Personal, minimalist, database-free bookmarking - Shaarli is a philosophy as much as an app. Everything lives in a single compressed datastore file inside data/: no MySQL, no PostgreSQL, backup by copying one directory. That write-once/read-many file is usually served straight from OS disk caches, which is why a decade-old Shaarli instance with tens of thousands of links still responds instantly. Designed deliberately single-user, it saves URL, title, unlimited-length description, and tags (with autocomplete, renaming, and merging), marks entries public or private, and automatically strips utm_source and fb tracking parameters from saved URLs. That description field is why the community uses Shaarli as far more than bookmarks: a microblog, read-it-later queue, code-snippet base, pastebin, and shared clipboard between machines. Sharing is one click via bookmarklet or Android apps; consumption is per-tag RSS/Atom feeds plus a daily digest feed; search is full-text with tag filtering. A REST API opens it to any client, a plugin and theme system extends the PHP core (Markdown rendering, thumbnails), and import/export uses browser-standard Netscape HTML - your data enters and leaves freely. LDAP login is supported, no telemetry is sent anywhere, and the UI degrades gracefully without JavaScript. The anti-cloud Delicious.

Arcane gives you a single polished dashboard to manage Docker containers, images, volumes, networks, and Compose projects across unlimited remote hosts. The SvelteKit frontend paired with a Go backend delivers real-time resource monitoring with historical graphs, container lifecycle controls including shell exec and live log streaming, and one-click Docker Compose deployment with Git repository synchronization for version-controlled stack definitions. The manager-agent architecture connects remote environments via Direct TCP on port 3553 or Edge mode where agents initiate outbound gRPC/WebSocket connections through NAT and firewalls without requiring inbound ports, all secured with mTLS certificates. Vulnerability scanning identifies security issues in running container images directly from the interface. The backup system enables scheduled container snapshots with configurable retention for disaster recovery. Network and volume administration includes visual relationship mapping between services, and the responsive interface supports dark/light themes with full mobile optimization and community-driven internationalization via Crowdin. 6,500+ stars and 89 releases since April 2025 reflect a rapid development cadence. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.

Backed by over 8,700 GitHub stars and OpenID Connect certification, Pocket ID delivers what enterprise identity platforms like Keycloak provide but without the configuration complexity — a passkey-only OIDC provider purpose-built for homelabs and small deployments. The core design decision is radical simplicity: no passwords exist in the system, only WebAuthn-based passkeys using hardware security keys, TouchID, FaceID, or device PINs, making phishing attacks structurally impossible rather than merely discouraged. The Go backend built on the Gin framework serves a compiled SvelteKit frontend as static assets, running as a single Docker container with SQLite as the default database and optional PostgreSQL for larger deployments. User management supports manual creation, signup links, and open registration, with group-based access control that restricts which OIDC clients each group can access and attaches custom claims for downstream role mapping. LDAP synchronization pulls users and groups from OpenLDAP or Active Directory, while SCIM support enables automated provisioning from compatible identity sources. Federated client credentials handle machine-to-machine authentication for service-to-service communication patterns. The audit system logs every authentication event with GeoIP enrichment, sends email notifications for sign-ins from unknown devices, and provides one-time login codes for accessing accounts from devices without passkey support. TLS with HTTP/2 is built in, PKCE adds code exchange protection, and OpenTelemetry provides tracing and metrics integration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD 2-Clause licensed.

Backed by 4,800+ GitHub stars and trusted by teams replacing LaunchDarkly and Split with a self-hosted solution, Flipt v2 delivers the first truly Git-native feature management platform that treats feature flags as code stored in your own repositories. The architecture eliminates all database dependencies by building immutable in-memory snapshots from YAML flag definitions on every Git commit, delivering sub-millisecond evaluation latency with zero external runtime dependencies beyond the single Go binary. Multi-environment support maps directly to Git abstractions — separate repositories per environment, different directories within the same repository, or different branches — enabling teams to use their existing branching strategy, pull request workflows, and code review processes for flag changes. The evaluation engine supports boolean flags, multivariate string and numeric variants, segment-based targeting with constraint rules, percentage rollouts, and namespace isolation. Native SCM integration with GitHub, GitLab, BitBucket, Azure DevOps, and Gitea creates merge proposals directly from the UI with GPG-signed commits. Flipt implements the OpenFeature Remote Evaluation Protocol with official providers for Go, Node.js, Python, Java, C#, Ruby, and Web SDKs, enabling vendor-agnostic flag evaluation across all services. The gRPC API with REST HTTP gateway exposes flag management, evaluation, and analytics endpoints. Offline mode continues serving flags when the source repository is temporarily unavailable. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Fair Core License (server) / MIT (client SDKs).

Receipts, contracts, and letters that arrive as pixels rather than text: Papermerge is a document management system built specifically for scanned documents. Upload a PDF, TIFF, JPEG, or PNG and OCR runs automatically, with a real-time status indicator beside the document title; under the hood it drives OCRmyPDF and Tesseract, supporting 130+ languages and producing a new document version with a selectable, searchable text layer you can download. Full-text search runs across everything, with multiple search-engine backends (Xapian by default). The interface deliberately mimics a modern desktop file browser: dual-panel commander, drag and drop, hierarchical folders, and colored tags on documents and folders. Page management fixes what scanners get wrong - delete blank pages, rotate, reorder, merge, extract, and move strayed pages between documents, powered by PikePDF. Document types act as categories, each with its own custom metadata fields, so invoices carry vendor and amount while contracts carry parties and dates. Versioning preserves every state of a document. Multi-user support includes groups, group ownership, permission management, and document/folder sharing between users and groups, and an OpenAPI-compliant REST API automates ingestion from scanners or scripts. Apache-licensed, ideal for long-term digital archives.

Winner of the 2015 Most Valued Agile Tool award and cited as a top project management platform by Opensource.com with over 2,100 GitHub stars on the Docker deployment repository alone, Taiga has served an estimated 20 million users worldwide with over 2 million Docker pulls since its creation in 2014 by Kaleidos. The platform delivers a complete agile project management experience through Scrum boards with backlog prioritization, sprint planning, story point estimation configurable per role, burndown charts at both project and sprint levels, and velocity tracking with a project doom-line indicator. Kanban boards offer customizable workflow columns with swimlanes, WIP limits, zoom controls, and the ability to switch between Scrum and Kanban at any point without losing data. The issue tracker supports custom types, priorities, and severities with the ability to promote issues directly to user stories. Team collaboration features include threaded comments, file attachments, email notifications, mentions, a built-in wiki for project documentation, and a team performance dashboard with the Iocane health metric for tracking team sustainability. The platform integrates with GitHub, GitLab, and Bitbucket for version control linking, provides importers for migrating from Trello and Jira, and exposes a REST API for custom integrations. Available in over 20 languages with custom fields, tags, roles, and permissions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MPL-2.0 licensed.

With nearly 3,000 GitHub stars and 14 releases since its June 2025 launch, Kite delivers a lightweight Kubernetes dashboard that replaces the fragmented workflow of switching between kubectl, Lens, and separate monitoring tools with a unified multi-cluster management platform. The dashboard automatically discovers clusters from kubeconfig files and supports independent Prometheus configurations per cluster, providing real-time CPU, memory, and network charts alongside live pod log streaming with filtering and search. A built-in web terminal opens shells directly into pods and nodes without kubectl port-forward, while the Monaco-based YAML editor offers syntax highlighting and validation for in-place resource editing. The integrated AI agent, powered by OpenAI or Anthropic models via native Go SDK integrations, translates natural language into precise client-go API calls — querying cluster health, analyzing pod logs, scaling deployments, patching resources, and cleaning up failed jobs — all operating strictly within the logged-in user's RBAC permissions. Enterprise governance includes OAuth 2.0 single sign-on, multi-factor authentication, FIDO2 passkeys, granular role-based access control with per-namespace permissions, and comprehensive audit logging. Helm chart management enables browsing, installing, and upgrading releases directly from the UI, while the Docker registry integration provides quick image tag selection. Deploy via a single Docker container with SQLite or use the official OCI Helm chart with PostgreSQL or MySQL for production. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Seanime turns your server into a dedicated anime and manga command center, combining local library management, torrent streaming, an integrated manga reader, and AniList progress tracking in a single self-hosted web application. Point it at your media folders and the smart scanner automatically identifies and matches your anime files to AniList entries without requiring strict naming conventions or folder hierarchies. Stream episodes directly from torrents through qBittorrent, Transmission, Torbox, Real-Debrid, AllDebrid, or Premiumize; the built-in player starts playback before the download finishes, so there is no waiting for full transfers. The manga reader pulls chapters from community extension sources and tracks your reading progress across series automatically. An in-app extension marketplace lets you install third-party providers for streaming, manga, and torrent sources, all written in JavaScript and managed through a visual interface. Seanime Tenji, the companion mobile app for iOS and Android, connects to your server for on-the-go library browsing, content streaming, and offline downloads. Auto-download rules grab new episodes of airing series the moment torrents appear. The transcoding engine handles on-the-fly conversion for browser playback on any device, while direct play passes through compatible formats at full quality. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

A single pane of glass for every service you run, arranged by drag-and-drop with no YAML or JSON files: Homarr is the modern dashboard for self-hosted infrastructure. Its grid system arranges apps, widgets, and bookmarks on desktop or touch, backed by an icon picker with over 11,000 icons. What separates Homarr from static launchers is 50+ live integrations: Plex, Jellyfin, and Emby media stats, the *arr suite (Sonarr, Radarr) with a unified release calendar, download clients, Pi-hole and AdGuard Home controls, Proxmox, Home Assistant, OPNsense, and Unifi monitoring. Widgets update in real time over WebSockets (tRPC and Redis under the hood), and a built-in search queries thousands of data points across connected services. Custom widgets extend the reach to any HTTP API without code: define endpoint, auth, and refresh interval in the management UI, then render responses as stat grids, tables, progress bars, status indicators, action buttons, or full custom JSX layouts - with an AI-prompt helper for generating templates. Multi-user support is first-class: credentials, OIDC, or LDAP sign-on, groups with granular permissions, and secrets encrypted with AES-256-CBC. A robust background-job system scales it from a Raspberry Pi homelab to deployments serving hundreds of users.

2FAuth generates TOTP, HOTP, and Steam Guard codes from any web browser, freeing your two-factor authentication from dependence on a single smartphone or app. Lose your phone, switch devices, or sit at a desktop computer, and your 2FA codes remain accessible through the web interface. The Laravel and Vue.js application stores account secrets in an encrypted SQLite database that backs up as a single file. Adding accounts works through camera-based QR scanning or manual secret key entry for services that only provide text codes. Group organization with drag-and-drop sorting keeps large collections navigable, categorized however you prefer. WebAuthn authentication with FIDO2 hardware keys protects vault access with phishing-resistant passwordless login, meaning the tool that secures your accounts is itself secured by the strongest available method. Automatic screen lock triggers after configurable idle time, and OTP obfuscation dots out generated codes until you tap to reveal them, preventing shoulder surfing in shared spaces. The REST API enables browser extensions and external applications to request codes programmatically. Import compatibility with Google Authenticator, Aegis, and 2FAS ensures painless migration without re-enrolling every account from scratch. PWA installation places 2FAuth on your device home screen for native-app-like instant access. Runs on a dedicated RepoCloud VPS with guaranteed resources and full root SSH access. AGPL-3.0 licensed.

Its author, a student and WakaTime fan, didn't want to pay $9/month for data about his own keystrokes - so Wakapi was born, a self-hosted, WakaTime-compatible backend for coding statistics. The compatibility is the killer design decision: the official WakaTime plugins for VS Code, JetBrains IDEs, Vim, and dozens of other editors work unmodified - just point the plugin's API URL at your Wakapi instance with your personal key, and heartbeats flow to your server instead of a third party's. Duration inference matches WakaTime's own algorithm, with a configurable timeout (10 minutes by default). From that stream Wakapi builds statistics and plots across projects, languages, editors, hosts, and operating systems, plus the fun extras: public leaderboards (optionally login-gated, with configurable aggregation windows), badges for GitHub readmes, and weekly email reports. A REST API serves your data programmatically, Prometheus export feeds your existing Grafana, and a WakaTime relay mode can mirror heartbeats to both services during migration - with one-click import of historical WakaTime data. Written in Go, it is lightning fast and light enough for the smallest instance, storing to SQLite, PostgreSQL, or MySQL, with configurable data retention for GDPR peace of mind. Deliberately smaller than WakaTime, deliberately yours.

A polished public status page without Statuspage prices or a heavyweight observability suite: Kener is a status and uptime monitoring system built with SvelteKit and Node.js. It runs 11 monitor types - API, Ping, TCP, DNS, SSL certificate, SQL query, Heartbeat, gRPC, and GameDig game-server checks among them - each with configurable intervals and thresholds. Incident management covers the full lifecycle: structured timelines from investigation through resolution, acknowledgements, and subscriber-visible updates, plus maintenance windows with RRULE-based recurring schedules and automatic status transitions. Notifications reach email, Slack, Discord, and custom webhooks through trigger-based workflows with template-driven messaging. One instance can serve multiple branded status pages - per product, team, or region - with custom logos, colors, and CSS, localization into 21 languages, timezone-aware displays, and server-rendered pages that stay fast and SEO-friendly. Operations tooling includes role-based access for teams, API key management, a secrets vault, analytics integrations (Google Analytics, Plausible, Umami, and others), and a REST API with 17+ endpoints for automating incidents and monitors from CI/CD. MIT-licensed; Docker deployment with Redis, SQLite by default, PostgreSQL or MySQL for production.

ToolHive is an open-source MCP server management platform that lets you run, secure, and orchestrate Model Context Protocol servers in isolated containers, giving AI agents structured access to tools like GitHub, databases, and cloud services without exposing host credentials or network. Every server launches inside its own sandboxed container with a minimal permission file, network access filtering, and encrypted secrets management, preventing misbehaving connectors from reaching beyond their defined scope. The built-in registry provides a catalog of vetted servers you can install with one command, while custom images and package-manager references let you onboard proprietary connectors without writing Dockerfiles. Platform teams deploy the Kubernetes operator to declare MCP servers as cluster resources using Custom Resource Definitions, with automated lifecycle management and multi-namespace isolation. The Virtual MCP Server gateway aggregates multiple backends behind a single endpoint, centralizing OIDC authentication, tool filtering, and composite cross-server workflows so clients connect once instead of juggling separate URLs. An MCP Optimizer analyzes tool schemas via semantic search and surfaces only relevant tools per request, cutting token consumption by up to 85%. OpenTelemetry traces and Prometheus metrics deliver full visibility into tool execution, latency, and request audit trails across every managed server. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Comments for small sites without Disqus's baggage: Cusdis is a lightweight, privacy-first, open-source comment system for embedding under blog posts and articles. The embedded JavaScript SDK is about 5 KB gzipped (Disqus is roughly 24 KB), sets no cookies, runs no tracking, and does not require readers to create an account or sign in before commenting. Integration is two lines: a container div with your app ID and an async script tag, with ready-made adapters for common frameworks and static site generators. Moderation is approval-based - new comments stay hidden until you approve them from the dashboard, and email notifications include a Quick Approve link that approves or replies to a comment from your phone without logging in. A webhook fires on every new comment for integrations like Telegram notifications. The widget ships with built-in i18n and dark mode. The stack is TypeScript and Next.js with a Prisma data layer, deployable via Docker with PostgreSQL. Deliberately minimalist: no ads, no reader profiling, and your comment data lives in your own database.

Unlimited domains, unlimited keywords, daily Google position checks with stored history and trend charts: SerpBear is an open-source search engine rank tracker. Retrieval works through your choice of third-party SERP APIs - ScrapingAnt, ScrapingRobot, SerpApi, SearchApi, HasData - or your own proxy IP pool, and a flexible scrape-strategy system (Basic, Custom, or Smart, set globally or per domain) works around Google's removal of the 100-results-per-page parameter by choosing how many pages to check per keyword. Google Search Console integration adds real visit counts, impressions, and click-through rates per tracked keyword and surfaces top-performing pages and countries; Google Ads integration supplies monthly search volumes and auto-generates keyword ideas from your site's content. Email notifications report position changes daily, weekly, or monthly, a built-in REST API feeds dashboards and reporting tools, and data exports to CSV. Built with Next.js on SQLite, deployed via Docker, installable as a PWA on mobile - with no per-keyword or monthly SaaS fees.

With 1,200+ GitHub stars since its April 2026 launch, Arkon provides an enterprise-grade knowledge management layer that turns scattered organizational documentation into AI-accessible structured context. The platform runs as a centralized MCP server, compiling your SOPs, policies, technical docs, and institutional knowledge into a versioned wiki with draft-approval workflows, then serving that wiki to Claude Desktop, Claude.ai, Cursor, and any MCP-compatible client through a single permission-scoped endpoint. OAuth 2.1 with PKCE authentication eliminates manual token management — employees authenticate through a browser login while the system discovers endpoints automatically via RFC 8414. The RBAC v2 system supports custom roles with granular permissions, department-scoped AI Skills, workspace isolation, and comprehensive audit logging so every query and access event is traceable. RAG retrieval powered by pgvector embeddings enables AI clients to search across all organizational documents with source attribution, while the AI Skills system lets teams define reusable instruction sets scoped to specific departments or roles. The architecture runs seven Docker containers coordinated by Compose: PostgreSQL with pgvector for embeddings and metadata, Redis for caching, MinIO for document storage, a FastAPI backend, two ARQ async workers for embedding generation and document processing, and a Next.js frontend portal accessible on port 3119. API keys are encrypted at rest with Fernet, and no telemetry leaves the deployment. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. PolyForm Internal Use licensed.

Backed by Y Combinator with 4,300 GitHub stars and growing rapidly since its September 2024 launch, Briefer delivers the first truly unified notebook-and-dashboard platform that eliminates the fragmented workflow of juggling Jupyter for analysis, Tableau for visualization, and Notion for documentation — combining all three in a single Notion-like workspace where SQL query results automatically become Python DataFrames accessible in subsequent code blocks. The built-in AI analyst understands your database schema and notebook context to generate SQL queries, write Python transformations, create visualizations, and fix errors on demand using configurable OpenAI or private LLM backends. Connect directly to PostgreSQL, MySQL, BigQuery, Redshift, Snowflake, and Amazon Athena as data sources, or upload CSV files for immediate analysis. Native point-and-click visualizations produce charts, tables, and dashboards without writing code, while interactive data apps use inputs, dropdowns, and date pickers to create parameterized reports for non-technical stakeholders. Scheduled execution runs notebooks and dashboards periodically with results delivered via Slack integration or public shareable links. Write-back queries modify production data directly from notebooks for ad-hoc pipeline testing. The architecture runs as three Docker containers — web frontend, API server, and optional AI service — backed by PostgreSQL and a Jupyter server for Python execution, deployable via single Docker command, Docker Compose, or Helm charts for Kubernetes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPLv3 licensed.

CheckCle provides a complete uptime monitoring and infrastructure observability platform that deploys with a single Docker container and stores all data in embedded SQLite via PocketBase. The Go backend runs three microservices — a service operation engine handling HTTP, HTTPS, DNS, Ping, and TCP checks at configurable intervals, a distributed regional check agent for multi-location network testing, and a server monitoring agent collecting CPU, RAM, disk usage, and network metrics via gRPC. The React frontend built with Vite, TypeScript, Tailwind CSS, and shadcn-ui subscribes to PocketBase WebSocket endpoints for real-time dashboard updates without polling. SSL and domain monitoring tracks certificate issuers, expiration dates, days remaining, and validation status. The incident management system records UP, DOWN, WARNING, and PAUSE states with full history, while scheduled maintenance windows prevent false alerts during planned downtime. Public status pages provide external stakeholders with live service health information. Health heatmaps visualize uptime performance and outage patterns over time. Notification channels include email, Telegram, Discord, and Slack, with multiple alert targets per monitored service. The one-click agent installation script supports Debian, Ubuntu, CentOS, Red Hat, Alpine, and Windows in beta. Docker deployment runs on port 8090 with a single persistent volume at /mnt/pb_data, requiring minimum 1 vCPU and 500MB RAM. On RepoCloud, deploy CheckCle on a dedicated VPS with root SSH access, persistent storage for your monitoring database, and complete control over agent endpoints and notification configurations, all under the MIT license.