Open Source App Cloud Marketplace

Upload a file, get a unique download link and a separate delete link - Jirafeau has done exactly this one thing since 2008. It is plain PHP with no database, no mail server, no JavaScript framework, and no external dependencies - files and metadata live on the filesystem, which is why it runs on nearly anything and why it has outlasted most of its imitators. Uploads use the HTML5 file API, so PHP's post_max_size ceiling does not constrain file size, with live progress showing speed, percentage, and time remaining. Every upload takes options: expiration from one minute to a year to unlimited, self-destruct after first download, and password protection with configurable policy - passwords can be optional, required, or server-generated with complexity rules. Server-side encryption (modern builds use XChaCha20-Poly1305) stores files encrypted at rest with the decrypt key embedded only in the download URL, never on the server, so a compromised host cannot read the contents. Unencrypted deployments get file-level deduplication - identical files stored once with multiple links. Upload access can be gated by password lists or IP allowlists, a small admin panel manages stored files, and a CLI cleanup script handles expired files via cron. Recipients can preview supported files in-browser.

What Doodle did before ads and paywalls took over: Rallly (three L's) lets you propose a few dates, share a link, and watch an availability grid fill in - no email threads, no forced accounts, no "$6.95/month to remove ads." The availability grid makes the winning slot obvious at a glance, comments on each poll keep the "I can do Tuesday if we start late" discussion attached to the decision instead of buried in chat, and email notifications fire as votes and comments arrive. When consensus lands, finalize the winning option and everyone gets notified. The stack is modern TypeScript - Next.js, tRPC, Prisma over PostgreSQL, Tailwind - with a clean, genuinely mobile-friendly UI, dark mode, and community translations in 10+ languages. Self-hosting means unlimited polls and unlimited participants with meeting data on your server rather than a scheduling SaaS. It pairs naturally with Cal.com: Rallly answers "which time works for everyone?", Cal.com handles "book a slot on my calendar." AGPL-licensed.

Enter a URL and get a dashboard of everything publicly discoverable about its security posture, server architecture, and technology stack: Web-Check is an all-in-one OSINT tool for analyzing any website. One scan surfaces IP info and server location, the full SSL certificate chain with issuing authority and validity, DNS records (A, MX, NS, CNAME, TXT) with DNSSEC status, HTTP response headers interpreted for security directives like HSTS, CSP, and X-Frame-Options, cookies and their flags, WHOIS domain info, robots.txt crawl rules, a sitemap-derived page map, the redirect ledger, open ports, traceroute, detected technologies, third-party trackers, associated hostnames, site performance, and even carbon footprint. Each card explains what the data means and why it matters, which makes the tool double as a security education resource - junior engineers learn headers and attack surfaces by scanning real sites. Practical uses span pre-deployment security audits (catch missing headers and misconfigurations before they ship), privacy compliance checks (identify trackers and cookie behavior for GDPR work), competitive tech-stack research, and network debugging via DNS and redirect inspection. Built by Lissy93 in TypeScript, it deploys as a single Docker container, and self-hosting keeps your reconnaissance targets and audit activity off third-party services.

No database anywhere in the stack: Grav, the leading flat-file CMS, builds every page from a folder of Markdown and YAML on PHP, Symfony components, Twig templating, and Doctrine caching. That architecture is the whole argument: content is Git-versionable, rsync-able, and lock-in-free; pages render in well under 100ms without database round-trips; and backup means copying a directory. Content authors write Markdown (or plain HTML), configure with readable YAML, and define custom page structures via blueprint files that generate editing forms automatically. The optional Admin panel adds a polished editing layer: dashboard with site activity, page management with a syntax-highlighted editor and live preview, drag-and-drop media uploads, one-click plugin/theme updates, and normal/expert modes for form-based or raw YAML editing. The ecosystem runs deep - hundreds of open-source plugins and themes installed through the GPM package manager, with an event-hook architecture that gives plugins full control over the request lifecycle, and downloadable skeletons providing entire pre-built sites. Grav 2.0 modernizes the stack (PHP 8.3+, Symfony 7, Twig 3) and adds a first-party REST API, an MCP server for AI agents, and a SvelteKit single-page admin with real-time collaborative editing. Ideal for docs, blogs, and marketing sites. MIT-licensed.

The integrations your SaaS product offers its own users - that is what Nango, an open-source product-integrations platform, exists to build. It solves the repetitive infrastructure work behind every third-party API connection: OAuth flows, API key handling, token refresh, encrypted credential storage, rate-limit backoff, retries, and multi-tenant connection management. It ships pre-built auth configurations for 800+ APIs. Your users connect their accounts through an embeddable, white-label Connect UI, and your backend then reads or writes data through Nango's proxy, SDKs, or REST API without ever touching raw credentials. Integration logic is written as TypeScript functions covering actions, scheduled data syncs, and webhook processing - all running on one runtime with retries, checkpointing, and per-connection logs built in. Syncs pull records incrementally on a schedule, one-way or two-way, which suits RAG pipelines, search indexing, and keeping local copies of external data current. Selected actions can also be exposed as tool schemas or through a built-in MCP server, so AI agents operate on user-connected accounts without ever handling provider credentials. Auth support spans OAuth 2.0, OAuth 1.0a, API keys, basic auth, and JWT, and observability - logs, metrics, failure detection, and a reconnect flow for expired credentials - is scoped per customer connection for easier support debugging. Works with any backend language. Self-hosting on RepoCloud keeps all customer credentials and synced data on infrastructure you control, which matters for data residency and compliance requirements.

A polished public status page without Statuspage prices or a heavyweight observability suite: Kener is a status and uptime monitoring system built with SvelteKit and Node.js. It runs 11 monitor types - API, Ping, TCP, DNS, SSL certificate, SQL query, Heartbeat, gRPC, and GameDig game-server checks among them - each with configurable intervals and thresholds. Incident management covers the full lifecycle: structured timelines from investigation through resolution, acknowledgements, and subscriber-visible updates, plus maintenance windows with RRULE-based recurring schedules and automatic status transitions. Notifications reach email, Slack, Discord, and custom webhooks through trigger-based workflows with template-driven messaging. One instance can serve multiple branded status pages - per product, team, or region - with custom logos, colors, and CSS, localization into 21 languages, timezone-aware displays, and server-rendered pages that stay fast and SEO-friendly. Operations tooling includes role-based access for teams, API key management, a secrets vault, analytics integrations (Google Analytics, Plausible, Umami, and others), and a REST API with 17+ endpoints for automating incidents and monitors from CI/CD. MIT-licensed; Docker deployment with Redis, SQLite by default, PostgreSQL or MySQL for production.

What Trello fans wanted Trello to stay: Kan (kan.bn) is a minimalist, frills-free kanban board capturing the original vision before the enterprise pivots - and then adds the things 2025 actually demands. The core is exactly right: drag-and-drop cards across lists, labels and filters to find work fast, comments for discussion on cards, checklists, a detailed activity log tracking every change, and reusable board templates. Workspaces gather your team with member invites and role management, and board visibility controls decide who can view or edit each board. Migration is first-class: a built-in Trello importer brings existing boards over, so switching costs an afternoon, not a quarter. The standout differentiator is the bundled Model Context Protocol server exposing 46 tools across workspaces, boards, lists, cards, comments, checklists, labels, and members - meaning Claude Desktop, Cursor, Copilot, or any MCP client can read and manage your boards in natural language: "move everything assigned to me into Done" becomes a sentence, not a click marathon. The stack is modern TypeScript - Next.js, tRPC, Drizzle ORM over PostgreSQL, Better Auth (credentials or OAuth), Tailwind - with optional SMTP email and S3 file storage. Unlimited boards, lists, and cards; AGPL-licensed.

Images, text, audio, video, HTML, PDFs, and time series, labeled in one tool with a standardized output format: Label Studio is the open-source data labeling platform for building training datasets. Computer vision tasks cover classification, object detection (boxes, polygons, ellipses, keypoints), and semantic segmentation; audio work spans transcription, speaker diarization, and emotion recognition; NLP handles named entity recognition and document classification with taxonomies up to 10,000 classes; and GenAI workflows support LLM fine-tuning data and RLHF response ranking. Labeling interfaces are fully configurable with an XML-like templating language, so the UI matches the task instead of the reverse. The ML backend SDK turns any model into a connected web server for pre-annotation (model predicts, humans verify), interactive labeling (real-time predictions as annotators draw regions or highlight text), and model evaluation - cutting annotation time dramatically on large datasets. Data imports from S3, GCS, or file uploads; the Data Manager filters and explores tasks; exports convert to the format your ML library expects via label-studio-converter. Multi-user accounts tie every annotation to its author, and webhooks, a Python SDK, and REST API embed labeling into any pipeline. Self-hosting keeps proprietary training data - often a company's most sensitive asset - entirely on your infrastructure.

The deep end of self-hosted recipe management: Tandoor Recipes is a Django/Vue application that replaces Paprika, AnyList, and ad-choked recipe sites with a database you control. Import is where most people start: paste any URL and Tandoor scrapes schema.org markup for ingredients, instructions, images, times, and nutrition; bulk-paste URLs for batch import; or migrate wholesale from Mealie, Paprika, Nextcloud Cookbook, Pepperplate, and other managers with built-in importers. The structured recipe editor tracks ingredients individually, which is what powers everything downstream: full-text search with trigram similarity, a "what can I make with what's in the fridge" ingredient search, automatic nutrition via OpenFoodFacts, and shopping lists that merge duplicate ingredients across recipes, convert units, scale by servings, and sort by your supermarket's actual aisle layout. The weekly meal planner is drag-and-drop, feeds shopping lists automatically, exports to your calendar, and shows a nutritional summary for the week. Multi-user support comes with a granular permission system - shared household cookbooks, private recipes, even secret ones - and shopping lists sync in real time so two people can shop simultaneously. A full REST API integrates with Home Assistant and Grocy. For households serious about cooking, Tandoor's depth is unmatched.

A personal Strava on your own server: Endurain is a self-hosted fitness platform that keeps your complete workout history, GPS routes, and health data out of a vendor's cloud. It ingests the standard device formats (.gpx, .tcx, and preferred .fit with full sensor data) via manual or bulk upload, and syncs directly with Strava and Garmin Connect so migrating years of history is straightforward - Garmin sync covers activities, gear, and body composition. The dashboard shows activity feeds with weekly and monthly statistics, routes on maps, and distance, speed, and training-volume trends over time, with definable goals that update automatically. Gear tracking is notably deep: log wetsuits, bicycles, shoes, racquets, skis, and snowboards, assign default gear per activity type, and track individual components like bike chains against replacement mileage. Multi-user support with admin and user roles, follower features, per-activity privacy settings, and configurable sign-up (email verification, admin approval) make it usable for clubs and coaches as well as individuals. Auth is serious for a fitness app: MFA TOTP, OIDC/SAML SSO, and email-based password resets via Apprise. The stack is Vue.js over a Python FastAPI backend with PostgreSQL, plus weight, steps, and sleep logging, imperial/metric units, multi-language support, and third-party app integration.

Manga, comics, ebooks, and light novels get a streaming-service-style home in Kavita - a fast, cross-platform reading server for the DRM-free collection you share with family and friends. It natively serves CBZ, CBR, CB7, ZIP/RAR/7z archives, raw images, EPUB, and PDF, with hand-crafted web readers per format: webtoon scrolling, single and dual-page spreads with advanced caching for the comic reader, and a book reader with adjustable fonts, spacing, margins, color themes, and column modes. Reading progress tracks per user, so everyone resumes exactly where they stopped on any device. Metadata parses from filenames, ComicInfo.xml, and EPUB fields, feeding index-backed search, smart filters, collections, reading lists with CBL import, and Want to Read queues. Role-based user management covers age restrictions, per-library access, and OIDC authentication. An OPDS feed connects third-party clients - Panels on iOS, Librera on Android, KOReader on e-ink devices - and a comprehensive REST API supports custom integrations. EPUB annotation and highlight support, custom theming, and full localization round it out. Built with .NET and Angular, it handles 50,000+ file libraries without strain; optional Kavita+ adds AniList scrobbling, recommendations, and external metadata.

Wire nodes together in a browser, deploy in one click, and real-time data flows from sources through transformations to outputs: Node-RED is the OpenJS Foundation's flow-based programming tool for event-driven applications. Born at IBM as a proof-of-concept for manipulating MQTT topic mappings, it has become the lingua franca of IoT and automation glue - home automation, industrial control, edge data collection - with a community library of over 5,000 contributed nodes and flows covering protocols, devices, and services. Where visual wiring runs out, JavaScript function nodes written in a rich in-editor code editor take over, and every flow serializes to importable, exportable JSON that shares cleanly and version-controls sensibly. Version 5.0 (2026) delivered the largest editor overhaul in the project's history: a rethought layout with Explorer and Information panels in a split sidebar, a native dark theme with theme variants, improved accessibility, and refreshed node appearance. The runtime is lightweight Node.js, exploiting the event-driven non-blocking model so the same flows run on a Raspberry Pi at the network edge or a cloud VM. Apache-2.0 licensed with 240+ contributors, it pairs naturally with dashboard nodes for live charts and controls.

Private npm packages without shipping code to the public registry or paying for npm Enterprise: Verdaccio is the standard lightweight, zero-config private registry and caching proxy. It runs as a single Node.js process with its own tiny embedded database; no external database is required to start. Point npm, yarn, or pnpm at it and everything behaves as expected: install, publish, unpublish, dist-tags, and deprecation all work against the standard npm endpoints. The uplink system is where it earns its keep: packages not found locally are fetched from configured upstreams (npmjs.org, yarn, JFrog, Nexus, or another Verdaccio), cached as tarballs, and served locally thereafter - cutting CI latency and surviving registry outages. Multiple uplinks chain for failover, and per-package glob patterns in config.yaml route scopes to specific upstreams while controlling access, publish, and unpublish rights per group. You can even override a public package by publishing a patched version under the same name locally. A plugin architecture swaps in auth backends (htpasswd default, LDAP and others available), storage drivers (S3, Google Cloud Storage), middleware routes, and metadata filters. With official Docker images and a Kubernetes Helm chart, it slots into any pipeline in minutes.

Every line an indentable bullet, every bullet a first-class block that can be referenced, embedded, and queried anywhere: Logseq is a privacy-first, local-first knowledge platform built around the block outliner. The daily journal is the system's beating heart - each day opens a fresh date-stamped page where tasks, meeting notes, and fleeting ideas land as blocks without filing decisions, then connect later through [[wikilinks]] with automatic bidirectional backlinks and ((block references)) that transclude any bullet into any page. Everything persists as plain Markdown or Org-mode files on disk - git-friendly, greppable, and owned forever, with sync via iCloud, Dropbox, Syncthing, Git, or an optional end-to-end encrypted service. Built-in tooling goes beyond notes: TODO/DOING task states with scheduling, native PDF annotation with area highlights, spaced-repetition flashcards, whiteboards for visual thinking, Zotero integration for researchers, and Datalog-powered queries that build dynamic views across the entire graph. A marketplace of hundreds of community plugins and themes adds AI chat, Ollama local-model integration, and custom workflows. Written in Clojure/ClojureScript, AGPL-3.0 licensed with 320+ contributors, and completely free - the local-first Roam for people who refuse subscriptions and lock-in.

Team and product documentation on a fast Vue frontend with PostgreSQL storage: Wiki.js is a Node.js wiki engine. Its distinguishing trait is per-page editor choice: authors pick Markdown with live preview, a WYSIWYG visual builder for non-technical writers, or raw HTML, page by page. Native Git synchronization commits every page change to GitHub, GitLab, Bitbucket, Azure DevOps, or any Git remote - bi-directionally, so edits made in the repository flow back into the wiki - giving documentation version-controlled backup for free. Authentication coverage is among the broadest of any self-hosted wiki: local accounts with self-registration, social login via Google, GitHub, Discord, and Slack, and enterprise SSO through LDAP/Active Directory, SAML, CAS, Auth0, Okta, Azure AD, Keycloak, and generic OAuth2/OIDC, with optional MFA. Built-in full-text search runs on PostgreSQL with zero setup, and external engines like Algolia or Solr can substitute. Page history with visual version comparison, granular group-based permissions per path, nested navigation menus, 50+ integration modules, and full localization round it out. AGPLv3-licensed with a 28k-star community.

What Jellyfin is for video, Komga is for comics, manga, BDs, magazines, and eBooks: point it at folders of CBZ, CBR, CBT, PDF, and EPUB files and it becomes a proper library with cover art, embedded metadata import, and per-user reading progress. The responsive web reader handles multiple reading modes - left-to-right for western comics, right-to-left for manga, webtoon scrolling - while collections and read lists organize crossovers and story arcs, with ComicRack .cbl read list import for existing curation. Its openness is the real differentiator: OPDS v1.2 and v2.0 feeds serve virtually every reader app (Panels, Moon+ Reader, Mihon/Tachiyomi, KyBook), with OpenSearch and page-streaming extensions so mobile apps fetch pages on demand instead of whole archives. E-ink support is built in, not bolted on - Kobo devices sync directly against Komga instead of Kobo's servers, with two-way read progress, on-the-fly KEPUB conversion via Kepubify, and optional proxying so official Kobo purchases still work; KOReader sync covers everything else. Multi-user management brings per-library access control, age restrictions, and label restrictions for family setups. Housekeeping tools detect duplicate files and duplicate pages, and a REST API feeds a healthy ecosystem of community scripts. Runs from a single Docker container with embedded SQLite.

API keys hardcoded in repos, database passwords pasted into CI variables, .env files emailed between developers - Infisical, the open-source platform for secrets, certificates, and privileged access management, is the answer to all three. Secrets live in versioned stores scoped by project, environment, and path, with fine-grained identity-aware access control and full audit logging on every read and change. Delivery covers every consumption pattern: CLI injection into local dev, SDKs for Go, Node.js, and Python, an HTTP API, agents, a Kubernetes Operator, and secret syncs that push to GitHub, GitLab, AWS Secrets Manager, and Vercel. Automatic rotation replaces credentials for PostgreSQL, MySQL, MSSQL, LDAP, AWS IAM, and Azure on a rolling schedule - new credentials issue while old ones stay temporarily valid, so nothing breaks mid-rotation. Dynamic secrets go further, generating ephemeral, time-bound database credentials on demand, and SSH access replaces static keys with short-lived CA-signed certificates that expire automatically. Secrets scanning catches hardcoded credentials in code and pipelines, certificate management automates X.509 issuance and renewal, and a built-in KMS handles encrypt/decrypt with central key control. Self-hosting keeps the keys to everything else on your own infrastructure.

A pile of paper becomes a searchable digital archive under Paperless-ngx, the community-maintained document management system. The pipeline is what makes it work: drop a file into the consumption folder (or let it poll an email inbox), and a worker hashes it for duplicate detection, routes it by type, runs OCRmyPDF with Tesseract (100+ languages) on anything without a text layer, and produces an archivable PDF/A with invisible selectable text embedded - so Ctrl+F works on your scans. Then the smart part: a scikit-learn classifier (TF-IDF plus multi-label prediction) trained on your own tagged documents automatically assigns tags, correspondents, and document types to new arrivals, alongside rule-based exact, keyword, and regex matching for deterministic cases. Full-text search includes relevance ranking, match highlighting, autocomplete, and "more like this" similarity search. Apache Tika integration extends consumption to Word, Excel, PowerPoint, and LibreOffice formats. The Django/Angular app adds custom fields, saved views on a customizable dashboard, bulk editing, workflow automation triggered on upload or matching, shareable public links with expiration, and a robust permissions system with per-document access control. Metadata lives in PostgreSQL with Redis-queued Celery workers processing documents in parallel. Your tax records, invoices, and contracts stay on your server - searchable in seconds, never in someone else's cloud.