webtrees turns a GEDCOM family file into a private, collaborative genealogy website where relatives anywhere browse ancestors, add photos and sources, and edit together under privacy rules the owner controls. Import a file and each person gets a page of facts, events, and citations, with tabs for families, sources, places, media, and albums and a navigator that jumps to parents, spouses, children, and siblings. Pedigree, fan, hourglass, compact, descendant, interactive, lifespan, relationship, and timeline charts show the same people from different angles, and a pedigree map plots ancestors' birthplaces on OpenStreetMap. Lists sort and filter individuals, families, sources, notes, repositories, and media, with branches that group people by surname. A calendar surfaces births, deaths, marriages, and anniversaries for any day, month, or year, in Gregorian, Julian, Jewish, Hijri, or Jalali dates. Printable PDF reports cover Ahnentafel, family group, descendancy, birth, death, and cemetery records, and search offers general, advanced, and search-and-replace modes for authorized users. Privacy rules apply per site, tree, user, record, and fact, so only authorized users see living people and sensitive details. Editors propose changes, moderators approve them, one site hosts several trees, and the interface comes in more than 60 languages. GEDCOM export lets every tree move to desktop genealogy programs. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Instead of querying a private registry with curl and its HTTP API, open Docker Registry UI and click through repositories, tags, digests, and layers in a browser. The catalog groups images by namespace, shows tag counts, and filters as you type in the search bar, which Ctrl+F or F3 focuses. Each repository's tag list shows creation date, size, content digest, and CPU architecture, sorts numerically, and copies a ready-made pull reference with one click. A history page expands any tag into its operating system, entrypoint, environment variables, exposed ports, and layer-by-layer build steps, and a Dockerfile view reconstructs the file from those steps. The same view also covers multi-architecture images and OCI Helm exports. When the registry allows deletion, tags go one at a time or in bulk with checkboxes, Alt+Click for a whole page, and Shift+Click for a range. One interface can switch between several registries from its menu, or be locked to a single registry with your own title. Basic authentication passes through the browser, and a built-in proxy option forwards requests to your registry container so CORS needs no configuration. Light, dark, and automatic themes come with color variables for custom branding, and a weekly notice announces newer releases. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Instead of deploying proprietary background agents across dozens of target nodes, engineers rely on Apache HertzBeat to monitor real-time infrastructure health, metrics gathering, threshold alerting, and public status pages from a central operations platform. Operations teams can poll hundreds of target services without deploying proprietary background daemons, gathering performance data across Linux hosts, Kubernetes clusters, SQL databases, and network switches using native connection protocols. Engineers can define custom monitoring targets directly within the web dashboard by composing declarative YAML templates that specify polling intervals, parsing expressions, and metric extraction rules. The centralized alert engine processes inbound threshold events, suppresses cascading alert storms during maintenance windows, and dispatches actionable incident notifications to Discord channels, Slack rooms, Telegram groups, and webhook endpoints. Telemetry streams flow into interactive charts with customizable refresh cadences, enabling site reliability engineers to inspect latency waterfalls, correlate log spikes against CPU exhaustion, and track disk capacity trends over extended timeframes. Administrators can also publish real-time public status pages that inform external stakeholders about service availability, scheduled downtime, and ongoing incident resolutions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

The Bitwarden server, reimplemented in Rust: Vaultwarden (formerly bitwarden_rs) is the unofficial lightweight edition. It speaks the same wire protocol as the official server, so every official Bitwarden client - browser extensions, iOS, Android, desktop, and the bw CLI - connects without modification, while the server itself runs as a single container against SQLite (or MySQL/MariaDB/PostgreSQL) instead of the official multi-container stack that wants gigabytes of RAM. Features Bitwarden gates behind paid tiers ship free: organizations with collections, groups, member roles, and policies; TOTP code storage; file attachments; Bitwarden Send; Emergency Access; event logs; and admin password reset. Two-factor options cover authenticator apps, email, FIDO2 WebAuthn, YubiKey, and Duo, and OIDC-based SSO landed natively in v1.35.0. Zero-knowledge encryption is unchanged - vault data is encrypted client-side and the master password never reaches the server. Attachments and Sends store on local disk or S3-compatible backends, an admin panel manages users and server settings, and backup is copying one data directory. Suited to individuals and teams up to roughly 50 users.

Merge, split, compress, convert, edit, annotate, redact, OCR, and sign PDFs - BentoPDF packs over 130 tools into a privacy-first toolkit that runs entirely in the browser through WebAssembly. Files are never uploaded - processing happens in browser memory on the user's machine and disappears when the tab closes, which makes the tool GDPR-clean by architecture and safe for financial, legal, and internal documents. The engine combines WASM builds of PyMuPDF, Ghostscript, and CoherentPDF; Tesseract handles OCR with searchable text-layer output; Office conversions cover Word, Excel, and PowerPoint; and digital signatures use X.509 certificates (PFX/PEM) with the private key staying on the client. Because there is no server-side processing, deployment is a static-file exercise: a single Docker container, or any static host. A dedicated self-hosted build strips the marketing pages while keeping every tool, and air-gapped deployments are first-class - an automated script bundles the WASM modules, OCR language data, and fonts for fully offline networks. No accounts, no limits, no watermarks; TypeScript and Vite under the hood.

Agent code needs somewhere disposable to run, and Sandstorm turns one modest VPS into a fleet of thousands of isolated sandboxes that wake the moment work arrives. You create sandboxes through a plain HTTP API, starting from a registered template or forking a tagged snapshot, with per-sandbox memory ceilings, attached volumes, and egress rules set on each call. Every sandbox is a gVisor container with its own network namespace, so untrusted agent code runs away from your host and away from its neighbors. Idle sandboxes cool down through four tiers, from running hot, to frozen in place with a wake time near ten milliseconds, to checkpointed on disk and back in about a fifth of a second, so a small machine can hold far more sandboxes than it could ever keep running at once. A single binary acts as master, node, and web console: the master tracks desired state and places work across nodes, nodes behind NAT dial out to join the fleet, and a gateway on each node wakes a sleeping sandbox and forwards its traffic automatically. The built-in Hub pulls ready-made snapshot packs for warmed runtimes like Python with numpy or a pre-warmed Playwright browser, skipping cold starts entirely. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Bifrost is an open-source AI gateway that unifies 23+ LLM providers into a single OpenAI-compatible endpoint with automatic failover, semantic caching, and built-in cost governance, so one provider going down never takes your production AI application with it. Point your existing OpenAI or Anthropic SDK at Bifrost's local endpoint and gain access to OpenAI, Anthropic, AWS Bedrock, Google Vertex, Azure, Groq, Mistral, and Ollama without changing application code. Define fallback chains that automatically switch providers when one returns errors or exceeds latency thresholds, keeping response times stable during outages. The built-in web dashboard at port 8080 lets you configure providers, create virtual API keys, monitor live request traffic, and review analytics without editing configuration files. Semantic caching combines exact hash matching with vector similarity search via Weaviate, serving cached responses for identical or paraphrased prompts in sub-millisecond time to cut costs on repetitive workloads. The MCP gateway connects AI agents to external tools like filesystems, databases, and web APIs, exposing them to clients such as Claude Desktop and Cursor with per-key allow-lists. Four-tier budget hierarchy at customer, team, virtual key, and provider levels enforces spend caps, rate limits, and model restrictions across your organization. Extend functionality through custom Go plugins for analytics, monitoring, or security middleware. Native Prometheus metrics and OpenTelemetry distributed tracing give operations teams full production observability. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Originated as Alibaba Group's official internal AI code review assistant serving tens of thousands of developers and identifying millions of code defects over two years before open-sourcing in May 2026 — now at 21,000+ GitHub stars — Open Code Review is the production-hardened platform that proves enterprise-grade code review can be fully open-source under Apache 2.0. The hybrid architecture separates deterministic engineering pipelines (file selection, diff parsing, rule matching for NPE, thread-safety, XSS, and SQL injection across 10+ languages) from LLM-powered agent reasoning with tool-use capabilities including FileRead, CodeSearch, and cross-file context inspection, consuming approximately one-ninth the tokens of general-purpose coding agents while delivering line-level precise comments with severity and confidence scoring. The bundled web dashboard (port 4173) provides review management, findings triage, result browsing, and direct GitHub posting without external dependencies, while the session viewer (port 5483) renders full LLM request/response traces for debugging and auditing. Integration spans GitHub Actions, GitLab CI, GitFlic CI, and Gerrit with delegation mode enabling Claude Code, Cursor, and other AI agents to leverage OCR's engineering logic alongside their own LLM reasoning. Supports OpenAI, Anthropic, Google Gemini, DeepSeek via built-in providers plus Ollama and vLLM for air-gapped deployments. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Processing over one billion tasks per month on Hatchet Cloud and holding 7,600+ GitHub stars, Hatchet is the open-source orchestration engine that replaces fragile legacy queues with durable, fault-tolerant task execution built entirely on PostgreSQL — no Redis, RabbitMQ, or Kafka required. Born from the creators' experience scaling Uber's Cadence-inspired patterns, the v1 engine achieves 10,000 tasks per second sustained throughput with 20ms average queue latency through dynamic buffer flushing and batch insert optimization. Define tasks, durable workflows, and DAG pipelines as code using native SDKs for Python, TypeScript, Go, and Ruby — every function gets automatic retries with configurable backoff, concurrency control with group round robin or cancellation policies, priority queuing, and dynamic rate limiting for third-party API protection. Durable execution persists the complete history of every task and state transition, enabling replay from failure, debugging via full event timelines, and complex pause/resume conditions using durable sleep and event waits. The real-time web dashboard provides workflow run visualization with DAG timeline rendering, worker health monitoring with slot utilization, queue depth metrics, task throughput charts, and error rate tracking — all filterable by status, workflow, or time window. OpenTelemetry integration and Prometheus metrics export enable advanced observability. Multi-tenant by default with users, roles, and namespace isolation. Self-host via Docker Compose with PostgreSQL and optional RabbitMQ, or use the single-container Hatchet Lite image for development. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 1,600 GitHub stars and a design philosophy that fundamentally rethinks how time tracking should work, Traggo abandons the traditional project-task hierarchy that forces your work into rigid categories and instead lets you tag time spans with arbitrary key-value pairs — project:website, type:coding, client:acme, billable:yes — enabling cross-dimensional analysis that conventional trackers cannot replicate. The Go backend compiles into a single binary that runs alongside a SQLite database and embedded web UI in under 10MB total, consuming approximately 50MB of RAM at runtime and starting in seconds on even the smallest VPS. Tags are the fundamental data model: create any tag key with any set of values, then apply multiple tags to each time span simultaneously to track by project, client, task type, energy level, or any other dimension your workflow demands. Customizable dashboards render pie charts, bar charts, and line graphs from tag-aggregated data, letting you visualize time distribution across any combination of dimensions over configurable date ranges. The calendar view displays time spans as colored blocks across days and weeks, while the list view provides chronological entry browsing with inline editing. Multiple themes including light and dark modes adapt the interface to personal preference, and simple user management with role-based access supports small team deployments. Docker deployment runs a single container exposing port 3030 with multi-architecture support for amd64, arm64, and arm v7. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Your prompts never have to leave the building: TextGen runs open large language models on your own hardware behind a chat interface and an API that speak fluent OpenAI. Load GGUF or Hugging Face weights through llama.cpp, ik_llama.cpp, Transformers, ExLlamaV3, or TensorRT-LLM, and switch models or backends from the interface without restarting the server. Chat mode gives you conversations with characters and system prompts, notebook mode behaves like a familiar completion editor, and both accept image attachments for vision models and documents for context. Models that support tool calling can search the web, fetch pages, and do math through single-file Python tools, and MCP servers plug in for larger tool catalogs. Start it with the API flag and the same model answers at chat, completions, and messages endpoints that mirror OpenAI and Anthropic, complete with streaming, logprobs, embeddings, and optional API key authentication. Portable builds for Linux, Windows, and macOS bundle every dependency, so the distance from download to a running model is an unzip and one shell command. Because everything is local, prompts, documents, and outputs stay on machines you control, and parallel request handling lets a single loaded model serve a whole team's tools at once. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Matrix's flagship client, built by the protocol's creators: Element brings the decentralized open standard for real-time communication to web, desktop, iOS, and Android. Paired with a Matrix homeserver, it delivers Slack-quality team messaging where you own every message, file, encryption key, and byte of metadata. End-to-end encryption is on by default, built on Olm and Megolm - the Double Ratchet algorithm family Signal popularized, extended for large-room scalability and publicly audited by NCC Group. Messages encrypt per-device with cross-signed device verification, so even a compromised server yields nothing readable. Federation is the defining capability: like email, users on different homeservers converse seamlessly, and 30+ bridges connect Matrix rooms to Slack, Discord, WhatsApp, and Telegram, so moving to sovereign infrastructure doesn't sever contact with anyone. Rooms support threads, reactions, file sharing, and voice and video calls via Element Call. The result is digital sovereignty chosen by governments and enterprises across Europe: your data sits on your server in your jurisdiction, portable to any other Matrix host because the protocol is an open standard. Apache-2.0 licensed, with no per-user fees at any scale.

An open-source application performance monitoring platform for microservices, Kubernetes, and service meshes, Apache SkyWalking draws the live service map and ties slow requests to their traces, logs, and metrics. Agents cover Java, .NET Core, PHP, Node.js, Go, Lua, Rust, C++, browser JavaScript, and Python, and OpenTelemetry, Zipkin, Prometheus, Zabbix, and Telegraf data can be ingested too. Start at the service topology map, follow a request through the trace waterfall, then drill into the instance and its API dependencies. When the cause is inside the code, trace profiling, async-profiler, Go pprof, eBPF, and network profiling render flame graphs and process graphs in the same console. The Rover eBPF agent profiles Kubernetes workloads for CPU and network problems, and Istio and Envoy service meshes, including Istio Ambient, report into the same dashboards. Alarm rules target a service, deployment, or API, and alarms and telemetry can be forwarded to third-party systems. Metric and log analysis rules hot-update at runtime without a restart, and a live debugger shows what each rule stage receives and produces. An AI assistant answers plain-language questions with charts, topology, and traces from live data, using an OpenAI-compatible or Amazon Bedrock model you configure, and an MCP connection serves your own AI client. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Comic Library Utilities (CLU) is a self-hosted comic library manager that converts, repairs, tags, downloads, and reads your entire comic collection from one web interface. Convert whole folders or libraries from CBR to CBZ in bulk, turn PDFs into CBZ with JPEG or WebP output, and rename thousands of files to one consistent pattern without touching a terminal. Open any CBZ in the browser editor to reorder pages, add or delete images, crop covers, split merged multi issue archives, and adjust contrast and brightness issue by issue. Write ComicInfo.xml from Metron, ComicVine, Grand Comics Database, AniList, MangaDex, MangaUpdates, or Bedetheque, then bulk apply tags across a directory with review before saving and a history log that can revert any change. Browse your library by publisher, series, or folder, read page by page in the built in reader that remembers your place, and follow weekly release calendars with a pull list and Wanted tracker for issues you do not own yet. Download new issues from Direct Download sources, Usenet through Newznab indexers with SABnzbd or NZBGet, and DC++, while folder monitoring unpacks, converts, renames, and files new arrivals automatically. Add Reader, Clerk, and Store Owner accounts with per folder permissions, publish OPDS feeds for reader apps, and sync reading history with Komga. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

With over 24,000 GitHub stars and a rapidly growing community of self-hosters, authentik delivers enterprise-grade identity management that replaces commercial solutions like Okta and Auth0 with a fully self-hosted platform requiring no per-user licensing fees. The platform serves as a unified identity provider supporting SAML 2.0, OAuth 2.0 and OpenID Connect, LDAP for legacy application compatibility, SCIM 2.0 for automated user provisioning, and RADIUS for network device authentication. The visual flow designer enables administrators to create custom authentication workflows combining password verification, multi-factor authentication with TOTP, WebAuthn, and SMS codes, email verification, captcha challenges, and conditional logic based on user attributes or device context. The forward-auth and reverse proxy integration works seamlessly with Traefik, Nginx, Caddy, and Envoy to protect applications that lack built-in authentication. User enrollment flows support self-registration with configurable approval workflows, invitation links, and automatic group assignment. The LDAP outpost exposes user and group data to legacy applications requiring LDAP bind authentication, while the SCIM provider automates user lifecycle management with downstream applications. Multi-tenancy support through brands allows a single authentik instance to serve multiple organizations with independent domains, branding, and authentication policies. The admin interface provides comprehensive user management, group hierarchy, application catalog, event logging with GeoIP enrichment, and system health monitoring. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Licensed under a source-available license with an open-source community edition.

With over 24,000 GitHub stars and active development since 2014, Firefly III is the self-hosted personal finance manager that gives you complete control over your financial data without ever contacting external servers. The double-entry bookkeeping system tracks every transaction with source and destination accounts, ensuring accurate balance calculations and audit trails across checking, savings, credit card, cash, and asset accounts. Budget management sets monthly spending limits by category with visual progress tracking and rollover support for unused allocations. Rule-based transaction automation applies categorization, tags, and budget assignments automatically based on configurable conditions matching description, amount, source, and destination patterns. Recurring transactions schedule regular bills, subscriptions, and income entries with automatic creation on configured dates. Piggy banks divide savings accounts into virtual sub-accounts for goal tracking with target amounts and deadlines. Financial reports include income versus expense summaries, budget performance charts, category breakdowns, tag reports, and net worth tracking with weekly, monthly, and yearly time ranges. Multi-currency support handles any currency with configurable exchange rates for international finance tracking. The REST JSON API covers nearly every feature for integration with external tools, import utilities, and the companion Firefly III Data Importer for bank statement processing. Two-factor authentication provides account security. Self-hosting deploys via Docker containers or directly on PHP 8.5+ with MySQL or PostgreSQL. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Google Analytics without the cookie banner or the maze of menus: Rybbit puts web and product analytics for every site you run on one readable dashboard, hosted on your own server. Pageviews, sessions, unique users, bounce rate, session duration, traffic sources, campaigns, devices, and countries update in real time beside a live visitor count. Session replay lets you watch the visits behind the numbers, and user profiles tie identified visitors to their sessions and events. Funnels pinpoint where conversions leak, journeys chart the paths people take through a site, retention reports show who comes back, and goals track conversions from page visits, custom events, and autocaptured clicks. Custom events carry JSON properties, filters slice every report across more than 15 dimensions, saved segments reapply them in one click, and location tracking drills from country to region to city on interactive maps, with optional 3D globe views through a Mapbox token. Error tracking connects JavaScript failures to the affected sessions, so a spike in errors leads straight to the visits that explain it. One install serves unlimited sites and organizations with role-based access, public dashboards share a site's stats through a link, and a tracking script of about 11 KB compressed collects data with no cookies and no consent banner. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Born at Brazilian media giant Globo.com, Thumbor answers imaging CDNs like Imgix and Cloudinary with an HTTP service where every image variant is just a URL. Ask for /300x200/smart/your-image.jpg and Thumbor fetches the original, crops and resizes on demand, and caches the result - one source file, unlimited renditions, no batch pre-generation pipeline. The "smart" in the URL is the signature feature: OpenCV-based face detection finds people in the frame and crops around them (no more thumbnails with severed heads), and when no faces exist, feature detection finds visually important corners and computes a weighted center of mass as the focal point. Beyond cropping, a chainable filter pipeline handles brightness, contrast, grayscale, blur, red-eye removal, rounded corners, rotation, watermarks, and format conversion with quality control - applied in order via URL segments. All common image formats work out of the box, and every layer is pluggable: loaders (HTTP, local, S3), storages and result storages (local, S3, Ceph, and community backends), engines, optimizers, filters, and even custom detectors, with the awesome-thumbor list cataloging the ecosystem. URL signing prevents abuse of your processing capacity. Integrations exist for Django, Rails, Node, WordPress, and most frameworks. MIT-licensed, battle- tested for over a decade.