With over 7,700 GitHub stars and thousands of Cloudflare employees using it daily across every function, Cloudflare OS delivers an open-source AI workspace where every employee gets a personal agent grounded in company context, systems, and skills — not a generic chatbot but a programmable workspace that builds real applications, automates workflows, and connects to internal tools through governed access. The Code Mode agent writes and immediately executes code snippets to perform arbitrary tasks, build full-stack Gadgets with client code, server code, APIs, and durable SQLite state, debug errors, and test results within isolated sandboxes. Gadgets are private application instances running in separate sandboxes — each document, spreadsheet, or tool is its own secure runtime that cannot leak data even to attackers with access to other Gadgets. Blueprints enable sharing application code as templates that others instantiate with independent state, credentials, and resources. Gatekeepers provide security governance giving system owners precise control over what agents can see, change, and when human approval is required before actions execute. Built on Cloudflare Workers using Durable Objects for workspace persistence, Dynamic Workers for Gadget execution, and Facets for access management. Zero Trust security via Cloudflare Access verifies every user and request before granting access. Real-time collaboration lets colleagues use shared Gadgets. Deploy to your own Cloudflare account or self-host on workerd, the open-source Workers runtime, on your own servers. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Keystone turns TypeScript schema definitions into a complete GraphQL API and React Admin UI automatically, eliminating the gap between data modeling and application scaffolding. Nearly 10,000 GitHub stars and over 270 contributors across a decade of development back a framework where list definitions map directly to Prisma models on PostgreSQL or SQLite, generating database migrations and exposing every field relationship through Apollo Server's GraphQL endpoint. Granular access control operates at the list, field, and operation level with filter-based restrictions that limit which records users can see, create, update, or delete based on session data and custom logic. The document field provides a structured WYSIWYG editor with content blocks, inline relationships, and custom React components that render consistently across the Admin UI and frontend applications. Event hooks fire before and after create, update, and delete operations for validation, side effects, and external service integration. Custom GraphQL queries and mutations extend the API beyond auto-generated CRUD for bespoke business logic. The Admin UI built with Next.js and the Keystar UI component library supports custom pages, branded navigation, and internationalized interfaces. OpenTelemetry tracing provides observability into operations, queries, and hook execution. Deploys via Docker or any Node.js host with Prisma managing schema evolution. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

HyperDX correlates logs, metrics, traces, session replays, and errors in a single interface so engineers can resolve production incidents in minutes instead of hours. Nearly 10,000 GitHub stars reflect its role as the integrated UI layer for the ClickStack blueprint endorsed by ClickHouse. The platform connects to any ClickHouse cluster as its storage backend, working with existing table structures without requiring data migration or proprietary ingestion formats. An intuitive Lucene-like search syntax supports full-text queries and property filtering like level:err or service.name:api without needing SQL, while native JSON string querying and event delta analysis surface anomalies in high-cardinality datasets. One-click cross-signal correlation lets you jump from a log line to its distributed trace, from a slow span to associated logs, or from a frontend session replay to the backend errors it triggered. The OpenTelemetry Collector accepts telemetry via OTLP on gRPC port 4317 and HTTP port 4318, supporting automatic instrumentation for Node.js, Python, Java, Go, Ruby, and browser applications. APM tracks HTTP request latency, database query duration, and external service calls with trace waterfall visualizations. Configurable alerts trigger via webhook, Slack, PagerDuty, or email when thresholds are breached. Deploys via Docker Compose with ClickHouse, MongoDB, Redis, and the OpenTelemetry Collector. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

"Less is more" is Kanboard's stated philosophy, and the free, MIT-licensed PHP application lives it: drag tasks between customizable columns, enforce work-in-progress limits per column, and slice boards horizontally with swimlanes for releases, teams, or priorities. Tasks carry what matters - colors, categories, subtasks with time estimates, Markdown descriptions, comments, attachments, internal links, and due dates - and move or duplicate across projects in one click. A concise query language filters any board dynamically (assignee, category, due date, description), and saved filters become custom views. The automatic-actions engine kills repetitive triage: on events like column moves or task creation, Kanboard reassigns, recolors, recategorizes, or closes tasks by rule. Around the board sit a calendar, per-project analytics (cumulative flow, lead and cycle time), Gantt view, and time tracking. Authentication spans LDAP/Active Directory, Google, GitHub, GitLab, and reverse-proxy headers; a JSON-RPC API, webhooks for creating tasks from external systems, and a CLI cover integration. A large community plugin catalog adds what core deliberately omits. With no external dependencies, it runs happily on anything from a Raspberry Pi up - translated into 30+ languages.

Gorse generates personalized recommendations from your application's user interaction data through automatically trained models, requiring no machine learning expertise to deploy or operate. Over 10,000 GitHub stars and production deployments processing millions of interactions validate a multi-source architecture that merges candidates from latest-item, user-to-user, item-to-item, and collaborative filtering recommenders, then ranks them using factorization machines or LLM-based rerankers with configurable query and document templates. Multimodal content support processes text, images, and video metadata via embedding vectors stored in BF16 format, with optional Qdrant, Weaviate, or Milvus integration for distributed similarity search. The visual RecFlow editor provides a drag-and-drop interface for designing recommendation pipelines, connecting data sources to recommenders and rankers without writing configuration files. A distributed cluster separates concerns across master nodes for model training and dashboard hosting, worker nodes for offline recommendation generation, and server nodes for real-time API endpoints, all scaling horizontally behind load balancers. Online evaluation analyzes recommendation quality from recent user feedback with configurable cache sizes and expiration intervals. RESTful APIs expose CRUD endpoints for users, items, and feedback alongside recommendation retrieval with category filters and API key authentication. Stores data in MySQL, PostgreSQL, MongoDB, or ClickHouse with Redis caching. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

One statically-compiled Go binary over PostgreSQL, no ORM, no framework, static assets embedded in the executable: Miniflux is the minimalist, opinionated feed reader. The opinions are the feature: page layout, fonts, and colors are tuned for reading, and everything else is treated as noise. It consumes Atom, RSS, and JSON Feed formats with OPML import/export, organizes articles with categories and bookmarks, fetches original full-text content for summary-only feeds, and provides Postgres-powered full-text search. Privacy work happens automatically: pixel trackers are stripped, tracking parameters removed from URLs, a media proxy blocks third-party tracking, referrers are never forwarded, and there is zero telemetry. Navigation is keyboard-first - j/k through items, o to open, f to star - with touch gestures on mobile. Podcast, video, and music enclosures are supported, and YouTube videos play inline. Over 25 integrations save articles onward to Wallabag, Readwise Reader, Pinboard, Linkding, Instapaper, Notion, Telegram, Matrix, Ntfy, and more, plus webhooks and a REST API with Go and Python clients; the Google Reader API endpoint supports existing mobile reader apps. Authentication spans local passwords, passkeys (WebAuthn), Google OAuth2, OpenID Connect, and reverse-proxy headers. It is Apache 2.0 licensed, translated into 20 languages, and updates feeds on an internal scheduler.

Runtipi makes any Linux server a personal app platform where installing services like Plex, Nextcloud, or Home Assistant takes a single click from a curated store of 265+ applications. With 9,500+ GitHub stars and 50 contributors, the React frontend backed by NestJS orchestrates Docker Compose projects for each installed app, automatically generating environment files, compose configurations, and Traefik reverse proxy labels for domain routing and SSL certificate provisioning via Let's Encrypt. The integrated Traefik reverse proxy handles all incoming traffic routing, HTTPS termination, and forward-auth protection for securing applications behind Runtipi's authentication layer without manual configuration. One-click updates notify administrators of new app versions and apply container image upgrades with automatic pre-update backup creation, while the restore feature rolls back application data to any saved snapshot. Custom app stores extend the ecosystem through Git repositories following the Runtipi app definition format, enabling organizations and communities to maintain private catalogs alongside the official store. The Docker Compose override system preserves user customizations across updates, allowing advanced modifications without losing changes. Architecture-aware filtering detects ARM64 or x86 platforms and displays only compatible applications. All apps deploy as standard Docker containers, and compose files can be exported for independent operation without lock-in. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Evolution API gives your applications a production-ready REST interface to WhatsApp, supporting both free Baileys-based Web connections and Meta's official Business Cloud API from the same server. With 9,200+ stars and 7,100+ forks, it is the most widely deployed WhatsApp integration layer available. Each installation handles unlimited isolated instances (one per phone number) with independent auth, webhooks, and database separation via Prisma ORM against PostgreSQL or MySQL, cached through Redis. Message types include text, images, audio, video, documents, contacts, locations, interactive buttons, list messages, carousel cards, and PIX payment links through unified endpoints. Native integrations connect to Typebot for chatbot flows, Chatwoot for multi-agent support, Dify and OpenAI for AI conversations, N8N and Flowise for workflow automation, and RabbitMQ, Kafka, or SQS for enterprise event streaming. Socket.io delivers real-time message and connection events. Amazon S3 or MinIO handles media offloading. The Evolution Manager v2 dashboard provides visual instance creation, QR code scanning, connection monitoring, and integration configuration without touching the API directly. Docker Compose bundles the server, PostgreSQL, and Redis with environment-variable-driven setup. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Governed by the non-profit Codeberg e.V. with over 150 contributors and quarterly major releases reaching v16.0 in July 2026, Forgejo delivers a complete code collaboration platform in a single Go binary that runs comfortably on 512 MB of RAM — providing full Git hosting with SSH and HTTPS, pull requests with inline code review, issue tracking with labels and milestones, kanban project boards, wikis, and an integrated package registry supporting Docker, npm, PyPI, Maven, NuGet, and Cargo. Forgejo Actions provides GitHub Actions-compatible CI/CD with reusable workflows, OpenID Connect for secure third-party access, ephemeral runners for autoscaling, and dynamic matrix support for complex build pipelines. The platform implements ActivityPub-based forge federation allowing issues, pull requests, and stars to work across independent instances — enabling a decentralized development ecosystem similar to how Mastodon federates social networks. Organizations and team permissions provide fine-grained access control, while LDAP, OAuth2, and OpenID authentication integrate with existing identity infrastructure. Code search indexes repositories for fast discovery, LFS handles large files efficiently, and mirror synchronization imports repositories from GitHub, GitLab, and other forges. Deploy via a single static binary, Docker container, or official Helm charts with SQLite for small instances or PostgreSQL and MySQL for production workloads. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPLv3+ licensed.

Full double-entry accounting on your own server: Manager.io Server Edition runs the same engine as the free desktop edition as a web server, so unlimited users work in unlimited businesses concurrently, with all books on infrastructure you control. The module coverage is genuinely comprehensive - general ledger with a customizable chart of accounts, sales and purchase invoices, quotes and orders, bank and cash account reconciliation, inventory with stock tracking, fixed assets with depreciation, payroll, multi-currency with exchange gains and losses, tax codes for VAT and GST regimes, and the complete reporting stack: balance sheet, profit and loss, trial balance, aged receivables and payables, and cash flow statements. The interface is translated into more than seventy languages, reflecting a genuinely global user base. The licensing model is the refreshing part: a server license is a one-time perpetual purchase, not a subscription - twelve months of updates included, optional renewals after, no per-user tiers, no data limits, and you can downgrade to the free desktop edition anytime, so your books are never hostage. Businesses wanting collaborative accounting behind their own firewall, with data sovereignty and no monthly fees, get exactly that.

Grocy is a household management system, bringing ERP-grade inventory tracking to kitchens, pantries, and homes worldwide. The stock management system tracks products with expiration dates, best-before dates, and opened tracking, while barcode scanning via USB readers or device cameras with Open Food Facts product lookup enables rapid item entry. Minimum stock amounts trigger automatic shopping list entries so frequently used products never run out, and multiple shopping lists can be maintained and shared across household members. Recipe management links ingredients directly to stock inventory, showing at-a-glance fulfillment status and a Due Score that highlights recipes best suited for consuming items approaching expiration. The meal planner organizes daily meals across customizable time periods and adds all missing ingredients to shopping lists with one click. Chore tracking schedules recurring household tasks with assignment to specific members, due date tracking, and completion history logging. Battery management monitors charge cycles for household devices with configurable reminder intervals. Custom fields and userfields extend any entity with additional data, while feature flags disable unused modules to simplify the interface. The RESTful API with integrated Swagger UI at the /api endpoint exposes every operation the web frontend uses, enabling third-party integrations with home automation systems. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Inspect a PostgreSQL database right now, without installing pgAdmin or exposing Postgres to the internet - pgweb answers that recurring need. It's a Go application from Dan Sosedoff, a decade in development, shipped as a single statically-linked binary with zero dependencies - the Docker image is essentially just the executable - that puts a clean browser UI in front of any PostgreSQL 9.1+ server. Connect via URL string or host/port credentials, and browse tables, views, and sequences from the sidebar; selecting a table shows its rows immediately alongside tabs for structure, indexes, and constraints. The Query tab executes arbitrary SQL with query history, and the Explain Query button renders the query plan - estimated cost, row counts, execution strategy - which makes pgweb a quick performance-triage tool, not just a browser. Results and entire tables export to CSV, JSON, or XML in a click. Connectivity is more flexible than its size suggests: native SSH tunneling (password or key) reaches databases behind firewalls, server bookmarks make switching instances instant, and an optional multi-session mode handles several databases concurrently. For a RepoCloud stack full of Postgres-backed apps, one pgweb instance is the universal inspection hatch. MIT-licensed, actively maintained.

With over 9,000 GitHub stars and a focus on developer experience over legacy monitoring complexity, Highlight.io delivers a unified observability platform that correlates frontend user behavior with backend performance data in a single interface. The session replay engine captures high-fidelity DOM recordings showing exactly what users experienced, including console logs, network requests, page transitions, and user interactions, with configurable privacy redaction for sensitive content. Error monitoring automatically groups and deduplicates errors, surfaces affected user sessions, and provides full stack traces with source map support for minified production code. The logging pipeline ingests structured and unstructured logs from any backend service with automatic property extraction, full-text search, and configurable alerting thresholds. Distributed tracing tracks request flows across microservices with embedded links to associated sessions, errors, and logs for complete request lifecycle visibility. The metrics system collects custom application metrics alongside built-in web vitals and performance data for trend analysis and anomaly detection. Search across all telemetry types uses a unified query language with automatic attribute discovery and saved views for recurring investigations. Integrations connect with Slack, Discord, Linear, Jira, Vercel, and dozens of other developer tools for notification routing and workflow automation. SDKs cover React, Next.js, Vue, Angular, Python, Go, Ruby, Java, PHP, and Elixir with framework-specific instrumentation. Self-hosted deployment runs via Docker Compose with ClickHouse for analytics storage. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 9,100 GitHub stars and production deployments powering real-time analytics at companies like SHOPLINE where it reduced API latency by 76.7%, RisingWave is the PostgreSQL-compatible streaming database that collapses the traditional Debezium-plus-Kafka-plus-Flink-plus-serving-database stack into a single Rust-powered system. The platform continuously ingests data from PostgreSQL and MySQL via native CDC connectors that eliminate Debezium middleware, consumes Kafka, Redpanda, Pulsar, and Kinesis topics, accepts webhook events from SaaS applications, and batch-loads historical data from S3 and data warehouses. Standard SQL defines sources, materialized views, and sinks — no new DSL, no Java, and no custom API — while the PostgreSQL wire protocol means psql, DBeaver, pgAdmin, Grafana, Metabase, Superset, Tableau, and every PostgreSQL client library works without modification. Materialized views are incrementally maintained as events arrive, delivering point lookups in single-digit milliseconds without recomputing aggregates from scratch. For long-term retention, RisingWave writes to Apache Iceberg tables with a hosted REST catalog and automated table maintenance including compaction, small-file optimization, and snapshot cleanup, with data queryable by Spark, Trino, DuckDB, and DataFusion. The disaggregated compute-storage architecture uses S3-based state management for elastic scaling, instant failure recovery measured in seconds rather than the minutes-to-hours typical of RocksDB-based systems, and cost-efficient storage tiering. An MCP server enables AI agents to query and operate RisingWave directly. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Links stop drowning in browser bookmarks once Heimdall - the application dashboard from the LinuxServer.io team - gives every web app and service you run a single, organized front door. Items come in three tiers. Generic items link to anything on the web with a name, color, and optional icon. Foundation apps are recognized as you type, auto-filling the application's icon and tile color so a full homelab dashboard assembles in minutes. Enhanced apps go further: supply API credentials and the tile shows live data - queue size and download speed for SABnzbd and NZBGet, plus integrations for Sonarr, Radarr, Plex, Jellyfin, Pi-hole, Portainer, Transmission, and many more. There are no iframes and no apps-within-apps; tiles are honest links with real-time stats layered on. Tiles arrange by drag and drop, backgrounds are customizable, an optional search bar (Google, Bing, or DuckDuckGo) makes it work as a browser start page, and optional multi-user authentication keeps dashboards personal. Built on Laravel with SQLite file-based storage - no external database - it stays light, responsive on mobile, and simple to back up. A natural first deployment: the page that ties every other self-hosted service together.

Stocks, ETFs, crypto, bonds, precious metals, and cash across every account and currency, in one privacy-first dashboard: Ghostfolio is open-source wealth management software. The deliberate design decision is no brokerage linking: positions enter by manual entry, CSV import, or the REST API, so your holdings never pass through a data aggregator. Performance is measured as return on average investment across Today, WTD, MTD, YTD, 1Y, 5Y, and Max timeframes, with benchmark comparison against indices like the S&P 500, dividend tracking, and allocation breakdowns by asset class, region, and sector. A static X-ray analysis flags concentration and other portfolio risks, and a FIRE calculator projects progress toward financial independence. Multi-currency support converts holdings using historical exchange rates, market data comes from Yahoo Finance and CoinGecko among other pluggable providers, and everything exports back out as CSV or JSON. Built with Angular and NestJS on PostgreSQL and Redis, shipped as Docker images for amd64 and ARM, with a mobile-first PWA interface, dark mode, and a distraction-free Zen mode. AGPL-licensed.

Backed by 9,200 GitHub stars and venture funding led by Nauta Capital, Nhost is the open-source Firebase alternative that replaces Google's proprietary document store with a relational PostgreSQL foundation from day one. The Hasura integration auto-generates a real-time GraphQL API with subscriptions, role-based permissions, and remote schemas from your PostgreSQL tables, while event triggers and cron triggers automate backend workflows without custom infrastructure. Authentication supports email and password, magic links, phone OTP via SMS, social OAuth providers including Google and GitHub, WebAuthn for passwordless login with Face ID, fingerprints, and YubiKeys, plus two-factor authentication. Since the Q1 2026 release, Nhost Auth also functions as a full OAuth2 and OpenID Connect provider, allowing your Nhost project to issue tokens to third-party applications the same way GitHub or Google do. The S3-compatible storage service handles file uploads with automatic image optimization, virus scanning, and presigned URLs for secure direct downloads. Node.js serverless functions deploy JavaScript and TypeScript backend logic without managing servers, while the Nhost CLI spins up the complete local stack via Docker for development with automatic database migration tracking and Hasura metadata management. The MCP server integration exposes project documentation and data schemas to AI assistants for intelligent query building. SDKs cover JavaScript, TypeScript, React, Vue, Next.js, and Dart for Flutter. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Backed by over 8,700 GitHub stars and OpenID Connect certification, Pocket ID delivers what enterprise identity platforms like Keycloak provide but without the configuration complexity — a passkey-only OIDC provider purpose-built for homelabs and small deployments. The core design decision is radical simplicity: no passwords exist in the system, only WebAuthn-based passkeys using hardware security keys, TouchID, FaceID, or device PINs, making phishing attacks structurally impossible rather than merely discouraged. The Go backend built on the Gin framework serves a compiled SvelteKit frontend as static assets, running as a single Docker container with SQLite as the default database and optional PostgreSQL for larger deployments. User management supports manual creation, signup links, and open registration, with group-based access control that restricts which OIDC clients each group can access and attaches custom claims for downstream role mapping. LDAP synchronization pulls users and groups from OpenLDAP or Active Directory, while SCIM support enables automated provisioning from compatible identity sources. Federated client credentials handle machine-to-machine authentication for service-to-service communication patterns. The audit system logs every authentication event with GeoIP enrichment, sends email notifications for sign-ins from unknown devices, and provides one-time login codes for accessing accounts from devices without passkey support. TLS with HTTP/2 is built in, PKCE adds code exchange protection, and OpenTelemetry provides tracing and metrics integration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD 2-Clause licensed.