With over 34,000 GitHub stars and backing from a well-funded engineering team, Tailscale has fundamentally simplified how developers and system administrators think about secure networking. The client daemon establishes WireGuard tunnels directly between devices using sophisticated NAT traversal techniques, achieving direct peer-to-peer connections in the vast majority of network configurations without requiring port forwarding, firewall rules, or VPN concentrators. When direct connections prove impossible due to restrictive network environments, DERP relay servers provide encrypted fallback paths. MagicDNS assigns human-readable hostnames to every device on the network, eliminating the need to remember IP addresses across a tailnet. Subnet routing allows nodes to advertise access to entire local networks, enabling remote access to office resources, home labs, or cloud VPCs through a single gateway node. Exit node functionality routes all internet traffic through a designated device for privacy protection or geographic flexibility. Access control lists define granular policies for which devices and users can communicate with which services, enforced cryptographically at the network layer. The authentication layer integrates with identity providers including Google, Microsoft, GitHub, Apple, and OIDC-compliant systems for single sign-on access. Taildrop enables direct encrypted file transfers between devices without cloud intermediaries. The tailscale CLI provides complete network management from the terminal including status monitoring, route advertisement, and node configuration. Running Tailscale on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console provides a permanent, always-on node in your mesh network. BSD-3-Clause licensed with an active open-source community.

Used by over 30,000 teams and 650+ enterprise customers managing more than 5.2 million containers, Rancher has earned recognition as a Leader in the Gartner Magic Quadrant for Container Management and the Forrester Wave for Multicloud Container Platforms. The platform provides a single pane of glass for provisioning, upgrading, and securing Kubernetes clusters across Amazon EKS, Google GKE, Microsoft AKS, RKE2, K3s, and any CNCF-conformant distribution. Multi-Cluster Management enables centralized authentication via Active Directory, LDAP, SAML, GitHub, and OpenID Connect with granular role-based access control at the cluster, project, and namespace levels. Fleet, the built-in GitOps engine, delivers continuous deployment across hundreds of clusters simultaneously using Helm charts, Kustomize, or raw YAML manifests from any Git repository. The integrated app catalog provides one-click deployment of Prometheus monitoring, Grafana dashboards, Longhorn persistent storage, Istio service mesh, and hundreds of community Helm charts. Rancher supports air-gapped installations for disconnected environments, CIS benchmark scanning for security compliance, and automated backup and restoration of cluster configurations. The dashboard offers real-time workload monitoring, log aggregation, pod shell access, and namespace-scoped resource quotas. Cluster templates enforce organizational standards through Helm-based provisioning policies that ensure consistent configurations across environments. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

A fair-source chatbot and conversational-form builder: Typebot assembles conversations in a visual graph editor. In a visual graph editor you chain blocks from four categories: bubbles display text, images, video, audio, and embeds; inputs collect data through text fields, email, phone, buttons, picture choices, date pickers, file uploads, and Stripe payments; logic blocks handle conditional branching, variables, URL redirects, A/B testing, and custom JavaScript; integration blocks call webhooks, OpenAI, Google Sheets, Google Analytics, Meta Pixel, Zapier, Make, and Chatwoot. Build once, deploy anywhere: custom domains, WhatsApp, or embedded in any site as a container, popup, or chat bubble through a fast native JS library with no iframe and no external dependencies - plus an HTTP API for executing bots programmatically from any language. Theming covers fonts, colors, roundness, and shadows with custom CSS and reusable templates, and results arrive in real time with drop-off and completion analytics plus CSV export. Two Next.js apps (builder and viewer) self-host via Docker under the Functional Source License, which converts to Apache 2.0 after two years.

Autonomous red team execution without manual script coordination is what PentaGI delivers through a multi-agent penetration testing platform engineered for automated security assessments. Security engineers configure testing scopes, target IP ranges, domain lists, and rules of engagement through an interactive web console with real-time execution graphs. Autonomous agent personas break down high-level assessment goals into discrete tactical phases, orchestrating network port discovery, service banner fingerprinting, web application crawling, and CVE verification. Specialized agents query integrated Graphiti knowledge graphs and local vulnerability repositories to synthesize attack paths, validate exploitability, and confirm finding veracity before issuing alerts. Operators monitor live agent terminal streams, inspect sandboxed tool executions, and adjust active LLM provider routes across OpenAI, Anthropic, or local Ollama endpoints. The template editor allows red teams to compose reusable testing playbooks with customizable security prompt chains, safety constraints, and automated remediation reporting. Audit logs capture full command histories, raw tool outputs, and LLM reasoning steps to generate compliance-ready technical documentation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Quote to cash in one web application - create quotes, convert them to invoices, record payments, track customers: iDURAR is an open-source ERP and CRM platform for small and medium-sized businesses. Built on the MERN stack (MongoDB, Express, React, Node.js) with Ant Design components and Redux state management, it presents a clean SaaS-style interface that needs little onboarding. Core modules cover invoice management with PDF generation and email delivery, payment recording against invoices, quote and proforma handling, customer records, and accounting views over the resulting data. Multi-currency support and localization make it usable for internationally operating teams. Because the whole stack is JavaScript with an API-first backend, extending it - custom fields, new modules, integrations - is approachable for any Node/React developer rather than requiring a specialist ERP skill set. Deployment is straightforward via Docker with a MongoDB instance. Licensed under AGPL-3.0 with free commercial use; a hosted enterprise version exists but the self-hosted edition is fully functional.

A pile of paper becomes a searchable digital archive under Paperless-ngx, the community-maintained document management system. The pipeline is what makes it work: drop a file into the consumption folder (or let it poll an email inbox), and a worker hashes it for duplicate detection, routes it by type, runs OCRmyPDF with Tesseract (100+ languages) on anything without a text layer, and produces an archivable PDF/A with invisible selectable text embedded - so Ctrl+F works on your scans. Then the smart part: a scikit-learn classifier (TF-IDF plus multi-label prediction) trained on your own tagged documents automatically assigns tags, correspondents, and document types to new arrivals, alongside rule-based exact, keyword, and regex matching for deterministic cases. Full-text search includes relevance ranking, match highlighting, autocomplete, and "more like this" similarity search. Apache Tika integration extends consumption to Word, Excel, PowerPoint, and LibreOffice formats. The Django/Angular app adds custom fields, saved views on a customizable dashboard, bulk editing, workflow automation triggered on upload or matching, shareable public links with expiration, and a robust permissions system with per-document access control. Metadata lives in PostgreSQL with Redis-queued Celery workers processing documents in parallel. Your tax records, invoices, and contracts stay on your server - searchable in seconds, never in someone else's cloud.

Created by Uber Technologies and graduated as the seventh CNCF top-level project in October 2019 with over 23,000 GitHub stars, Jaeger has become one of the most widely deployed open-source distributed tracing platforms, processing billions of spans per day in production environments at organizations including Uber, Red Hat, and Shopify. Version 2 rebuilt the platform on the OpenTelemetry Collector framework, inheriting its extensible pipeline architecture while implementing Jaeger-specific features as extensions and components, enabling seamless integration with the OpenTelemetry ecosystem through native OTLP protocol support. The platform stores traces in Cassandra 4.0+, Elasticsearch 7.x/8.x, OpenSearch 1.0+, ClickHouse, or the embedded Badger database for development setups. Three sampling strategies control trace volume: head-based sampling with constant, probabilistic, and rate-limiting modes, tail-based sampling using the OpenTelemetry Collector processor that evaluates complete traces before storage decisions, and adaptive sampling that dynamically adjusts probabilities based on observed traffic patterns. Service Performance Monitoring computes RED metrics directly from spans, displaying request rates, error rates, and latency percentiles in the Monitor tab with drill-down from aggregate service views to individual traces. The web UI provides trace search with multi-field filtering, trace detail views with span timeline visualization, trace comparison across services, and dependency graphs mapping service relationships from actual traffic. Deployment options range from a single all-in-one binary for development to distributed collector-ingester-query configurations with Kafka intermediate buffering for production scale. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Designed as a unified personal AI workstation, QwenPaw operates as an autonomous digital copilot that coordinates scheduled automations, interactive coding sessions, and multi-channel team communication across everyday messaging apps. Users can dispatch long-running research tasks, process office documents including PDF, Excel, and Word files, and execute browser-based data collection without manual intervention. The built-in web console and terminal interface provide full visibility into agent reasoning, allowing operators to inspect intermediate thinking steps, review proposed file edits, and approve sensitive tool calls. Through direct connectors for Discord, Telegram, DingTalk, Lark, and WeChat, teams can trigger specialized skills or query shared workspaces directly from their existing group channels. A self-evolving personal memory system continuously indexes chat interactions and local resources into editable Markdown files, ensuring knowledge persists across restarts and task delegations. Built-in guardrails including a sandboxed execution runtime, tool access policies, and automated skill scanners protect underlying host files from unauthorized modifications during autonomous scripting runs. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Cognee gives AI agents persistent long-term memory that survives across sessions, replacing the traditional stack of separate graph, vector, and session databases with a unified engine running on a single PostgreSQL instance. The memory-native API exposes four verbs (remember, recall, forget, and improve) enabling agents to persist context, retrieve cited answers, prune outdated knowledge, and self-improve from feedback. Under the hood, Cognee combines pgvector embeddings with a PostgreSQL-native graph store and cognitive-science-grounded ontology generation, delivering hybrid retrieval that fuses semantic similarity, structural graph traversal, and lexical search in a single query. Integrations span Claude Code, Cursor, LangGraph, OpenAI Agents, and any MCP-compatible client through a dedicated MCP server on port 8001, while the Python and TypeScript SDKs provide direct programmatic access. The platform supports swappable backends including Neo4j, FalkorDB, Qdrant, ChromaDB, Weaviate, Milvus, and LanceDB for teams with existing infrastructure. Built-in OpenTelemetry tracing, an experimental dashboard with knowledge graph visualization, multi-tenant user isolation, and audit trails ensure production readiness. Deploy via Docker Compose with optional profiles for PostgreSQL, Neo4j, Redis, and the web frontend. Reached v1.0 in April 2026 with 30,000+ stars. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

In continuous open-source development since 2009, Etherpad is the original really-real-time collaborative editor - used by Wikimedia, governments, EU public-sector institutions, and tens of thousands of self-hosters. Its core idea is visible authorship: every keystroke is attributed with author colors, every revision preserved, and the timeslider lets you scrub through a document's entire history character by character. Multiple people type into the same pad and see each other's changes instantly - it scales to thousands of simultaneous editors per pad. The base install is deliberately lightweight; capability comes from roughly 290 plugins installable from the admin web UI: comments, images, tables, drawing, video chat via WebRTC, math rendering, code highlighting, and authentication via OAuth, LDAP, or OpenID. AI is pointedly a plugin, not a default - you choose the model and infrastructure, or never turn it on. There is no telemetry. For integrators, an HTTP API (with OpenAPI definitions at /api/openapi.json) manages pads, users, and groups for embedding in your own applications, and the ueberDB abstraction layer supports PostgreSQL, MySQL, Redis, MongoDB, and SQLite backends. Full data export is built in, the format is open, it is translated into 105 languages, and it runs on anything from a Raspberry Pi to a server farm. Apache 2.0 licensed, Node.js based.

A PostgreSQL database becomes a production-grade GraphQL API the moment Hasura GraphQL Engine points at it: track tables and relationships - existing schemas included - and full query, mutation, and subscription types appear with where, order_by, limit, offset, and on_conflict arguments, no resolvers or boilerplate written. Its Haskell core compiles GraphQL to efficient SQL, and any query becomes a real-time live query with a single keyword, powering dashboards and collaborative UIs over standard GraphQL subscriptions. Authorization is where Hasura earns its enterprise reputation: role-based access control with row- and column-level permission policies driven by session variables from JWTs, auth webhooks, or headers - each role effectively sees its own GraphQL schema containing only what it may touch, integrating cleanly with Auth0, Firebase, or homegrown auth. Event triggers fire webhooks on inserts, updates, and deletes for asynchronous business logic; Actions extend the schema with custom REST handlers; remote schema stitching merges external GraphQL services into one endpoint; and auto-generated REST endpoints serve clients that skip GraphQL. A browser console handles data modeling and API exploration, the CLI manages migrations and metadata as code, and deployment is a single stateless Docker container beside Postgres.

Backed by over 45,000 GitHub stars and described as the tool that replaces Notion, Evernote, and Anki in a single Docker container, SiYuan is the privacy-first knowledge management system where every paragraph, heading, and list item is a uniquely addressable content block. The block-level architecture enables bidirectional links, transclusion embeds, and SQL query blocks that dynamically aggregate content across your entire workspace, while the knowledge graph visualization maps relationship networks between documents and blocks. Built-in databases support table views with relation and rollup columns, filter composition, sorting, and template-based calculations for structured data management alongside freeform notes. The FSRS spaced repetition engine turns any content block into a flashcard with scientifically calibrated review scheduling, eliminating the need for separate memorization tools. AI integration connects to OpenAI-compatible APIs for writing assistance, translation, summarization, and Q&A chat, with semantic search using embeddings and reranking for intelligent content retrieval. The Bazaar community marketplace delivers plugins, themes, templates, and widgets through a managed extension system with TypeScript plugin APIs. End-to-end encrypted synchronization works across S3-compatible storage, WebDAV servers, or SiYuan's own cloud service, while Tesseract OCR extracts searchable text from images and the web clipper captures pages from Chrome, Edge, and Firefox. Export targets include Markdown with assets, PDF, Word, and HTML. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 27,000 GitHub stars and an ecosystem of 1,900+ plugins covering every major cloud provider, database, and SaaS platform, Kestra is the orchestration engine that brings Infrastructure as Code principles to workflow automation — defining complex multi-step pipelines in readable YAML that execute across any language, runtime, or infrastructure boundary. The built-in VS Code-style editor provides syntax highlighting, auto-completion, real-time validation, and an AI Copilot that generates workflow YAML from natural language descriptions. Tasks execute in Python, Node.js, Go, R, Shell, SQL, or any Docker container, with event-driven triggers listening for file arrivals on SFTP and cloud storage, messages from Kafka, Redis, Pulsar, AMQP, MQTT, NATS, AWS SQS, Google Pub/Sub, and Azure Event Hubs in real time. The topology view visualizes workflow DAGs with execution state, duration, and output artifacts for each task node. Namespaces organize workflows into isolated environments with configurable secrets, while subflows enable modular composition with inputs, outputs, and conditional branching. Retry policies, timeouts, error handlers, and automatic backfills for missed schedules ensure reliability across production workloads. Git integration pushes workflows directly to branches from the UI with CI/CD pipeline support for automated deployment. The REST API enables programmatic workflow management, execution triggering, and resource provisioning. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Every unit of income gets a job in Actual Budget - a local-first personal finance app built on envelope (zero-sum) budgeting, where you can only budget cash you actually have, which keeps the plan honest by construction. The data model is a SQLite file that lives on your device and works fully offline; the self-hosted Node.js sync server adds background multi-device synchronization using CRDT-based distributed-systems machinery, browser and mobile access as an installable web app, and automated backups. Optional end-to-end encryption makes the synced data unreadable even to the server hosting it. Transactions enter three ways: manual entry, file import (CSV, QIF, OFX, QFX, CAMT.053), or automatic bank syncing through GoCardless for EU/UK banks and SimpleFIN for US/Canada. Built-in YNAB4 and nYNAB importers migrate complete budget histories, and reports, schedules for recurring transactions, and rule-based transaction cleanup handle the day-to-day. A fully featured local API lets developers script custom importers and automation against their own data. 100% free, open source, and 26k stars strong.

Forum software rebuilt on the modern web stack: NodeBB runs the classic bulletin-board format - categories, threads, local accounts - in real time, on Node.js over MongoDB, Redis, or PostgreSQL. WebSockets stream new posts into open topics as they're written and deliver instant notifications for follows, likes, and subscriptions; built-in chat supports side-by-side private conversations. The headline of recent versions is core ActivityPub federation: your forum can follow, share, and converse with other NodeBB instances, Mastodon, Lemmy, and anything else that speaks the protocol, turning an isolated community into a fediverse node. Everything beyond the common core is a plugin - more than 500 plugins and themes install in one click from the admin panel, covering SSO providers, search backends like Elasticsearch and Solr, galleries, calendars, and more. The theming engine extends base templates with SCSS/CSS on Bootstrap 5, plus a drag-and-drop widget system and custom HTML/CSS/JS injection. Operators get a real-time analytics dashboard, human-readable SEO-friendly URLs with semantic markup, multilingual UI, and full read and write REST APIs for integration. Mobile-first rendering means the same install works everywhere. For communities that outgrew phpBB but don't want Discourse's weight, NodeBB is the natural middle.

Akaunting is an online accounting software for small businesses and freelancers. The double-entry accounting engine provides a full Chart of Accounts, journal entries, and balance sheet reporting, eliminating the manual errors inherent in single-entry systems. Unlimited invoice creation with customizable templates, automatic payment reminders, and client portal access lets businesses present professional documents and accept payments through PayPal, Stripe, and other gateway integrations. Expense tracking captures operational costs with category-based organization, receipt scanning, and vendor bill management with overdue payment alerts. Bank Feeds auto-syncs transactions from connected bank accounts and matches them against invoices and bills for streamlined reconciliation. The dashboard displays receivables, payables, cash flow summaries, profit and loss charts, expenses by category, and account balances at a glance with configurable date ranges. Quotes and estimates convert directly into invoices upon client approval, while recurring invoices and bills automate periodic billing without manual intervention. The modular architecture built on Laravel with the Akaunting Module package enables an App Store where developers publish extensions for payroll, inventory, projects, and CRM functionality. Multi-company support manages separate books from a single installation with per-company user roles. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSL licensed.

Your own Heroku or Vercel on a dedicated server — Dokploy is the open-source PaaS that replaces cloud platform subscriptions with a single dashboard you control. Point it at a Git repository or a Docker image, and it builds and deploys the application using Dockerfiles, Nixpacks, or Heroku/Paketo buildpacks. Traefik handles reverse proxying, routing, load balancing, automatic Let's Encrypt SSL, and HTTP/3. Databases — MySQL, PostgreSQL, MongoDB, MariaDB, libsql, and Redis — provision from the UI with automated backups to any S3-compatible destination. Complex multi-service applications deploy through native Docker Compose support, and multi-node scaling uses Docker Swarm. The web dashboard covers environment variables, volumes, resource limits, real-time CPU/memory/network monitoring, and deployment logs, with a CLI and REST API for automation. Deploy notifications go to Slack, Discord, Telegram, or email. One-click templates install common open-source tools, and a single control plane can manage deployments across multiple remote servers. Because everything is standard Docker, there is no lock-in: Dockerfiles, Compose files, and data volumes work anywhere else Docker runs. The push-to-deploy workflow of a $20/seat cloud PaaS, running on a dedicated VPS with guaranteed CPU, RAM, SSD, and full root access — no per-app, per-environment, or per-seat fees regardless of how many applications you deploy. 26,000+ GitHub stars.

With over 27,500 GitHub stars, 350 contributors, and 220 releases since 2022, InvokeAI delivers an industry-leading creative engine that serves as the foundation for multiple commercial AI art products. The web-based UI supports an extensive model ecosystem including Stable Diffusion 1.5 through 3.5, SDXL, Flux.1 Dev, Flux.1 Schnell, Flux.1 Kontext, Flux.2 Klein 4B and 9B, CogView 4, Z-Image, Anima, and Qwen Image — plus externally-hosted models from OpenAI GPT Image, Google Gemini, BytePlus, and Alibaba Cloud via API key integration. The Unified Canvas provides a fully integrated workspace with in-painting, out-painting, brush tools, layer management, and regional guidance for compositing AI-generated content with existing artwork. The node-based Workflow Editor enables building complex generation pipelines with branching logic, connecting text encoders, VAEs, ControlNets, IP-Adapters, and LoRA weights into reusable graphs. Model management handles automatic downloading from HuggingFace and Civitai with conversion between safetensors, diffusers, and checkpoint formats. The backend runs on Python with CUDA, ROCm, and MPS acceleration supporting NVIDIA, AMD, and Apple Silicon GPUs. Multi-user accounts allow shared access to a single InvokeAI server with per-user galleries and settings. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.