Follow every blog, newsletter, and news site you like from one distraction-free inbox with the self-hosted Fusion RSS reader, which has no AI features by design. A left sidebar lists feed groups with unread counts and jumps between Unread, Starred, and All, while the center list shows articles under filter tabs with read and star buttons on every card. Click a card and a right-hand drawer opens with the full sanitized article, a link to the original, and Previous and Next buttons. Press Cmd or Ctrl+K, or the slash key, to search feeds and articles from anywhere. Stay on the keyboard with Google Reader-style keys such as j and k to move, m to mark read, s to star, and g then u to jump to Unread; the question mark lists them all. Add a feed by entering a site address and letting auto-discovery find it, then pick its group, refresh frequency, and HTTP proxy, or suspend it to pause updates. OPML import and export bring subscriptions in or out. Starred articles are saved as snapshots that outlive their source feed. Fever API compatibility lets Reeder, Unread, and FeedMe read the same library. Sign in with a password or OIDC single sign-on, and install the interface as a PWA with Light, Dark, and System themes in eight languages. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Security-conscious IT departments pick Passbolt for its cryptography: every user holds an OpenPGP key pair, and shared credentials are encrypted individually to each recipient's public key - real end-to-end encryption, not a vault password handed around. All crypto runs client-side in the mandatory browser extension (distributed and signed through the Chrome and Firefox stores, deliberately separating the crypto code from the server that stores ciphertext); private keys and passphrases never touch your instance, and the server admin cannot read a single secret. Authentication uses the challenge-based GpgAuth protocol, secrets are digitally signed to verify sender integrity, and metadata encryption extends protection to resource names and URLs. Day to day it behaves like a polished commercial manager: auto-fill and auto-save in forms, strong password generation, anti-phishing protection, TOTP storage, folder hierarchies shared per-user or per-group with fine-grained permissions and instant cryptographic revocation. Native iOS, Android, and desktop apps ship alongside a JSON API, CLI, and SDKs for CI/CD secret retrieval and rotation. The PHP server runs on MariaDB and is AGPL-licensed open source - including the paid tiers' codebase - with published security audits.

Your next favorite record is hiding in your listening history, and Digarr is the self-hosted discovery engine that finds it, scores it, and queues it for your library. Connect ListenBrainz, Last.fm, Spotify, Deezer, Discogs, or your Plex, Jellyfin, Emby, or Subsonic server, and Digarr builds a taste profile from what you actually play. An AI provider you choose, from Anthropic, OpenAI, and Gemini to a local Ollama model, proposes candidates, and a weighted scoring system ranks them by consensus, similarity, genre overlap, and your past feedback. Every suggestion lands in a review queue where you can preview tracks, approve, reject, or permanently block artists before anything touches your collection. Approve an artist and Digarr adds them to Lidarr with your quality profile, queues the release in slskd, or exports a playlist to Spotify, Navidrome, Jellyfin, Emby, or Plex. Album-level discovery runs on its own: Release Radar catches new releases from artists you follow, Library Gap-Fill surfaces the studio albums you are missing, and scheduled subscriptions keep fresh candidates flowing in without you lifting a finger. Share the instance with family or friends, each with their own queue and connections, protected by local accounts or OIDC single sign-on, and get notified through webhooks, ntfy, Telegram, or Apprise when new picks arrive. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Engineers who have outgrown Duplicati or rsync scripts tend to appreciate Kopia's design: encrypted, compressed, content-deduplicated snapshots in Go, stored in a repository on any storage you control - S3, Google Cloud Storage, Azure Blob, Backblaze B2, SFTP, WebDAV, or a plain filesystem. Encryption is mandatory and end-to-end: every block is encrypted client-side with AES-256-GCM or ChaCha20-Poly1305 using keys derived from your repository password, and even file names never leave the machine in plaintext. Blocks are packed into 20-40 MB blobs with random names, so the storage provider learns nothing about content or structure. Deduplication is automatic and content-based - identical data across files, snapshots, and even multiple machines backing up to the same repository is stored once. Policies govern everything per-directory: compression choice, retention (hourly through annual), scheduling, and ignore rules. Incremental snapshots are point-in-time records you can mount and browse like a filesystem. This deployment runs the Kopia repository server with its web UI, centralizing backups from multiple client machines over an authenticated API - each client connects with the server URL and certificate fingerprint, and users only see their own snapshots. Error correction, high-latency-tolerant caching, and both CLI and GUI round it out.

GrandNode lets you run one shop, a dozen regional storefronts, or a full marketplace from a single installation, with a back office for every role involved. Each store gets its own domain, theme, currencies, languages, and settings, and a store manager panel limits staff to the catalog, orders, and customers of their own store. Outside sellers join through a vendor panel where they manage their own products and orders. The catalog handles attributes and combinations, bundles, grouped items, downloads, date-based reservations, and auctions. B2B selling adds customer groups, tier prices, sales employees, and approvals. Checkout accepts payments through plugins such as Stripe Checkout, Braintree, and cash on delivery, with shipping by fixed rate, weight, or pickup point and tax rules by country, state, or zip code. Marketing tools include coupon codes, discount rules, loyalty points, gift vouchers, customer segments, newsletter campaigns, and push notifications. Clean URLs, sitemaps, and structured data with price and availability help search engines read your products. Pages, blog posts, news, and sliders cover content, and a REST API serves headless storefronts and ERP or CRM integrations. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Kaleta is a business-website CMS where the page you edit is the page your visitors get, not a preview of it. The visual builder works on the live canvas: add sections, drag elements, edit text in place, and style every element separately for desktop, tablet, phone, and hover before you publish. Forty-six elements and forty ready-made sections cover pricing tables, timelines, before-and-after sliders, galleries, accordions, carousels, maps, and mega menus. Consistency comes from a design-token system: change one colour, font, spacing, or radius token and the whole site follows, with a WCAG contrast check on every colour pair and export in the W3C token format. Blocks you reuse become components edited once and updated everywhere, and each page carries its own search title, sharing image, and visibility, with the last twenty publications kept as versions. Moving in is a first-class feature: importers take WordPress exports including WooCommerce products and Polylang or WPML translations, plus Ghost, Blogger, Joomla, Drupal, and Webflow, creating a redirect from every old address so rankings survive. An optional AI assistant connected through MCP builds pages and handles chores only as drafts you approve. Forms, booking, enquiries, media folders with focal-point cropping, multilingual publishing, and GDPR duties such as automatic personal-data deletion are built in rather than bolted on. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-2.0 licensed.

Paper co-authors usually trade .tex files by email or pay for a hosted editor seat by seat; Aldine replaces both with a self-hosted LaTeX workspace where the whole team types in one document at once and sees a typeset PDF seconds later. Live cursors and presence show who is editing which paragraph, and the underlying sync is conflict-free, so two authors can rewrite the same section without overwriting each other. Every project is a real git repository: branch a draft, edit it independently, and merge it back from the interface when the argument holds together. Connect GitHub, GitLab, Gitea, or Forgejo to push and pull without leaving the editor, watch ahead and behind indicators, resolve conflicts, and open a pull or merge request on the merged result. Moving in is painless, since an exported Overleaf project ZIP dropped on the home screen imports with its root file detected and its first typeset automatic. Citations come from your own Zotero library or a single collection, kept in sync as a .bib file and inserted from a search panel or \cite autocomplete. Reviewers select text and leave anchored, threaded comments, optionally with a suggested replacement the author accepts in one click. Compiles run in a sandboxed container with no network access, warm recompiles land in about two seconds, and errors jump to the offending line. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Five servers, five cron jobs, five restic scripts nobody quite remembers writing: Arkeep replaces that archaeology with one dashboard where every backup in your infrastructure reports for duty. A small agent on each machine dials out to the central server and waits for work, so nothing listens on an agent port and machines behind NAT or a home firewall enroll just as easily as cloud VPSes. From the web interface you define destinations, which can be local disk, any S3-compatible storage, SFTP, a restic REST server, or more than forty Rclone backends, then build policies that send one backup job to several destinations at once for a genuine 3-2-1 layout. Docker volumes are discovered automatically, and databases stream straight into the backup with pg_dump and mysqldump instead of fragile file copies. Retention and repository integrity checks run per destination on their own schedules. When recovery day comes, you open any snapshot in the browser, browse its files, and restore a single folder in place or somewhere new. Failures announce themselves by email, Slack, Discord, or webhook, or stay silent in Healthchecks.io. Sign-in is yours to choose: local accounts with TOTP two-factor, or single sign-on through any OIDC provider. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

A server full of scattered services becomes one clean application hub under Flame - a self-hosted startpage where every bit of configuration happens in built-in GUI editors, never a config file. Applications and bookmarks are created, edited, and organized into categories directly in the browser, and favorites pin to the homescreen for one-click access. The integrated search bar filters your apps and bookmarks locally as you type, and prefix shortcuts (like /g for Google) route queries to any of 11 web search providers or custom ones you define, making Flame a genuine browser homepage rather than a static link wall. Docker integration is the standout for homelabs: mount the Docker socket, add flame.type, flame.name, and flame.url labels to containers, and new services appear on the dashboard automatically - Kubernetes Ingress annotations work the same way. A weather widget shows temperature, cloud coverage, and animated conditions for your coordinates, and password authentication protects settings and items. Appearance is deeply customizable with 15 built-in color themes, a custom theme builder, and full custom CSS support. The stack is Node.js with SQLite behind a React frontend - light, fast, and inspired by the minimalist SUI design.

With over 33,000 GitHub stars and a codebase written in 92.9% Rust for maximum performance and memory safety, Tabby is the most widely adopted self-hosted alternative to GitHub Copilot — delivering real-time code completions entirely on your own infrastructure with zero code leaving your network. Deploy a single Docker container on any NVIDIA CUDA, Apple Silicon Metal, AMD ROCm, or CPU-only server and connect VS Code, JetBrains IDEs (IntelliJ, PyCharm, WebStorm, GoLand), Vim, Neovim, and Emacs through native extensions. The completion engine supports a curated registry of models including StarCoder2 (1B to 15B parameters), DeepSeek-Coder, CodeLlama, CodeGemma, Qwen2.5-Coder, and Mistral Code — swappable at runtime through the admin dashboard without redeployment. Repository indexing parses your Git repositories and feeds project-specific types, function signatures, and patterns into completion context via RAG, producing suggestions that understand your codebase rather than generic boilerplate. The Answer Engine provides instant responses to code queries within the IDE, while inline chat enables contextual code editing and explanation without switching windows. The admin dashboard manages per-developer API tokens, usage analytics, and model configuration. Enterprise features include SSO via LDAP, OAuth, and SAML, role-based access control, and audit logging for compliance environments. A single RTX 4090 workstation serves a team of 10-15 developers with sub-500ms completion latency. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Encrypted, incremental, compressed backups on storage you already have - Amazon S3, Backblaze B2, Google Drive, Azure, OneDrive, Dropbox, MEGA, Storj, WebDAV, SFTP, FTP, SMB, or a plain local disk - is what the MIT-licensed Duplicati has quietly done for years. Its security model is Trust No One: every block is encrypted with AES-256 (or a local GPG instance) before leaving the machine, and the passphrase never travels, so the storage provider holds only ciphertext. The block-based storage engine gives the best of both backup worlds: after one initial full backup, only changed data blocks upload - modify a tiny part of a huge file and only that part transfers - yet every backup version restores like a full backup in a single operation, with no incremental chains to replay. Deduplication and compression keep remote storage growth slow even across years of versions. A web interface manages everything: the built-in scheduler keeps backups current automatically, flexible filters select folders, file types, or custom patterns, retention policies prune old versions, and an integrated updater flags new releases. On compatible object-lock backends, immutable (WORM) storage protects backup data from ransomware that reaches the credentials. Runs on Windows, macOS, and Linux, free even for commercial use.

Whether it is a delivery van, a trailer in a storage yard, or a dog on a hike, Traccar is the GPS tracking server that puts it on one live map you host and control. Every position and event lands in your own SQL database. Over 200 protocols covering 2000+ tracker models decode out of the box, so a Teltonika fleet unit and a budget dongle share one device list. Pick a device to see speed, address, ignition, and total distance. Routes replay on a timeline slider, and a ruler tool measures distances. Geofences can be polygons, polylines, or circles, linked to devices or groups, colored as you like, and limited by calendar schedules. Alerts for overspeed, fuel drops, offline devices, alarms, and maintenance arrive by web, email, push, SMS, Telegram, or WhatsApp. Reports cover trips, stops, summaries, charts, events, and positions, with Excel export and scheduled email delivery. Commands go out over the tracker's own connection or by SMS, queued for offline devices. Computed attributes derive ignition or fuel values from raw inputs using expressions. Resellers get admin, manager, user, and read-only roles with device limits, plus white-label branding. Traccar Client lets a smartphone report as a tracker, and Traccar Manager monitors devices from mobile. Teams who want AI assistants to query their devices can add the MCP endpoint, which is optional. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Backed by over 45,000 GitHub stars and described as the tool that replaces Notion, Evernote, and Anki in a single Docker container, SiYuan is the privacy-first knowledge management system where every paragraph, heading, and list item is a uniquely addressable content block. The block-level architecture enables bidirectional links, transclusion embeds, and SQL query blocks that dynamically aggregate content across your entire workspace, while the knowledge graph visualization maps relationship networks between documents and blocks. Built-in databases support table views with relation and rollup columns, filter composition, sorting, and template-based calculations for structured data management alongside freeform notes. The FSRS spaced repetition engine turns any content block into a flashcard with scientifically calibrated review scheduling, eliminating the need for separate memorization tools. AI integration connects to OpenAI-compatible APIs for writing assistance, translation, summarization, and Q&A chat, with semantic search using embeddings and reranking for intelligent content retrieval. The Bazaar community marketplace delivers plugins, themes, templates, and widgets through a managed extension system with TypeScript plugin APIs. End-to-end encrypted synchronization works across S3-compatible storage, WebDAV servers, or SiYuan's own cloud service, while Tesseract OCR extracts searchable text from images and the web clipper captures pages from Chrome, Edge, and Firefox. Export targets include Markdown with assets, PDF, Word, and HTML. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Unlimited agents, unlimited tickets, unlimited mailboxes, forever, on a $4 VPS - FreeScout's pricing inversion is why it became the most popular self-hosted Help Scout alternative, a PHP/Laravel help desk and shared inbox developed from scratch over eight years. The inbox deliberately behaves like Gmail or Outlook, so new support agents need close to zero training. The email-support core is genuinely complete: seamless IMAP/SMTP integration including modern Microsoft Exchange authentication, collision detection that warns when two agents open the same conversation, canned responses, auto-replies, internal notes, open tracking, starring, forwarding, merging, and moving conversations between mailboxes, phone-call logging, push notifications, and an auto-refreshing conversation list - plus screenshot pasting straight from the clipboard into replies. It's 100% mobile-friendly, fully screen-reader accessible, and translated into 28 languages. Beyond the core, an ecosystem of 100+ modules (mostly one-time $12-20 purchases) adds knowledge base, workflows with Gmail-filter-style automation rules, satisfaction ratings, time tracking, tags, custom fields, LDAP, Slack, WhatsApp and Telegram channels, and an API with webhooks - pay only for what your team needs. Web installer and updater included. AGPL-licensed.

Teams tired of paying Salesforce or HubSpot per seat run EspoCRM: an AGPL-licensed PHP application with a fast single-page frontend over a REST API, covering sales, support, and marketing in one uncluttered interface. The sales core is complete - leads, contacts, accounts, opportunities with customizable pipeline stages, kanban views, calendars, meetings, and calls. Email is deeply integrated rather than bolted on: IMAP sync links messages to CRM records automatically, and mass email campaigns run with reusable templates, tracking, and Web-to-Lead forms feeding the funnel. Support teams get case management and a customer portal where clients track their own tickets and access a knowledge base. The real differentiator is the Entity Manager: create custom entities, fields, relationships, and layouts from the admin UI without code, with dynamic logic showing or hiding fields conditionally - EspoCRM is as much a business-application platform as a CRM. Formula scripting handles calculated fields and record automation in the free core; the optional Advanced Pack adds visual BPM process design and workflow rules. Role-based permissions with team and territory scoping, full-text search, reports, and a straightforward REST API for n8n or custom integrations round it out. Runs on PHP 8.3+ with MySQL, MariaDB, or PostgreSQL - unlimited users, zero per-seat fees.

SourceWeft is an AI workstation you host yourself, where agents, your documents, and your model keys work in one place instead of scattering across chat tabs you do not control. Describe a job and a lead agent breaks it down, handing research, exploration, and execution to focused sub-agents that share the same working context and files. Agents draw on a skill library covering presentations, HTML pages, images, meeting summaries, and study guides, and you can add your own skills so good workflows become repeatable. MCP servers, web search, and web extraction connect agents to outside tools, while approved commands run inside a sandboxed environment that cannot touch the rest of your server. Feed it PDFs, web pages, notes, YouTube videos, Notion, Drive, Gmail, or Slack, then follow citations from any answer back to the source material it came from. Bring your own keys for the chat and indexing models you prefer, organize the team into workspaces with roles and access controls, and pick up any conversation from the web app or desktop clients. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Your scanner still emails PDFs, your backup scripts still send nightly reports, and none of them will ever learn OAuth 2.0: Email OAuth 2.0 Proxy learns it on their behalf. It listens on local IMAP, POP, and SMTP ports on your server, and when a client logs in the old-fashioned way with a username and password, the proxy swaps that exchange for a modern SASL XOAUTH2 token before the connection ever reaches the provider. The client never knows anything changed, so ancient mail apps, embedded devices, monitoring tools, and hand-rolled scripts keep sending and fetching mail through Outlook, Office 365, Gmail, Google Workspace, Fastmail, Yahoo, AOL, and any other provider that demands OAuth 2.0. The hop from your client to the proxy stays simple, while the proxy opens a fully encrypted TLS connection upstream, including STARTTLS negotiation for SMTP relays that require it. One proxy instance serves many accounts at once, with each mailbox mapped to its own local port and its tokens cached under a password you control. Optional plugins can even rewrite traffic in flight: strip Microsoft Defender Safe Links back to their real URLs, stop duplicate sent messages, or swallow test mail into a black hole. Setup is a single configuration file covering server ports, per-account scopes, and token endpoints, and the proxy then runs quietly as a headless service. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Somewhere in every organisation there is a folder called FINAL_v2 that nobody dares delete, and Drive from La Suite exists to end that. It gives teams a shared file space where uploads land in organised workspaces, versions stay findable through search, and every file or folder carries its own access list. You preview PDFs, images, audio, and video in the browser, and office documents open for editing through Collabora or OnlyOffice without downloading a thing. Sharing reaches outside the organisation too: invite external partners by link, even without an account, and revoke access the moment a project ends. Uploads pass malware scanning before they touch storage, a trash bin restores accidents, and quotas with usage metrics keep big archives honest. Administrators plug in their own OIDC identity provider, so logins follow the same single sign-on as the rest of the stack, while an embeddable file picker lets other internal apps reuse Drive as their document library. Because the data lives in your own S3-compatible storage, sovereignty requests stop being an argument with a vendor and become a setting. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.