Every unit of income gets a job in Actual Budget - a local-first personal finance app built on envelope (zero-sum) budgeting, where you can only budget cash you actually have, which keeps the plan honest by construction. The data model is a SQLite file that lives on your device and works fully offline; the self-hosted Node.js sync server adds background multi-device synchronization using CRDT-based distributed-systems machinery, browser and mobile access as an installable web app, and automated backups. Optional end-to-end encryption makes the synced data unreadable even to the server hosting it. Transactions enter three ways: manual entry, file import (CSV, QIF, OFX, QFX, CAMT.053), or automatic bank syncing through GoCardless for EU/UK banks and SimpleFIN for US/Canada. Built-in YNAB4 and nYNAB importers migrate complete budget histories, and reports, schedules for recurring transactions, and rule-based transaction cleanup handle the day-to-day. A fully featured local API lets developers script custom importers and automation against their own data. 100% free, open source, and 26k stars strong.

Authentication that lives inside your application rather than behind a redirect to an external identity provider - SuperTokens takes a fundamentally different architecture from Auth0 and AWS Cognito. Three tiers make that work - frontend SDKs (React, Angular, Vue, vanilla JS, React Native) render overridable login UI and manage tokens; backend SDKs (Node.js, Python, Go) expose auth endpoints on your own API domain; and SuperTokens Core, the piece you host here, is the stateless HTTP service handling core auth logic, password hashing, token signing, and database operations against PostgreSQL. The recipe system keeps features decoupled: use email/password, social login, passwordless (magic links, OTP), phone-password, multi-factor authentication (TOTP, WebAuthn), user roles, and microservice auth - individually or combined; you can even use SuperTokens purely for session management alongside another login provider. Sessions are where it shines: rotating refresh tokens with theft detection, automatic access-token refresh, CSRF protection, and secure cookie handling out of the box - the details that become vulnerabilities when hand-rolled. Verification happens locally in your backend via cached JWT signing keys, so the Core stays off the hot path. Self-hosted means no user limits, free forever, with all user data in your database. Apache-licensed.

Powering authentication for over 15,000 GitHub stargazers and production deployments across startups and enterprises alike, SuperTokens delivers the complete login infrastructure that Auth0, Firebase Auth, and AWS Cognito charge premium prices for — entirely open source under Apache 2.0 with no per-user limits. The Java-based core service runs as a lightweight HTTP microservice that connects to PostgreSQL or MySQL and handles email-password login, passwordless magic links and OTP via email or SMS, social OAuth with Google, GitHub, Facebook, Apple, and any custom OIDC provider, phone-password authentication, and time-based one-time password multi-factor authentication. Session management uses rotating refresh tokens with anti-CSRF and anti-session-fixation protections, verifying tokens locally in your backend SDK without network round-trips to the core. Frontend SDKs for React, React Native, Angular, Vue, and vanilla JavaScript provide pre-built UI components for login, signup, email verification, and password reset flows, all customizable through an override system that lets you add pre- and post-API logic, custom hooks, and user event handlers. The built-in user management dashboard enables administrators to view users, reset passwords, revoke sessions, modify roles, and manage email verification status. Multi-tenancy and organization support powers B2B SaaS applications with tenant-level authentication configuration and Enterprise SSO via SAML and OIDC. Migration tools support bulk importing millions of existing password hashes, TOTP secrets, and role mappings. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Friendica connects to more federation protocols than any other single platform: ActivityPub reaches Mastodon, Pleroma, Misskey, Lemmy, Pixelfed, and PeerTube; the Diaspora protocol bridges that network; and OStatus provides legacy compatibility. But protocol reach is just the foundation. Where most fediverse platforms stop at microblogging, Friendica offers long-form posts, photo albums, event calendars with RSVP, group discussions, and rich multimedia content. BlueSky and Tumblr connectors extend your reach into non-federated networks, while RSS import pulls content from any blog or news source into your timeline. Privacy controls let you scope each post to specific contacts, groups, or public visibility with per-post granularity rather than account-wide settings. Multiple themes customize the interface from Facebook-like layouts to minimal designs, and Fedilab provides native mobile access. Under the hood, the PHP application with MariaDB runs as either an Apache or FPM Docker image with Redis caching and background cron workers handling federation delivery, media processing, and notification dispatch. One of the oldest fediverse projects (1,650+ stars, 160+ contributors since 2010), Friendica has weathered every protocol evolution and platform migration the decentralized web has thrown at it, making it one of the most battle-tested social networking platforms available.

Every service you run, behind one polished start page: Dashy is the most customizable homelab dashboard, built as a Vue.js homepage. Configuration lives in a single YAML file, but you never have to hand-edit it: an integrated UI editor with real-time validation writes changes back to disk, so both config-as-code and point-and-click camps are served. Status indicators put a live health dot next to every app - HTTP checks or pings on custom intervals, with response time and status details on hover - giving you an at-a-glance uptime overview before anything breaks. Over 50 built-in widgets pull dynamic content from the services you already run: Pi-hole and AdGuard block stats, Proxmox lists, Nextcloud status, Netdata CPU/memory history, Prometheus data, plus weather, RSS, crypto prices, and generic iframe/API-response widgets for anything with an endpoint. Instant fuzzy search launches any app as you type, with customizable hotkeys and web-search fallthrough. Theming is deep: dozens of built-in themes, a UI color palette editor, and custom CSS over CSS variables. Alternate views include a fast-loading minimal startpage and a workspace view that embeds apps side-by-side without leaving the dashboard. Icons resolve from Font Awesome, homelab icon packs, emojis, or auto-fetched favicons. Built-in authentication, multi-page support, cloud backup/sync, and multi-language round out an MIT project with a massive community.

Decisions that scatter across email threads and chat scrollback get one home in Loomio, where a group discusses a question, votes, and publishes what it decided. Every decision starts as a thread with context, comments, @mentions, reactions, tags, and attachments, and tasks inside it carry assignees and emailed due-date reminders. Proposals ask for a defined response plus an optional written reason, using sense check, advice, consent, or consensus templates. Polls handle simple choices, scores, dot voting, ranked choice, meeting-time availability, and multi-winner STV elections. Coordinators set a participation quorum, require a vote share, weight votes, limit voting to appointed delegates, or hide results until close with anonymous voting. Groups nest subgroups, pick Open, Closed, or Secret visibility, and admit members freely, by request, or by invitation. People reply to discussion emails and catch up through a daily digest, and webhook integrations post invitations and outcomes to Slack, Discord, Microsoft Teams, Matrix, and Mattermost. Published outcomes stay searchable, and groups export CSV, HTML, or JSON and print threads to PDF. Comments translate on request, the interface is available in 24 languages, and a user API, server API, and webhooks connect other tools. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

OpenLLM serves any large language model as an OpenAI-compatible API endpoint from a single CLI command, handling model download, backend selection, quantization, and port binding automatically. It supports the full spectrum of popular models including Llama 3.3, Qwen2.5, DeepSeek, Mistral, and Phi3, choosing between vLLM and PyTorch inference backends based on hardware capabilities. When vLLM is available, continuous batching with PagedAttention achieves up to 23x throughput improvement over naive serving, while GPTQ and bitsandbytes quantization reduces memory requirements for GPU-constrained deployments. The server exposes a RESTful API on port 3000 with full OpenAI client library compatibility, enabling drop-in replacement for commercial providers in any application using the standard chat completions format. A built-in web chat UI at the /chat endpoint provides immediate interactive testing without external clients. Custom model repositories allow teams to maintain private catalogs of fine-tuned models alongside the default repository that tracks the latest releases. Deployment workflows generate production-ready Docker images automatically, with Kubernetes manifest support for orchestrated scaling. Native integration with LangChain and LlamaIndex supports RAG pipelines, Transformers Agents enables tool-calling workflows, and HuggingFace Hub handles model discovery. Server-Sent Events enable real-time token streaming across all API endpoints. Backed by BentoML's production ML infrastructure. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

CommaFeed delivers the Google Reader experience on your own infrastructure with modern performance characteristics. The Quarkus-based Java backend compiles to native code via GraalVM, achieving sub-second cold starts and 50MB memory footprint — a fraction of traditional JVM RSS readers. Four distinct layouts (title-only, expanded, magazine, and card) with light and dark themes adapt to any reading style, while comprehensive keyboard shortcuts cover navigation, marking, starring, and feed management without touching a mouse. The Fever-compatible API and newly added Google Reader API connect native iOS and Android apps (Reeder, Unread, FeedMe, ReadKit) directly to your instance. Per-feed push notifications through ntfy, Gotify, or Pushover alert you to new articles instantly. The visual query builder for automatic read-marking rules replaces raw expression syntax with an intuitive condition editor supporting title, content, author, and URL matching. OPML import and export enable seamless migration from any RSS service. Custom CSS and JavaScript injection let power users completely restyle the interface, while the browser extension adds one-click subscription from any website. Docker images for linux/amd64 and linux/arm64 with H2 embedded database require zero configuration to start. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

With over 35,000 GitHub stars in just two years, Glance has become the most popular self-hosted dashboard project on GitHub, outpacing established alternatives like Homarr and Homepage. Built as a single Go binary under 20MB with minimal JavaScript and zero external dependencies, Glance delivers a blazing-fast personal information dashboard that consolidates your entire digital morning routine into one beautiful page. Configure everything through clean YAML files that support modular includes and environment variable interpolation, with automatic hot-reload that applies changes without restarting the server. The widget ecosystem covers RSS and Atom feeds, Reddit and Hacker News frontpages, YouTube channel subscriptions, GitHub release timelines, weather forecasts from Open-Meteo, stock market quotes, Docker container status, Twitch live streams, calendar events via iCal, site monitor uptime checks, and custom HTML or iframe embeds. A community widgets repository extends functionality even further with user-contributed integrations. The theming system provides light, dark, and custom color schemes with multiple layout options including slim and wide column configurations. Authentication support added in 2025 secures access with username and password protection. Preconfigured page templates let you get started in seconds with curated layouts for development, homelab monitoring, news reading, and entertainment tracking. Deploy via Docker Compose or as a standalone binary on Linux, macOS, or Windows across AMD64 and ARM64 architectures. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

End-to-end encrypted by design, CryptPad is a real-time office suite where teams write documents, plan on kanban boards, collect answers with forms, and draw diagrams without the hosting server ever seeing their content. Rich text pages come with comments, replies, @mentions, and a document outline, while the Markdown editor adds a live preview, Mermaid diagrams, mind maps, and math. Kanban columns hold colored, tagged cards with Markdown bodies, and the diagram editor exports PNG, JPG, SVG, or PDF. Optional ONLYOFFICE editors add spreadsheets, word-processing documents, and presentations that several people can edit together. The form builder offers text, choice, grid, date, ranking, and poll questions, conditional sections, and separate author, auditor, and participant roles. Documents can be shared with contacts or teams, by link, or as embed code, with view, edit, present, or view-once access. Passwords, expiry dates, owner lists, and access lists limit who gets in, and every edit lands in a history you can step through, restore, or pin as a named snapshot. CryptDrive keeps files in folders, tags, templates, and a trash bin, while teams get their own drive, chat, and member roles. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Raw zone files and API calls become something a whole team can operate safely once PowerDNS-Admin puts its web interface in front of a PowerDNS authoritative server. It's a Python/Flask application covering full forward and reverse zone management, with the touches that matter in daily DNS work: zone templates for stamping out consistent new domains, easy IPv6 PTR record editing (reverse zones by hand are misery), full IDN/Punycode support for internationalized domains, and DynDNS 2 protocol support so routers and scripts can update records the way they would against a commercial dynamic-DNS service. Access control is enterprise-grade: local users, LDAP against OpenLDAP or Active Directory, SAML, and OAuth via Google, GitHub, Azure, or OpenID Connect, hardened with TOTP two-factor authentication. Role-based permissions extend to zone-specific access control - hand a developer their project's zone without exposing the rest of your namespace - and activity logging records who changed which record when, the audit trail bare PowerDNS never gives you. The dashboard monitors PDNS service configuration and statistics, and its own API exposes zone and record management for automation on top of the UI. Runs against MySQL/MariaDB or PostgreSQL, talking to PowerDNS through its REST API. MIT-licensed.

With over 31,000 GitHub stars and 430 contributors, Homepage has become the definitive self-hosted dashboard for homelab enthusiasts and server administrators who want a single, elegant landing page for all their services. The dashboard renders as a fully static site at build time for instant page loads, while a Node.js backend securely proxies all API requests to prevent exposing service credentials to the browser. Docker integration automatically discovers running containers through label-based configuration, populating the dashboard with service status indicators, health checks, and real-time statistics without manual URL entry. Over 100 native service widgets display live data from popular applications including Plex, Jellyfin, Radarr, Sonarr, Home Assistant, Pi-hole, Portainer, Proxmox, Nextcloud, Gitea, and dozens more, each showing relevant metrics like active streams, download queues, or system health directly on the dashboard. Information widgets provide weather forecasts, system resource utilization, search bars, and date/time displays. The layout system supports multiple columns, tabs, and custom CSS for pixel-perfect arrangement of service groups and bookmarks. Built-in authentication options include OIDC integration and password protection. Quick search functionality enables instant access to bookmarks and services with keyboard shortcuts. Internationalization covers 40+ languages with community-maintained translations. Configuration lives entirely in YAML files for version-controlled, reproducible dashboard setups. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console for complete control. GPL-3.0 licensed with an active community and bi-weekly releases.

With over 24,000 GitHub stars and a rapidly growing community of self-hosters, authentik delivers enterprise-grade identity management that replaces commercial solutions like Okta and Auth0 with a fully self-hosted platform requiring no per-user licensing fees. The platform serves as a unified identity provider supporting SAML 2.0, OAuth 2.0 and OpenID Connect, LDAP for legacy application compatibility, SCIM 2.0 for automated user provisioning, and RADIUS for network device authentication. The visual flow designer enables administrators to create custom authentication workflows combining password verification, multi-factor authentication with TOTP, WebAuthn, and SMS codes, email verification, captcha challenges, and conditional logic based on user attributes or device context. The forward-auth and reverse proxy integration works seamlessly with Traefik, Nginx, Caddy, and Envoy to protect applications that lack built-in authentication. User enrollment flows support self-registration with configurable approval workflows, invitation links, and automatic group assignment. The LDAP outpost exposes user and group data to legacy applications requiring LDAP bind authentication, while the SCIM provider automates user lifecycle management with downstream applications. Multi-tenancy support through brands allows a single authentik instance to serve multiple organizations with independent domains, branding, and authentication policies. The admin interface provides comprehensive user management, group hierarchy, application catalog, event logging with GeoIP enrichment, and system health monitoring. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Licensed under a source-available license with an open-source community edition.

Every Redis client you already use connects to Kvrocks without a single code change, but instead of holding your entire dataset in RAM, data lives on SSD through RocksDB, turning terabytes of memory cost into pennies of disk. An Apache Software Foundation top-level project, Kvrocks supports strings, hashes, lists, sets, sorted sets, streams, bitmaps, JSON documents, TimeSeries data points, Bloom filters, Cuckoo filters, and HyperLogLog structures, all persisted to disk with in-memory caching for hot data access. Asynchronous replication using binlog similar to MySQL provides data durability across replicas, while Redis Sentinel integration enables automatic failover when master or replica nodes fail. The proxyless centralized cluster architecture distributes data across shards while remaining fully compatible with standard Redis cluster SDKs and clients. Token-based namespaces provide multi-tenant isolation with authentication per namespace, going beyond Redis SELECT's numbered database model. RocksDB's LSM-tree storage engine provides efficient compression through configurable compaction strategies, reducing disk footprint dramatically while maintaining sub-millisecond reads for cached keys. Migration tooling includes RedisShake for Redis-to-Kvrocks live migration and kvrocks2redis for reverse migration, enabling gradual adoption without service interruption. The kvrocks_exporter exposes Prometheus-compatible metrics for monitoring, and OpenTelemetry integration provides distributed tracing. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Grocy is a household management system, bringing ERP-grade inventory tracking to kitchens, pantries, and homes worldwide. The stock management system tracks products with expiration dates, best-before dates, and opened tracking, while barcode scanning via USB readers or device cameras with Open Food Facts product lookup enables rapid item entry. Minimum stock amounts trigger automatic shopping list entries so frequently used products never run out, and multiple shopping lists can be maintained and shared across household members. Recipe management links ingredients directly to stock inventory, showing at-a-glance fulfillment status and a Due Score that highlights recipes best suited for consuming items approaching expiration. The meal planner organizes daily meals across customizable time periods and adds all missing ingredients to shopping lists with one click. Chore tracking schedules recurring household tasks with assignment to specific members, due date tracking, and completion history logging. Battery management monitors charge cycles for household devices with configurable reminder intervals. Custom fields and userfields extend any entity with additional data, while feature flags disable unused modules to simplify the interface. The RESTful API with integrated Swagger UI at the /api endpoint exposes every operation the web frontend uses, enabling third-party integrations with home automation systems. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Trello's board model on your own server: Planka is an open-source Kanban project management tool. Boards organize into projects with lists, cards, labels, due dates, checklists, file attachments, and per-card stopwatch time tracking, all managed through drag-and-drop. Updates propagate over WebSockets, so a teammate moving a card or adding a comment appears instantly for everyone without a refresh - a genuine differentiator among self-hosted boards. Card descriptions use a full Markdown editor, custom fields adapt cards to your workflow, and views switch between Kanban, grid, and list layouts. Authentication supports OpenID Connect single sign-on with Google, Azure AD, Okta, or any OIDC provider - a feature Trello reserves for enterprise plans - and notifications reach 100+ channels including Slack, Discord, Telegram, and SMTP via Apprise. A REST API with 50+ webhook events supports custom integrations, and one-click board import eases migration. Built with React and Node.js on PostgreSQL, translated into 35+ languages, deployed via Docker.

With over 9,100 GitHub stars and production deployments powering real-time analytics at companies like SHOPLINE where it reduced API latency by 76.7%, RisingWave is the PostgreSQL-compatible streaming database that collapses the traditional Debezium-plus-Kafka-plus-Flink-plus-serving-database stack into a single Rust-powered system. The platform continuously ingests data from PostgreSQL and MySQL via native CDC connectors that eliminate Debezium middleware, consumes Kafka, Redpanda, Pulsar, and Kinesis topics, accepts webhook events from SaaS applications, and batch-loads historical data from S3 and data warehouses. Standard SQL defines sources, materialized views, and sinks — no new DSL, no Java, and no custom API — while the PostgreSQL wire protocol means psql, DBeaver, pgAdmin, Grafana, Metabase, Superset, Tableau, and every PostgreSQL client library works without modification. Materialized views are incrementally maintained as events arrive, delivering point lookups in single-digit milliseconds without recomputing aggregates from scratch. For long-term retention, RisingWave writes to Apache Iceberg tables with a hosted REST catalog and automated table maintenance including compaction, small-file optimization, and snapshot cleanup, with data queryable by Spark, Trino, DuckDB, and DataFusion. The disaggregated compute-storage architecture uses S3-based state management for elastic scaling, instant failure recovery measured in seconds rather than the minutes-to-hours typical of RocksDB-based systems, and cost-efficient storage tiering. An MCP server enables AI agents to query and operate RisingWave directly. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Scira is an AI search engine that breaks complex research questions into sub-tasks, retrieves grounded answers from live sources, and cites every claim with clickable links to the original evidence. Formerly known as MiniPerplx and now backed by nearly 12,000 GitHub stars, the platform implements agentic research planning where language models decompose queries, select appropriate tools, retrieve information in parallel, and synthesize responses with inline citations. Seventeen distinct search modes cover Web, Academic, Extreme, X (Twitter), Reddit, GitHub, Stocks, Crypto, YouTube, and Prediction markets, each activating a curated subset of the 28 built-in tools. The Extreme mode deploys a deep research agent with multi-step planning, parallel source retrieval, code execution in sandboxed Daytona environments, and R2 artifact storage for generated charts. Model routing spans 50+ AI providers through a unified configuration layer supporting OpenAI, Anthropic, Google, xAI Grok, and custom models, with per-mode model assignment based on task requirements. The web search tool supports Exa, Tavily, and Firecrawl as interchangeable providers via a Strategy pattern. Lookouts schedule recurring research agents on cron schedules that monitor topics, track changes, and email summaries using Upstash QStash for reliable execution. PostgreSQL stores chat history, user preferences, and custom instructions while Redis handles caching and rate limiting. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.