No database anywhere in the stack: Grav, the leading flat-file CMS, builds every page from a folder of Markdown and YAML on PHP, Symfony components, Twig templating, and Doctrine caching. That architecture is the whole argument: content is Git-versionable, rsync-able, and lock-in-free; pages render in well under 100ms without database round-trips; and backup means copying a directory. Content authors write Markdown (or plain HTML), configure with readable YAML, and define custom page structures via blueprint files that generate editing forms automatically. The optional Admin panel adds a polished editing layer: dashboard with site activity, page management with a syntax-highlighted editor and live preview, drag-and-drop media uploads, one-click plugin/theme updates, and normal/expert modes for form-based or raw YAML editing. The ecosystem runs deep - hundreds of open-source plugins and themes installed through the GPM package manager, with an event-hook architecture that gives plugins full control over the request lifecycle, and downloadable skeletons providing entire pre-built sites. Grav 2.0 modernizes the stack (PHP 8.3+, Symfony 7, Twig 3) and adds a first-party REST API, an MCP server for AI agents, and a SvelteKit single-page admin with real-time collaborative editing. Ideal for docs, blogs, and marketing sites. MIT-licensed.

Graduated as an Apache Software Foundation Top-Level Project with over 15,500 GitHub stars and 100,000+ Docker Hub downloads, Apache Answer delivers the structured Q&A platform that Stack Overflow and Discourse popularized — fully self-hosted under Apache 2.0 with zero vendor lock-in. The Go backend with React frontend serves questions, answers, and knowledge articles with real-time Markdown preview using CommonMark syntax, inline @mentions to ping domain experts, and transparent revision history tracking every edit. Version 2.0 introduced AI workflows including an integrated AI assistant that helps draft and improve answers, a Model Context Protocol server for connecting AI agents to your knowledge base, API key management, and editor plugin support for extending the writing experience. Advanced search filters by tags, usernames, scores, and date ranges, while real-time suggestions surface relevant existing questions as users type to reduce duplicates. The reputation system rewards quality contributions with configurable privilege thresholds, and admin/moderator/user roles control access across the platform. A plugin architecture enables community-built extensions for third-party OAuth login, caching backends, search engines, and storage providers. Theming supports custom layouts, dark mode, and responsive design across devices, with content available in 15+ languages translated by the community. Bulk user import, email domain restrictions, and content access controls secure the platform for enterprise deployment. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Run a Stack Overflow of your own: Apache Answer brings the question-and-answer format in-house, maintained under the Apache Software Foundation with an Apache-2.0 license. You use it to run a community forum, product help center, or internal knowledge base where content lives as questions and answers rather than wiki pages. It ships the mechanics that make that format work: voting, accepted answers, a reputation system with privilege levels, tagging, full-text search with filters, revision history on every edit, and admin/moderator/user roles. Content is written in Markdown with real-time preview and code syntax highlighting. A plugin system covers OAuth login (Google, GitHub), S3 storage, external search backends like Algolia, and Akismet anti-spam, and a REST API exposes platform data for integration. The backend is Go, the frontend React, and it runs against SQLite, MySQL, or PostgreSQL. Self-hosting replaces per-seat tools like Stack Overflow for Teams with a flat-cost instance where you own all the content.

OpenMetadata builds a unified knowledge graph connecting schemas, tables, columns, dashboards, pipelines, ML models, and data products into one searchable catalog accessible at port 8585. The ingestion framework ships 130+ connectors covering Snowflake, BigQuery, Redshift, Databricks, PostgreSQL, MySQL, Kafka, Airflow, dbt, Tableau, Looker, Power BI, Metabase, and Superset, automatically extracting metadata on configurable schedules. Column-level lineage traces data flow across transformations, joins, and aggregations, while built-in data quality testing executes profiling and validation rules as data contracts with automated alerting on failures. Governance features include role-based access control, PII auto-detection, glossary term propagation, and domain-based ownership assignment. The native MCP server and AI SDK expose semantic search, lineage queries, and governance metadata as tools any LLM agent can call, enabling AI systems to discover and reason about enterprise data with full trust context. The architecture requires only PostgreSQL or MySQL plus Elasticsearch, no Kafka, no graph database, and deploys via a single Docker Compose file. Created by the founders of Apache Hadoop, Apache Atlas, and Uber's Databook, the platform has earned over 14,700 GitHub stars and adoption by 3,000+ organizations. Apache 2.0 licensed.

With over 15,000 GitHub stars and positioning itself as the most feature-complete open-source alternative to Airtable, APITable combines a buttery-smooth spreadsheet interface with a full database engine and automatic API generation that turns every datasheet into a queryable REST endpoint without writing a single line of backend code. Real-time collaborative editing powered by Operational Transformation algorithms supports 100,000+ rows with multiple simultaneous users, while seven built-in view types — Grid, Kanban, Gallery, Gantt chart, Calendar, Mindmap, and Form — let teams visualize the same data in whatever format suits their workflow. The one-click API panel exposes every table as a documented REST API with filtering, sorting, and pagination, effectively functioning as a backend-as-a-service for frontend developers and automation builders. Robot automation triggers workflows on record changes with integrations into n8n, Zapier, Appsmith, and Slack, while the extensible widget system provides 20+ open-source widgets for custom charts, dashboards, and data visualizations embedded directly into datasheets. Enterprise features include SAML single sign-on, field-level and row-level permissions via Mirrors, organizational team management, audit logging, database auto-backup, and data export. Bi-directional table linking with infinite cross-links creates relational data models across workspaces, and built-in templates cover CRM, project management, inventory, and content planning. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 14,000 GitHub stars and a mission to become the world's most trusted document-signing tool, Documenso delivers a beautifully designed electronic signature platform that organizations can self-host for complete data sovereignty. The signing workflow handles everything from simple one-party signatures to complex multi-recipient documents with configurable roles including signers, approvers, viewers, and CC recipients, each with distinct permissions and notification flows. Document templates enable reusable signing packages with pre-configured fields and recipient patterns, eliminating repetitive setup for contracts, NDAs, and onboarding documents that teams process regularly. The PAdES-standard implementation ensures digital signatures are legally compliant and cryptographically verifiable, with complete audit trails documenting every action from document creation through final signature. Direct link signing allows recipients to access documents without email, enabling embedded signing experiences within existing applications and websites. The REST API provides programmatic document creation, recipient management, and webhook notifications for integrating signature workflows into CRM systems, HR platforms, and custom business applications. Team management features organize users into groups with role-based permissions, custom branding per team, and centralized billing for organizations with multiple signing workflows. SSO integration supports standard authentication providers for enterprise identity management. The TypeScript codebase built on Next.js and Prisma with PostgreSQL makes customization and contribution accessible to modern web developers. Zapier integration connects Documenso to thousands of third-party applications for automated document routing. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

QM is Y Combinator's internal multiplayer agent infrastructure that shifts AI agents from personal assistants to shared company operating layer. The headless TypeScript core runs on Node.js with Fastify handling HTTP, Slack integration via Bolt, and a web UI built with Vite and Lit. PostgreSQL stores sessions, memory, queue state, and audit logs. Every person and every Slack channel gets an isolated sandbox with its own durable file system, installed tools that persist across runs, private memory, keychain view, permissions, and background crons. The harness-agnostic architecture routes agent tasks through Pi, OpenCode, Codex, or Claude Code without vendor lock-in, with production implementations swapping via a single wiring file. Three org-level security postures gate execution: Strict requires human approval for every tool call, Auto applies automated content screening, and Dangerous removes all pauses. Skills are scope-owned and shareable by grant, with admin-gated promotion to the entire organization and skill packs importable from Git repositories. The web apps feature lets agents spin up custom internal applications published to specific users. The qm CLI bootstraps operator-owned deployment directories with digest-pinned release images, infrastructure rendering, secret management, and live verification checks for Docker, Fly.io, or AWS ECS Fargate targets. On RepoCloud, deploy QM on a dedicated VPS with PostgreSQL persistence, Docker socket access, root SSH access, and complete control over your multiplayer agent infrastructure, all under the MIT license.

AWX transforms Ansible from a command-line tool into a centralized automation hub with a web UI, REST API, and distributed task engine for managing playbooks, inventories, and credentials at enterprise scale. The React-based dashboard provides real-time visibility into job status, inventory health, and execution history while Django REST Framework powers programmatic control over every automation resource. Job templates combine Ansible playbooks, inventories, and credentials into reusable units that chain together in workflow templates using directed acyclic graph orchestration with conditional branching on success, failure, or always-run logic and configurable convergence gates. The RBAC system built on django-ansible-base provides granular permission control over organizations, teams, projects, inventories, and credentials at object-level granularity. Dynamic inventory sources pull host data from AWS EC2, Google Cloud, Microsoft Azure, VMware vCenter, and Red Hat Satellite, while credential management securely stores SSH keys, cloud tokens, and vault passwords with HashiCorp Vault and CyberArk integration for external secret retrieval. Notifications deliver alerts via Slack, email, PagerDuty, Mattermost, IRC, and webhooks, while activity streams log every action for compliance auditing. The Receptor mesh network distributes job execution across isolated container-based execution environments with capacity-aware scheduling and hop-node routing for network-segmented infrastructures. Upstream of Red Hat Ansible Automation Platform. Deploys via Docker Compose with PostgreSQL and Redis or via the AWX Operator on Kubernetes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Securing a SaaS product, running B2B onboarding, or replacing Auth0 and Keycloak with a stack they own - teams needing more than basic auth reach for ZITADEL, an open-source identity and access management platform built in Go. Its multi-tenancy model is the differentiator: a strict Instance, Organization, Project hierarchy isolates data and scopes policy at each level, with identity brokering (pre-built templates for Google, GitHub, Microsoft, Apple, plus generic OIDC, OAuth, SAML, and LDAP), domain discovery that routes users to the right organization by email domain, and delegated management so customers administer their own users and roles. Authentication covers OpenID Connect (certified, including device authorization and token exchange), SAML 2.0 as both IdP and SP, SCIM, FIDO2 passkeys for phishing-resistant passwordless login, and MFA via OTP, email, SMS, and U2F; machine-to-machine flows support JWT profile, PATs, and client credentials. The architecture is event-sourced - every mutation is an immutable event, yielding a complete audit trail - with relational projections for queries and no external session store, so it scales horizontally. API-first with gRPC and REST, extensible via Actions webhooks, and the same codebase self-hosted (Docker Compose or Helm on PostgreSQL) as in the cloud.

With over 14,000 GitHub stars and a growing global network of security deployments, CrowdSec turns every attack on any participating server into protection for the entire community. The security engine operates as a combined IDS/IPS and WAF, analyzing log sources from Nginx, Apache, SSH, WordPress, and over 50 other services to detect brute force attacks, port scans, web vulnerability exploitation, and credential stuffing in real time. When one server detects a new threat, the attacker's IP is shared through the community blocklist, proactively protecting thousands of other installations before the attacker can reach them. The built-in WAF powered by Coraza v3 inspects HTTP requests at the application layer, validates against OpenAPI schemas, and applies custom rules with flexible AND/OR condition mixing for precise threat detection. Bot detection serves challenge pages with client fingerprinting to distinguish legitimate traffic from automated scrapers and scanners. Remediation components block malicious IPs at multiple infrastructure layers including iptables, nftables, Nginx, HAProxy, Cloudflare, and AWS Security Groups through the detect-here-remedy-there architecture. The scenario-based detection system ships with default rules for common attack patterns and supports custom scenarios written in YAML with an expressive filter language. A centralized console provides real-time visualization of alerts, threat intelligence analysis, and management of multiple distributed security engines. GDPR compliant by design, all log analysis happens locally and raw logs never leave your infrastructure. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Mail-in-a-Box turns a single Ubuntu server into a fully functional email system with one setup command, installing and configuring Postfix for SMTP, Dovecot for IMAP, Roundcube for webmail, and Z-Push for Exchange ActiveSync push notifications in an automated sequence that would take days to replicate manually. The DNS server auto-configures the full suite of email authentication records: SPF, DKIM, DMARC, DNSSEC with DANE TLSA, MTA-STS, and SSHFP. Getting all of these right is what separates email that lands in inboxes from email that lands in spam, and most manual installations never achieve the complete set. Nextcloud integration adds CardDAV contact sync and CalDAV calendar sharing across devices. Let's Encrypt certificates provision and renew automatically for every hosted domain. The web control panel manages users, aliases, custom DNS records, and automated backups, protected by TOTP two-factor authentication. Daily health checks verify that services run correctly, ports remain open, TLS certificates stay valid, and DNS records resolve properly, alerting you before delivery problems develop. Multiple domains and users operate from one installation with internationalized domain name support. Built-in HTTPS static site hosting uses the TLS infrastructure already in place. Runs on a dedicated RepoCloud VPS with guaranteed resources, root SSH, and browser serial console for complete email sovereignty. CC0 public domain licensed.

Exploratory data work, teaching material, and research code all live in the same browser tab with JupyterLab, the web workspace of Project Jupyter. Notebooks combine runnable code cells, Markdown, and rich output such as images, JSON, and Vega charts, and they use the same notebook format as the classic Jupyter Notebook. Any Jupyter kernel can execute the code, so Python, R, and other languages share one interface, and code inside plain text files such as Markdown or LaTeX can be run interactively as well. Tabs and splitters arrange documents side by side, and a notebook's cell outputs can be mirrored into their own tab to build a simple dashboard with interactive controls. Code consoles serve as scratchpads linked to a notebook kernel, while full terminals run system shells such as bash on the server. A visual debugger offers breakpoints, a call stack, and a variable explorer for kernels that support the Jupyter debug protocol. Markdown, CSV, and Vega documents show a live preview as they are edited, and built-in viewers handle images, JSON, and PDF files. The Extension Manager installs themes, editors, and renderers from PyPI, and real-time collaboration becomes available by adding the jupyter-collaboration extension. Access is protected by a generated token unless a password is set. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.

The fediverse's answer to YouTube comes from French non-profit Framasoft: PeerTube is a TypeScript/Angular video platform where hundreds of independently operated instances federate over ActivityPub into one network. Videos you publish are discoverable across the whole video fediverse, and viewers can follow your channels from Mastodon or any ActivityPub platform - or plain RSS - without needing an account on your instance. The namesake innovation attacks video hosting's core cost problem: alongside HLS delivery, an optional WebRTC-based P2P layer lets concurrent viewers' browsers share video segments with each other, so a video going viral distributes its own bandwidth demand instead of crushing your server; instance redundancy extends this by letting friendly instances cache each other's videos. Livestreaming is first-class - stream via OBS or any RTMP software, host permanent streams, enable replays, and interact through live chat. Creators get channels, playlists, analytics, built-in video editing (trim, watermark), and an embeddable player for any website. There are no ads, no data mining, and no recommendation algorithm engineered for watch-time - the project's explicit design stance. Admins control federation policy, P2P settings, and theming; a plugin system extends the rest. AGPL-licensed, 300+ contributors, in active development since 2015.

TREK coordinates group expeditions and vacations through a collaborative travel planning workspace that unifies daily itineraries, interactive route maps, shared expense budgets, and packing lists. Travel groups can build day-by-day timelines by dragging activities between dates, attaching transit bookings with flight numbers, and estimating driving intervals directly on OpenStreetMap and Mapbox canvases. Instant WebSocket synchronization mirrors itinerary edits, group chat messages, and decision poll votes across all traveling companions simultaneously without page refreshes. The integrated multi-currency expense manager tracks shared expenditures across lodging, dining, and transit categories, automatically calculating per-person debts and generating simplified debt settlement summaries. An interactive world atlas highlights visited nations and tracks lifetime travel statistics, enabling globe-trotters to manage personal bucket lists and review past journeys. Travelers can organize shared packing checklists from reusable equipment templates, monitor real-time weather forecasts powered by Open-Meteo, and export comprehensive travel schedules to printable PDF guides and calendar feeds. Role-based permission controls safeguard sensitive travel documents and boarding pass uploads while allowing guests to contribute notes and vote on activities. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Authentication that lives inside your application rather than behind a redirect to an external identity provider - SuperTokens takes a fundamentally different architecture from Auth0 and AWS Cognito. Three tiers make that work - frontend SDKs (React, Angular, Vue, vanilla JS, React Native) render overridable login UI and manage tokens; backend SDKs (Node.js, Python, Go) expose auth endpoints on your own API domain; and SuperTokens Core, the piece you host here, is the stateless HTTP service handling core auth logic, password hashing, token signing, and database operations against PostgreSQL. The recipe system keeps features decoupled: use email/password, social login, passwordless (magic links, OTP), phone-password, multi-factor authentication (TOTP, WebAuthn), user roles, and microservice auth - individually or combined; you can even use SuperTokens purely for session management alongside another login provider. Sessions are where it shines: rotating refresh tokens with theft detection, automatic access-token refresh, CSRF protection, and secure cookie handling out of the box - the details that become vulnerabilities when hand-rolled. Verification happens locally in your backend via cached JWT signing keys, so the Core stays off the hot path. Self-hosted means no user limits, free forever, with all user data in your database. Apache-licensed.

Powering authentication for over 15,000 GitHub stargazers and production deployments across startups and enterprises alike, SuperTokens delivers the complete login infrastructure that Auth0, Firebase Auth, and AWS Cognito charge premium prices for — entirely open source under Apache 2.0 with no per-user limits. The Java-based core service runs as a lightweight HTTP microservice that connects to PostgreSQL or MySQL and handles email-password login, passwordless magic links and OTP via email or SMS, social OAuth with Google, GitHub, Facebook, Apple, and any custom OIDC provider, phone-password authentication, and time-based one-time password multi-factor authentication. Session management uses rotating refresh tokens with anti-CSRF and anti-session-fixation protections, verifying tokens locally in your backend SDK without network round-trips to the core. Frontend SDKs for React, React Native, Angular, Vue, and vanilla JavaScript provide pre-built UI components for login, signup, email verification, and password reset flows, all customizable through an override system that lets you add pre- and post-API logic, custom hooks, and user event handlers. The built-in user management dashboard enables administrators to view users, reset passwords, revoke sessions, modify roles, and manage email verification status. Multi-tenancy and organization support powers B2B SaaS applications with tenant-level authentication configuration and Enterprise SSO via SAML and OIDC. Migration tools support bulk importing millions of existing password hashes, TOTP secrets, and role mappings. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 15,100 GitHub stars and seven years of battle-tested production use, OneDev replaces entire DevOps toolchains — GitLab, Jenkins, Jira, Artifactory — with a single Java application that runs comfortably on a 1-core 2GB server for medium-sized projects. The platform unifies Git hosting with ANTLR-powered language-aware code search and symbol navigation, pull request workflows with configurable branch protection rules and required reviewers, and customizable issue tracking with scripted state transitions that automatically advance issues when code is committed, builds pass, or deployments complete. The GUI-based CI/CD editor creates pipelines without writing YAML, supporting typed parameters, matrix builds, job templates, cache management, and artifact publishing in a single visual interface. Jobs execute via Docker containers, bare metal shell, Kubernetes pods, or distributed agent pools, with web terminal access for live debugging and the ability to pause running jobs for inspection. Built-in package registries handle Docker images, npm packages, Maven artifacts, NuGet libraries, PyPI wheels, and RubyGems without external infrastructure. AI users can be assigned to issues and pull requests to autonomously implement features, review code, fix CI/CD failures, and resolve merge conflicts. The automated Kanban board supports rule-based card movement, time tracking, timesheets, and service desk ticket creation via email. Cluster deployment enables project replication across servers for high availability and horizontal distribution for scalability. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Cockpit puts Linux server administration in a web browser, rendering storage, networking, containers, and virtual machines as visual panels you click through instead of command-line syntax you memorize. It ships in every major Linux distribution and activates through systemd socket activation, consuming zero resources until someone connects on port 9090. What makes it different from other admin panels: every change through the web interface appears instantly at the command line, and every terminal change reflects in the browser in real time. No abstraction layer sits between the UI and the operating system, which means no configuration drift. Storage management covers disk partitioning, RAID arrays, LUKS encryption, LVM volumes, and NFS shares. Network configuration handles bonds, bridges, VLANs, and firewall zones through visual editors. Native Podman integration pulls images, creates containers, manages pods, and provides terminal access into running processes. KVM/libvirt support handles VM creation, cloning, snapshots, and live migration with console access. A built-in terminal provides shell access when the web interface is not enough, and the journal viewer filters systemd logs by severity and unit. Multi-server management connects additional hosts over SSH, presenting a unified dashboard across your entire infrastructure from one browser tab. Runs on a dedicated RepoCloud VPS with full root SSH access and browser serial console. LGPL licensed.