Recognized by the CNCF Landscape in the AI Agent – Workflow Orchestration category alongside Dify and Temporal, Astron Agent is iFLYTEK's fully open-source platform for building, deploying, and managing enterprise multi-agent systems — backed by 8,900+ GitHub stars and the production infrastructure behind one of China's largest AI companies. Unlike pip-install frameworks such as LangGraph, CrewAI, or AutoGen, Astron Agent ships as a complete microservices platform spanning 10+ services across Java, Python, Go, and TypeScript: a ReactFlow-based visual workflow builder for low-code agent orchestration, native integration with the Model Context Protocol (MCP) for tool calling, a built-in model management layer supporting iFLYTEK Spark, OpenAI, Anthropic, and on-premises MaaS deployments, and a multi-tenant Go authentication service powered by Casdoor. The standout differentiator is native RPA integration via the companion astron-rpa project (7,200+ stars), providing 300+ pre-built automation capabilities spanning browser, Office document, and enterprise system interaction — enabling agents to execute physical UI actions rather than only API calls. Infrastructure includes PostgreSQL for multi-tenant data isolation, MySQL for application metadata, Kafka for event streaming, Redis for caching, and MinIO for object storage, all orchestrated through Docker Compose with explicit health checks and dependency chains or production Kubernetes Helm charts. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Stalwart replaces the traditional Postfix + Dovecot + SpamAssassin + calendar-server stack with one Rust binary that speaks every standard mail and collaboration protocol natively. JMAP, IMAP4rev2, POP3, SMTP, CalDAV, CardDAV, and WebDAV all run inside the same process — no glue scripts, no sidecar daemons, no version conflicts between components. The pluggable storage architecture lets operators choose RocksDB for single-node deployments, FoundationDB for distributed clusters, PostgreSQL, MySQL/MariaDB, or SQLite for the data store, S3/MinIO/Azure Blob for message blobs, and Elasticsearch or Meilisearch for full-text search, with Redis or the internal engine backing rate limiters and session state. Security features include S/MIME and OpenPGP encryption at rest, automated DKIM key generation with DNS publication, DANE and MTA-STS transport security, automatic ACME TLS provisioning, granular ACLs, rate limiting, and IP banning. The browser-based admin console manages accounts, domains, groups, mailing lists, SMTP queues, DMARC/TLS-RPT/ARF reports, and every configuration object without touching a config file, while the self-service portal at /account gives end users password reset and encryption key management. Multi-tenant support with per-tenant quotas enables hosting-platform deployments, and coordinator-less clustering via Zenoh or NATS scales horizontally by adding nodes. Deploy via Docker or the standalone binary. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL v3 licensed.

Every Redis client you already use connects to Kvrocks without a single code change, but instead of holding your entire dataset in RAM, data lives on SSD through RocksDB, turning terabytes of memory cost into pennies of disk. An Apache Software Foundation top-level project, Kvrocks supports strings, hashes, lists, sets, sorted sets, streams, bitmaps, JSON documents, TimeSeries data points, Bloom filters, Cuckoo filters, and HyperLogLog structures, all persisted to disk with in-memory caching for hot data access. Asynchronous replication using binlog similar to MySQL provides data durability across replicas, while Redis Sentinel integration enables automatic failover when master or replica nodes fail. The proxyless centralized cluster architecture distributes data across shards while remaining fully compatible with standard Redis cluster SDKs and clients. Token-based namespaces provide multi-tenant isolation with authentication per namespace, going beyond Redis SELECT's numbered database model. RocksDB's LSM-tree storage engine provides efficient compression through configurable compaction strategies, reducing disk footprint dramatically while maintaining sub-millisecond reads for cached keys. Migration tooling includes RedisShake for Redis-to-Kvrocks live migration and kvrocks2redis for reverse migration, enabling gradual adoption without service interruption. The kvrocks_exporter exposes Prometheus-compatible metrics for monitoring, and OpenTelemetry integration provides distributed tracing. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Scira is an AI search engine that breaks complex research questions into sub-tasks, retrieves grounded answers from live sources, and cites every claim with clickable links to the original evidence. Formerly known as MiniPerplx and now backed by nearly 12,000 GitHub stars, the platform implements agentic research planning where language models decompose queries, select appropriate tools, retrieve information in parallel, and synthesize responses with inline citations. Seventeen distinct search modes cover Web, Academic, Extreme, X (Twitter), Reddit, GitHub, Stocks, Crypto, YouTube, and Prediction markets, each activating a curated subset of the 28 built-in tools. The Extreme mode deploys a deep research agent with multi-step planning, parallel source retrieval, code execution in sandboxed Daytona environments, and R2 artifact storage for generated charts. Model routing spans 50+ AI providers through a unified configuration layer supporting OpenAI, Anthropic, Google, xAI Grok, and custom models, with per-mode model assignment based on task requirements. The web search tool supports Exa, Tavily, and Firecrawl as interchangeable providers via a Strategy pattern. Lookouts schedule recurring research agents on cron schedules that monitor topics, track changes, and email summaries using Upstash QStash for reliable execution. PostgreSQL stores chat history, user preferences, and custom instructions while Redis handles caching and rate limiting. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With 13,800+ GitHub stars and active releases through 2026, Casdoor is the open-source identity platform that ships OAuth 2.0, OIDC, SAML 2.0, CAS, LDAP, SCIM 2.0, WebAuthn passkeys, TOTP multi-factor authentication, and Face ID biometric login in a single Go binary with a React web console — covering every authentication protocol your organization will ever need. Social login connects 50+ identity providers including Google, GitHub, Microsoft Azure AD, Facebook, WeChat, DingTalk, Apple, Twitter, and LinkedIn without custom code. The AI-first architecture includes a Model Context Protocol gateway for AI agent authentication and Agent-to-Agent protocol support for securing LLM-powered workflows. Built-in Casbin integration delivers authorization primitives beyond basic RBAC: attribute-based access control, relationship-based access control, and custom policy models through a unified engine. The organization-scoped multi-tenancy model isolates users, applications, and identity providers per tenant with customizable login pages, branding, and SMTP configuration. SCIM 2.0 endpoints automate user provisioning from HR systems and Active Directory. Official SDKs for Go, Java, Node.js, Python, and PHP accelerate application integration. The RESTful API exposes every resource for programmatic management. Comprehensive audit logs record authentication events and administrative actions. Deploy via Docker Compose with MySQL or PostgreSQL, the all-in-one SQLite Docker image for quick trials, or the official Kubernetes Helm chart for production clusters. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

"As simple as Trello but as feature-rich as Jira" is how the Leantime team frames its goals-focused project management system for non-project managers - built from the ground up with ADHD, autism, and dyslexia in mind, with behavioral science shaping customizable dashboards, time blocking, low-cognitive-load prioritization, and Kanban, list, table, Gantt, and calendar views so each person works the way their brain does. The PHP application (AGPL, Laravel Blade frontend) connects strategy to execution: tasks with unlimited subtasks and dependencies roll up into milestones on a timeline, sprints and retrospectives handle iteration, and strategy-level blueprint boards - Lean Canvas, SWOT, risk analysis, goal and metric tracking - keep the "why" attached to the work. Knowledge lives alongside: wikis and docs, idea boards, comments on everything, file storage on S3 or local disk, even screen and webcam recording. Time tracking with timesheets supports estimation and client billing. Admin features are serious for an OSS tool: per-project permissions, two-factor auth, LDAP and OIDC single sign-on, Slack, Mattermost, and Discord integrations, a plugin system, and an expanding API that now powers a mobile app. Recent releases added multi-collaborator task assignment and low-vision accessibility improvements. Available in 20+ languages.

Keystone turns TypeScript schema definitions into a complete GraphQL API and React Admin UI automatically, eliminating the gap between data modeling and application scaffolding. Nearly 10,000 GitHub stars and over 270 contributors across a decade of development back a framework where list definitions map directly to Prisma models on PostgreSQL or SQLite, generating database migrations and exposing every field relationship through Apollo Server's GraphQL endpoint. Granular access control operates at the list, field, and operation level with filter-based restrictions that limit which records users can see, create, update, or delete based on session data and custom logic. The document field provides a structured WYSIWYG editor with content blocks, inline relationships, and custom React components that render consistently across the Admin UI and frontend applications. Event hooks fire before and after create, update, and delete operations for validation, side effects, and external service integration. Custom GraphQL queries and mutations extend the API beyond auto-generated CRUD for bespoke business logic. The Admin UI built with Next.js and the Keystar UI component library supports custom pages, branded navigation, and internationalized interfaces. OpenTelemetry tracing provides observability into operations, queries, and hook execution. Deploys via Docker or any Node.js host with Prisma managing schema evolution. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Quote to cash in one web application - create quotes, convert them to invoices, record payments, track customers: iDURAR is an open-source ERP and CRM platform for small and medium-sized businesses. Built on the MERN stack (MongoDB, Express, React, Node.js) with Ant Design components and Redux state management, it presents a clean SaaS-style interface that needs little onboarding. Core modules cover invoice management with PDF generation and email delivery, payment recording against invoices, quote and proforma handling, customer records, and accounting views over the resulting data. Multi-currency support and localization make it usable for internationally operating teams. Because the whole stack is JavaScript with an API-first backend, extending it - custom fields, new modules, integrations - is approachable for any Node/React developer rather than requiring a specialist ERP skill set. Deployment is straightforward via Docker with a MongoDB instance. Licensed under AGPL-3.0 with free commercial use; a hosted enterprise version exists but the self-hosted edition is fully functional.

With 2,600+ GitHub stars since its May 2026 open-source launch, Knowhere solves the last-mile problem of document intelligence for AI systems — transforming complex unstructured PDFs, reports, and multi-page documents into structured JSON chunks that LLMs can consume without hallucination. The platform processes documents through an AI-native parsing pipeline that handles 20+ page documents with deep hierarchies, intricate tables, and multimodal content including images with OCR, achieving 95% precision in information extraction while reducing token costs by 50% compared to raw document ingestion. The knowledge tree architecture maintains historical context across multiple documents, enabling cross-document graph navigation for agentic retrieval that goes beyond simple chunk-based RAG. Built on Python 3.11+ with MinerU as the default PDF parser, the backend API runs alongside async workers that process document ingestion, graph construction, and embedding generation. The self-hosted Docker Compose stack packages the API server, processing workers, and Next.js dashboard for managing API keys, webhooks, and document-processing jobs, backed by PostgreSQL and Redis. Both Python and Node.js SDKs provide programmatic access for integration into existing AI pipelines and agent frameworks. LLM providers include DeepSeek and Alibaba Cloud DashScope with configurable key rotation for rate-limit management. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Send a document, receive a PDF: Gotenberg is a Docker-based, stateless HTTP conversion API trusted in production by thousands of companies and adopted by notable open-source projects. Send files as multipart/form-data, get a PDF back; Chromium, LibreOffice, and fonts are the container's problem, not yours. Headless Chromium handles URLs, HTML templates, and Markdown with pixel-perfect browser rendering: it executes JavaScript, loads web fonts, waits for network idle, a JS expression, or a DOM selector before rendering SPAs, and accepts injected cookies and HTTP headers for authenticated pages. LibreOffice converts 100+ office formats - .docx, .xlsx, .pptx, and legacy formats - with page-range extraction and PDF/A archival conformance. Built-in PDF engines round out the pipeline in every image variant: merge, split, rotate, flatten, encrypt, watermark, stamp, read/write metadata and bookmarks, plus Factur-X/ZUGFeRD e-invoicing and PDF/UA accessibility compliance. Screenshots of URLs and HTML come from the same endpoints. Zero-transfer pipelines stream files directly between S3, MinIO, or GCS presigned URLs and Gotenberg, bypassing your application entirely, and webhooks enable async processing. Statelessness means horizontal scaling is trivial - run as many replicas as your conversion volume demands. Three image variants (full, Chromium-only, LibreOffice-only) trim the footprint to what you actually use.

With over 3,800 GitHub stars and continuous development since 2002 spanning 24 years of active maintenance through version 16.4.0 released in May 2026, Piwigo has proven itself as one of the most battle-tested self-hosted photo gallery platforms available, trusted by professional photographers managing 150,000+ high-resolution images alongside small teams sharing event photos. The PHP backend with MySQL or MariaDB storage serves a responsive web interface that organizes photos into hierarchical albums with nested sub-albums, tag-based categorization, and smart albums generated dynamically from search criteria. Batch management tools handle bulk uploads, metadata editing, tag assignment, and album moves across thousands of images simultaneously. User permission controls define access at the album level with configurable public, private, and group-restricted visibility, while guest access allows public galleries without authentication. Image processing via ImageMagick or PHP GD generates multiple thumbnail sizes, watermarks, and responsive derivatives automatically. The plugin ecosystem with over 200 community-built extensions adds functionality from EXIF metadata display and GPS mapping to social sharing, download controls, and Lightroom synchronization for desktop workflow integration. The REST Web API with personal API key authentication enables programmatic album creation, photo uploads, and metadata queries from external applications. Mobile apps for iOS and Android provide on-the-go upload and browsing capability. Docker deployment via the official container or traditional LAMP installation on any hosting provider. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-2.0 licensed.

Built for self-hosting from the ground up, Kutt is a modern, MIT-licensed URL shortener: zero-configuration setup, no build step, and SQLite, PostgreSQL, or MySQL with optional Redis caching. Links carry real management features - custom slugs from a configurable alphabet (confusable characters like 0/O and l/1 omitted by default), password protection, descriptions, expiration times, and the ability to edit a destination URL without changing the short link already in circulation. Custom domains make branded short links first-class: add as many as you like and serve each under your own name instead of a third-party's. Private, per-link statistics track clicks, browsers, operating systems, and countries without logging visitor IPs or sensitive data. An admin page manages users and links instance-wide, and two environment flags (DISALLOW_REGISTRATION, DISALLOW_ANONYMOUS_LINKS) lock the instance down for private use; OpenID Connect login integrates with an existing identity provider. Automation runs through a documented REST API - create, list, delete, and pull stats - plus Chrome and Firefox extensions and ShareX compatibility for shortening from anywhere. Built with Node.js and React, deployed in one Docker container, it replaces Bitly with something you own: your domain, your analytics, and links that never die with a vendor.

Garnet is Microsoft Research's cache-store built on .NET that speaks the Redis RESP wire protocol while delivering up to 10x higher throughput and 4x lower tail latency than comparable alternatives on identical hardware. The Tsavorite storage engine provides a cache-friendly, shared-memory architecture scaling linearly across CPU cores, supporting both in-memory operation and tiered storage across local SSDs and Azure Storage for datasets exceeding available RAM. Cluster mode enables sharded deployments with replication, dynamic key migration for live rebalancing, non-blocking checkpointing, and automatic failover using standard Redis cluster commands. The RESP implementation covers raw strings, sorted sets, lists, hashes, sets, bitmaps, HyperLogLog, streams, pub/sub, Lua scripting, and client-side transactions, allowing StackExchange.Redis, Jedis, redis-py, and other Redis clients to connect without modification. C#-based extensibility lets developers define custom commands and new data types as server-side stored procedures, compiled and loaded at runtime without restarting the server. TLS encryption, ACL-based access control, and operation logging complete the production feature set. Deployed across Microsoft services including Windows & Web Experiences, Azure Resource Manager, and Azure Resource Graph. Nearly 12,000 GitHub stars. MIT licensed.

"Forget about bouncers" became a real sentence because of The Lounge: a Node.js web IRC client that holds persistent connections to your networks 24/7, logging everything while you sleep, so closing the browser tab never means missing a message or losing your place in a channel. Open it again from any device - desktop, phone, tablet - and you resume exactly where you left off, with full history synchronized. Because it combines bouncer and client in one process, the experience feels like a modern chat app rather than 1990s infrastructure: push notifications for highlights and private messages (with self-generated VAPID keys, so even Web Push needs no third-party service), automatic link previews, inline file and image uploads, and full IRCv3 protocol support. It installs as a progressive web app from any modern browser, so phones get a native-feel client without an app store. Multi-user support means one instance serves your whole team or community, each user with their own networks and history, and LDAP integration ties into existing authentication. A public mode alternatively serves as an open, registration-free web chat for events or support channels. MIT-licensed, born as a fork of Shout, and a fixture of self-hosting stacks since.

Mastodon serves single-user and small-community instances poorly; GoToSocial, an ActivityPub server written in Go, was built precisely for them. Where Mastodon demands Ruby, PostgreSQL, Redis, and Sidekiq, GoToSocial is one binary using roughly 250-350 MiB of RAM with SQLite as the default database (PostgreSQL optional) - it runs comfortably on a $5 VPS or a repurposed laptop. The deliberate design choice is having no built-in web client: the server exposes profile pages, a settings panel, and a faithful implementation of the Mastodon API, and you post through the client app you already like - Tusky on Android, Feditext on iOS, Pinafore or Phanpy in the browser. Federation is the point: your instance follows, boosts, and replies across Mastodon, Misskey, Pixelfed, and the rest of the Fediverse, with your identity anchored to your own domain. Safety is a stated focus, with granular per-post visibility and interaction controls, content warnings, custom emoji, hashtag following, domain allow/blocklists, and OIDC login support. Built-in Let's Encrypt provisioning simplifies the mandatory TLS. AGPL-3.0 licensed and in active beta, federating cleanly with the ecosystem's major servers.

InvenTree is an inventory management system for electronics manufacturers, makerspaces, and small-to-medium businesses. The hierarchical part categorization system organizes components into unlimited nested categories, while stock items tracked across cascading locations and sub-locations provide instant visibility into current inventory levels, with optional serial number tracking for individual item traceability and acceptance testing. Intelligent BOM management calculates sub-part requirements, validates availability against current stock, supports multi-format BOM upload including KiCad integration, and generates detailed bills of materials with full database enrichment. Build orders consume BOM-allocated stock to produce assembled parts with step-by-step work order tracking, while purchase orders manage supplier relationships with pricing history, lead times, and automatic stock receipt processing. The modern React frontend built with Mantine, TanStack Query, and Zustand provides responsive data tables, tree-select navigation, a preview drawer, and a snippet editor. The extensible plugin system supports 19 mixin types including BarcodeMixin for scanner integration, LabelPrintingMixin for Zebra and Brother printers, AppMixin for custom database tables, and ScheduleMixin for periodic background tasks. Companion mobile apps on Android and iOS provide barcode scanning and stock operations in the warehouse. Docker Compose deploys with PostgreSQL, MySQL, or MariaDB backends behind any reverse proxy. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

API keys hardcoded in repos, database passwords pasted into CI variables, .env files emailed between developers - Infisical, the open-source platform for secrets, certificates, and privileged access management, is the answer to all three. Secrets live in versioned stores scoped by project, environment, and path, with fine-grained identity-aware access control and full audit logging on every read and change. Delivery covers every consumption pattern: CLI injection into local dev, SDKs for Go, Node.js, and Python, an HTTP API, agents, a Kubernetes Operator, and secret syncs that push to GitHub, GitLab, AWS Secrets Manager, and Vercel. Automatic rotation replaces credentials for PostgreSQL, MySQL, MSSQL, LDAP, AWS IAM, and Azure on a rolling schedule - new credentials issue while old ones stay temporarily valid, so nothing breaks mid-rotation. Dynamic secrets go further, generating ephemeral, time-bound database credentials on demand, and SSH access replaces static keys with short-lived CA-signed certificates that expire automatically. Secrets scanning catches hardcoded credentials in code and pipelines, certificate management automates X.509 issuance and renewal, and a built-in KMS handles encrypt/decrypt with central key control. Self-hosting keeps the keys to everything else on your own infrastructure.

Deployment decoupled from release: Unleash, the most popular open-source feature management platform on GitHub, is a Node.js server backed by PostgreSQL. Ship code dark, then control who sees it through activation strategies: gradual percentage rollouts, targeting by user ID, IP, hostname, or application name, custom constraints against your own context fields, and scheduled or time-limited releases. Strategies stack - a flag activates if any strategy matches - and strategy variants layer A/B versions on top of the on/off decision. Each flag carries per-environment configurations, so a feature can run at 100% in staging while canarying at 5% in production. Backend SDKs (Node.js, Java, Go, Python, Ruby, .NET, PHP, Rust, and more) fetch configuration and evaluate flags locally, so a flag check adds zero network latency to request paths; frontend SDKs for React, Vue, Svelte, iOS, Android, and Flutter evaluate through a proxy layer. Flag hygiene is built in: flags are typed (release, experiment, operational, kill-switch, permission) with expected lifetimes, and Unleash marks overdue flags as potentially stale and surfaces unknown flags your SDKs request but that don't exist. Self-hosting via Docker keeps flag data, targeting rules, and evaluation infrastructure entirely on your side.