Point Emby at your movie, music, and photo libraries and it becomes a private streaming service: metadata and artwork arrive from TMDB and TVDB, everything lands in a polished browsable interface, and media transcodes on the fly whenever a client can't play the original format. The client reach is the selling point: native apps span Android TV, Apple TV, Google TV, Fire TV, Roku, LG and Samsung smart TVs, iOS, Android, Apple CarPlay, Android Auto, plus web browsers and desktop apps for Windows, macOS, and Linux, and DLNA devices are auto-detected for casting and remote control. Multi-user support gives each household member their own account, watch history, favorites, and recommendations, with genuinely capable parental controls: content restrictions, access schedules, time limits, and live monitoring with remote control of kids' sessions. Live TV works with hardware tuners like HDHomeRun or M3U playlists, with free guide data in the US, Canada, and UK. The server and core features are free; an optional Premiere key adds hardware-accelerated transcoding, DVR recording, offline sync, and Cinema Mode intros.

The deep end of self-hosted recipe management: Tandoor Recipes is a Django/Vue application that replaces Paprika, AnyList, and ad-choked recipe sites with a database you control. Import is where most people start: paste any URL and Tandoor scrapes schema.org markup for ingredients, instructions, images, times, and nutrition; bulk-paste URLs for batch import; or migrate wholesale from Mealie, Paprika, Nextcloud Cookbook, Pepperplate, and other managers with built-in importers. The structured recipe editor tracks ingredients individually, which is what powers everything downstream: full-text search with trigram similarity, a "what can I make with what's in the fridge" ingredient search, automatic nutrition via OpenFoodFacts, and shopping lists that merge duplicate ingredients across recipes, convert units, scale by servings, and sort by your supermarket's actual aisle layout. The weekly meal planner is drag-and-drop, feeds shopping lists automatically, exports to your calendar, and shows a nutritional summary for the week. Multi-user support comes with a granular permission system - shared household cookbooks, private recipes, even secret ones - and shopping lists sync in real time so two people can shop simultaneously. A full REST API integrates with Home Assistant and Grocy. For households serious about cooking, Tandoor's depth is unmatched.

Mastodon serves single-user and small-community instances poorly; GoToSocial, an ActivityPub server written in Go, was built precisely for them. Where Mastodon demands Ruby, PostgreSQL, Redis, and Sidekiq, GoToSocial is one binary using roughly 250-350 MiB of RAM with SQLite as the default database (PostgreSQL optional) - it runs comfortably on a $5 VPS or a repurposed laptop. The deliberate design choice is having no built-in web client: the server exposes profile pages, a settings panel, and a faithful implementation of the Mastodon API, and you post through the client app you already like - Tusky on Android, Feditext on iOS, Pinafore or Phanpy in the browser. Federation is the point: your instance follows, boosts, and replies across Mastodon, Misskey, Pixelfed, and the rest of the Fediverse, with your identity anchored to your own domain. Safety is a stated focus, with granular per-post visibility and interaction controls, content warnings, custom emoji, hashtag following, domain allow/blocklists, and OIDC login support. Built-in Let's Encrypt provisioning simplifies the mandatory TLS. AGPL-3.0 licensed and in active beta, federating cleanly with the ecosystem's major servers.

Full double-entry accounting on your own server: Manager.io Server Edition runs the same engine as the free desktop edition as a web server, so unlimited users work in unlimited businesses concurrently, with all books on infrastructure you control. The module coverage is genuinely comprehensive - general ledger with a customizable chart of accounts, sales and purchase invoices, quotes and orders, bank and cash account reconciliation, inventory with stock tracking, fixed assets with depreciation, payroll, multi-currency with exchange gains and losses, tax codes for VAT and GST regimes, and the complete reporting stack: balance sheet, profit and loss, trial balance, aged receivables and payables, and cash flow statements. The interface is translated into more than seventy languages, reflecting a genuinely global user base. The licensing model is the refreshing part: a server license is a one-time perpetual purchase, not a subscription - twelve months of updates included, optional renewals after, no per-user tiers, no data limits, and you can downgrade to the free desktop edition anytime, so your books are never hostage. Businesses wanting collaborative accounting behind their own firewall, with data sovereignty and no monthly fees, get exactly that.

"Throw it on a haste and send the link" entered developer vocabulary because of Hastebin (haste-server), the minimalist open-source pastebin. Written in Node.js with three stated design goals - be really pretty, be really simple, be easy to set up - it does one job precisely: paste code, logs, stack traces, or config snippets, press save (or Ctrl+N for a new one), and get a short random-key URL to share. Syntax highlighting renders pastes readably across common languages, a raw view serves plain text for curl and scripts, and duplicate-and-edit makes iterating on a shared snippet trivial. The killer workflow is the terminal: with the haste-client utility or a one-line shell function, `cat error.log | haste` prints a shareable URL straight from stdout - the fastest route from a broken build to a colleague's eyeballs. Storage is pluggable through a simple adapter interface: filesystem by default, Redis with optional key expiration for pastes that should age out, and configurable key length, maximum paste size, and static documents. Self-hosting matters here because pastes often contain internal logs and stack traces that should never sit on a public pastebin - your instance keeps them inside your network, under your retention rules.

Authentication that lives inside your application rather than behind a redirect to an external identity provider - SuperTokens takes a fundamentally different architecture from Auth0 and AWS Cognito. Three tiers make that work - frontend SDKs (React, Angular, Vue, vanilla JS, React Native) render overridable login UI and manage tokens; backend SDKs (Node.js, Python, Go) expose auth endpoints on your own API domain; and SuperTokens Core, the piece you host here, is the stateless HTTP service handling core auth logic, password hashing, token signing, and database operations against PostgreSQL. The recipe system keeps features decoupled: use email/password, social login, passwordless (magic links, OTP), phone-password, multi-factor authentication (TOTP, WebAuthn), user roles, and microservice auth - individually or combined; you can even use SuperTokens purely for session management alongside another login provider. Sessions are where it shines: rotating refresh tokens with theft detection, automatic access-token refresh, CSRF protection, and secure cookie handling out of the box - the details that become vulnerabilities when hand-rolled. Verification happens locally in your backend via cached JWT signing keys, so the Core stays off the hot path. Self-hosted means no user limits, free forever, with all user data in your database. Apache-licensed.

Send a document, receive a PDF: Gotenberg is a Docker-based, stateless HTTP conversion API trusted in production by thousands of companies and adopted by notable open-source projects. Send files as multipart/form-data, get a PDF back; Chromium, LibreOffice, and fonts are the container's problem, not yours. Headless Chromium handles URLs, HTML templates, and Markdown with pixel-perfect browser rendering: it executes JavaScript, loads web fonts, waits for network idle, a JS expression, or a DOM selector before rendering SPAs, and accepts injected cookies and HTTP headers for authenticated pages. LibreOffice converts 100+ office formats - .docx, .xlsx, .pptx, and legacy formats - with page-range extraction and PDF/A archival conformance. Built-in PDF engines round out the pipeline in every image variant: merge, split, rotate, flatten, encrypt, watermark, stamp, read/write metadata and bookmarks, plus Factur-X/ZUGFeRD e-invoicing and PDF/UA accessibility compliance. Screenshots of URLs and HTML come from the same endpoints. Zero-transfer pipelines stream files directly between S3, MinIO, or GCS presigned URLs and Gotenberg, bypassing your application entirely, and webhooks enable async processing. Statelessness means horizontal scaling is trivial - run as many replicas as your conversion volume demands. Three image variants (full, Chromium-only, LibreOffice-only) trim the footprint to what you actually use.

From a freelancer logging billable hours to companies with hundreds of users, Kimai scales professional-grade open-source time tracking - a Symfony/PHP application without the per-seat pricing of Harvest or Toggl. Tracking is flexible by design: run multiple concurrent timers, use punch-in/punch-out mode, or enter times manually, organized by customer, project, and activity with tags, and priced by user-, customer-, or project-specific rates. The billing pipeline is where Kimai earns "professional grade": generate invoices directly from timesheet data with configurable templates (DOCX, ODS, XLSX, PDF), entry grouping, and invoice-number generators, while an export flag locks billed records against editing and excludes them from future invoices - the audit-safety detail spreadsheet workflows never get right. E-invoicing supports EN 16931, XRechnung 3.0, and Zugferd/Factur-X. Enterprise controls come standard: SAML and LDAP login against Google Workspace, Azure AD, or Authentik, TOTP two-factor auth, customizable role permissions, and teams that scope customers and projects to departments. Money and time budgets alert before overruns, advanced reporting slices recorded time by any dimension, and an extensive JSON API plus a plugin marketplace (expenses, approvals, and more) integrate it with existing infrastructure. Over 30 translations, multi-timezone, AGPL-licensed.

Links rot - the hard truth Linkwarden is built around, as a collaborative bookmark manager that preserves what it saves. Every page you save is fully preserved - a screenshot, a PDF, a self-contained single-file HTML archive (generated by the Monolith Rust binary), and a clean reader view - so the content survives even after the original site disappears. Think of it as a private Wayback Machine you own, with an optional one-click snapshot to archive.org on top. The reading experience matches the archival rigor: a distraction- free reader view supports text highlighting and annotation, and full-text search across everything you have saved is powered by Meilisearch. Optional AI tagging analyzes page content and auto-assigns tags - generate new ones, pick from your existing set, or constrain to predefined tags - with providers ranging from local Ollama models (fully private) to OpenAI, Anthropic, and OpenRouter. Organization is collections, sub-collections, and multiple tags per link; teams collaborate on shared collections with per-member permissions, and public collections share curated link sets (with preserved copies) to anyone. The stack is Next.js/React on TypeScript with PostgreSQL via Prisma, NextAuth supporting credentials, OAuth2, and SAML SSO, and a Playwright-driven headless Chromium worker doing the capture. Native iOS and Android apps and browser extensions feed it from anywhere.

"Forget about bouncers" became a real sentence because of The Lounge: a Node.js web IRC client that holds persistent connections to your networks 24/7, logging everything while you sleep, so closing the browser tab never means missing a message or losing your place in a channel. Open it again from any device - desktop, phone, tablet - and you resume exactly where you left off, with full history synchronized. Because it combines bouncer and client in one process, the experience feels like a modern chat app rather than 1990s infrastructure: push notifications for highlights and private messages (with self-generated VAPID keys, so even Web Push needs no third-party service), automatic link previews, inline file and image uploads, and full IRCv3 protocol support. It installs as a progressive web app from any modern browser, so phones get a native-feel client without an app store. Multi-user support means one instance serves your whole team or community, each user with their own networks and history, and LDAP integration ties into existing authentication. A public mode alternatively serves as an open, registration-free web chat for events or support channels. MIT-licensed, born as a fork of Shout, and a fixture of self-hosting stacks since.

Crypto portfolio tracking that inverts the SaaS model: rotki runs on your own machine, needs no email or account for the free tier, and keeps every wallet address, balance, transaction, and tax event in a local SQLCipher database encrypted with 256-bit AES. By default nothing passes through rotki-operated servers - a design choice that matters when cloud portfolio trackers concentrate exactly the identity-linked holdings data attackers want. Centralized exchanges (Kraken, Binance, Coinbase, Bitstamp, and more) connect through read-only API keys that can see but never withdraw; blockchain accounts cover Ethereum and its L2s, Bitcoin, Solana, Polkadot, and Kusama, with ENS resolution and your choice of RPC endpoint or your own node. rotki decodes on-chain transactions into readable events across major DeFi protocols - Aave, Uniswap, Compound, Curve, Lido - and generates profit-and- loss reports for tax season with customizable accounting settings, including FIFO, LIFO, and HIFO cost-basis methods, plus CSV imports for defunct exchanges. Optional premium sync is zero-knowledge, encrypting the database on-device before upload. AGPLv3-licensed and multiplatform, with a Docker package for server deployment.

Engineers who have outgrown Duplicati or rsync scripts tend to appreciate Kopia's design: encrypted, compressed, content-deduplicated snapshots in Go, stored in a repository on any storage you control - S3, Google Cloud Storage, Azure Blob, Backblaze B2, SFTP, WebDAV, or a plain filesystem. Encryption is mandatory and end-to-end: every block is encrypted client-side with AES-256-GCM or ChaCha20-Poly1305 using keys derived from your repository password, and even file names never leave the machine in plaintext. Blocks are packed into 20-40 MB blobs with random names, so the storage provider learns nothing about content or structure. Deduplication is automatic and content-based - identical data across files, snapshots, and even multiple machines backing up to the same repository is stored once. Policies govern everything per-directory: compression choice, retention (hourly through annual), scheduling, and ignore rules. Incremental snapshots are point-in-time records you can mount and browse like a filesystem. This deployment runs the Kopia repository server with its web UI, centralizing backups from multiple client machines over an authenticated API - each client connects with the server URL and certificate fingerprint, and users only see their own snapshots. Error correction, high-latency-tolerant caching, and both CLI and GUI round it out.

Unlimited agents, unlimited tickets, unlimited mailboxes, forever, on a $4 VPS - FreeScout's pricing inversion is why it became the most popular self-hosted Help Scout alternative, a PHP/Laravel help desk and shared inbox developed from scratch over eight years. The inbox deliberately behaves like Gmail or Outlook, so new support agents need close to zero training. The email-support core is genuinely complete: seamless IMAP/SMTP integration including modern Microsoft Exchange authentication, collision detection that warns when two agents open the same conversation, canned responses, auto-replies, internal notes, open tracking, starring, forwarding, merging, and moving conversations between mailboxes, phone-call logging, push notifications, and an auto-refreshing conversation list - plus screenshot pasting straight from the clipboard into replies. It's 100% mobile-friendly, fully screen-reader accessible, and translated into 28 languages. Beyond the core, an ecosystem of 100+ modules (mostly one-time $12-20 purchases) adds knowledge base, workflows with Gmail-filter-style automation rules, satisfaction ratings, time tracking, tags, custom fields, LDAP, Slack, WhatsApp and Telegram channels, and an API with webhooks - pay only for what your team needs. Web installer and updater included. AGPL-licensed.

The ad-riddled "free online tools" sites people paste sensitive text into and upload confidential PDFs to - OmniTools replaces that whole ecosystem with one self-hosted app. It bundles 50+ utilities behind one clean React/TypeScript interface: image tools (resize, convert, crop, edit), video and audio tools (trim, reverse, convert), PDF tools (split, merge, edit), text and list utilities (case converters, formatters, shufflers), plus date/time, math, and data-format helpers for JSON, CSV, and XML. The architectural decision that makes it trustworthy is that all file processing happens entirely client-side in the browser - the server only serves static assets, and nothing you process ever leaves your device. That design has a pleasant side effect: the host needs almost no resources (people run it on a Raspberry Pi Zero), because your browser does the work while the server just delivers files. The Docker image is a remarkable 28 MB, making it one of the fastest apps to deploy and cheapest to keep running. There are no ads, no tracking, no accounts, and no upload limits. With multi-language support and an MIT license, it works equally well as a personal toolbox or a team-wide internal utility portal - one URL that replaces a bookmark folder full of questionable converters. Actively developed with 50 contributors and 9,500+ GitHub stars.

Typeform's conversational format, self-hosted: HeyForm is the open-source form builder that presents one question at a time. Forms present one question at a time, which measurably improves completion rates compared to long static pages. It supports 40+ field types, from text, email, and phone inputs to picture choices, date pickers, star ratings, signatures, and file uploads. Conditional logic shows or hides questions based on earlier answers, routes respondents to different endings, and redirects to URLs, so a single form can serve multiple flows. Completed submissions land in a results dashboard with drop-off and completion analytics, and connect outward through webhooks or integrations with Zapier, Make, Google Sheets, Notion, Airtable, and Slack. Theming covers fonts, colors, backgrounds, and custom CSS, so embedded forms look native to your site rather than like a third-party widget; the JavaScript embed library renders them inline, as popups, or full-page, with shareable standalone links as the default. Team workspaces and projects with member management let multiple teams share one instance without mixing data. Self-hosting removes per-response pricing entirely - unlimited forms and submissions for flat hosting cost - and keeps lead data, feedback, and quiz answers in your own MongoDB, simplifying GDPR compliance. The stack is a NestJS server and React webapp backed by MongoDB and KeyDB, distributed under GPLv3 as a Docker image.

Raw zone files and API calls become something a whole team can operate safely once PowerDNS-Admin puts its web interface in front of a PowerDNS authoritative server. It's a Python/Flask application covering full forward and reverse zone management, with the touches that matter in daily DNS work: zone templates for stamping out consistent new domains, easy IPv6 PTR record editing (reverse zones by hand are misery), full IDN/Punycode support for internationalized domains, and DynDNS 2 protocol support so routers and scripts can update records the way they would against a commercial dynamic-DNS service. Access control is enterprise-grade: local users, LDAP against OpenLDAP or Active Directory, SAML, and OAuth via Google, GitHub, Azure, or OpenID Connect, hardened with TOTP two-factor authentication. Role-based permissions extend to zone-specific access control - hand a developer their project's zone without exposing the rest of your namespace - and activity logging records who changed which record when, the audit trail bare PowerDNS never gives you. The dashboard monitors PDNS service configuration and statistics, and its own API exposes zone and record management for automation on top of the UI. Runs against MySQL/MariaDB or PostgreSQL, talking to PowerDNS through its REST API. MIT-licensed.

Airtable's spreadsheet-database model, self-hostable and open-source: that is Baserow. It presents data in a spreadsheet-style grid, but underneath each table is a real relational structure with typed fields, links between tables, filters, sorts, and multiple views (grid, gallery, form, kanban, calendar). Beyond the database core, it includes an application builder for composing pages and portals on your data, workflow automations, and dashboards. Everything is API-first: each table exposes a REST endpoint with token auth and webhooks, so it plugs directly into n8n, Zapier, or custom scripts. The stack is Django (Python) on the backend, Vue.js on the frontend, PostgreSQL for storage, with Redis for async tasks. Core features are MIT-licensed; premium features are a paid add-on. The self-hosted version has no row, storage, or API request limits - Airtable's per-base record caps and monthly API quotas simply don't exist here, and capacity is bounded only by your PostgreSQL database and disk. Existing Airtable bases, CSVs, and Excel files import directly with structure preserved, so migration doesn't start from a blank slate, and both the backend and frontend support plugins for custom field types and integrations without forking the core. For non-technical teammates the interface behaves like a spreadsheet; for engineers, the data model is the API.

A status page and uptime monitor in one Go binary: Statping-ng - the actively maintained fork of Statping - replaces the UptimeRobot-plus-Statuspage combo with a ~20 MB Docker image using under 50 MB of RAM. It checks services over HTTP, TCP, UDP, ICMP ping, and gRPC health checks on configurable intervals, with per-service timeouts, expected status codes, POST requests with custom JSON bodies, SSL verification, and failure thresholds before alerting. The public status page is the differentiator against plain monitors: visitors see live status, uptime percentages, and latency charts grouped into service categories, with incident announcements and scheduled-maintenance messages you publish from the dashboard - and Sass-based custom styling matches the page to your brand rather than a vendor template. When something fails, notifiers fire immediately: Slack, Discord, Telegram, SMTP email, PagerDuty, Twilio SMS, Pushover, and custom webhooks, each testable before saving. Because notifiers are single Go files, the plugin system makes new channels straightforward. A RESTful API manages services and reads uptime data programmatically, and the free Statping mobile app connects to your server via QR code for on-the-go monitoring. Data persists to SQLite, MySQL, or PostgreSQL. Point it at internal services too - anything the container can reach is monitorable.