Every server, embedded board, and edge gateway you manage becomes reachable through one SSH address in ShellHub, even when it sits behind NAT with no public IP and no open inbound port. A small agent on each device dials out to your server, so a box on a customer LAN or a cellular link needs nothing beyond outbound web access. Connect with the stock ssh client by typing [email protected]@server, or open a terminal in the browser, and scp, sftp, rsync, and port forwarding work unchanged. SSH identities tie every key to a named team member, so removing someone ends their access on every device at once. Default-deny access policies grant or block members, roles, users, or API keys by device tag, Linux login, and source address, and can require a fresh browser confirmation before a session opens. Provisioning keys enroll whole fleets through automatic, manual, webhook, or allowlist acceptance, with usage limits, expiry dates, and tags. The Sessions page records who connected to which device, as which login, and from where, and browser terminals can be recorded and replayed. A Docker connector turns containers into devices that policies can grant one by one. Four member roles shape what each person can change, and the HTTP API, API keys, and an MCP server let scripts and AI assistants list devices and review sessions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Every Terraform change becomes a pull request with Atlantis, which runs the plan on your server, posts the output for review, and applies only the exact change reviewers approved. Open a pull request that touches Terraform code and Atlantis automatically runs terraform plan, posting the full output as a comment and a commit status your reviewers can inspect line by line. When the change looks right, a teammate comments atlantis apply and Atlantis executes the exact plan that was reviewed, then reports the result back on the same pull request. Each directory and workspace is locked while a pull request is open, preventing two changes from applying out of order, and locks can be inspected or discarded from the web interface. Apply requirements let you demand an approved review or a mergeable branch before anything runs, and optional policy checks evaluate plans against your rules before they can proceed. Repositories describe their projects, workspaces, and custom workflows in an atlantis.yaml file, including pinned Terraform versions, execution order groups, and parallel planning or applying across projects. Because Atlantis runs inside your infrastructure, cloud credentials never leave your network, and every plan, approval, and apply is preserved on the pull request as an audit trail. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Used by over 80% of Fortune 100 companies including LinkedIn, Netflix, Uber, and Goldman Sachs, Apache Kafka processes trillions of messages per day as the world's most widely deployed distributed event streaming platform. Since version 4.0 released in March 2025, Kafka operates exclusively with KRaft consensus, replacing Apache ZooKeeper entirely with an internal Raft-based metadata quorum managed by controller nodes, reducing operational complexity and eliminating external coordination dependencies. Topics are organized as append-only partitioned commit logs with configurable replication factors across brokers, delivering network-limited throughput with end-to-end latencies as low as 2 milliseconds. Kafka Streams provides a client library for building stateful stream processing applications with exactly-once semantics, windowed aggregations, joins across streams and tables, and interactive queries against local state stores. Kafka Connect integrates with hundreds of systems including PostgreSQL, MySQL, Elasticsearch, Amazon S3, MongoDB, HDFS, and JMS through a standardized connector framework with distributed worker mode and automatic offset management. Share Groups introduced in version 4.2 deliver queue-style consumption semantics alongside traditional consumer groups, enabling Kafka to serve both pub-sub and point-to-point messaging patterns natively. The Schema Registry enforces Avro, Protobuf, and JSON Schema compatibility rules across producers and consumers, preventing schema evolution from breaking downstream applications. Tiered Storage offloads older log segments to object storage like S3 while maintaining transparent consumer access, dramatically reducing local broker storage costs for long-retention topics. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Mail-in-a-Box turns a single Ubuntu server into a fully functional email system with one setup command, installing and configuring Postfix for SMTP, Dovecot for IMAP, Roundcube for webmail, and Z-Push for Exchange ActiveSync push notifications in an automated sequence that would take days to replicate manually. The DNS server auto-configures the full suite of email authentication records: SPF, DKIM, DMARC, DNSSEC with DANE TLSA, MTA-STS, and SSHFP. Getting all of these right is what separates email that lands in inboxes from email that lands in spam, and most manual installations never achieve the complete set. Nextcloud integration adds CardDAV contact sync and CalDAV calendar sharing across devices. Let's Encrypt certificates provision and renew automatically for every hosted domain. The web control panel manages users, aliases, custom DNS records, and automated backups, protected by TOTP two-factor authentication. Daily health checks verify that services run correctly, ports remain open, TLS certificates stay valid, and DNS records resolve properly, alerting you before delivery problems develop. Multiple domains and users operate from one installation with internationalized domain name support. Built-in HTTPS static site hosting uses the TLS infrastructure already in place. Runs on a dedicated RepoCloud VPS with guaranteed resources, root SSH, and browser serial console for complete email sovereignty. CC0 public domain licensed.

Aegra runs your LangGraph agents on your own infrastructure with the same SDK and APIs you would use on the managed platform, so moving in does not mean rewriting your agents. You deploy an agent once and clients connect through Agent Chat UI, LangGraph Studio, or CopilotKit, while threads, runs, and checkpoints persist between sessions instead of vanishing when a process restarts. Streaming answers arrive token by token over server-sent events, and if a connection drops, the stream reconnects and replays missed events rather than losing the run. Human-in-the-loop gates pause an agent at the step you choose, wait for a person to approve or edit, and then resume from exactly that state. Scheduled cron jobs trigger runs on standard or seconds-level expressions with timezone support, which turns agents into recurring workers for reports, checks, and follow-ups. When traffic grows, Redis-backed workers process runs with lease-based crash recovery, so a dead worker's job is picked up instead of disappearing. Authentication handlers plug in JWT, OAuth, or Firebase, custom endpoints sit beside the agent API, and traces fan out to the observability backend you already run. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Monitor watches your servers the way a status page should: second by second, from one small binary you run yourself. A lightweight Linux agent on each machine reports CPU, memory, disks, network throughput, connections, and processes to your hub over a persistent connection, and the hub pushes a fresh snapshot to your browser every two seconds. History is kept for charting, so node pages show how load, traffic, and latency behaved over days. Ping tasks run from the hub's side too: define targets once and every agent measures latency to them on its own interval, drawing the curves next to the machine metrics. The public face is a status page you can reskin without touching the server: themes install from the panel, run as static pages against a small public API, and anonymous visitors see only the nodes you marked public, with addresses and hostnames stripped out. Node management stays practical: registration windows hand out tokens safely, installing an agent is one command, and replacing a token disconnects the old connection immediately. When a node goes offline, crosses its traffic allowance, approaches expiry, or someone signs in, alerts go out through Telegram or any webhook. The hub listens only on localhost behind your HTTPS proxy, signs in by password or GitHub OAuth allowlist, and lists revocable sessions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Neon reimagines PostgreSQL with a serverless architecture that decouples storage from compute, enabling instant copy-on-write database branching, autoscaling under load, and scale-to-zero when idle with sub-second cold starts. The lakebase architecture distributes durability across three layers: stateless compute nodes running unmodified PostgreSQL, safekeepers providing Paxos-based WAL quorum replication, and a pageserver that materializes pages on demand while offloading immutable history to S3-compatible object storage via MinIO or AWS S3. Copy-on-write branching creates full database clones as metadata operations without duplicating data, enabling developers to spin up isolated test environments, run parallel CI/CD pipelines, or recover from data loss through point-in-time restore across the configurable history window. Autoscaling dynamically adjusts CPU and memory based on live traffic without manual capacity planning, while scale-to-zero ensures costs drop to storage-only during idle periods. Neon maintains 100% PostgreSQL compatibility with broad extension support including PostGIS, pg_cron, pgvector, pg_stat_statements, and hundreds more, so existing applications connect with standard PostgreSQL drivers and ORMs unchanged. The API-first control plane enables programmatic provisioning, branch management, and multi-tenant fleet operations for platform builders and AI agent integrations. Acquired by Databricks in May 2025 and backed by over 22,800 GitHub stars. Deploys via Docker Compose with pageserver, safekeepers, storage broker, and compute nodes backed by MinIO object storage. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Pulse monitors your entire heterogeneous infrastructure from one screen: Proxmox VE, Proxmox Backup Server, Proxmox Mail Gateway, Docker, Podman, Docker Swarm, Kubernetes, TrueNAS SCALE/CORE, VMware vSphere, and standalone Linux/Windows/macOS machines. The Go binary embeds a SolidJS/TypeScript frontend, delivering WebSocket-driven dashboards with sub-second metric updates on port 7655. A unified agent auto-detects Docker, Podman, Kubernetes, and Proxmox on each host without manual configuration and self-updates silently, while Proxmox nodes need only API credentials with zero agent installation. Smart alerts use adaptive hysteresis-based thresholds to prevent notification floods, pushing to Discord, Slack, Telegram, Teams, email, ntfy.sh, Gotify, and generic webhooks with per-resource overrides. The standout feature is Pulse Patrol: scheduled AI health checks running every ten minutes to seven days using OpenAI, Anthropic, Gemini, or local Ollama models. Patrol catches silent backup failures, capacity creep, restart loops, unhealthy containers, and clock drift that dashboards miss when nobody is watching. Platform-specific views render Proxmox nodes, Ceph clusters, Docker Compose projects, Kubernetes workloads, TrueNAS pools, and vSphere VMs in familiar layouts. OIDC, SSO, and SAML authentication with credential encryption at rest secures access. 6,500+ stars and 441 releases since February 2025. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Consistently ranked the most loved and most wanted database in developer surveys, PostgreSQL powers mission-critical workloads at Apple, Instagram, Spotify, and the U.S. Federal Aviation Administration with an architecture refined over nearly four decades since its origins at UC Berkeley. Its native JSONB type stores JSON in an indexed binary format with GIN and GiST index support, enabling document-store capabilities that eliminate the need for a separate NoSQL database in many architectures. The extension ecosystem exceeds 1,000 add-ons: PostGIS provides ISO-compliant geospatial queries, pgvector enables AI embedding similarity search, TimescaleDB adds time-series hypertable compression, and Citus distributes tables across nodes for horizontal scaling. PostgreSQL supports declarative partitioning by range, list, or hash, parallel query execution across multiple CPU cores, and four transaction isolation levels including full Serializable. Streaming replication provides physical standby servers with synchronous or asynchronous modes, while logical replication enables selective table-level change data capture through the Write-Ahead Log. Stored procedures run in PL/pgSQL, PL/Python, PL/Perl, and PL/V8 JavaScript, and advanced indexing includes B-tree, GIN, GiST, SP-GiST, BRIN, and hash types. Full-text search is built in with tsvector and tsquery, and row-level security policies enforce fine-grained access control. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. PostgreSQL License (MIT-like permissive) licensed.

Adopted by over 3,400 companies and backed by 34,000 GitHub stars, Backstage is the open-source developer portal framework created by Spotify and now hosted by the Cloud Native Computing Foundation. The centralized Software Catalog registers every service, library, data pipeline, website, and ML model in your organization using YAML metadata files stored alongside code in GitHub, GitHub Enterprise, or GitLab, tracking ownership, lifecycle status, and dependency relationships across your entire ecosystem. Software Templates provide self-service infrastructure provisioning where developers fill out a form and Backstage automatically scaffolds new repositories, CI/CD pipelines, and cloud resources following your organization's standardized best practices. TechDocs renders Markdown documentation directly alongside the services it describes using a docs-like-code approach powered by MkDocs, with the TechDocs Addon Framework for extending the reading experience. The Search Platform indexes content across the catalog, TechDocs, Confluence, and Stack Overflow through configurable search backends. Kubernetes monitoring built specifically for service owners rather than cluster admins displays pod health, logs, and deployment status across any cloud provider or managed Kubernetes service. The plugin ecosystem includes over 230 open-source integrations covering CI/CD systems like GitHub Actions and GitLab Pipelines, monitoring platforms like Datadog and Grafana, cloud providers including AWS and Azure, plus specialized plugins for security scanning, cost management, API documentation, PagerDuty incident management, and Lighthouse website auditing. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

ToolHive is an open-source MCP server management platform that lets you run, secure, and orchestrate Model Context Protocol servers in isolated containers, giving AI agents structured access to tools like GitHub, databases, and cloud services without exposing host credentials or network. Every server launches inside its own sandboxed container with a minimal permission file, network access filtering, and encrypted secrets management, preventing misbehaving connectors from reaching beyond their defined scope. The built-in registry provides a catalog of vetted servers you can install with one command, while custom images and package-manager references let you onboard proprietary connectors without writing Dockerfiles. Platform teams deploy the Kubernetes operator to declare MCP servers as cluster resources using Custom Resource Definitions, with automated lifecycle management and multi-namespace isolation. The Virtual MCP Server gateway aggregates multiple backends behind a single endpoint, centralizing OIDC authentication, tool filtering, and composite cross-server workflows so clients connect once instead of juggling separate URLs. An MCP Optimizer analyzes tool schemas via semantic search and surfaces only relevant tools per request, cutting token consumption by up to 85%. OpenTelemetry traces and Prometheus metrics deliver full visibility into tool execution, latency, and request audit trails across every managed server. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Trusted by thousands of organizations processing billions of time series data points and backed by 17,000+ GitHub stars, VictoriaMetrics delivers a monitoring and time series database that outperforms Prometheus by 16x on query speed while consuming 2.5x less disk space through its optimized compression and storage engine. The architecture supports both single-node deployments handling 10M+ active time series and a horizontally scalable cluster version with vminsert, vmstorage, and vmselect components providing multi-tenancy, replication, and independent namespace isolation. Data ingestion accepts both push protocols including InfluxDB line protocol, Graphite plaintext, OpenTSDB HTTP, CSV, and OpenTelemetry OTLP alongside pull-based Prometheus scraping and remote write, enabling drop-in replacement of existing monitoring stacks without reconfiguring exporters. MetricsQL extends standard PromQL with additional functions, subqueries, and implicit time range alignment while maintaining full backward compatibility with existing Prometheus alerts and Grafana dashboards. The vmalert component processes recording and alerting rules with Alertmanager integration, while vmbackup and vmrestore enable point-in-time snapshots to S3, GCS, and Azure Blob Storage. Stream aggregation operates as a StatsD alternative for pre-aggregating high-cardinality metrics before storage. NFS-compatible storage backends including Amazon EFS and Google Filestore allow shared persistent volumes across cluster nodes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

VyManager puts every VyOS router you run, across every site, into one web control plane with live dashboards and per-site permissions. Organize instances into logical sites, from the datacenter core to the smallest branch office, and add or remove routers without touching a command line. Live dashboards stream interface counters, system information, network graphs, and WireGuard peer status, so a saturated link announces itself before your users do. Configuration adapts to each router's VyOS version, with 1.4, 1.5, and rolling releases supported side by side during the longest upgrade cycle. Access is granted per site with OWNER, ADMIN, and VIEWER roles, API keys authenticate the machines, and SSH credentials stay encrypted at rest. A setup wizard walks a fresh deployment to its first managed router, and light, dark, and custom themes keep the night shift comfortable. For automation, AI assistants can be connected through the companion MCP integration, and the whole stack arrives as Docker Compose services you can redeploy in minutes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Keep every VPS, home-lab box, NAS, and router you run on one self-hosted dashboard, with a small agent on each machine reporting whether it is up and how hard it is working. Nezha tracks CPU, memory, swap, disk, load, traffic, process counts, and TCP and UDP connections on Linux, Windows, macOS, OpenWRT, and Synology machines, plus GPU and temperature where supported. Servers sort into groups and appear as cards, a list, or a world map, with live charts and, when the optional time-series database is on, 1, 7, and 30 days of history. HTTP GET, ICMP Ping, and TCPing monitors run from the servers you choose, chart latency and packet loss, and warn about HTTPS certificate changes and upcoming expiry. Alert rules watch offline servers, resource use, bandwidth, and cycle traffic limits, then message Telegram, Slack, Matrix, Feishu, DingTalk, or any webhook. A browser terminal and file manager handle quick fixes, while scheduled or alert-triggered tasks run backups, restarts, and scripts across many servers. DDNS updates Cloudflare, Tencent Cloud, or Hurricane Electric records when an agent's IP changes, and NAT traversal publishes a home router or NAS page on your own domain. Admin and user roles, scoped API tokens, and an optional MCP endpoint let people and AI tools list servers and run commands within their permissions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Dockhand is a Docker management platforms, offering a modern alternative to Portainer with free OIDC SSO and vulnerability scanning that competitors gate behind paid tiers. Real-time container management provides start, stop, restart, and remove operations with live resource monitoring across CPU, memory, and network usage on a dashboard with real-time metrics. The visual Docker Compose editor enables stack creation and modification with syntax highlighting, while Git integration deploys stacks directly from repositories with webhooks and auto-sync for GitOps workflows. Vulnerability scanning powered by Grype and Trivy analyzes container images against CVE databases, with configurable auto-update scheduling that can trigger updates based on vulnerability severity criteria. The Hawser Go agent enables management of remote Docker hosts in Standard mode for LAN environments or Edge mode using outbound WebSocket connections for hosts behind NAT, firewalls, or dynamic IPs without exposing inbound ports. Interactive terminal sessions provide shell access into running containers, while the file browser enables uploading, downloading, and editing files directly within containers. Image management includes registry browsing, pull operations, and layer inspection alongside network and volume administration. The security-focused architecture builds its own OS layer from scratch using Wolfi packages via apko with every package explicitly declared. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSL 1.1 licensed, converting to Apache 2.0 in 2029.

Routerly is the one front door for every AI model your apps use: point your OpenAI or Anthropic client at it, and it chooses the right model for each request, enforces your budget, and keeps the receipts. Nothing in your code changes except the base URL, and from that moment streaming chat completions and messages flow to OpenAI, Anthropic, Gemini, Mistral, Cohere, xAI or your own Ollama models behind a single token. Nine routing policies score every candidate in parallel: cheapest, fastest, healthiest, most capable, biggest context, least rate-limited, fairest, most budget left, and one that asks a small model to judge which model fits the task. When the winner errors or times out, the next candidate takes over automatically, and the recorded routing trace shows exactly why each model won or lost. Guardrails can block or log content that breaks your rules, and phone numbers, card numbers, SSNs, IBANs and emails can be scrubbed out before anything reaches a provider. Every call is logged with tokens, USD cost and latency, and hard limits per model, project and token reject overspending requests before a provider can charge for them. Projects keep separate tokens, model lists and budgets for each team or tool, role-based permissions decide who may change what, and alerts land in Slack, email, webhooks or PagerDuty when budgets or providers misbehave. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Every service you self-host wants its own account database, and Kanidm exists so they can all share one: one identity server where people sign in with passkeys and every application trusts the same login. Users register YubiKeys, Touch ID, Windows Hello, or TPM backed authenticators, and attested passkey policies let administrators restrict sign-in to specific authenticator models in high security environments. Applications connect as OAuth2 or OpenID Connect clients with authorization code, client credentials, PKCE, token exchange, and revocation supported, so your wiki, Git forge, and file sync all delegate sign-in instead of storing passwords. The application portal gives each person one page of tiles for every service they may open, and role based access control decides which groups see which applications and scopes. Older systems that only speak LDAP bind to the read-only LDAPS gateway, while Wi-Fi and VPN gear authenticates through the built-in RADIUS server with MS-CHAPv2 and EAP-TLS. Linux machines join through the Unix client for PAM and NSS authentication, cached offline credentials protected by the machine TPM, and SSH keys distributed from the server to every host. A second server replicates the whole database with strong eventual consistency, every node accepting writes without elections or quorums, so a failed machine never locks your users out of sign-in. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MPL-2.0 licensed.

Your racks of hypervisor hosts become one private cloud with Apache CloudStack, the open-source IaaS platform that deploys and manages large networks of virtual machines behind a single web interface and API. One cloud can mix hypervisors side by side, running KVM, XenServer or XCP-ng, and VMware vSphere clusters under the same control plane, each organized into regions, zones, pods, and clusters that mirror your physical datacenters and racks. Administrators provision instances from templates and ISO images, take volume and VM snapshots on schedules, and migrate running instances between hosts in a cluster without downtime. Built-in networking spans isolated and shared networks, VPCs with tiered virtual routers, load balancers with SSL offloading, VPNs, and firewall rules, all exposed both to admins and to end users through separate, customizable interfaces. Multi-tenancy is native: domains, accounts, usage metering, and resource quotas let providers bill departments or customers for what they consume. The 4.22 LTS release strengthens backup and disaster recovery, adds a CSI driver for CloudStack Kubernetes Service, and streamlines VMware-to-KVM migrations for teams consolidating onto open virtualization. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.