Created in March 2026 and rapidly gaining traction in self-hosting communities, DockPanel delivers the most feature-dense free server panel available — 811 API endpoints, 153 one-click Docker app templates across 14 categories, and full multi-server management, all running on three Rust binaries consuming under 50MB of combined RAM. The panel handles the complete server lifecycle: sites with automatic SSL via Let's Encrypt, MySQL and PostgreSQL databases in Docker containers, Git push-to-deploy using Nixpacks for automatic language detection without Dockerfiles, blue-green zero-downtime deployments with automatic rollback on failed health checks, DNS management, mail servers, monitoring dashboards, and encrypted backups to S3, SFTP, Backblaze B2, or Google Cloud Storage. Security receives production-grade attention with per-image CVE scanning that gates deployments, a built-in WAF, passkey authentication alongside Argon2 password hashing, HttpOnly JWT sessions with blacklist-on-logout, rate limiting on auth endpoints, and fail2ban integration — all verified through an 18-vulnerability pentest with zero remaining issues. Infrastructure as Code support exports your entire server configuration to YAML, and the developer CLI provides status, diagnose, and export commands for automation. GPU passthrough enables AI workload hosting, reseller accounts support white-label branding for agencies, and ARM64 compatibility covers Raspberry Pi and Oracle Cloud free-tier deployments. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Your AI coding agent has your API keys in its environment and unrestricted network access, which means one prompt injection away from sending those secrets anywhere. Pipelock closes that gap by sitting as a proxy between your agents and every outbound connection, scanning the actual content of HTTP, WebSocket, MCP, and Agent-to-Agent traffic before it leaves your server. An 11-layer scanner pipeline checks every request against 62 credential patterns covering AWS, GCP, Azure, GitHub, OpenAI, Anthropic, SSH keys, and database URLs, then inspects every response for prompt injection using 29 detection patterns with six-pass normalization that catches base64-encoded, leetspeak, and whitespace-obfuscated payloads. The MCP proxy wraps any Model Context Protocol server (stdio, HTTP, or WebSocket) with bidirectional scanning that detects tool description poisoning and mid-session rug-pull changes via SHA-256 fingerprinting. Every scanning decision produces a cryptographically signed action receipt that third parties can verify offline without trusting the agent or the vendor. The Operator Console provides a web dashboard for reviewing evidence scorecards, receipt timelines, agent sessions, enforcement decisions, and fleet posture at a glance. Cross-request taint tracking catches slow-drip exfiltration attempts that spread a secret across multiple calls. Canary tokens plant synthetic secrets that trip alerts the moment an agent tries to exfiltrate them. Pre-built Prometheus metrics and a Grafana dashboard provide real-time visibility into traffic volumes and block rates. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

SolidInvoice ships a complete billing platform as a single FrankenPHP binary — no separate PHP installation, no web server configuration, just one executable that delivers quote-to-invoice conversion, automated recurring billing, Stripe and PayPal payment processing, multi-currency precision arithmetic, and eight render-ready PDF templates out of the box. Maintained since 2012 across 63 releases with 30 contributors, the Symfony 7 and PHP 8.4 backend provides quote creation with one-click conversion to invoices, recurring billing with configurable frequency schedules, and online payment processing through Payum supporting Stripe, PayPal, and additional gateways. Multi-currency support uses real Money objects for precision arithmetic, while multi-tax support handles invoice-level and line-item tax rates with automatic calculation. Client management stores contacts, multiple addresses with map integration, credit balances, and complete quote and invoice history per client. The redesigned Tabler-based UI features a dashboard with hero statistics, ChartJS revenue trend visualization, attention-required alerts for overdue and draft invoices, quick actions, and a recent activity timeline. A RESTful API enables integrations with external systems. Multi-channel notifications deliver alerts via email, SMS, and webhooks. Google OAuth and two-factor authentication secure access. Grid export and full company data export support backup and migration. Deploy using Docker, Homebrew, the standalone FrankenPHP binary, or from source. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Poznote serves as an all-in-one personal knowledge base and digital workspace designed to bridge unstructured thinking and structured documentation. The platform pairs a responsive Markdown editor with live side-by-side rendering, KaTeX mathematical notation, and interactive Mermaid diagram compilation. Creative thinkers can switch instantly to an embedded Excalidraw infinite canvas to sketch system architectures, design mind maps, and create interface wireframes alongside their written notes. Every directory within the workspace can be toggled into an agile Kanban board where nested folders become customizable workflow columns and notes transform into draggable task cards. Task management views aggregate checklists across documents into unified priority queues with due date reminders and completion filters. An integrated bi-directional Git synchronization engine connects user workspaces directly to personal GitHub or Forgejo repositories, versioning edits automatically on save. The software also provides an integrated Model Context Protocol server that enables AI coding assistants to search notes, create documents, and query knowledge repositories securely. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Named after the Bosnian word for invoice (račun) with a raccoon twist, Rachoon provides a clean self-hosted invoicing platform that handles the complete billing cycle from quotation to payment reconciliation without touching a third-party SaaS subscription. The Nuxt.js frontend serves a dashboard that surfaces revenue totals, pending balances, overdue items, and client statistics at a glance, while the AdonisJS backend manages all business logic against a PostgreSQL 16 database with TypeScript throughout the full stack. Invoice templates use Nunjucks with full HTML and CSS control—including conditional logic, loops, and custom formatting—so the rendered PDFs actually match your design intent. This is possible because Rachoon delegates PDF generation to Gotenberg, which renders invoices through headless Chrome rather than a restricted drawing API, producing output that faithfully preserves complex layouts, web fonts, and CSS grid. Client records stay organized and searchable, each linked to their invoice and quotation history with payment status tracking across pending, paid, and overdue states. Multi-currency billing with flexible tax configuration supports international operations, and all data remains on your own infrastructure. The monorepo is managed by Turborepo with a CI pipeline covering linting, PostgreSQL integration tests, build verification, and multi-platform Docker image creation for both amd64 and arm64 architectures. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

LobsterBoard lets you assemble custom monitoring dashboards from 50 pre-built widgets using a visual drag-and-drop editor, covering everything from CPU and memory gauges to AI subscription trackers, stock tickers, and camera feeds on your own server with zero cloud dependencies. The snap-grid editor handles layout composition with resize handles and a property panel, so you drag widgets onto a canvas, configure their data sources, and the dashboard is live. Real-time system statistics flow through Server-Sent Events, updating CPU load, memory pressure, disk usage, network throughput, and Docker container status without page refreshes. Five built-in themes range from a dark default to a retro CRT terminal aesthetic, a warm sepia paper look, and pastel options for different display environments. The template gallery lets you export complete dashboard layouts with auto-captured screenshot previews, share them with other users, and import configurations as a full replacement or selective merge. Custom pages extend beyond dashboards into notes, kanban boards, or any free-form layout you need. Built-in widgets connect to iCal feeds for calendar events, RSS sources for news aggregation, weather APIs for local conditions, and financial data providers for cryptocurrency and stock prices. The whole system runs from a single server.cjs file with zero cloud dependencies or external frameworks. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSL-1.1 licensed (free for non-commercial use; converts to MIT in 2030).

Describe an app in one sentence and sandboxd, a self-hosted AI app builder, has a coding agent build it in an isolated sandbox and hand back a live preview URL. Start from a blank prompt, a React, Next.js, Express, or FastAPI starter, or an imported public Git repo. Refine it in one persistent chat beside Preview, Code, Terminal, and Git tabs. Pick OpenCode, Pi, or Claude Code. Point OpenCode or Pi at local or remote OpenAI-compatible and Anthropic-compatible endpoints, LiteLLM gateways included. A proxy injects provider keys on the wire, so nothing secret lands in a sandbox. Did the agent get it wrong? Every task is checkpointed first, so one click reverts the turn. Snapshots, forks, and named versions keep known-good points to branch from. Edit files in the browser, review file-by-file diffs, commit, and push. Secrets are write-only and encrypted per app. Idle sandboxes sleep and wake on the next request. One modest server can host per-user previews, coding playgrounds, or an agent platform. The app library installs 80+ curated open-source apps, such as Ghost, n8n, Gitea, and Grafana, each in its own sandbox. Every console action is also a /v1 HTTP call with an OpenAPI spec. Upgrades back up the database, health-check the new version, and roll back on failure. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Allocating every incoming dollar into purposeful spending and savings buckets before transactions occur, OpenBudgeteer gives households complete financial control through a self-hosted zero-based envelope budgeting platform. Users can organize expenditures into customizable bucket hierarchies, grouping everyday living costs, debt repayments, and sinking funds into distinct categories with target balances. Financial planners can import bank statement files via flexible CSV mapping profiles that parse transaction descriptions, clean up merchant strings, and auto-assign records to corresponding expense buckets. The transaction registry provides split-transaction functionality, allowing shoppers to divide a single department store receipt across grocery, household, and clothing envelopes with exact currency precision. Interactive progress bars display bucket health throughout the billing month, signaling when spending velocity threatens allocated limits and calculating suggested contributions for forthcoming paychecks. Advanced forecasting reports plot multi-month net worth trajectories, track category expenditure patterns, and calculate burn rates against long-term retirement and emergency savings goals. Account balances synchronize across multiple physical checking accounts, credit cards, and cash wallets, ensuring total bucket balances reconcile perfectly against real bank reserves. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL v3 licensed.

VoidAccess is a self-hosted dark web OSINT platform that takes a single investigation question and returns a sourced report, a searchable relationship graph, and indicators you can load straight into your defenses. One query fans out in parallel to more than a dozen Tor search engines, code hosts, paste sites, security feeds, and curated onion seeds, then follows newly discovered onion links while mandatory safety gates drop prohibited queries, URLs, and content. A thirteen-step pipeline refines the question, collects across English, Russian, and Chinese sources, filters signal from duplicates and dead ends, enriches what survives, and extracts the entities that matter. It recognizes threat actors, ransomware groups, malware families, IP addresses, domains, onion addresses, file hashes, cryptocurrency wallets across seven chains, exposed credentials with secrets masked, messaging handles, CVEs, and MITRE ATT&CK techniques. Everything lands in an interactive graph with communities and infrastructure clusters, so you can start from one wallet or handle and walk the neighborhood it belongs to, cross-referenced against earlier investigations. Scheduled monitors watch for changes and send Telegram or email alerts when your targets move. Finished work exports as STIX 2.1, MISP events, Sigma and YARA rules, CSV, JSON, and bundled IOC packages, with multi-user access for a team. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 600 GitHub stars and a featured Show HN launch, Mission Control is the agent-first command center that replaces the chaos of manually shepherding AI agents with structured delegation, approval workflows, and autonomous execution. The Next.js 15 web UI delivers an Eisenhower priority matrix with drag-and-drop quadrants, a Kanban board tracking tasks through Not Started, In Progress, and Done columns, and a goal hierarchy with milestone progress bars — powered by shadcn/ui, Radix UI, and @dnd-kit. Six built-in agent roles — Researcher, Developer, Marketer, Business Analyst, Tester, and You — receive tasks through a token-optimized API compressing context by 92 percent to approximately 50 tokens versus 5,400 unfiltered. The autonomous daemon polls task queues on cron schedules, spawns Claude Code sessions via the official CLI, enforces concurrency limits, and auto-retries with loop detection that escalates to human decisions after three failures. Field Ops extends execution to 64 external services across 16 categories with working X, Ethereum with MetaMask signing, and Reddit adapters, protected by AES-256-GCM encrypted vault with scrypt key derivation, per-service and global spend limits, a circuit breaker, and three autonomy levels. All data lives in local JSON files with Zod validation and async-mutex locking ensuring safe concurrent writes, backed by 193 automated Vitest tests. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

AgentVerse OS turns a single Ubuntu server into a personal cloud with a real desktop in the browser, built for a developer and their AI agents. You work in a windowed desktop with a taskbar, start menu, and widgets for system monitoring, clock, news, weather, and projects, and the same desktop opens from a laptop, tablet, or phone while everything stays on the server. Each project gets an isolated Incus container with Docker inside, its own network and gate, plus VS Code, a terminal, files, and git in the browser. The Agents app runs Claude Code, Codex, Gemini CLI, pi, and Antigravity inside the workspace, with permission prompts you approve from any device, scheduled routines, model menus, conversation search and export, and a ledger of what each session spent. When you close your laptop the agents keep working, and you pick the conversation up later exactly where it stopped. A built-in store merges the Runtipi, Coolify, and Umbrel catalogs into about 945 installable apps with guided setup, credentials shown in the app card, snapshots, and rollback. Projects request capabilities such as storage.s3, llm, or notify instead of hardcoding addresses, scheduled ZFS snapshots feed a restic backup repository, and access arrives only through your Tailscale network with real certificates. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Friday night, 1994: you are standing in the Action aisle deciding what the weekend looks like, except the shelves are stocked with your own library and the store lives in your browser. Halcyon Video rebuilds that ritual in 3D around your Jellyfin, Plex, or Emby server, turning libraries into aisles and genres into signed sections you can walk. Pick a case off the shelf and it comes up in your hand at true rental proportions; flip it over for the synopsis, cast, runtime, ratings, and a technical table read from the actual file. Seasons arrive as box sets, popular titles sit deeper on the shelf, and the clerk behind the counter searches by title, director, or genre and recommends from your catalog and watch history. Carry an armful to the checkout and she bags them in plastic that folds around the cases, receipt and all. A RomM connection opens a games department with platform-correct cartons and clamshells, while Jellyseerr requests appear as discovery cases you can order in-store. Drive it from the couch with a TV remote, gamepad, keyboard, or phone, or let attract mode tour the floor past the ceiling CRTs. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Why split your entertainment life across half a dozen siloed apps when Floppy tracks every movie, television episode, anime season, book, comic, video game, board game, album, and podcast in one unified self-hosted library? A configurable home dashboard shows exactly how much runtime remains in your current shows alongside personalized recommendation rows driven by your genre, studio, cast, and tag history. Music and podcasts are first-class citizens backed by MusicBrainz discography metadata, track-level scoring, Last.fm scrobble polling, and live Pocket Casts episode synchronization. Collectors can catalog physical and digital media ownership down to the exact disc format, video resolution, HDR standard, audio codec, and bitrate, complete with automated Plex collection syncing. Live webhooks and scheduled jobs connect directly to Plex, Jellyfin, Emby, Audiobookshelf, Sonarr, Radarr, and Seerr so watches, listens, and library additions log themselves automatically. You can curate public or private lists with programmable smart-list rules, RSS and JSON feeds, Trakt watchlist imports, and barcode ISBN scanning for physical books. Recap-style statistics let you compare custom date ranges across reading streaks, pages read, listening hours, and top actors or authors, while a REST API and built-in Model Context Protocol server power custom automations. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Every physical device on your network gets a living digital counterpart in Eclipse Ditto: a Thing whose Features hold its current state, desired state, and properties, readable and writable through APIs even while the device itself is offline. Your application talks to the twin over a REST-like HTTP API for CRUD and search, over WebSocket for real-time bidirectional streams, or over Server-Sent Events for change notifications, and Ditto routes commands down the live channel to the actual device when it is connected. Devices and backends connect through managed Connections to MQTT, AMQP 1.0 and 0.9.1, Apache Kafka, and HTTP endpoints, with payload mapping that translates between device formats and Ditto Protocol JSON. Fine-grained Policies decide per subject and resource who may read a temperature, change a setpoint, or receive an event, including namespace-scoped entries and partial change notifications that only reveal fields a subscriber may see. Search across millions of twins uses an RQL query language with custom MongoDB indexes, and Web of Things integration generates Thing Descriptions scoped to each requester's permissions. The bundled Explorer UI lets operators browse Things, inspect Features, and time-travel a twin's state to any past revision or timestamp to see exactly what changed and when. OpenID Connect and basic authentication protect the gateway, and Prometheus metrics expose live entity counts per namespace. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. EPL-2.0 licensed.

New hires fail from information overload and IT bottlenecks, not lack of goodwill - the observation behind ChiefOnboarding, a free, open-source employee onboarding platform (Django, Celery, PostgreSQL, Redis). Its answer is sequences - drag-and-drop timelines that drip-feed to-do items, resources, courses, forms, and badges to each new hire, triggered by dates or by completing a previous item, so nobody faces everything at once. Onboarding starts before day one: preboarding pages welcome hires early, and colleagues can leave personal messages that appear there. The account provisioning module creates the new hire's Slack, Google, Asana, and other accounts automatically on the scheduled day via a library of integrations plus custom webhooks - the IT ticket queue never gets involved. Everything works through two equivalent interfaces: a full web dashboard and a Slack bot, either usable standalone. Slack can even auto-create new hire accounts when someone joins the workspace and assign default sequences with zero manual action. Colleague tasks with comments and collaboration, a searchable people directory, scheduled introductions, and per-hire timezone awareness (no 3 a.m. notifications) round it out. No trackers, no phoning home - third-party credentials sit in encrypted fields on your server.

PowerDNS answers the queries; Poweradmin gives you a browser-based control panel for its zones, records, DNSSEC keys, and users, with a REST API for automation. Create master, native, and slave zones, and let zone templates stamp predefined record sets onto new ones. Edit records inline with filters, or open the optional Record Wizard for DMARC, SPF, DKIM, CAA, TLSA, and SRV. Reverse zones link to their forward zones. The batch PTR tool fills whole network ranges, bulk add takes one CSV line per record, and secondary zones can be imported over AXFR. For DNSSEC, manage keys and copy DS and DNSKEY records for your registrar; changes are applied or rectified through the PowerDNS API so signed zones stay consistent. Every record and zone edit is logged with before and after snapshots, and the logs can be filtered and exported. The panel is translated into 43 languages, including right-to-left ones. Permission templates, users, and groups control who touches which zones, sign-in works through LDAP, OIDC, or SAML, and administrators can switch on authenticator-app or email two-factor codes. API keys can be read-only, limited to chosen operations, or restricted to specific zones, and companion projects link Terraform, ExternalDNS, cert-manager, and Certbot. Dynamic DNS clients such as ddclient and inadyn update records through a dyndns2-compatible endpoint. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Draw it, write it as code, or hand it to your AI agent: OpenFlowKit is an open-source diagram canvas where the picture and the text behind it are always the same diagram. Drag shapes on the canvas or type a few forgiving lines, and each side regenerates the other as a single undo step. Ten diagram types share that one language: architecture with C4 views and cloud icons, sequence, flowchart, entity-relationship, state, class, mind maps, git graphs, charts, and wireframes. Paste Mermaid, Structurizr, or D2 and it converts into editable shapes, and Copy as Mermaid sends a flowchart or sequence back out for your README. Paste a GitHub repository instead and Map mode draws its architecture for you, with every arrow citing the exact file and line behind it, and a CLI that maps a local checkout for private repos. Connect Claude Code, Cursor, or any MCP client and the agent draws on your live canvas, restyles what is there, and screenshots its own work to check it. A built-in assistant works with your own key from Claude, OpenAI, Gemini, Groq, Mistral, OpenRouter, or a local Ollama, and exports cover PNG, SVG, PDF, JSON, and animated SVG, GIF, MP4, or WebM you can drop into documentation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Built to consolidate fragmented digital life into a private personal cloud, Eclaire centralizes tasks, notes, documents, photos, and web bookmarks into a unified workspace powered by local artificial intelligence. Users can save web articles to generate clean Markdown copies and searchable PDF archives, automatically bypassing clutter and dead links. The integrated document ingestion engine extracts tabular data from spreadsheets, performs optical character recognition across uploaded receipts and handwritten images, and indexes multi-page PDF manuals for rapid full-text search. Conversational assistant panels allow operators to interrogate their accumulated library using natural language, asking for cross-document summaries, research timelines, or action items extracted from meeting transcripts. Background workers prioritize asynchronous indexing queues, categorizing image libraries with visual object tags and managing recurring task deadlines with automated Telegram alert notifications. External automation flows can interact directly with the unified storage layer via an OpenAI-compatible REST API, allowing mobile shortcuts and custom scripts to ingest bookmarks and dictate notes remotely. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.