With over 2,200 GitHub stars and a philosophy that your notes should be files you own rather than rows in a database, ZenNotes is the keyboard-first Markdown editor that runs as a self-hosted web app backed by a Go server accessible from any browser on your network. Every note is a plain .md file in a vault directory you mount, with zero proprietary lock-in. Modal editing with real Vim motions, leader-key flows, and a command palette keeps your hands on the keyboard through edit, split, and preview modes. The rendering engine handles KaTeX math, Mermaid diagrams, TikZ graphics, and JSXGraph plots directly from Markdown syntax alongside wiki links and callout blocks. A first-party MCP server ships in the box with one-click integration for Claude Desktop and Cursor, letting AI assistants read and write the same Markdown files on disk without sync layers or duplicate copies. The bundled zen CLI provides note creation, search, tagging, task toggling, and piped capture with JSON output for shell scripting. Board views render plain CSV files as Kanban columns. Daily notes, quick capture, archive, and trash round out the vault workflow. The Go backend serves the browser frontend on port 7878 with token-based authentication, configurable browse roots, TLS proxy support, and file permission hardening at 0600/0700 defaults. Deploy via the multi-arch Docker image for linux/amd64 and linux/arm64. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Memos, the lightweight open-source note service from the usememos project, packaged as a containerized deployment for multi-architecture Docker hosts (x86-64 and arm64): that is Usermemos. The model is frictionless capture: no folders or titles, just a chronological stream of Markdown notes with code blocks, task lists, tables, and file attachments, organized by #hashtags pulled automatically from the text. Per-memo visibility - private, protected for logged-in users, or public - lets a single instance serve as a personal journal, a shared team log, or a public microblog simultaneously. Multi-user support with authentication makes it workable for small teams, and full REST and gRPC APIs open capture and retrieval to CLIs, bots, and automation tools. The runtime is a single Go binary with a React frontend that idles around 50 MB of memory and stores content as plain Markdown in SQLite by default, with MySQL and PostgreSQL available for heavier deployments. Configuration happens through environment variables, access works over HTTP or HTTPS behind a reverse proxy, and there is no telemetry - notes stay on your server in a portable format.

Hosting a Minecraft survival world, a Terraria server, and a Palworld host no longer means juggling SSH sessions and screen windows, because MCSManager puts every instance behind one web panel. A built-in marketplace installs game servers from ready-made templates, filtered by operating system and tagged with the Java version each one needs, while any Docker Hub image, uploaded ZIP archive, or plain process can run as an instance with its own start command, stop command, and live terminal. Docker instances get memory, CPU, port mapping, and volume settings, and each instance can auto start, auto restart, and run scheduled tasks. For Minecraft servers, the plugin and mod manager (Beta) searches Modrinth and CurseForge, and the file manager handles maps, configs, and uploads. Administrators create user accounts and assign instances to them, so friends or paying customers only see their own servers, which suits small hosting businesses that sell game servers. Extra machines join as nodes and connect to the same panel, and the drag-and-drop dashboard can be rearranged to taste. The interface supports many languages. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Subscribe to a feed and Oksskolten fetches the complete text of every new article, cleans it, and files it as Markdown in a library you can read without leaving the app. About 500 cleanup patterns strip ads, navigation, and tracking, with no per-feed toggles or selectors to maintain. No feed on the site? Auto-discovery goes first, then RSS Bridge, then LLM-inferred CSS selectors, while FlareSolverr gets past bot protection. Every feed is checked on its own schedule, somewhere between every 15 minutes and every 4 hours. Inbox, Read Later, Liked, and Read views keep the queue tidy. Clip any URL as a standalone article. Likes and bookmarks feed an engagement score that shapes search ranking and recommendations. One click summarizes or translates an article through Anthropic, Gemini, OpenAI, Ollama, or vLLM, with Google Translate and DeepL as translation engines. Ask the chat questions about your archive, or point Claude Code or Codex at the built-in MCP server to use the same tools. Search forgives typos and covers every stored article. Login works with a password, a passkey, or GitHub. Pick from four layouts and fourteen color themes, import custom themes as JSON, rebind keyboard shortcuts, and keep reading offline as a progressive web app. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

LLDAP is a lightweight user directory that lets all your self-hosted apps share one set of accounts and passwords. It speaks just enough LDAP for Nextcloud, Jellyfin, Gitea, GitLab, Grafana, Home Assistant, Proxmox VE, Vaultwarden, and many more to authenticate users against a single source of truth, with ready-made example configurations for more than 80 services. Day-to-day administration happens in a web interface where you create users, set passwords, upload avatars, build groups, and add members from a dropdown. Regular users can sign in to edit their own profile, and once SMTP is configured they can request a password-reset link by email instead of pinging the admin. Custom attributes (text, numbers, dates, or JPEG photos) are defined on the user and group schema pages, which unlocks integrations that expect fields such as uidNumber or homeDirectory, including Linux logins through PAM. Three built-in groups keep privileges tidy: lldap_admin for full control, lldap_password_manager for password resets, and lldap_strict_readonly for read-only service accounts. Group membership is exposed through memberOf filters, LDAPS secures connections when you expose the port, and a GraphQL API plus a bootstrap script let you manage users, groups, and attributes declaratively from JSON files. Pair it with Authelia, Authentik, or Keycloak when you also want single sign-on and multi-factor prompts. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Marfa is a data layer you run yourself, where your notes, tasks, reading, and records live in one typed store that any app, script, or AI agent you allow can read and write. You decide what kinds of things you keep and how they connect, and the server checks every write against that structure, so a task, a book, and a person stay linked instead of scattered across five apps. Connectors pull in what already lives elsewhere, from GitHub repositories and issues, Todoist tasks, Readwise highlights, and RSS feeds, each writing under its own type with its own key. Keys are scoped, so the script that imports your reading list can never touch your tasks, and every change flows back out through a live event stream and full-text search. The marfa command line writes and reads from scripts and agents, the TypeScript SDK builds web apps on the same API, and the Swift SDK keeps an offline working copy on your devices that syncs its writes when your instance is reachable again. A folders command mirrors your notes as plain Markdown files on disk. Everything sits in one SQLite database and a folder of files on your server, with container deployment that streams backups to your own bucket. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Tracking over 50,000 fleet vehicles across production deployments, Fleetbase delivers a modular logistics operating system where each module—Fleet-Ops, Storefront, Pallet, and Ledger—works independently yet shares a unified data layer that eliminates middleware between ordering, dispatch, warehousing, and accounting. The Fleet-Ops core handles real-time driver tracking through a SocketCluster-based WebSocket event bus, interactive map-based dispatch with both directed and ad-hoc driver assignment, configurable order workflows with custom rules, automation triggers, and activity flows, plus a Kanban-style order board for visual pipeline management. Service zones let dispatchers define geographic operating areas, while proof-of-delivery capture and route optimization close the last-mile loop. The Storefront module provides headless e-commerce with products, carts, and checkout that feed directly into dispatch queues, and the Ledger module records invoices and financial journal entries across all operations. The Navigator driver app—also AGPL-3.0 licensed and fully white-label—delivers turn-by-turn navigation, live order communication, and fault reporting to drivers in the field. The extension architecture pairs backend Laravel Composer packages with frontend Ember Engine modules, enabling third-party developers to build first-class platform extensions without forking. A RESTful API with full documentation, webhook delivery via Redis-backed queues, and push notification support through APNs and FCM round out the integration surface. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Links stop drowning in browser bookmarks once Heimdall - the application dashboard from the LinuxServer.io team - gives every web app and service you run a single, organized front door. Items come in three tiers. Generic items link to anything on the web with a name, color, and optional icon. Foundation apps are recognized as you type, auto-filling the application's icon and tile color so a full homelab dashboard assembles in minutes. Enhanced apps go further: supply API credentials and the tile shows live data - queue size and download speed for SABnzbd and NZBGet, plus integrations for Sonarr, Radarr, Plex, Jellyfin, Pi-hole, Portainer, Transmission, and many more. There are no iframes and no apps-within-apps; tiles are honest links with real-time stats layered on. Tiles arrange by drag and drop, backgrounds are customizable, an optional search bar (Google, Bing, or DuckDuckGo) makes it work as a browser start page, and optional multi-user authentication keeps dashboards personal. Built on Laravel with SQLite file-based storage - no external database - it stays light, responsive on mobile, and simple to back up. A natural first deployment: the page that ties every other self-hosted service together.

Follow the channels you actually chose, and let their newest uploads land on your own disk instead of in an algorithmic feed. Yarrtube tracks public YouTube playlists and whole channels, checks them on a schedule, and downloads fresh videos automatically the moment they appear. The built-in web player lets you watch the collected library from a desktop or a phone browser without ads interrupting. Downloads are organized into media-server friendly folders, so the same collection shows up inside Plex, Jellyfin, or Kodi next to your films and shows. For Plex homes, an optional scan trigger refreshes the library right after a download finishes, so new episodes surface without manual rescans. You control download quality per source and can cap how many videos each channel keeps, which protects limited disk space from runaway back catalogs. Grouping sources into categories and smart playlists keeps a growing archive browsable instead of turning into one long dump. Everything runs from one Docker container with two persistent mounts, one for its small database and one for the video files. A free YouTube Data API v3 key powers the new-upload checks, so setup takes minutes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

RSS-Bridge gives a feed to every website that never offered one, so social profiles, video channels, and news pages become subscriptions for any feed reader. Pick a bridge, enter a username or search term, and the generated URL returns Atom, JSON, HTML, MRSS, plaintext, or Sfeed output. Dedicated bridges cover YouTube channels and playlists, public Telegram channels, Reddit users and subreddits, Mastodon instances, Twitch channels, TikTok accounts, SoundCloud users, and Rumble channels. When a site has no bridge, CssSelectorBridge and XPathBridge scrape its pages into a feed from the CSS selectors or XPath expressions you provide. FilterBridge keeps or drops items by keyword, FeedMergeBridge folds several feeds into one stream, and FeedReducerBridge thins out noisy sources. Caching keeps upstream services from banning your server for repeated updates, and a token or HTTP basic authentication keeps a private instance closed to strangers. The enabled_bridges setting limits which bridges appear in the menu, and a failing bridge reports its error as a feed item, so your reader notifies you the moment one breaks. A new bridge is one small class file dropped into the bridges folder, and a mounted config folder carries your custom settings across container restarts. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Unlicense licensed.

Behind one admin panel, DefGuard runs a WireGuard VPN, an identity provider, and multi-factor authentication, so every person and device proves who they are before reaching your private network. Administrators define VPN locations, assign which users and groups may enter each one, and enforce firewall rules that allow or deny traffic per location, with changes applied to gateways in real time. People enroll remotely through a guided self-service flow, register their own laptops and phones, and connect with desktop and mobile clients that show live connection statistics. Sign-in goes well beyond passwords, because the built-in OpenID Connect provider gives internal tools single sign-on, while TOTP codes, WebAuthn and FIDO2 keys, email tokens, and mobile biometrics gate each connection. Directory teams sync accounts from LDAP and Active Directory, or federate sign-in through Google, Microsoft, and custom OpenID providers, instead of maintaining a separate user list. Every authentication, enrollment, and policy change lands in a searchable activity log, and webhooks plus a REST API let surrounding systems react to access events automatically. Gateways keep enforcing access from a local cache when the control plane is unreachable, and several gateways can front the same location for failover. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Scatter a few cheap VPS boxes, a home server, and one bare metal machine across three different providers, and Uncloud still treats them as a single place to run your applications. You describe services in ordinary Docker Compose files, deploy them with the uc command line tool, and publish any container port as a public HTTPS endpoint in a single command. Every machine joins an encrypted WireGuard mesh with its own container IP addresses, so services on different continents reach each other directly without VPN configuration or exposed ports. A built-in DNS server resolves service names to container IPs, and the integrated Caddy reverse proxy provisions and renews Let's Encrypt certificates automatically, sharing them across the cluster. Rolling updates replace containers with zero downtime, persistent Docker volumes keep stateful services safe, and the Unregistry integration pushes image layers straight to your machines when no registry is available. There is no control plane to babysit: each machine keeps a synchronised copy of the cluster state, and SSH access to any single node is enough to manage the whole fleet. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Every call your AI agents make becomes a searchable trace in LangWatch, and the same platform tests and scores those agents before a new prompt or model reaches users. The Trace Explorer filters by origin, user, model, cost, and evaluator, reads each run as a waterfall, flame graph, topology, or sequence diagram, and takes traces from the Python, TypeScript, and Go SDKs or any OpenTelemetry source. Agent Testing sends simulated users, in text or beta voice calls, through your agent while a judge passes or fails every criterion with its reasoning, adds multi-turn red teaming, and compares two agents side by side. The Experiments workbench scores prompts and agents on datasets with LLM judges, exact match, and RAG checks, then compares runs on cost, latency, and pass rate, while online evaluations monitor live traffic and guardrails block unsafe replies. Prompts keep version history and staging or production tags, Workflows wire prompts, Python code, and HTTP calls on a visual canvas, and annotation queues route traces to human reviewers. Alerts fire when a graph crosses a threshold, automations post to Slack, email, or webhooks, and scheduled reports go out by email or Slack. Claude Code, Codex, Copilot, Gemini CLI, and opencode report session cost, pull request cost, and terminal replays, and an MCP server exposes trace search and prompt management to coding assistants. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Garnet is Microsoft Research's cache-store built on .NET that speaks the Redis RESP wire protocol while delivering up to 10x higher throughput and 4x lower tail latency than comparable alternatives on identical hardware. The Tsavorite storage engine provides a cache-friendly, shared-memory architecture scaling linearly across CPU cores, supporting both in-memory operation and tiered storage across local SSDs and Azure Storage for datasets exceeding available RAM. Cluster mode enables sharded deployments with replication, dynamic key migration for live rebalancing, non-blocking checkpointing, and automatic failover using standard Redis cluster commands. The RESP implementation covers raw strings, sorted sets, lists, hashes, sets, bitmaps, HyperLogLog, streams, pub/sub, Lua scripting, and client-side transactions, allowing StackExchange.Redis, Jedis, redis-py, and other Redis clients to connect without modification. C#-based extensibility lets developers define custom commands and new data types as server-side stored procedures, compiled and loaded at runtime without restarting the server. TLS encryption, ACL-based access control, and operation logging complete the production feature set. Deployed across Microsoft services including Windows & Web Experiences, Azure Resource Manager, and Azure Resource Graph. Nearly 12,000 GitHub stars. MIT licensed.

Watch YouTube without the ads, accounts, or tracking, from a server you own: TubeHaus is a private YouTube client that keeps the familiar layout, URLs, and keyboard shortcuts. Your subscriptions, watch history, resume positions, Watch Later, and playlists live as files on the server, so every device in the house shares one library and picks up a video where another screen left it. Live streams play with segments fetched ahead of the player, and captions are transcribed on the fly when a stream has none. Chapters, storyboard previews, a mini player, and theater mode make long videos easy to navigate, while sponsors are skipped automatically and dislike counts come back to the page. Save videos offline in 1080p or 4K for trips, send playback to a TV from your phone without a separate casting dongle, and drive the television interface entirely from a remote. Imports arrive from a Google Takeout export, Invidious, NewPipe, or FreeTube, so years of subscriptions move over in minutes instead of being rebuilt by hand. A calm mode hides recommendations and Shorts when you only want to search and watch deliberately. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Certificate lifetimes are collapsing toward 47 days, which turns TLS from a yearly chore into a weekly one, and CertMate is the control plane that makes that schedule boring. It issues and renews certificates from Let's Encrypt, ZeroSSL, Google Trust Services, Actalis, DigiCert, SSL.com, Sectigo, or your own private CA, validating by DNS-01 through 29 DNS providers, HTTP-01, or a CSR whose private key never leaves the device. Renewals run automatically, earlier when a certificate's life is short or the CA moves the date through ARI, and deploy hooks push each renewed certificate where it is actually served, then probe the live endpoint to prove the new certificate answers. Discovery watches hosts and certificate transparency logs for certificates you did not issue, folding them into one inventory of what is served where and when it expires. Certificates rest on local disk or in Azure Key Vault, AWS Secrets Manager, HashiCorp Vault, Infisical, or S3 storage, with encrypted backups copied off-site. Its built-in CA issues client certificates for mTLS with OCSP and CRL, and can serve ACME itself, so certbot, lego, acme.sh, and cert-manager get internal certificates under EAB rules you define. Every action lands in a tamper-evident, hash-chained audit trail you can export and verify independently. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Cold outreach dies in the spam folder long before a prospect reads it, and Warmbly is the open-source platform that keeps your mailboxes warm, capped, and credible while campaigns run from the accounts you already own. Connect Google Workspace, Microsoft 365, or any SMTP and IMAP mailbox, and Warmbly checks SPF and DMARC records, scores mailbox health, then warms each account gradually, starting near 10 messages a day and ramping toward a 40-per-day ceiling instead of blasting from day one. Campaigns run as multi-step sequences spread across many mailboxes, with per-mailbox daily caps, minimum spacing between sends, and weekday sending windows, so volume grows without one account absorbing all the risk. Opens, clicks, bounces, and complaints stream into a deliverability view with suppression handling, while every reply from every mailbox lands in one unified inbox your whole team can work in real time. A built-in CRM tracks contacts, pipelines, deals, tasks, and meetings next to the conversations that created them. Visual playbooks react the moment a reply, booking, bounce, or warmup dip arrives: branch on intent or confidence, let an AI step read the reply and act only with the actions you allow, open the deal, post to Slack, update HubSpot or Pipedrive, and test the whole path on a canvas before it goes live. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

With over 7,000 GitHub stars and active community maintenance through version 0.26.0 released in June 2026, Homebox fills the gap between inadequate spreadsheets and overcomplicated enterprise asset management by providing a purpose-built inventory system designed specifically for home users, families, and small groups. The Go backend with SQLite storage deploys as a single Docker container consuming under 50MB of RAM at idle, running on hardware as modest as a Raspberry Pi while the responsive web interface adapts seamlessly across desktops, tablets, and smartphones. The entity-based architecture introduced in v0.26 unifies items and locations into a shared structure supporting custom fields, attachments, entity types, and reusable templates for consistent data entry across inventory categories. QR code generation creates printable labels that scan with any smartphone camera to instantly display item details, photos, serial numbers, and associated documents. Warranty tracking records purchase dates, prices, and expiration dates while maintenance scheduling sends reminders for recurring service tasks. Location hierarchies organize items spatially with nested sub-locations, and flexible label tagging enables cross-cutting categorization beyond physical placement. Multi-user support shares collections with family members or roommates with OIDC single sign-on integration for Active Directory, Okta, and other identity providers. CSV import and export handles bulk operations, while the full REST API enables automation and third-party integrations. Collection-level ZIP export packages complete inventories with attachments for backup or migration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.