With over 7,000 GitHub stars and continuous development since 2017 by former Intel engineer Ylian Saint-Hilaire, MeshCentral has become the go-to self-hosted alternative to ConnectWise Control and Splashtop for managing devices remotely without per-seat licensing fees. The Node.js server installs via a single npm command and manages Windows, macOS, Linux, and FreeBSD endpoints through lightweight agents that maintain persistent WebSocket connections for real-time remote desktop, terminal access, and file transfer directly in the browser. Intel AMT integration provides out-of-band hardware management including power control and BIOS access even when the operating system is unresponsive. Device groups organize endpoints by location, customer, or function with granular role-based access control for multi-technician environments. Session recording captures remote desktop interactions for compliance auditing, while Wake-on-LAN powers on machines remotely across subnets. The server supports MongoDB for production deployments handling thousands of agents or the embedded NeDB for smaller setups under 200 devices, with a single 8GB VPS comfortably managing 1,500 concurrent agents. Security features include mandatory TLS with automatic Let's Encrypt certificate provisioning, multi-factor authentication via TOTP and FIDO2, SAML-based single sign-on, IP filtering, and HashiCorp Vault integration for secrets management. The web console provides real-time device monitoring with hardware and software inventory, network topology visualization, and customizable branding. TacticalRMM uses MeshCentral as its remote access layer. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Fleet lets IT and security teams query every device in their organization like a SQL database, using osquery to surface installed software, running processes, configurations, and vulnerabilities within seconds across macOS, Windows, Linux, iOS, Android, and ChromeOS. The Go-based server exposes a web console and REST API for centralized device management, with MDM capabilities built on nanoMDM for Apple device enrollment, configuration profiles, and remote lock or wipe. Vulnerability management cross-references installed software inventories against NVD and OVAL CVE databases, automatically flagging known vulnerabilities with severity scores and remediation guidance. Software deployment handles OS updates using Apple Declarative Device Management, Windows Update, and custom installer packages distributed through S3-compatible storage. A GitOps workflow enables infrastructure-as-code management where device policies, osquery queries, and configuration profiles live as YAML files in Git repositories, with CI/CD pipelines pushing changes through the fleetctl CLI. The fleetd agent bundle includes osquery for telemetry, Orbit for version management, and Fleet Desktop providing end users a menu bar status indicator. Integrations connect to Snowflake, Splunk, Elastic, Jira, Zendesk, Vanta, and GitHub Actions for automated compliance reporting. CIS benchmark policies verify security baselines across operating systems. Deployment requires MySQL for persistence and Redis for caching, running as Docker containers or on Kubernetes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Unpatched Linux servers expose production environments to critical vulnerabilities, and PatchMon eliminates that blind spot by centralizing package telemetry, security advisory tracking, and automated update orchestration across your entire fleet. Administrators can inspect pending updates across APT, DNF, YUM, APK, Pacman, Zypper, FreeBSD pkg, Windows Update, and winget from one unified queue without opening inbound firewall ports on monitored hosts. Before touching production workloads, operators run dry-run validations to preview exact package transactions, enforce multi-user approval workflows, and schedule rollouts during fixed maintenance windows. During execution, live agent output streams directly to the browser over WebSocket so engineers can watch progress in real time or halt a problematic upgrade mid-flight. Beyond package updates, the platform runs OpenSCAP CIS benchmark and Docker Bench security assessments, inventories running containers and outdated base images, and routes host-down or threshold alerts to Slack, Discord, Microsoft Teams, ntfy, or email. Built-in browser SSH and Apache Guacamole RDP terminals let teams troubleshoot machines directly through the outbound agent tunnel with role-based access control and OIDC single sign-on. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Linux Update Dashboard is a self-hosted web app that lets you check and apply package updates across a whole fleet of Linux servers from one browser dashboard, over SSH, with no agent installed on any managed machine. It discovers each server's package managers, operating system, installed packages, reboot state, and distribution lifecycle, then lets you refresh, upgrade selected packages, run full upgrades, autoremove leftovers, cancel running work, or reboot remotely while watching real-time command output stream into the page. Groups with health badges and explicit priorities organize fleets for clear overviews and ordered Upgrade All batches that run as waves across eligible systems. An encrypted SSH credential vault stores reusable passwords, private keys, and OpenSSH certificates with AES-256-GCM, and you can view or edit repository source files through sudoedit with diff review and activity history. Cron-based schedules automate refreshes, updates, autoremove, reboots, and notifications for chosen systems, while alerts go out by email, Gotify, MQTT, ntfy.sh, Telegram, or webhooks, with Home Assistant MQTT discovery entities for every server. Sign-in supports passwords with optional TOTP, passkeys and WebAuthn, OpenID Connect SSO, and API tokens, and the interface speaks ten languages with dark and light themes and custom branding. Because this tool can run commands on your servers, keep it on trusted networks behind TLS, a reverse proxy, or a VPN. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

GLPI combines helpdesk ticketing, hardware inventory, license compliance, CMDB, and project management in a single PHP application with over 6,200 GitHub stars and 500,000+ Docker pulls, offering a unified ITSM platform that replaces ServiceNow, Freshservice, and ManageEngine without per-agent pricing. The ITIL-aligned service desk handles incidents, problems, changes, and service requests with configurable SLA management, approval workflows, satisfaction surveys, and business rules that automate ticket routing, escalation, and categorization. Native dynamic inventory through the GLPI Agent discovers Windows, Linux, and macOS endpoints with deep hardware profiling, while network discovery scans switches, printers, and infrastructure devices automatically. Software and license management tracks per-user and per-core license allocations with compliance reporting, expiration alerts, and financial cost tracking across the asset lifecycle from purchase through depreciation to disposal. Data center infrastructure management provides rack visualization with U-level positioning, PDU tracking, and connection mapping. The integrated forms editor builds custom request portals for end-users, while the self-service portal lets users submit tickets, browse the service catalog, and reserve assets. Webhooks trigger external HTTP calls on events, and the High-Level REST API v2 exposes every resource for automation. A plugin marketplace offers 90+ extensions for monitoring integration, advanced reporting, and authentication. Deploy via Docker with the glpi/glpi image alongside MySQL. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPLv3 licensed.

Small MSPs waste thousands of dollars annually on overlapping subscriptions for documentation, ticketing, and billing tools that don't talk to each other. ITFlow replaces that fragmented stack with a unified platform where client contacts, locations, vendors, computer assets, software licenses, domains, SSL certificates, passwords, and documents all live under one roof. The AES-encrypted password vault stores credentials with organized access controls, and domain plus SSL certificate tracking generates automated renewal alerts before expiration disrupts client services. Ticketing supports creation, prioritization, assignment, and SLA tracking, with a client portal where customers submit tickets, view invoices, approve quotes, and access their own documentation independently. The accounting module covers the full lifecycle: quotes, recurring billing, expense tracking, Stripe payment processing, and financial dashboards showing revenue and outstanding balances at a glance. AI integration through Ollama, LocalAI, or ChatGPT accelerates documentation writing and ticket responses directly within the interface. The modular architecture lets you enable only what you need, sidestepping the bloat of enterprise PSA platforms designed for organizations ten times your size. With stable releases since 2025 and zero per-user licensing, ITFlow removes the escalating costs that make commercial PSA tools unsustainable for growing teams. The PHP application deploys with MariaDB and Nginx, ready for production in minutes.

Terminals, remote desktops, and file browsers for every server you run: Nexterm opens them over SSH, VNC, RDP, Telnet, or SFTP from a self-hosted web page. Servers live in folders with tags and custom icons. Connections open as tabs or split views, keep running across browsers and devices, and can hibernate and resume later. The file manager handles SFTP and FTP: drag files in, upload whole folders, search, and edit in place with syntax highlighting. Live metrics track CPU, memory, disk, network, and processes for each host. Snippets store the commands you retype most. Scripts run whole maintenance jobs. Git repositories added as sources bring ready-made ones filtered by operating system. Organizations share servers through role-based permissions, and every action is logged. Record full terminal sessions for audits and training, or send a shared-session link so a colleague can join, read-only or writable. Authentication covers local accounts with TOTP and passkeys, OIDC providers such as Keycloak, Authentik, and Microsoft Entra ID, and LDAP or Active Directory. Saved passwords, SSH keys, and passphrases stay encrypted at rest. A Proxmox integration lists LXC containers and QEMU virtual machines and can start or stop them. An opt-in AI assistant drafts shell commands from plain-language requests. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Termix delivers a unified, self-hosted infrastructure control center that consolidates SSH terminals, remote desktop streaming, and fleet automation into an intuitive browser workspace that replaces proprietary tools like Termius. Administrators connect to Linux servers and desktop environments using embedded RDP, VNC, and Telnet protocols powered by Apache Guacamole without requiring local client installations. The multi-panel terminal interface supports four-way split screens, allowing operators to broadcast keystrokes simultaneously across multiple production hosts or execute saved reusable script snippets with dynamic parameters. Real-time multiplayer session sharing lets engineers invite teammates via secure, time-limited links with configurable read-only or collaborative write permissions for troubleshooting incidents. Advanced networking layers handle SSH jump hosts, SOCKS5 proxy chains, Warpgate relays, and port knocking sequences to access segmented private networks securely. Integrated SFTP file managers provide drag-and-drop file transfers with editable path bars, inline text editing, and folder synchronization across remote machines. Background telemetry monitors CPU loads, memory utilization, disk IOPS, and container statuses, while built-in session recording captures complete terminal sessions for compliance auditing. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Every server, embedded board, and edge gateway you manage becomes reachable through one SSH address in ShellHub, even when it sits behind NAT with no public IP and no open inbound port. A small agent on each device dials out to your server, so a box on a customer LAN or a cellular link needs nothing beyond outbound web access. Connect with the stock ssh client by typing [email protected]@server, or open a terminal in the browser, and scp, sftp, rsync, and port forwarding work unchanged. SSH identities tie every key to a named team member, so removing someone ends their access on every device at once. Default-deny access policies grant or block members, roles, users, or API keys by device tag, Linux login, and source address, and can require a fresh browser confirmation before a session opens. Provisioning keys enroll whole fleets through automatic, manual, webhook, or allowlist acceptance, with usage limits, expiry dates, and tags. The Sessions page records who connected to which device, as which login, and from where, and browser terminals can be recorded and replayed. A Docker connector turns containers into devices that policies can grant one by one. Four member roles shape what each person can change, and the HTTP API, API keys, and an MCP server let scripts and AI assistants list devices and review sessions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Monitoring everything from network switches to Kubernetes clusters since 2001 with over 6,200 GitHub stars and deployments exceeding 100,000 devices per installation, Zabbix has established itself as one of the most mature and feature-rich open-source monitoring platforms available, trusted by organizations including Dell, Salesforce, ICANN, and T-Mobile. The platform collects metrics from virtually any source using Zabbix Agent written in C, Zabbix Agent 2 written in Go with native plugin support, SNMP v1/v2c/v3 polling and trapping, IPMI for hardware health, JMX for Java applications, SSH and Telnet checks, HTTP/HTTPS polling, and ODBC database queries. Version 7.0 LTS introduced synthetic browser monitoring that executes user-defined JavaScript via WebDriver to simulate multi-step user interactions on websites, proxy load balancing with automatic host redistribution across proxy groups for high availability, in-memory proxy data buffering delivering up to 100x performance improvement, native multi-factor authentication with TOTP and Duo support, and just-in-time user provisioning from SAML and LDAP. Low-level discovery automatically detects file systems, network interfaces, SNMP OIDs, VMware resources, and Kubernetes pods, creating monitoring items and triggers dynamically. The alerting engine correlates events with configurable escalation chains, sending notifications through Slack, Microsoft Teams, PagerDuty, Jira, email, and SMS with customizable message templates. Over 1,000 official templates provide instant monitoring for Linux, Windows, VMware, AWS, Azure, Docker, PostgreSQL, MySQL, Apache, Nginx, and hundreds more. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

MikroTik Manager is a web control plane for whole RouterOS fleets, built so that a bad VLAN change reverts itself instead of costing you a drive to the site. Before any risky edit, Change Guard saves a restore point on the device and arms a scheduler; if a fresh connection cannot reach the router afterwards, it rolls itself back. Lockout prediction simulates each change against live device state and refuses one that would cut management access, naming the exact port and VLAN at fault. Config Health audits for settings RouterOS accepts but silently ignores. Day to day, a live dashboard tracks availability, wireless clients, and alerts delivered by email, Slack, Discord, Telegram, or ntfy. Switch faceplates, per-port client views, VLAN copy wizards, bulk SSID deployment, RF health charts, rogue AP detection, and a guest Wi-Fi captive portal wizard cover the wired and wireless side. A rule builder handles firewall and NAT, topology maps come from LLDP, CDP, and MNDP, and a built-in NetFlow collector attributes traffic to clients and applications. Firmware rolls out in canary waves that halt on failure, and every configuration snapshot supports diffs and one-click rollback. OIDC single sign-on, TOTP two-factor, role-based access, and scoped API tokens protect the console, while sites group devices per customer network. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Keep every ticket tied to the servers, applications, and contracts it affects with iTop, an IT service management platform that joins a configuration management database (CMDB) to a helpdesk. Agents work user requests, incidents, problems, known errors, and changes through ITIL-style life cycles, and SLA targets for time to own and time to resolve move a ticket to an escalated status when a deadline passes. The CMDB models infrastructure, virtualization, end-user devices, software, and business applications, and its impact analysis graph shows what a failing server would take down. A service catalog of services and subcategories, backed by customer and provider contracts, feeds a user portal where employees and customers submit requests from a mosaic, tree, or list, follow progress, add comments and attachments, and reopen resolved tickets. Administrators bulk-load inventory from CSV, run consistency audits to catch data-quality problems, synchronize records from external sources, and connect other tools through REST web services. Sign-in works with local accounts, LDAP, or CAS, with optional two-factor authentication through authenticator apps, email codes, or recovery codes, and the console offers dark, high-contrast, and color-blind-friendly themes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Trusted by thousands of organizations worldwide with over 14,700 GitHub stars, Snipe-IT has been the gold standard in open-source IT asset management since 2013. Built on Laravel 12 with PHP 8.2+, it provides a comprehensive web-based platform for tracking every physical and digital asset in your organization — from laptops and servers to software licenses, accessories, consumables, and components. The check-in/check-out system assigns assets to users with full audit trails, digital signature acceptance, and automated email notifications for checkouts, approaching deadlines, expiring warranties, and low inventory. License management handles multi-seat software with seat-by-seat tracking, compliance monitoring, and expiration alerts. Custom fields let you capture organization-specific metadata, while the advanced search engine supports logical operators including and/or conditions, exact matching with is:value, fuzzy exclusions with not:value, and null checks. SCIM 2.0 integration synchronizes users, groups, locations, companies, and managers from identity providers like Azure Entra ID and Okta. Enterprise authentication supports LDAP, Active Directory, Google Secure LDAP, and SAML 2.0 single sign-on. The reporting dashboard generates custom asset reports with saved templates, depreciation schedules, and audit logs. QR code labels enable instant mobile asset lookup via barcode scanners. The full-featured JSON REST API powers custom integrations, with community-built SDKs, MCP servers, and third-party mobile apps including SnipeMate and Snipe-Scan. Deploy via Docker Compose with MariaDB 11 in minutes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With nearly 14,000 GitHub stars and over 200 releases, Semaphore UI has established itself as the lightweight yet powerful alternative to enterprise automation platforms like Ansible AWX and Jenkins. Unlike AWX's heavyweight Kubernetes-dependent architecture, Semaphore ships as a single Go binary with zero external runtime dependencies — install it, run setup, and you have a production-ready automation server in minutes. The platform natively orchestrates Ansible playbooks, Terraform and OpenTofu infrastructure code, Terragrunt configurations, PowerShell scripts, Bash commands, and Python automation, all from a clean Vue.js web interface that displays task history, execution logs, and scheduling status at a glance. Semaphore supports concurrent task execution across multiple servers using distributed project runners, enabling horizontal scaling of automation workloads without complex clustering. The built-in inventory management system handles both static and dynamic inventory sources, while four-level RBAC (Owner, Manager, Task Runner, Guest) provides granular access control for team environments. Notifications flow to Slack, Microsoft Teams, Telegram, email, Rocket.Chat, and Gotify, keeping operators informed of failed tasks and deployment status. Integration with HashiCorp Vault secures sensitive credentials, and the comprehensive REST API with built-in Swagger documentation enables programmatic automation. Deploy via Docker Compose, Helm chart for Kubernetes, or native packages for Debian, Ubuntu, and RHEL-based distributions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

AWX transforms Ansible from a command-line tool into a centralized automation hub with a web UI, REST API, and distributed task engine for managing playbooks, inventories, and credentials at enterprise scale. The React-based dashboard provides real-time visibility into job status, inventory health, and execution history while Django REST Framework powers programmatic control over every automation resource. Job templates combine Ansible playbooks, inventories, and credentials into reusable units that chain together in workflow templates using directed acyclic graph orchestration with conditional branching on success, failure, or always-run logic and configurable convergence gates. The RBAC system built on django-ansible-base provides granular permission control over organizations, teams, projects, inventories, and credentials at object-level granularity. Dynamic inventory sources pull host data from AWS EC2, Google Cloud, Microsoft Azure, VMware vCenter, and Red Hat Satellite, while credential management securely stores SSH keys, cloud tokens, and vault passwords with HashiCorp Vault and CyberArk integration for external secret retrieval. Notifications deliver alerts via Slack, email, PagerDuty, Mattermost, IRC, and webhooks, while activity streams log every action for compliance auditing. The Receptor mesh network distributes job execution across isolated container-based execution environments with capacity-aware scheduling and hop-node routing for network-segmented infrastructures. Upstream of Red Hat Ansible Automation Platform. Deploys via Docker Compose with PostgreSQL and Redis or via the AWX Operator on Kubernetes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Trusted by millions of engineers and deployed on over 80,000 GitHub stars worth of community confidence, Netdata delivers true real-time monitoring at per-second granularity — 10-60x faster than Prometheus, Datadog, or any conventional monitoring stack that averages away the transient anomalies lasting 2-10 seconds where most production incidents originate. A single installation command deploys the agent with zero configuration, automatically discovering every running process, container, systemd service, network connection, disk, and application on the host within seconds. Unsupervised machine learning trains multiple models per metric directly at the edge, detecting anomalies without thresholds, baselines, or manual tuning. The distributed Parent-Child architecture scales horizontally from a single Raspberry Pi to fleets exceeding 100,000 nodes while maintaining sub-2-second visualization latency and storing metrics at approximately 0.5 bytes per sample through tiered compression. Native network monitoring provides live topology maps, NetFlow and sFlow analytics, SNMP device polling across 200+ profiles, and trap handling — capabilities that typically require a separate NPM product. Hundreds of pre-configured alerts cover systems and applications out of the box, with AI-powered root cause analysis surfacing correlated metrics through natural language via MCP-compatible AI assistants. The agent supports Linux, macOS, FreeBSD, Kubernetes, and Docker with eBPF-based kernel observability requiring no application instrumentation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL v3+ licensed.