With 4,500+ GitHub stars and version 1.0.92 released August 2026, xyOps delivers a complete operations platform that unifies workflow automation, job scheduling, server monitoring, alerting, and incident response in one self-hosted system. The platform uses a distributed architecture where a central conductor coordinates lightweight xySat satellite agents running on Linux, macOS, or Windows worker nodes via persistent WebSocket connections. The visual workflow builder lets you chain events, triggers, actions, and monitors into multi-step pipelines with conditional logic, fan-out/fan-in parallelism, multiplex controllers for fleet-wide execution, and configurable resource limits. QuickMon provides per-second CPU, memory, disk, and network visibility streamed live to the web UI, while user-defined monitor plugins sample metrics every minute with time-series storage at hourly, daily, monthly, and yearly resolutions. Alert triggers evaluate expressions against live data and fire notifications via email, webhook, or custom actions, with full server snapshots attached showing every running process, network connection, and resource utilization at the moment of detection. Failed jobs and alerts automatically create tickets with linked logs, metrics history, and context for end-to-end incident tracking. The plugin marketplace supports extensions written in any language, and the Docker plugin enables container-based job execution. Deploy via Docker with persistent volumes on port 5522 for the web UI and 5523 for API access, running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.

A server full of scattered services becomes one clean application hub under Flame - a self-hosted startpage where every bit of configuration happens in built-in GUI editors, never a config file. Applications and bookmarks are created, edited, and organized into categories directly in the browser, and favorites pin to the homescreen for one-click access. The integrated search bar filters your apps and bookmarks locally as you type, and prefix shortcuts (like /g for Google) route queries to any of 11 web search providers or custom ones you define, making Flame a genuine browser homepage rather than a static link wall. Docker integration is the standout for homelabs: mount the Docker socket, add flame.type, flame.name, and flame.url labels to containers, and new services appear on the dashboard automatically - Kubernetes Ingress annotations work the same way. A weather widget shows temperature, cloud coverage, and animated conditions for your coordinates, and password authentication protects settings and items. Appearance is deeply customizable with 15 built-in color themes, a custom theme builder, and full custom CSS support. The stack is Node.js with SQLite behind a React frontend - light, fast, and inspired by the minimalist SUI design.

Document-generation code is the worst kind of code in your backlog - Carbone kills it. Its insight is separating design from data - templates are ordinary office documents (DOCX, ODT, XLSX, PPTX, HTML, even custom XML) built in LibreOffice, Microsoft Office, or Google Docs, with mustache-like markers such as {d.companyName} typed directly into the text. Send a template plus JSON from your existing APIs to the HTTP API, and Carbone returns the finished document - exported as-is or converted to PDF, XLSX, CSV, HTML, PNG, EPUB, and more via its integrated LibreOffice converter (Chromium and OnlyOffice engines are also supported for HTML-fidelity and office-format conversions). The template language goes well beyond substitution: loops over arrays render dynamic table rows, filters and aggregations run inside the document, and built-in formatters handle dates, numbers, currencies, timezones, and locales, with custom JavaScript formatters when needed. One template serves multiple languages through translation markers with auto-maintained translation files. The XML-agnostic engine means anything your document editor can design - pagination, headers, footers, nested tables, charts - survives generation intact, and Carbone guarantees no breaking changes in template syntax. Node.js-based, fast via multi-threaded LibreOffice conversion. The invoices, contracts, and reports your product owes its users become template edits, not sprints.

SurveyKing combines survey creation and online examination in a single platform — generate complete questionnaires from plain English via built-in LLM integration, administer timed exams with anti-cheating proctoring, and collect structured data through 20+ question types including matrix questions, cascading selectors, file uploads, and electronic signatures. Built on Spring Boot 3 with a React and TypeScript frontend using the UMI framework and Ant Design components, version 1.12 delivers each question type with independent validation rules, data type controls, and formula calculations. The AI engine connects to mainstream LLMs for survey generation from natural language prompts and provides real-time answer explanations during practice sessions. Exam mode features item banks with Word and Excel bulk import, fixed and randomized question selection, composite paper assembly, live proctoring dashboards with anti-cheating controls, automatic and manual grading with per-question scoring, and PDF score report archiving. The visual logic designer and DSL expression engine handle show/hide conditions, required rules, skip branching, quota controls, randomization, and cross-tabulation analysis with SPSS export. Role-based access controls support multi-user collaboration with department and permission management via Spring Security and JWT authentication. Redis handles caching and queuing while MyBatis Plus manages database operations. Deploy via a single Docker command with embedded H2 for trials or Docker Compose with MySQL for production. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Solidtime is a time tracker for freelancers and agencies, offering a modern SaaS-quality interface that rivals commercial tools like Toggl and Clockify. The time tracking interface provides a running timer, calendar view, and weekly timesheet for flexible entry across desktop, mobile, and the dedicated macOS, Windows, and Linux desktop applications. Project management organizes work by client with hierarchical billable rates configurable at organization, member, project, and project-member levels, ensuring accurate billing across complex team structures. The invoicing module generates polished PDF invoices and structured EU e-invoices with configurable VAT rates, percentage and fixed discounts, EU reverse-charge handling, reusable company templates, and automatic line item generation from billable time entries. Reporting provides filterable summaries by user, project, client, and date range with exportable data for billing audits and team retrospectives. Multi-organization support manages separate workspaces from a single account with role-based permissions controlling access across organizations. Data import from Toggl, Clockify, and generic Timeentry CSV files enables migration from existing tools without losing historical records. The RESTful API with bearer token authentication enables automation and integration with external services. Docker deployment with PostgreSQL runs behind Nginx or Traefik reverse proxy. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Backed by 1,080+ GitHub stars and maintained by Percona with the latest release v3.8.1 in June 2026, Percona Monitoring and Management delivers the open-source database observability platform that provides a single pane of glass across MySQL, PostgreSQL, MongoDB, Valkey, and Redis databases deployed on-premises, cloud, or hybrid environments. The Go-powered PMM Server collects metrics from lightweight PMM Client agents with minimal performance impact, storing time-series data in ClickHouse for fast querying across configurable retention periods. Query Analytics ranks every query by load across all database engines from one unified dashboard, drilling from fleet-level performance down to individual problematic queries with explain plans, per-query metrics, and anomaly detection. Real-time Query Analytics streams live MongoDB operations updated every 1-5 seconds for immediate troubleshooting of lock contention and long-running queries. Built-in Percona Advisors continuously scan connected databases for security gaps, misconfigurations, and performance problems, distilling decades of DBA expertise into automated actionable recommendations. Percona Alerting integrates with 15+ notification channels including Slack, PagerDuty, email, and webhooks to trigger on custom metric thresholds. Database-specific dashboards visualize InnoDB storage engine details, WiredTiger cache metrics, PostgreSQL tuple activity, replication lag, and cluster health with annotations for root-cause correlation. Deployment options include Docker single-container setup, Podman rootless execution, and Helm charts for Kubernetes with Ingress controller support and ConfigMap management. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Merge, split, compress, convert, edit, annotate, redact, OCR, and sign PDFs - BentoPDF packs over 130 tools into a privacy-first toolkit that runs entirely in the browser through WebAssembly. Files are never uploaded - processing happens in browser memory on the user's machine and disappears when the tab closes, which makes the tool GDPR-clean by architecture and safe for financial, legal, and internal documents. The engine combines WASM builds of PyMuPDF, Ghostscript, and CoherentPDF; Tesseract handles OCR with searchable text-layer output; Office conversions cover Word, Excel, and PowerPoint; and digital signatures use X.509 certificates (PFX/PEM) with the private key staying on the client. Because there is no server-side processing, deployment is a static-file exercise: a single Docker container, or any static host. A dedicated self-hosted build strips the marketing pages while keeping every tool, and air-gapped deployments are first-class - an automated script bundles the WASM modules, OCR language data, and fonts for fully offline networks. No accounts, no limits, no watermarks; TypeScript and Vite under the hood.

Kokoro-FastAPI turns text into natural-sounding speech across eight languages by serving the 82-million-parameter Kokoro-82M model through an OpenAI-compatible REST API, so any existing OpenAI SDK client can generate audio by just changing the base URL. With over 5,300 GitHub stars since December 2024, the fully Dockerized FastAPI server covers American English, British English, Spanish, French, Hindi, Italian, Japanese, Brazilian Portuguese, and Mandarin Chinese with language-specific phoneme processing. Inline voice mixing blends multiple profiles using weighted ratios like af_bella(2)+af_heart(1), automatically normalizing weights and caching combined voicepacks as PyTorch tensor files for reuse. Audio streams in real time over HTTP with configurable chunk sizes, or generates complete files in MP3, WAV, OPUS, FLAC, AAC, or PCM formats with speed control from 0.25x to 4.0x. Per-word timestamped captions with speaker-tagged voice labels enable subtitle generation for podcasts, audiobooks, and accessibility workflows. Pre-built Docker images support NVIDIA GPU acceleration via CUDA, experimental AMD GPU inference via ROCm, and CPU-only deployment on linux/amd64 and linux/arm64 architectures, with Apple Silicon MPS support available through direct UV execution. The integrated web interface at port 8880 provides browser-based speech generation, while the Swagger UI at /docs exposes the full API reference. Debug endpoints report system statistics for monitoring inference load. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Point Openship at a GitHub repo, local folder, or prebuilt artifact and it detects your stack, builds a Docker container, provisions databases, configures domains with automatic Let's Encrypt TLS, and routes traffic through an OpenResty edge layer on ports 80 and 443. Already past 10,000 stars since launching in March 2026, it turns any Linux VPS into a managed application host. Language support covers Node.js, Python, Go, Rust, PHP, Ruby, Java, .NET, Docker, and monorepo projects with push-to-deploy CI/CD, pull request preview environments on unique subdomains, staging/production flows, and one-click rollbacks. Integrated backend services include managed Postgres, MySQL, MongoDB, Redis, persistent volumes, WebSocket proxying, object storage, and worker processes, all provisioned from the dashboard without compose files. A built-in SMTP server handles transactional email with automatic DKIM, SPF, and DMARC configuration, eliminating external email services. The edge layer serves HTTP/3 with Brotli compression, configurable cache rules, and instant purging. Real-time monitoring streams build logs, container metrics, visitor geography, and per-status-code analytics at 1.4 microsecond overhead with zero database writes. Scheduled backups cover databases and volumes with one-click restore and export. Three interfaces (web dashboard, desktop app for macOS/Windows/Linux, and the openship CLI) drive the same API, plus a Model Context Protocol endpoint for AI integration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 7,500 GitHub stars and 1 million Docker pulls — making it the most popular open-source database backup tool on GitHub ahead of pgBackRest and WAL-G — Databasus delivers production-grade backup management through a designer-polished web interface that replaces complex configuration files and CLI-only workflows. The platform supports PostgreSQL 14-18, MySQL 5.7-8, MariaDB 10-12, and MongoDB 4.2-8 with logical backups via pg_dump and mysqldump, while PostgreSQL 17+ enables physical backups using the native pg_basebackup engine with block-level incremental support via pg_basebackup --incremental and continuous WAL streaming via pg_receivewal for Point-in-Time Recovery to any second between backups. Storage destinations include local disk, AWS S3, CloudFlare R2, Google Drive, Azure Blob Storage, SFTP, NAS, and rclone-backed targets, while built-in AES-256-GCM encryption secures both backup files and stored credentials. Restore verification runs automated recovery into throwaway Docker containers, validating backups by comparing schema counts, table structure, and row counts against the source database — proving recoverability rather than merely checking checksums. The notification system integrates with Slack, Discord, Telegram, email, and webhooks for real-time backup status alerts. Deployment options span a single Docker container, Docker Compose with Caddy for automatic HTTPS, Helm charts for Kubernetes clusters, or a one-line install script. SSH tunnel support reaches databases in closed networks through bastion hosts without public exposure. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Automate transactional and marketing messages across email, SMS, mobile push, WhatsApp, Slack, and custom webhooks from a single visual journey canvas. Dittofeed provides the capabilities of Customer.io or Braze while keeping customer PII within your own infrastructure and eliminating volume-based pricing entirely. The drag-and-drop journey builder creates multi-trigger automations with branching logic, wait nodes, random cohort splits for A/B testing, and local timezone delivery without writing code. User segments combine trait conditions, event history, and array-based filtering through AND/OR operators with real-time evaluation. Template authoring supports both a low-code visual editor and direct HTML/MJML input, with templates reusable across journeys and one-off broadcasts. Data flows in through Segment integration, Reverse ETL connections, or the REST API with Web, Node.js, and React Native SDKs. Message delivery routes through SendGrid, Amazon SES, Twilio, or SignalWire with per-channel analytics tracking opens, clicks, bounces, and unsubscribes. Authentication supports Keycloak, AWS Cognito, and GCP OAuth for enterprise SSO. Embeddable iframe and headless React components let SaaS platforms white-label journey builders into their own products. Deploy on RepoCloud with a dedicated VPS for full GDPR compliance under the MIT license.

With over 6,400 GitHub stars, 130 contributors, and 512 releases, Flagsmith is the open-source feature flag and remote configuration platform that gives development teams granular control over feature releases, remote configuration values, user segmentation, and A/B testing from a single self-hosted dashboard. Feature flags support boolean toggles and remote config values simultaneously — every flag carries both an enabled state and a configurable value, letting teams deploy functional and visual changes without code modifications or app store approvals. User segments target audiences by attributes, percentage rollouts, and custom rules, enabling beta testing, canary releases, and gradual feature rollouts with real-time toggle control. Multivariate flags split traffic across multiple variations with configurable percentage weights for A/B and multivariate testing with analytics integration. The flag evaluation engine runs server-side with local evaluation mode in SDKs for sub-millisecond performance without network calls, supporting 15+ languages including TypeScript, Python, Java, C#/.NET, Go, Ruby, PHP, Swift, Kotlin, Flutter, React, and Next.js. The REST API and webhooks enable integration with CI/CD pipelines, and pre-built connectors exist for Datadog, New Relic, Amplitude, Mixpanel, Segment, Heap, Rudderstack, and Slack. Built on Django with a React frontend, self-hosting deploys via Docker Compose with PostgreSQL, or via Helm charts and the OpenShift Operator for Kubernetes environments. Change history provides a complete audit trail of flag modifications. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.

HyperDX correlates logs, metrics, traces, session replays, and errors in a single interface so engineers can resolve production incidents in minutes instead of hours. Nearly 10,000 GitHub stars reflect its role as the integrated UI layer for the ClickStack blueprint endorsed by ClickHouse. The platform connects to any ClickHouse cluster as its storage backend, working with existing table structures without requiring data migration or proprietary ingestion formats. An intuitive Lucene-like search syntax supports full-text queries and property filtering like level:err or service.name:api without needing SQL, while native JSON string querying and event delta analysis surface anomalies in high-cardinality datasets. One-click cross-signal correlation lets you jump from a log line to its distributed trace, from a slow span to associated logs, or from a frontend session replay to the backend errors it triggered. The OpenTelemetry Collector accepts telemetry via OTLP on gRPC port 4317 and HTTP port 4318, supporting automatic instrumentation for Node.js, Python, Java, Go, Ruby, and browser applications. APM tracks HTTP request latency, database query duration, and external service calls with trace waterfall visualizations. Configurable alerts trigger via webhook, Slack, PagerDuty, or email when thresholds are breached. Deploys via Docker Compose with ClickHouse, MongoDB, Redis, and the OpenTelemetry Collector. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Agentic SOC Platform compresses hours of manual security analysis into seconds by deploying specialized AI agents that autonomously triage, investigate, and enrich security alerts. The Python/Django backend processes SIEM webhooks through Redis Streams into a modular pipeline where LangGraph-orchestrated agents extract IOCs, correlate signals, and generate Cases with severity, confidence, impact, priority, and structured verdicts. The built-in SIRP provides full case management with Alerts, Artifacts, Enrichments, Tickets, and a Knowledge base that accumulates institutional memory for both human analysts and LLM agents. Native Splunk and Elasticsearch/Kibana integrations deliver unified log search through a standardized interface so agents and analysts share identical security context. The playbook engine combines traditional SOAR automation with AI-powered investigation — launching threat hunting agents, knowledge extraction, threat intelligence enrichment, and CMDB lookups from a single orchestration layer. MCP Plugin support exposes ASP capabilities to Claude Code, Codex, and OpenCode, enabling external AI agents to operate cases, search logs, query threat intelligence, and write custom modules directly. Python Modules adapt new alert sources while Playbooks orchestrate LLM analysis and automated response actions, scaling the platform with your security scenarios. Deploy via Docker Compose with all data staying inside your network. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Small MSPs waste thousands of dollars annually on overlapping subscriptions for documentation, ticketing, and billing tools that don't talk to each other. ITFlow replaces that fragmented stack with a unified platform where client contacts, locations, vendors, computer assets, software licenses, domains, SSL certificates, passwords, and documents all live under one roof. The AES-encrypted password vault stores credentials with organized access controls, and domain plus SSL certificate tracking generates automated renewal alerts before expiration disrupts client services. Ticketing supports creation, prioritization, assignment, and SLA tracking, with a client portal where customers submit tickets, view invoices, approve quotes, and access their own documentation independently. The accounting module covers the full lifecycle: quotes, recurring billing, expense tracking, Stripe payment processing, and financial dashboards showing revenue and outstanding balances at a glance. AI integration through Ollama, LocalAI, or ChatGPT accelerates documentation writing and ticket responses directly within the interface. The modular architecture lets you enable only what you need, sidestepping the bloat of enterprise PSA platforms designed for organizations ten times your size. With stable releases since 2025 and zero per-user licensing, ITFlow removes the escalating costs that make commercial PSA tools unsustainable for growing teams. The PHP application deploys with MariaDB and Nginx, ready for production in minutes.

The drawing surface inside WebRTC conference tools like Meetzi and the LAMS online-learning platform is Whiteboard (by cracker0dks) - a lightweight Node.js collaborative sketchboard built to be embedded and customized, which also slots into Nextcloud via the External Sites app. Everyone opening the same whiteboardid URL parameter draws on the same board, with remote user cursors visible live, per-user undo/redo, and an indicator showing the smallest participating screen so nobody draws outside a colleague's view. Content handling goes beyond pen strokes: drag-and-drop or paste images and PDFs from any PC or browser, then resize, rotate, and draw over them on canvas or background; add text and sticky notes; hold Shift for angle-snapped lines and perfect squares. Every function has a keybinding - deliberately friendly to pen displays like Wacom and XP-Pen whose hardware buttons map to shortcuts. Boards save to image or JSON (with reload), export directly to Nextcloud via WebDAV, and persist across restarts with the file-database option. A REST API with bundled interactive docs allows full programmatic control, an optional access token locks down uploads, and YAML configuration tunes behavior and performance. MIT-licensed and reverse-proxy friendly.

Cerbos decouples authorization logic from application code entirely, evaluating human-readable YAML policies in under one millisecond through a stateless Policy Decision Point that requires no application state synchronization or cross-network fan-out. Its custom decision engine benchmarks up to 17x faster than OPA-based alternatives. Access control policies use conditions expressed in Google's Common Expression Language, supporting role-based, attribute-based, and policy-based access control patterns including derived roles, scoped policies, and permissions-aware data filtering that pushes authorization predicates directly into database queries. The PDP exposes both gRPC and HTTP APIs with SDKs for JavaScript, Python, Go, Java, .NET, Rust, PHP, and Ruby, making integration a single function call regardless of tech stack. GitOps-native workflows treat policies as code with Git versioning, CI validation through GitHub Actions, coverage reports, breaking-change detection, and audit logs of every authorization decision for ISO27001, SOC2, and HIPAA compliance. Deployment flexibility spans Kubernetes sidecars, standalone services, systemd daemons, AWS Lambda functions, and WebAssembly-embedded PDPs that run authorization logic directly in browsers, serverless architectures, and edge devices. The Admin API manages policy lifecycle operations programmatically, while the built-in Playground and REPL provide interactive testing environments for policy authoring and debugging. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Upload files, get a share link, let it expire: PsiTransfer is a self-hosted WeTransfer with no accounts, no logins, and no third-party cloud with size caps and metadata harvesting. The engineering focus is large files over imperfect networks. Uploads use the tus.io resumable protocol, so a dropped connection on a multi-gigabyte video resumes exactly where it stopped once you're back online; downloads support HTTP range headers for the same resilience, and everything streams, so file size is bounded by your disk rather than memory. Files organize into upload buckets with retention you control: expire after a set time (up to weeks) or after a one-time download, with automatic cleanup when links lapse. Recipients need nothing installed - they open the link, preview files in modal views, and grab everything as a zip or tar.gz archive with one click. Buckets can be password-protected (AES-encrypted download lists), and security-through-obscurity is done properly: bucket URLs use hashed UUID tokens and stored filenames are replaced with UUIDs. An optional admin page (enabled by setting an admin password) lists bucket information and storage. The Vue.js frontend ships under 100 KB gzipped and is fully responsive. Honest caveat from the author: no end-to-end payload encryption yet. BSD-licensed, Docker-ready.