than Google Analytics, so measurement stops being a page-weight tax. The dashboard covers the core metrics - pageviews, visitors, bounce rate, visit duration, referrers, browsers, devices, and countries - with any date range and filtering by country or device. Beyond pageviews, custom events track clicks, form submissions, and signups via a data attribute or one JavaScript call, and advanced reports add funnels, user journeys, retention and cohort analysis, goals, and automatic UTM campaign tracking. Anonymous session views show individual visitor activity without identifying anyone. Teams share websites with role-based access, one instance manages unlimited sites, and a full REST API exposes every metric programmatically. MIT-licensed and self-hosted on PostgreSQL or MySQL via Docker, your analytics data never leaves your infrastructure.

Inspect a PostgreSQL database right now, without installing pgAdmin or exposing Postgres to the internet - pgweb answers that recurring need. It's a Go application from Dan Sosedoff, a decade in development, shipped as a single statically-linked binary with zero dependencies - the Docker image is essentially just the executable - that puts a clean browser UI in front of any PostgreSQL 9.1+ server. Connect via URL string or host/port credentials, and browse tables, views, and sequences from the sidebar; selecting a table shows its rows immediately alongside tabs for structure, indexes, and constraints. The Query tab executes arbitrary SQL with query history, and the Explain Query button renders the query plan - estimated cost, row counts, execution strategy - which makes pgweb a quick performance-triage tool, not just a browser. Results and entire tables export to CSV, JSON, or XML in a click. Connectivity is more flexible than its size suggests: native SSH tunneling (password or key) reaches databases behind firewalls, server bookmarks make switching instances instant, and an optional multi-session mode handles several databases concurrently. For a RepoCloud stack full of Postgres-backed apps, one pgweb instance is the universal inspection hatch. MIT-licensed, actively maintained.

Over 2,500 open-source projects and companies in more than 165 countries localize with Weblate - the libre continuous localization platform and the standard self-hosted answer to Crowdin and Lokalise. Its defining trait is that translations live in the same version control as your code: Weblate talks directly to Git and Mercurial, pulls new source strings automatically via webhooks, and pushes finished translations back either as direct commits or as pull/merge requests on GitHub, GitLab, Gitea, Bitbucket, Azure DevOps, Gerrit, or Pagure. Every translator is properly credited in the commit history. For translators, it is a full computer-aided translation tool: translation memory, glossaries, customizable quality checks that catch placeholder and formatting mistakes, propagation of identical strings across components, and automatic suggestions from machine translation services - DeepL, Amazon Translate, LibreTranslate, and others, with per-service priorities and support for custom Python engines. It handles the format zoo (gettext PO, JSON, YAML, Android XML, iOS strings, and dozens more) and supports crowdsourced workflows with granular access control, workspaces, two-factor authentication, and reviewer approval steps. A REST API, CLI client, and add-on system automate everything else. Built on Python/Django, GPL-licensed, with no per-string or per-seat pricing when self-hosted.

Share code snippets, logs, configs, and notes without registration, tracking, or ads: Lenpaste is a minimal, self-hosted, anonymous alternative to pastebin.com. It is deliberately spartan in the right ways: no accounts, no JavaScript required (the entire site works in text browsers and hardened setups), and cookies used solely to store display preferences. Pastes support syntax highlighting across a long list of languages (from ApacheConf and Arduino to mainstream stacks), configurable expiration from minutes to unlimited, one-use "burn after reading" pastes that self-delete on first view, optional author attribution, and iframe embedding for dropping pastes into other pages. The form-encoded HTTP API covers everything the UI does - create pastes with title, syntax, expiration, and line-ending normalization, fetch them by ID, and query server capabilities - making it trivial to pipe command output to your paste server from shell scripts. Server operators control maximum title and body lengths, maximum paste lifetime, rate limits for viewing and creation, search-engine indexing policy, and can lock private instances behind HTTP Basic authentication. It deploys as a single lightweight Docker container, giving your team a snippet-sharing endpoint where the content never touches a third-party service.

Authentication that lives inside your application rather than behind a redirect to an external identity provider - SuperTokens takes a fundamentally different architecture from Auth0 and AWS Cognito. Three tiers make that work - frontend SDKs (React, Angular, Vue, vanilla JS, React Native) render overridable login UI and manage tokens; backend SDKs (Node.js, Python, Go) expose auth endpoints on your own API domain; and SuperTokens Core, the piece you host here, is the stateless HTTP service handling core auth logic, password hashing, token signing, and database operations against PostgreSQL. The recipe system keeps features decoupled: use email/password, social login, passwordless (magic links, OTP), phone-password, multi-factor authentication (TOTP, WebAuthn), user roles, and microservice auth - individually or combined; you can even use SuperTokens purely for session management alongside another login provider. Sessions are where it shines: rotating refresh tokens with theft detection, automatic access-token refresh, CSRF protection, and secure cookie handling out of the box - the details that become vulnerabilities when hand-rolled. Verification happens locally in your backend via cached JWT signing keys, so the Core stays off the hot path. Self-hosted means no user limits, free forever, with all user data in your database. Apache-licensed.

Built by an agency in 2011 and refined by real client work since, Cockpit is a headless CMS whose pragmatism is earned. It's a pure content backend: model your data, let editors manage it, and fetch it over REST or GraphQL from any frontend - React, Vue, Flutter, a static site generator, or an IoT dashboard. Content modeling covers three shapes: Collections for repeatable items (posts, products, events), Singletons for one-off content (settings, about pages), and Trees for hierarchies (navigation, categories), all assembled from 20+ field types including relationships. The API layer is unusually capable: MongoDB-style query filtering, field selection to trim payloads, automatic image optimization through the assets API, and built-in caching. Localization is first-class with per-field multi-language content and fallback support; user management includes roles, granular permissions, two-factor authentication, and API tokens; and webhooks push changes into external workflows. Agencies get multi-tenant Spaces - several sites or clients from one installation. The operational footprint is refreshingly small: PHP plus either SQLite or MongoDB, no build steps, no toolchain, extensible through hooks, events, and addons (pages/SEO, forms, full-text search, layout components). Where enterprise headless platforms bill per seat and per locale, Cockpit is MIT-licensed and simply yours.

Schema design with no account and a few clicks: drawDB is the browser-based entity-relationship diagram editor and SQL generator - an AGPL-3.0 React project with over 37,000 GitHub stars. Draw tables with columns, data types, defaults, and constraints; connect fields to create foreign-key relationships; group tables into labeled subject areas; and annotate with notes. When the design is ready, one export produces CREATE TABLE DDL - with constraints, indexes, and foreign keys - targeted at MySQL, PostgreSQL, SQLite, MariaDB, SQL Server, or Oracle. Diagrams can be database-specific, unlocking every native type plus dialect features like PostgreSQL enums and composite custom types, or generic for portability across all supported flavors. The reverse direction works too: paste existing DDL into the import dialog and drawDB renders your live schema as a navigable diagram - the fastest way to document an inherited database. Versioning and migration-script generation track schema evolution, full editor ergonomics (undo/redo, copy/paste, duplicate, themes) keep iteration fast, and diagrams export as PNG, SVG, or shareable JSON. Everything runs client-side against browser storage - no backend database connection needed - so the self-hosted Docker deployment is a featherweight static app that keeps proprietary schema designs entirely on your infrastructure.

Wrap code in a flag, then toggle it per environment, per user, per segment, or by percentage - no redeploy required: Flagsmith is an open-source feature flag and remote config platform. Every flag doubles as remote config, carrying string, number, or JSON values, so functional and visual changes ship to production without a code push. Segments are the targeting engine: build them from stored user traits, then release to beta testers first, test in production by exposing features only to internal teams, or run canary deployments to a small percentage before going wide - segment membership changes instantly without app updates. Multivariate flags split traffic across two or more variations for A/B/n testing, with flag events flowing into Amplitude, Mixpanel, or Segment for analysis. SDKs cover 15+ languages including TypeScript, .NET, Java, Python, and Go, with framework support for React, Next.js, and mobile, plus local evaluation for latency-sensitive paths. Organizations, projects, and roles keep multi-team setups tidy. Core functionality - unlimited flags, remote config, targeting, multivariate flags - is BSD-3-Clause licensed with an explicit commitment that it stays open. Self-hosting suits privacy-conscious teams: flag rules and user traits stay on your infrastructure, deployable via Docker or Kubernetes with Helm.

The utilities engineers otherwise scatter across a dozen ad-laden websites - 80+ of them - live together in IT-Tools, one fast, polished web app. Crypto covers JWT decoding, MD5 through SHA-512 hashing, HMAC and bcrypt generation, RSA key pairs, and password strength analysis. Converters handle JSON to CSV, YAML, and TOML, Base64 files, URL encoding, HTML entities, color formats, and Docker run commands to Compose files. Generators produce UUIDv4, ULID, BIP39 mnemonics, QR codes (including Wi-Fi QR), and tokens; text tools include a regex tester, diff viewer, slug and case converters; web utilities parse URLs and user agents, look up HTTP status codes and MIME types, and inspect Open Graph metadata; plus a cron parser, chmod calculator, and more. The privacy argument is the point: JWTs contain user IDs, hashes derive from passwords, JSON dumps hold PII - exactly the inputs you least want a third-party utility site to log. IT-Tools is a frontend-only static bundle (Vue/TypeScript, GPL-3.0, 39k+ GitHub stars) served by Nginx in one container, so everything runs client-side on your infrastructure with nothing transmitted anywhere. New tools ship roughly monthly, and a scaffolding script makes adding custom ones straightforward.

API keys hardcoded in repos, database passwords pasted into CI variables, .env files emailed between developers - Infisical, the open-source platform for secrets, certificates, and privileged access management, is the answer to all three. Secrets live in versioned stores scoped by project, environment, and path, with fine-grained identity-aware access control and full audit logging on every read and change. Delivery covers every consumption pattern: CLI injection into local dev, SDKs for Go, Node.js, and Python, an HTTP API, agents, a Kubernetes Operator, and secret syncs that push to GitHub, GitLab, AWS Secrets Manager, and Vercel. Automatic rotation replaces credentials for PostgreSQL, MySQL, MSSQL, LDAP, AWS IAM, and Azure on a rolling schedule - new credentials issue while old ones stay temporarily valid, so nothing breaks mid-rotation. Dynamic secrets go further, generating ephemeral, time-bound database credentials on demand, and SSH access replaces static keys with short-lived CA-signed certificates that expire automatically. Secrets scanning catches hardcoded credentials in code and pipelines, certificate management automates X.509 issuance and renewal, and a built-in KMS handles encrypt/decrypt with central key control. Self-hosting keeps the keys to everything else on your own infrastructure.

Wire nodes together in a browser, deploy in one click, and real-time data flows from sources through transformations to outputs: Node-RED is the OpenJS Foundation's flow-based programming tool for event-driven applications. Born at IBM as a proof-of-concept for manipulating MQTT topic mappings, it has become the lingua franca of IoT and automation glue - home automation, industrial control, edge data collection - with a community library of over 5,000 contributed nodes and flows covering protocols, devices, and services. Where visual wiring runs out, JavaScript function nodes written in a rich in-editor code editor take over, and every flow serializes to importable, exportable JSON that shares cleanly and version-controls sensibly. Version 5.0 (2026) delivered the largest editor overhaul in the project's history: a rethought layout with Explorer and Information panels in a split sidebar, a native dark theme with theme variants, improved accessibility, and refreshed node appearance. The runtime is lightweight Node.js, exploiting the event-driven non-blocking model so the same flows run on a Raspberry Pi at the network edge or a cloud VM. Apache-2.0 licensed with 240+ contributors, it pairs naturally with dashboard nodes for live charts and controls.

"Throw it on a haste and send the link" entered developer vocabulary because of Hastebin (haste-server), the minimalist open-source pastebin. Written in Node.js with three stated design goals - be really pretty, be really simple, be easy to set up - it does one job precisely: paste code, logs, stack traces, or config snippets, press save (or Ctrl+N for a new one), and get a short random-key URL to share. Syntax highlighting renders pastes readably across common languages, a raw view serves plain text for curl and scripts, and duplicate-and-edit makes iterating on a shared snippet trivial. The killer workflow is the terminal: with the haste-client utility or a one-line shell function, `cat error.log | haste` prints a shareable URL straight from stdout - the fastest route from a broken build to a colleague's eyeballs. Storage is pluggable through a simple adapter interface: filesystem by default, Redis with optional key expiration for pastes that should age out, and configurable key length, maximum paste size, and static documents. Self-hosting matters here because pastes often contain internal logs and stack traces that should never sit on a public pastebin - your instance keeps them inside your network, under your retention rules.

Between your databases and everything that consumes data - BI tools, embedded analytics, AI agents - sits Cube (formerly Cube.js), an open-source semantic layer. Metrics, dimensions, joins, and access rules are defined once as code in YAML, JavaScript, or Python, forming a governed data model that every downstream consumer shares, so "revenue" means the same thing in every dashboard. Caching is two-level: an in-memory cache absorbs bursts of identical queries, and declared pre-aggregations - rollup tables built in the warehouse or in Cube Store, Cube's distributed columnar engine, and refreshed in the background - deliver sub-second latency while cutting warehouse compute costs. The query planner routes each request to cache, rollup, or source automatically. Consumers connect through a Postgres-compatible SQL API (any tool that speaks Postgres works), plus REST, GraphQL, and a Meta API for model introspection. Row-level security and multi-tenancy are enforced in the layer itself, upstream of every client. Sources include Snowflake, BigQuery, Databricks, Postgres, MySQL, Presto, and Athena. Headless by design - bring your own UI.