Cerbos decouples authorization logic from application code entirely, evaluating human-readable YAML policies in under one millisecond through a stateless Policy Decision Point that requires no application state synchronization or cross-network fan-out. Its custom decision engine benchmarks up to 17x faster than OPA-based alternatives. Access control policies use conditions expressed in Google's Common Expression Language, supporting role-based, attribute-based, and policy-based access control patterns including derived roles, scoped policies, and permissions-aware data filtering that pushes authorization predicates directly into database queries. The PDP exposes both gRPC and HTTP APIs with SDKs for JavaScript, Python, Go, Java, .NET, Rust, PHP, and Ruby, making integration a single function call regardless of tech stack. GitOps-native workflows treat policies as code with Git versioning, CI validation through GitHub Actions, coverage reports, breaking-change detection, and audit logs of every authorization decision for ISO27001, SOC2, and HIPAA compliance. Deployment flexibility spans Kubernetes sidecars, standalone services, systemd daemons, AWS Lambda functions, and WebAssembly-embedded PDPs that run authorization logic directly in browsers, serverless architectures, and edge devices. The Admin API manages policy lifecycle operations programmatically, while the built-in Playground and REPL provide interactive testing environments for policy authoring and debugging. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

To explore years of personal music streaming habits without waiting for an annual year-end summary, Your Spotify continuously tracks your listening history and presents it inside a private analytics dashboard. Music enthusiasts use the interface to inspect daily, weekly, monthly, and custom date-range breakdowns of their most played tracks, top artists, favorite albums, and total listening duration. Listeners who want their complete historical archive from day one can upload official Spotify privacy data exports, including both past-year StreamingHistory JSON files and multi-year Extended Streaming History archives, directly through the settings panel. Friends and family sharing an instance can use the collaborative affinity view to compare overlapping listening habits across multiple accounts in intersection or union mode. From any historical table, top-tracks ranking, or multi-user affinity comparison, you can generate new playlists directly inside your Spotify account or trigger track playback on active devices. Administrators can manage user registrations, generate shareable public guest tokens for read-only dashboard access, blacklist specific artists from skewing statistics, and expose ingestion metrics to Prometheus. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Every DJI and Litchi flight you have ever logged becomes a searchable dashboard on your own server with Open DroneLog, a free, open-source alternative to DroneLogbook, Airdata UAV, and Flight Reader. Drop in DJI .txt logs, Litchi CSV files, or Airdata CSV exports and units are detected automatically, while deduplication on drone serial, battery serial, and start time lets you re-import a folder without duplicate flights. Each flight opens as a 3D terrain map with satellite, topographic, and OpenStreetMap layers, then replays from 0.5x to 16x speed with live telemetry and an RC joystick overlay. Synchronized charts plot height, speed, battery cell voltages, attitude, RC signal, GPS, and distance to home, with drag-to-zoom. Filters narrow flights by date, drone, battery, controller, duration, altitude, distance, tag, or map area, and automatic tags such as Night Flight and Low Battery arrive with offline reverse-geocoded locations. The overview dashboard adds an activity heatmap, per-drone and per-battery charts, and a cluster map. Battery health bars track cycle counts and capacity history, and maintenance thresholds show as color-coded progress bars. Export flights as CSV, JSON, GPX, or KML, build printable HTML flight reports that save as PDF, or generate a FlyCard image for social media. A sync folder imports new logs automatically, pilot profiles can sit behind passwords, and full-database backup and restore moves data between desktop and Docker. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

A plain text journal is all Paisa needs to put your net worth, cash flow, expenses, and investment returns on one set of dashboards. Write entries in the built-in editor. It brings syntax highlighting, auto completion, error checking, and auto formatting to double-entry journals. Bank and credit card statements in CSV, Excel, or PDF import through reusable templates that categorize every transaction. Price providers track mutual funds, NPS holdings, and stocks. Manual prices revalue a house, a car, or a plot of land. Budgets set a limit for each category and track spending against it. Allocation targets show how far a debt and equity split has drifted. Goals compute a completion date from monthly savings. The retirement planner works from a safe withdrawal rate and yearly expenses. A calendar marks recurring bills as cleared, late, past due, or upcoming, and Liabilities pages cover credit cards, loan repayment, and interest. Live Sheets calculate taxes and EMIs from ledger data. Journals and settings stay in plain text files that can be version controlled or shared, and ledger, hledger, and beancount are all supported. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0-or-later licensed.

With over 4,300 GitHub stars and a v3 release adding built-in user management, team views, and multi-language support, Kubero has established itself as the most feature-complete open-source Heroku alternative running natively on Kubernetes. The platform operates as a Kubernetes operator with two containers — kubero-ui and the operator — storing all state in etcd without an external database. Developers push code via Git integration with GitHub, GitLab, Bitea, or Gitea, and Kubero automatically builds using Buildpacks, Nixpacks, Runpacks, or Dockerfiles, then deploys to the configured domain with SSL via cert-manager. CI/CD pipelines support up to four staging environments — review, test, staging, and production — with per-stage environment variable isolation and ephemeral review apps that spin up on pull request open and tear down on close. The template catalog includes over 170 pre-configured applications like WordPress, Grafana, and PostgreSQL deployable in one click, while managed add-ons provide highly available PostgreSQL, Redis, MySQL, Kafka, CouchDB, Elasticsearch, and MongoDB alongside your applications. Security features include Trivy vulnerability scanning, GitHub and OAuth2 single sign-on, basic auth, and a role-based permission system with API tokens. The NestJS backend with Vue.js and Vuetify frontend provides application metrics, real-time logs, a built-in web console for container access, scheduled cronjob management, and deployment notifications via Discord, Slack, or webhooks. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

"The easiest music streaming server available" is mStream's own billing, and the claim holds up: a lightweight Node.js app that turns a folder of audio files into a private streaming service in minutes, no external database required. Its filesystem-based design is the clever part - the API mirrors your folder structure, so you can browse and play music immediately, before any library scan finishes, and your organization on disk is your organization in the app. It streams flac, mp3, wav, ogg, opus, aac, and m4a, which matters to the audiophile crowd: FLAC plays uncompressed, bit-perfect, with gapless playback for live albums and continuous mixes. The web player runs anywhere a browser does and packs personality - a Milkdrop-style visualizer (Butterchurn), playlist sharing via links, and drag-and-drop uploads straight through the file explorer. Native iOS and Android apps add the feature streaming subscriptions can't match: sync your collection to your phone for true offline playback of music you own. Multi-user support assigns separate directories and permissions per account. Resource usage is famously light - mStream is tested on multi-terabyte libraries and runs happily on a Raspberry Pi, so a small RepoCloud instance serves a lifetime's collection. GPL-licensed, with zero listening-habit telemetry.

Replace a dozen household subscriptions with one app that keeps your family's tasks, calendars, meals, budget, and shopping in a single private place you control. Nineteen modules cover the daily rhythms of a household: assign chores with deadlines and priorities, plan the week's dinners and push the ingredients to a shared shopping list in one tap, track income and expenses by category with automatic subscription renewal warnings, and log health activities from vitals to medications. Two-way sync connects to Google Calendar via OAuth, iCloud and Nextcloud via CalDAV, and Outlook via Microsoft Graph, so every family member's phone shows the same schedule without switching apps. CardDAV keeps contacts in sync with external address books. The budget module handles accounts, loans, split expenses, and per-category planning with savings goals and month-over-month comparisons. Documents attach to tasks, receipts link to transactions, and a checked-off grocery item books itself back into the pantry inventory with its quantity. A Kanban board, recurring task schedules, and a rewards ledger that pays out points for completed chores keep kids and adults accountable. Wall mode turns a kitchen tablet into a glanceable family dashboard, and the Immich screensaver shows your own photos when the screen goes idle. API tokens and a built-in MCP endpoint let AI agents and third-party tools interact with every module programmatically. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Artalk embeds a full commenting system into any webpage with three lines of JavaScript, packing multi-site management, social login, spam filtering, and Markdown rendering into a client that weighs roughly 40KB. One server instance manages comments for unlimited websites with complete data isolation between sites, eliminating the need for separate deployments per project. The framework-agnostic Vanilla JS client renders a complete comment interface with Markdown support, LaTeX mathematical formula rendering, image uploads, emoji packs compatible with OwO format, and automatic dark mode detection. An integrated admin dashboard accessible through the comment box provides comment moderation queues, IP banning, comment pinning, page-level statistics, and content management without direct database access. Social login authenticates commenters through GitHub, Google, Twitter, Discord, and additional OAuth providers, while captcha protection spans four backends: image captcha, Cloudflare Turnstile, Google reCAPTCHA, and hCaptcha. Spam filtering layers include Akismet integration, keyword block lists, and cloud moderation services that catch unwanted content before publication. Email notifications support SMTP, Aliyun DM, and Sendmail transports with customizable templates, and multi-channel push notifications extend to Telegram, Bark, and other messaging platforms. The OpenAPI-documented HTTP API enables programmatic comment management. Database flexibility covers SQLite, MySQL, PostgreSQL, and SQL Server. A plugin marketplace offers community extensions for custom behavior. Continuously maintained for over 8 years. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

A trading journal you host yourself, Trade Journal rebuilds broker fills and statement exports into round-trip trades, a profit and loss calendar, and daily notes that show what actually works. Read-only sync covers more than twenty brokers and exchanges, including Alpaca, Binance, Coinbase, Kraken, and IBKR Flex. Statement import auto-detects TradingView, MetaTrader, NinjaTrader, Tradovate, and thinkorswim files, handles TradeZella and Tradervue CSV migrations, and maps columns for anything else. Trades can be matched first-in-first-out, last-in-first-out, or by weighted average, with partial fills, scale-ins, and futures multipliers handled. The dashboard offers gauges, cumulative and daily P&L, an Edge Score radar, and cards you can rearrange into named layouts, while Reports break results down by symbol, tag, mistake, playbook, weekday, and time of day. Each trade page charts entries and exits and can replay candles you load, with estimated MAE and MFE. Daily journal pages hold Markdown notes, templates, attachments, and voice dictation, and optional AI recaps use your own Anthropic or OpenAI key or a local Ollama model. Playbook checklists score rule adherence, a prop firm ledger tracks costs and payouts, and privacy mode masks every amount. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Preventing silent link rot across research libraries, LinkAce captures, indexes, and permanently archives web discoveries into searchable multi-user collections with automated Wayback Machine snapshots. Curators bookmark articles, documentation, tools, and media using custom browser bookmarklets or quick-add input fields that automatically scrape page titles and metadata descriptions. The built-in link monitor continuously checks saved endpoints for HTTP status anomalies, alerting curators whenever destinations move, throw server errors, or vanish from the live internet. For long-term preservation, the system dispatches automated backup requests to the Internet Archive Wayback Machine to capture historical copies of critical research material. Curators organize their library using nested lists and granular tag hierarchies, switching seamlessly between compact tables, detailed reading feeds, and visual card layouts. Teams and households can create separate user accounts to collaborate on shared collections, delegating read-only or editing privileges per list. The platform also generates individualized RSS feeds for public or private bookmark streams, synchronizes external data through a tokenized REST API, and dispatches automated database dumps to AWS S3 storage buckets. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

One clean interface in front of Anthropic, OpenAI, Google Gemini, Cohere, and more: Chat Chat is a Next.js front door to the major AI providers, ending the juggling of separate subscriptions, tabs, and UIs per model. Bring your own API keys, pick a provider and model per conversation, and switch between them as the task demands: Claude for long-form reasoning, GPT for code, Gemini for multimodal work - the interface stays identical. Beyond configured presets, custom providers plug in with their own API endpoints and keys, which covers OpenAI-compatible gateways and local inference servers. The design splits into two dedicated modes: a chat interface for conversational work with customizable system prompts, and a search interface that pairs AI processing with query handling for research-style questions. The stack is modern and hackable - Next.js 14, Tailwind CSS, shadcn/ui on Radix primitives, Jotai for state - with full internationalization including English, Chinese, and Japanese. Self-hosting means your conversation history and API keys live on your instance rather than a third-party wrapper service, and pay-per-token API pricing typically beats stacking multiple monthly chat subscriptions. AGPL-licensed and deliberately simple to deploy: one container, environment variables for keys, done.

Getting non-technical friends and family onto a media server is its most tedious chore - Wizarr solves it. Instead of manually creating accounts, dictating server addresses, and explaining which app to install, you send one invite link. When the recipient clicks it, Wizarr creates their account on your server automatically - Plex, Jellyfin, Emby, Audiobookshelf, Komga, Kavita, and Romm are all supported - then walks them through a mobile-first, app-like onboarding wizard: download the right client, sign in, and learn how to request movies through your Overseerr or Ombi instance, with an optional Discord server invite along the way. Invitations are genuinely manageable: set expiration dates, usage limits, passphrases, library-scoped access tiers, and time-limited memberships that end access automatically. The wizard itself is fully customizable - Markdown-based steps managed from the admin UI, organized into pre-invite and post-invite phases (terms of service before joining, app setup after), reorderable bundles assignable to specific invitation types, and combined flows for invites spanning multiple servers. Multi-server and multi-admin support manages several backends from one dashboard, SSO support is plug-and-play, and a REST API with OpenAPI/Swagger documentation covers automation. A Flask/HTMX app in a single Docker container.

TryPost is an open-source social media scheduler that publishes natively to thirteen networks from one composer, calendar, and queue, whether the author is a person on your team or an AI agent connected over MCP. Write a post once and it adapts per network, with a live preview of each version, character quirks handled, and an AI assistant in the editor to rephrase, shorten, or expand when a caption fights back. Posts land on each channel's own posting times in its queue, the calendar shows the whole month at a glance, and anything can be dragged to a new slot when plans change. Members who need a second opinion send work for approval, and admins approve or reject in one click, which is how agencies keep many brands from becoming many headaches. Workspaces keep every client apart with its own channels, members, and settings, while signatures save the hashtag and call-to-action blocks you refuse to retype and labels color-code the calendar. Insights follow followers and post performance across channels, Repurpose copies videos you posted elsewhere onto your other networks automatically, and webhooks announce every created, published, or failed post to your other tools. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 400 GitHub stars and growing, Pythia transforms a local LLM into a self-calibrating geopolitical oracle that watches the entire planet and predicts what happens next — no API keys, no cloud, no cost. The Osiris-based Three.js globe frontend streams 30+ concurrent live feeds including GDELT geopolitics, armed conflict events, USGS earthquakes, NWS storm polygons, EONET disasters, FIRMS wildfires, Polymarket crowd odds, cryptocurrency and commodity prices, UNHCR displacement data, WHO disease outbreaks, and WFP food insecurity indicators. The FastAPI backend fuses these heterogeneous sources into a unified world brief, pipes it through Ollama, and generates located predictions across 24-hour, weekly, monthly, and yearly horizons — each carrying a probability, reasoning, and geocoordinates that fly the globe to the event. A council of four specialist swarm agents — Strategist, Economist, Naturalist, and Skeptic — re-scores every forecast, surfacing consensus, dissent, and splits through Brier-weighted voting where historically accurate personas earn louder votes. The engine maintains a persistent ledger graded by an LLM judge against archived world state, producing running Brier scores and calibration charts. Signal rules fire browser notifications and webhooks when conditions match, a morning brief digest summarizes overnight changes, and the agent API at port 8088 delivers the complete world view in a single JSON call compressed to approximately 50 tokens for AI agent consumption. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Wanderer provides a privacy-first alternative to AllTrails and Komoot, giving outdoor enthusiasts complete ownership of their GPS data on a self-hosted server. The platform accepts uploads in GPX, KML, FIT, and TCX formats, automatically extracting distance, elevation gain and loss, duration, and speed statistics to build a searchable trail catalogue. The built-in route planner uses the Valhalla routing engine to calculate hiking, cycling, and walking routes directly on the map, while MapLibre GL renders smooth vector tiles from OpenStreetMap data with configurable tile sources and overlay layers. Each trail supports rich metadata including difficulty ratings, categories, waypoints with descriptions, photo galleries, and summit log entries that track completion dates with optional GPS data. Meilisearch powers instant full-text search across trail names, descriptions, and tags, complemented by map-based spatial filtering and advanced date, distance, and elevation filters. The ActivityPub integration follows the same federation protocol as Mastodon, allowing users to follow explorers on other Wanderer instances and see their public trails, comments, and summit logs in a unified feed without requiring cross-instance accounts. The WASM-based plugin system enables third-party extensions for custom integrations. The Docker Compose stack runs three containers — SvelteKit frontend on port 3000, PocketBase backend with embedded SQLite, and Meilisearch — with startup completing in under 90 seconds. On RepoCloud, deploy Wanderer on a dedicated VPS with root SSH access, persistent storage for your trail database and uploaded photos, and complete control over routing, geocoding, and tile server configurations, all under the AGPL v3 license.

Instead of running an Elasticsearch or Loki cluster, VictoriaLogs stores and searches your logs from a single zero-config server. Ship from Filebeat, Fluent Bit, Fluentd, Logstash, Vector, Promtail, Telegraf, the OpenTelemetry Collector, or the Datadog Agent. Syslog, journald, and Splunk endpoints work too. Query with LogsQL: word, phrase, and prefix filters combine with pipes that extract fields from raw lines and compute stats, top values, and facets. See results as a table, grouped by stream, as raw JSON, or as a live tail. Chart them in Grafana, or work from a terminal with vlogscli and pipe output into grep, less, or jq. Events with hundreds of fields are supported. So are high-cardinality fields like trace_id and user_id. Late, out-of-order backfills are accepted. During an incident, stream_context pulls the lines around any match. Tenants are keyed by AccountID and ProjectID headers. vmalert evaluates LogsQL queries as alerting and recording rules. CEF messages sent over Syslog are parsed automatically for SIEM work. Retention defaults to 7 days and can be capped by disk space. Per-day partitions snapshot and copy out with rsync or rclone. Cluster mode splits ingestion, querying, and storage across nodes for logs that outgrow one server. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Galene is a self-hosted video conferencing system that runs full meetings, lectures, and tutorials in the browser while asking remarkably little of the server it runs on. Every group gets its own page with video tiles, a user list, and a chat pane, and participants join from desktop or mobile browsers with nothing to install. Presenters share a screen or individual windows, stream a video or audio file straight from disk, and switch to blackboard mode when a slide needs resolution more than frame rate. Moderators can warn or remove participants and lock the group, raise-hand status keeps question queues orderly, and anyone can blur their background or exchange files directly with peers. Groups are simple configuration files: set public or private rooms, passwords or login tokens, client limits, and expiry windows, then create users with moderator or presenter privileges using the galenectl command. Automatic subgroups spin up identical breakout rooms on demand, the pattern its author uses to supervise forty students working in pairs during computer science practicals. Calls stay smooth on poor networks because the server adapts video quality per participant, recovers lost packets, and relays media through its built-in TURN server when firewalls block direct paths. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Every code snippet in Opengist lives inside a real Git repository that you can initialize, clone, pull, and push over HTTP or SSH while browsing syntax-highlighted files, revision diffs, and Markdown documents through a self-hosted web interface that replaces GitHub Gist. Create public, unlisted, or private multi-file gists directly from your browser, terminal Git client, or the OpenAPI-documented REST API v1 using personal access tokens. Rich rendering displays source code across hundreds of languages alongside Markdown documents with Mermaid diagrams, LaTeX math, CSV tables, images, and downloadable ZIP archives. Full-text code and metadata search powered by Bleve or Meilisearch lets teams locate snippets by content, filename, extension, language, user, or topic tags in milliseconds. Users can star, fork, archive, and embed snippets into external websites via JavaScript widgets or fetch raw files and structured JSON payloads. Enterprise authentication supports GitHub, GitLab, Gitea, OpenID Connect, and LDAP directories, reinforced by TOTP two-factor authentication and WebAuthn passkeys, while administrators control anonymous access and monitor Prometheus metrics. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.