Security-conscious IT departments pick Passbolt for its cryptography: every user holds an OpenPGP key pair, and shared credentials are encrypted individually to each recipient's public key - real end-to-end encryption, not a vault password handed around. All crypto runs client-side in the mandatory browser extension (distributed and signed through the Chrome and Firefox stores, deliberately separating the crypto code from the server that stores ciphertext); private keys and passphrases never touch your instance, and the server admin cannot read a single secret. Authentication uses the challenge-based GpgAuth protocol, secrets are digitally signed to verify sender integrity, and metadata encryption extends protection to resource names and URLs. Day to day it behaves like a polished commercial manager: auto-fill and auto-save in forms, strong password generation, anti-phishing protection, TOTP storage, folder hierarchies shared per-user or per-group with fine-grained permissions and instant cryptographic revocation. Native iOS, Android, and desktop apps ship alongside a JSON API, CLI, and SDKs for CI/CD secret retrieval and rotation. The PHP server runs on MariaDB and is AGPL-licensed open source - including the paid tiers' codebase - with published security audits.

With 6,800 GitHub stars and over a decade of development since its 2014 release, ONLYOFFICE Docs delivers a self-hosted Microsoft Office replacement with pixel-perfect OOXML rendering and real-time collaborative editing supporting both Fast (character-by-character) and Strict (manual save) co-authoring modes. The suite encompasses five full-featured editors — Document Editor for DOCX/ODT/EPUB/HTML, Spreadsheet Editor with 500+ functions and pivot tables, Presentation Editor with animations and transitions, Form Creator for fillable PDF forms with field validation, and PDF Editor for annotation and conversion — all operating within a unified web interface. Format support spans 50+ types including DOCX, XLSX, PPTX, ODT, ODS, ODP, PDF, CSV, RTF, TXT, and Markdown with server-side conversion between any supported pair. The JavaScript plugin API enables extending editor functionality through a marketplace of ready-made plugins for ChatGPT integration, speech-to-text, OCR, Zotero citations, and Thesaurus. Ready-to-use connectors integrate with Nextcloud, ownCloud, Seafile, Moodle, Odoo, Confluence, SharePoint, Alfresco, Liferay, and Chamilo, while WOPI protocol compliance enables integration with any WOPI-compatible platform. JWT authentication secures all API communications between host applications and the document server. Deploy via Docker with a single command or DEB/RPM packages on Ubuntu, Debian, CentOS, or RHEL. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GNU AGPL v3 licensed.

What Doodle did before ads and paywalls took over: Rallly (three L's) lets you propose a few dates, share a link, and watch an availability grid fill in - no email threads, no forced accounts, no "$6.95/month to remove ads." The availability grid makes the winning slot obvious at a glance, comments on each poll keep the "I can do Tuesday if we start late" discussion attached to the decision instead of buried in chat, and email notifications fire as votes and comments arrive. When consensus lands, finalize the winning option and everyone gets notified. The stack is modern TypeScript - Next.js, tRPC, Prisma over PostgreSQL, Tailwind - with a clean, genuinely mobile-friendly UI, dark mode, and community translations in 10+ languages. Self-hosting means unlimited polls and unlimited participants with meeting data on your server rather than a scheduling SaaS. It pairs naturally with Cal.com: Rallly answers "which time works for everyone?", Cal.com handles "book a slot on my calendar." AGPL-licensed.

Encrypted, incremental, compressed backups on storage you already have - Amazon S3, Backblaze B2, Google Drive, Azure, OneDrive, Dropbox, MEGA, Storj, WebDAV, SFTP, FTP, SMB, or a plain local disk - is what the MIT-licensed Duplicati has quietly done for years. Its security model is Trust No One: every block is encrypted with AES-256 (or a local GPG instance) before leaving the machine, and the passphrase never travels, so the storage provider holds only ciphertext. The block-based storage engine gives the best of both backup worlds: after one initial full backup, only changed data blocks upload - modify a tiny part of a huge file and only that part transfers - yet every backup version restores like a full backup in a single operation, with no incremental chains to replay. Deduplication and compression keep remote storage growth slow even across years of versions. A web interface manages everything: the built-in scheduler keeps backups current automatically, flexible filters select folders, file types, or custom patterns, retention policies prune old versions, and an integrated updater flags new releases. On compatible object-lock backends, immutable (WORM) storage protects backup data from ransomware that reaches the credentials. Runs on Windows, macOS, and Linux, free even for commercial use.

Point Sourcebot at your GitHub, GitLab, Bitbucket, Azure DevOps, Gerrit, or Gitea repositories and get regex, symbol, and filtered search results in under a second across thousands of repos and branches. Backed by Y Combinator with production deployments at NVIDIA, Shutterstock, SeatGeek, Arista, and Red Hat, the Zoekt-powered engine deploys as a single Docker container with zero external data transmission. Ask Sourcebot connects reasoning models like Claude Opus to your entire codebase, enabling natural language questions that return structured answers grounded with inline citations and navigable code snippets, backed by automatic tool calls that search code, follow references, and read files across all indexed repositories. Ask connectors extend this to Jira, Slack, Linear, and Confluence via MCP, pulling external context alongside code for debugging and documentation. IDE-level code navigation provides goto definition and find all references across repository boundaries without local cloning. The built-in file explorer renders any indexed file with syntax highlighting, breadcrumb navigation, and git blame showing per-line commit attribution. An analytics dashboard tracks daily, weekly, and monthly search activity. Permission syncing from GitHub and GitLab enforces access control lists so users only see repositories they are authorized to access. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Other licensed.

With over 9,000 GitHub stars earned since Google killed its browser-based Timeline, Dawarich fills the gap with a fully self-hosted location history platform that keeps your movement data under your control. Built on Ruby on Rails 8.0 with PostgreSQL and the PostGIS spatial extension for geometry-based queries, Dawarich imports your entire Google Takeout location archive in minutes and begins rendering interactive maps immediately. The visualization engine supports five map layers — heatmaps, points, lines, Fog of War exploration tracking, and a 3D globe view — each powered by Leaflet and spatial SQL rather than browser-side computation. Native iOS and Android apps handle background GPS tracking with offline support, automatically uploading location points when connectivity returns, while third-party integrations support OwnTracks, GPSLogger, Overland, Home Assistant, Traccar, and PhoneTrack. The trip system lets you create route visualizations between any two dates, attach notes, replay travel paths with a timeline scrubber, and share trips publicly with phrase-protected links and per-section visibility controls. Immich and PhotoPrism integrations automatically overlay geotagged photos on your maps and trips, while AirTrail integration renders flight history as arcs. Statistics dashboards break down countries visited, cities explored, total distance traveled, and active days by year and month, with visit detection suggesting places you have frequented. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Backed by over 45,000 GitHub stars and described as the tool that replaces Notion, Evernote, and Anki in a single Docker container, SiYuan is the privacy-first knowledge management system where every paragraph, heading, and list item is a uniquely addressable content block. The block-level architecture enables bidirectional links, transclusion embeds, and SQL query blocks that dynamically aggregate content across your entire workspace, while the knowledge graph visualization maps relationship networks between documents and blocks. Built-in databases support table views with relation and rollup columns, filter composition, sorting, and template-based calculations for structured data management alongside freeform notes. The FSRS spaced repetition engine turns any content block into a flashcard with scientifically calibrated review scheduling, eliminating the need for separate memorization tools. AI integration connects to OpenAI-compatible APIs for writing assistance, translation, summarization, and Q&A chat, with semantic search using embeddings and reranking for intelligent content retrieval. The Bazaar community marketplace delivers plugins, themes, templates, and widgets through a managed extension system with TypeScript plugin APIs. End-to-end encrypted synchronization works across S3-compatible storage, WebDAV servers, or SiYuan's own cloud service, while Tesseract OCR extracts searchable text from images and the web clipper captures pages from Chrome, Edge, and Firefox. Export targets include Markdown with assets, PDF, Word, and HTML. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

High-resolution weather forecasts became a free commodity because of Open-Meteo - and this deployment puts the whole open-source engine on your own infrastructure. The public open-meteo.com service aggregates national weather models (NOAA GFS, DWD ICON, ECMWF, Meteo-France, and others) into one consistent JSON interface; self-hosting gives you that same API without rate limits, third-party dependency, or usage metering. The architecture is two cooperating services: the API server exposes forecast endpoints fully compatible with Open-Meteo query parameters - latitude, longitude, hourly and daily variables like temperature, precipitation, wind, and radiation - while a background sync worker downloads fresh weather model data on a configurable interval into a shared persistent volume at /app/data, so forecasts stay current and survive restarts without re-downloading. You control which weather models to mirror, which variables to store, how much historical depth to keep, and how often to refresh - meaning a lean deployment can sync only the model and region you actually query. Responses are plain HTTP/JSON, so integration with dashboards, Home Assistant-style automations, agricultural monitoring, IoT fleets, or any application takes minutes. For anyone making thousands of forecast calls a day, replacing a metered weather API with your own instance turns a recurring bill into a flat infrastructure cost.

Take the tool sales teams use to never forget a client detail and point it at the people who actually matter - friends, family, the colleague whose kid's name you keep blanking on: Monica is a personal CRM. It's a Laravel/PHP application over MySQL where each contact accumulates the texture of a real relationship: how you met, family members and pets, work changes, addresses, notes from conversations, activities done together, gift ideas and gifts given, even debts owed in multiple currencies. Two features set it apart from every contact app. Reminders with staying power: set per-contact intervals (weekly through yearly), get notified at 30 days, 7 days, and day-of, with automatic birthday reminders and CalDAV sync to your calendar. And a journal linked to contacts: write about dinner with friends, tag each person, and build a timeline that's part diary, part relationship log - plus a daily "how was your day" rating. Monica is deliberately manual and deliberately private: no social network features, no AI, no email scraping, no ads, no analytics - a quiet database of what you know about people you love, on your own server. Multiple vaults and users, labels, custom activity types, and document/photo uploads round it out. AGPL-licensed.

A polished public status page without Statuspage prices or a heavyweight observability suite: Kener is a status and uptime monitoring system built with SvelteKit and Node.js. It runs 11 monitor types - API, Ping, TCP, DNS, SSL certificate, SQL query, Heartbeat, gRPC, and GameDig game-server checks among them - each with configurable intervals and thresholds. Incident management covers the full lifecycle: structured timelines from investigation through resolution, acknowledgements, and subscriber-visible updates, plus maintenance windows with RRULE-based recurring schedules and automatic status transitions. Notifications reach email, Slack, Discord, and custom webhooks through trigger-based workflows with template-driven messaging. One instance can serve multiple branded status pages - per product, team, or region - with custom logos, colors, and CSS, localization into 21 languages, timezone-aware displays, and server-rendered pages that stay fast and SEO-friendly. Operations tooling includes role-based access for teams, API key management, a secrets vault, analytics integrations (Google Analytics, Plausible, Umami, and others), and a REST API with 17+ endpoints for automating incidents and monitors from CI/CD. MIT-licensed; Docker deployment with Redis, SQLite by default, PostgreSQL or MySQL for production.

Marimo is a reactive Python notebook that treats cells like spreadsheet formulas: change one cell or interact with a UI widget and every dependent cell automatically re-executes, eliminating the hidden state bugs that make traditional notebooks unreliable. Backed by over 22,000 GitHub stars, notebooks are stored as pure Python files with PEP 723 inline metadata, making them Git-diffable, importable as modules, executable as CLI scripts with parameterized arguments, and testable with PyTest. Built-in SQL cells query Polars, Pandas, PyArrow, DuckDB, SQLite, PostgreSQL, and MySQL databases, with results automatically flowing into the reactive dependency graph. The AI-native editor provides GitHub Copilot autocomplete, context-aware assistants that access live runtime variables, inline code edits powered by configurable models from OpenAI, Anthropic, or local Ollama instances, and a pair mode that lets external AI agents connect over WebSocket. Notebooks become read-only interactive web applications with marimo run, collaborative authoring environments with marimo edit, or embedded flows inside existing FastAPI applications through ASGI middleware. Gallery mode serves multiple notebooks from a single instance with an auto-generated index page. The Docker image ships with SQL support, token-based authentication, health check endpoints at /health and /api/status, and configurable WebSocket or SSE kernel transport for proxy compatibility. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

TriliumNext organizes notes in an infinitely deep tree where any single note can be cloned into multiple branches without duplication, building personal knowledge bases that mirror how ideas actually connect rather than forcing a single rigid folder hierarchy. Carrying forward the original Trilium project under active community stewardship with nearly 37,000 GitHub stars, the application is built on TypeScript with a CKEditor 5 WYSIWYG editor supporting rich text, tables, images, KaTeX math expressions, Mermaid diagrams, Excalidraw canvases, mind maps, spreadsheets with XLSX and CSV import/export, and code blocks with full syntax highlighting. A built-in JavaScript scripting engine runs on both frontend and backend, enabling custom widgets, automated workflows, scheduled tasks, and direct interaction with external REST services through a typed Script API. Full-text and fuzzy search with attribute-based queries locates any note instantly across databases tested at over 100,000 notes without performance degradation. The v0.104 release introduced importers for OneNote, Notion, Google Keep, Anytype, and Obsidian alongside 16 dedicated security fixes. Per-note AES encryption, OpenID Connect authentication, and TOTP two-factor protection safeguard sensitive content. The sync server keeps desktop clients, the progressive web app, and mobile devices in lockstep with zero third-party cloud dependency. Web Clipper captures content directly from browsers. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Over 400 technologies and thousands of smart devices from any manufacturer, unified under one roof: openHAB is the vendor-neutral home automation platform with a pluggable binding architecture. Each binding translates a device or service into openHAB's clean abstraction: Things expose Channels, Channels link to Items, and Items feed a rules engine that runs your home. That engine meets you at your skill level: Blockly gives non-programmers drag-and-drop visual logic, JS Scripting (GraalJS with the openhab-js library) is the modern text-based standard, the classic Rules DSL remains supported, and JSR223 opens the door to Python, Ruby, and Groovy. Time- and event-based triggers, scripts, notifications, and voice control compose into automations of any complexity, and users report decade-old rule sets still running rock solid. The Main UI handles configuration, semantic modeling, and now built-in charting - no external Grafana required. Built in Java on Apache Karaf's OSGi runtime and stewarded by the non-profit openHAB Foundation, it requires no cloud to function: everything runs locally, talking directly to your devices. Optional connectors bridge to Alexa, Google Assistant, and HomeKit, with iOS, Android, and web apps for control from anywhere.

Deployment decoupled from release: Unleash, the most popular open-source feature management platform on GitHub, is a Node.js server backed by PostgreSQL. Ship code dark, then control who sees it through activation strategies: gradual percentage rollouts, targeting by user ID, IP, hostname, or application name, custom constraints against your own context fields, and scheduled or time-limited releases. Strategies stack - a flag activates if any strategy matches - and strategy variants layer A/B versions on top of the on/off decision. Each flag carries per-environment configurations, so a feature can run at 100% in staging while canarying at 5% in production. Backend SDKs (Node.js, Java, Go, Python, Ruby, .NET, PHP, Rust, and more) fetch configuration and evaluate flags locally, so a flag check adds zero network latency to request paths; frontend SDKs for React, Vue, Svelte, iOS, Android, and Flutter evaluate through a proxy layer. Flag hygiene is built in: flags are typed (release, experiment, operational, kill-switch, permission) with expected lifetimes, and Unleash marks overdue flags as potentially stale and surfaces unknown flags your SDKs request but that don't exist. Self-hosting via Docker keeps flag data, targeting rules, and evaluation infrastructure entirely on your side.

Hi.Events is an alternative to Eventbrite, Tickettailor, and Dice.fm, eliminating per-ticket platform fees entirely when self-hosted. Event organizers create fully brandable event pages supporting paid, free, donation, and tiered ticket types with recurring and multi-date scheduling, sold-out waitlists that automatically release tickets when spots open, and product add-ons with category organization. Stripe Connect integration processes payments directly to the organizer's bank account with instant payouts, while offline payment methods support cash and invoice scenarios. Promo codes offer fixed or percentage discounts with usage limits, expiry dates, and promo-gated hidden tickets for VIP access. QR code check-in enables fast door scanning with multiple check-in lists, scan logs, and real-time attendance tracking across entry points. Custom checkout questions collect attendee information beyond standard fields, with advanced search, filtering, CSV and XLSX export, full and partial refunds, and bulk attendee messaging. The analytics dashboard tracks daily sales, revenue, tax breakdowns, product performance, and promo code usage with exportable reports, while affiliate tracking assigns custom codes to promoters with tracked sales data. Multi-user roles control organizer permissions, automatic invoicing generates receipts, and the REST API ships with interactive OpenAPI documentation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Every wiki page lives as a plain-text file in a standard Git repository, giving you full version history, branching, merging, and the freedom to edit with any text editor or IDE alongside the web interface. Originally built by GitHub's founders as the engine behind GitHub's own wiki feature, Gollum supports Markdown, AsciiDoc, reStructuredText, Org-mode, Textile, MediaWiki, Creole, and Pod markup formats with live preview rendering as you type. PlantUML and Mermaid diagrams render inline for architecture documentation, MathJax handles mathematical notation, and BibTeX integration via Pandoc provides academic citation management. YAML frontmatter controls per-page sidebars, headers, footers, and table of contents generation. CriticMarkup annotations enable editorial review workflows with tracked insertions, deletions, substitutions, and comments. Macros extend pages with dynamic content injection, file includes, and navigation helpers. The wiki maintains compatibility with GitHub and GitLab wiki repositories, so teams can clone existing platform wikis for local editing and offline access. The official Docker image at gollumwiki/gollum exposes port 4567 with volume-mounted repositories, requiring roughly 170 MB of container storage and minimal RAM. Authentication integrates via OmniAuth supporting GitHub, GitLab, Google, and other OAuth providers. Over 14,300 stars on GitHub since 2009. MIT licensed.

With over 28,600 GitHub stars and 450 contributors, Grafana Loki is the log aggregation system that takes the Prometheus approach to logging — indexing only metadata labels instead of full log content, making it dramatically cheaper and simpler to operate than traditional log management platforms. The label-based indexing strategy groups log streams using the same labels already applied to Prometheus metrics, enabling seamless switching between metrics and logs in Grafana dashboards without maintaining separate indexing infrastructure. Grafana Alloy, the telemetry collector replacing Promtail, scrapes and pushes logs with Prometheus-style service discovery, automatic Kubernetes Pod label extraction, and pipeline stages for parsing, filtering, and relabeling before ingestion. LogQL, the query language, combines label matchers for stream selection with regex line filters and aggregation functions, supporting rate calculations, pattern parsing, and metric generation from log data for alerting and dashboard panels. The storage architecture writes compressed log chunks and TSDB indexes to S3, GCS, Azure Blob Storage, or MinIO-compatible object stores, with configurable retention and compaction policies. Deployment modes scale from a single binary for development through monolithic high-availability mode with multiple replicas to full microservices decomposition with separate ingester, distributor, querier, query-frontend, compactor, and ruler components on Kubernetes via Helm charts. Multi-tenancy isolates data and query paths per tenant through header-based tenant ID assignment. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Authentication that lives inside your application rather than behind a redirect to an external identity provider - SuperTokens takes a fundamentally different architecture from Auth0 and AWS Cognito. Three tiers make that work - frontend SDKs (React, Angular, Vue, vanilla JS, React Native) render overridable login UI and manage tokens; backend SDKs (Node.js, Python, Go) expose auth endpoints on your own API domain; and SuperTokens Core, the piece you host here, is the stateless HTTP service handling core auth logic, password hashing, token signing, and database operations against PostgreSQL. The recipe system keeps features decoupled: use email/password, social login, passwordless (magic links, OTP), phone-password, multi-factor authentication (TOTP, WebAuthn), user roles, and microservice auth - individually or combined; you can even use SuperTokens purely for session management alongside another login provider. Sessions are where it shines: rotating refresh tokens with theft detection, automatic access-token refresh, CSRF protection, and secure cookie handling out of the box - the details that become vulnerabilities when hand-rolled. Verification happens locally in your backend via cached JWT signing keys, so the Core stays off the hot path. Self-hosted means no user limits, free forever, with all user data in your database. Apache-licensed.