Keystone turns TypeScript schema definitions into a complete GraphQL API and React Admin UI automatically, eliminating the gap between data modeling and application scaffolding. Nearly 10,000 GitHub stars and over 270 contributors across a decade of development back a framework where list definitions map directly to Prisma models on PostgreSQL or SQLite, generating database migrations and exposing every field relationship through Apollo Server's GraphQL endpoint. Granular access control operates at the list, field, and operation level with filter-based restrictions that limit which records users can see, create, update, or delete based on session data and custom logic. The document field provides a structured WYSIWYG editor with content blocks, inline relationships, and custom React components that render consistently across the Admin UI and frontend applications. Event hooks fire before and after create, update, and delete operations for validation, side effects, and external service integration. Custom GraphQL queries and mutations extend the API beyond auto-generated CRUD for bespoke business logic. The Admin UI built with Next.js and the Keystar UI component library supports custom pages, branded navigation, and internationalized interfaces. OpenTelemetry tracing provides observability into operations, queries, and hook execution. Deploys via Docker or any Node.js host with Prisma managing schema evolution. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Hunting for a suspicious file, process, or registry key across every endpoint becomes a single hunt in Velociraptor, an endpoint visibility and digital forensics platform. A web console sends tasks to clients on Windows, Linux, and macOS machines, which hold a persistent connection and run each task as soon as it is issued. A hunt runs a VQL artifact, one of more than 400 built in, across selected endpoints, picks up machines that reconnect later, and tracks which hosts have answered. Each hunt and collection opens into a notebook where markdown and live VQL cells group, filter, and timeline the results. A virtual file system browses a client's directories and fetches files through file, NTFS, and registry accessors, with hex and text viewers. Offline collectors bundle chosen artifacts into one binary that writes an optionally encrypted container for later import, suiting machines that never reach the server. Client event queries stream telemetry such as DNS lookups to the server, and server event queries can alert Slack, email, Elastic, or Splunk. Quarantine confines a host's network traffic to the Velociraptor server, and the Shell page runs commands on it. Sign-in works through Google, Azure, GitHub, OIDC, or SAML, with reader, analyst, investigator, and administrator roles. Responders reach for it during threat hunts, compromised host triage with KapeFiles targets, and dead disk image analysis. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

If cloud-dependent smart home hubs and YAML-heavy configuration files leave your household at the mercy of vendor outages and broken scripts, Gladys Assistant puts your entire home under clean, point-and-click local control. Zero YAML required. Pair thousands of lights, thermostats, smart plugs, locks, and sensors directly through native Zigbee2MQTT, Matter, Z-Wave, and MQTT support, or install hundreds of sandboxed community integrations for Philips Hue, Shelly, Sonos, TP-Link Tapo, Netatmo, and Reolink cameras in a single click. Visual scenes make automation effortless. Trigger multi-step routines from motion sensors, sunrise schedules, house presence, calendar events, or electricity tariff changes, and chain conditional actions with delays, HTTP webhooks, and Telegram alerts. Customizable room dashboards display live RTSP camera streams, climate charts, weather forecasts, and interactive dimmer controls. Built-in energy monitoring tracks real-time wattage, historical kWh consumption, and utility contract costs across every circuit. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

API keys hardcoded in repos, database passwords pasted into CI variables, .env files emailed between developers - Infisical, the open-source platform for secrets, certificates, and privileged access management, is the answer to all three. Secrets live in versioned stores scoped by project, environment, and path, with fine-grained identity-aware access control and full audit logging on every read and change. Delivery covers every consumption pattern: CLI injection into local dev, SDKs for Go, Node.js, and Python, an HTTP API, agents, a Kubernetes Operator, and secret syncs that push to GitHub, GitLab, AWS Secrets Manager, and Vercel. Automatic rotation replaces credentials for PostgreSQL, MySQL, MSSQL, LDAP, AWS IAM, and Azure on a rolling schedule - new credentials issue while old ones stay temporarily valid, so nothing breaks mid-rotation. Dynamic secrets go further, generating ephemeral, time-bound database credentials on demand, and SSH access replaces static keys with short-lived CA-signed certificates that expire automatically. Secrets scanning catches hardcoded credentials in code and pipelines, certificate management automates X.509 issuance and renewal, and a built-in KMS handles encrypt/decrypt with central key control. Self-hosting keeps the keys to everything else on your own infrastructure.

big-AGI is an open-source generative AI workspace that provides a unified, local-first interface for orchestrating multi-model reasoning, automated code execution, and custom persona workflows across private infrastructure. Users query multiple large language models simultaneously through the Beam scatter-gather engine, which prompts independent AI systems in parallel, compares candidate completions side by side, and merges optimal passages into a single refined response. Knowledge workers assemble tailored AI personas equipped with specialized system instructions, custom temperature settings, and predefined document context to handle domain-specific tasks ranging from architectural design reviews to legal contract analysis. The application renders rich multimedia outputs including interactive Mermaid sequence diagrams, LaTeX mathematical formulas, syntax-highlighted code blocks with live execution previews, and AI-generated image generation canvases. Teams integrate local inference servers like Ollama and LocalAI alongside commercial API endpoints to route confidential datasets strictly through internal networks while monitoring per-prompt token usage and operational latency. Users attach complex PDF documents, spreadsheets, and source code repositories for automatic parsing and semantic retrieval, while local-first storage engines ensure private chat transcripts and custom presets remain encrypted on host drives. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Why keep a Java runtime on the server just to host Minecraft, when Pumpkin runs from a single native executable and lets Java and Bedrock players share a world? Java Edition clients join on port 25565 and Bedrock clients on 19132, although Bedrock support is still marked work in progress. Builds exist for Windows, Linux, macOS, and Android. On launch, the console reports the worlds loaded and the server ready within milliseconds. Plugins are sandboxed WebAssembly modules that raise console permission prompts and pass signature checks, and authors can write them in Rust, Kotlin, Python, Go, C#, C/C++, D, Zig, or TypeScript. The ppm package manager searches and installs community plugins from the Pumpkin Market, and PatchBukkit loads some Bukkit and Paper plugins, with expected gaps. One pumpkin.toml file holds ports, MOTD, view distance, whitelist, authentication, compression, PvP, chat, resource packs, and world options, while chunks save in Anvil, Linear, or the native Pump format. Velocity and BungeeCord forwarding fit proxy networks, and the Query protocol plus Minecraft Server Management Protocol cover monitoring and remote administration. A public parity tracker lists every vanilla block, entity, item, and command as implemented, partial, or planned, so gaps are easy to spot before a world moves. Today it suits private survival worlds, test servers, and plugin development. It is early software, so the project advises backups. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

EmDash rebuilds the WordPress publishing experience as an open-source CMS, with drafts, revisions, scheduled posts, a media library, menus, widgets, and plugins that run in sandboxes and can only do what they declare. Writers get a rich-text editor with featured images, slugs, bylines, categories, and tags, plus signed preview links for unpublished work and a calendar of everything published or scheduled. Site builders define their own content types in a visual schema builder, choosing required and searchable fields, URL patterns, comments, SEO metadata, and edit locking so two people never overwrite each other. Uploads are drag and drop, with folders and filename search in the media library. Menus, sidebar widgets, reusable sections, and redirects with a 404 log shape the public site. Access is passkey-first, with OAuth and magic-link fallbacks, four roles from Contributor to Administrator, comment moderation, and personal API tokens. Coming from WordPress? Point the importer at a migration key, a site URL, or an exported XML file and it carries over posts, pages, media, and taxonomies. Plugins add hooks, settings, admin pages, dashboard widgets, custom blocks, and API routes after declaring capabilities such as content:read or email:send, while a built-in MCP server and CLI let AI assistants manage content directly. Blog, marketing, and portfolio templates give new sites a head start. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Automatisch runs your Zapier workflows on your own hardware - an open-source, self-hosted automation platform built as a direct alternative. Flows are chains of steps: one trigger (a polling or webhook event such as a new GitHub issue, a Stripe payment, or a form submission) followed by action steps that pass data downstream (post to Slack, append a Google Sheets row, update Notion). The visual builder deliberately mirrors Zapier's trigger-action model, so migrating existing Zaps requires no retraining and no programming knowledge. Roughly 60 integrations cover common business services - Slack, GitHub, Google Sheets, Notion, Stripe, Discord - and connections store credentials per service, with multiple accounts per app supported. Every execution runs on your own server: execution history, logs, and payload data never touch a third-party processor, which matters for GDPR, healthcare, and finance workloads. Error handling with retry logic, a REST API for programmatic flow management, and Docker Compose deployment round out the platform. The AGPL-3.0 Community Edition has no feature limits or per-task billing; an Enterprise Edition adds SSO, roles, and audit logs.

Instead of deploying proprietary background agents across dozens of target nodes, engineers rely on Apache HertzBeat to monitor real-time infrastructure health, metrics gathering, threshold alerting, and public status pages from a central operations platform. Operations teams can poll hundreds of target services without deploying proprietary background daemons, gathering performance data across Linux hosts, Kubernetes clusters, SQL databases, and network switches using native connection protocols. Engineers can define custom monitoring targets directly within the web dashboard by composing declarative YAML templates that specify polling intervals, parsing expressions, and metric extraction rules. The centralized alert engine processes inbound threshold events, suppresses cascading alert storms during maintenance windows, and dispatches actionable incident notifications to Discord channels, Slack rooms, Telegram groups, and webhook endpoints. Telemetry streams flow into interactive charts with customizable refresh cadences, enabling site reliability engineers to inspect latency waterfalls, correlate log spikes against CPU exhaustion, and track disk capacity trends over extended timeframes. Administrators can also publish real-time public status pages that inform external stakeholders about service availability, scheduled downtime, and ongoing incident resolutions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Companies with privacy and security concerns about piping customer conversations through Intercom or Zendesk run Papercups - open-source live customer chat. The stack is a deliberate strength: an Elixir/Phoenix API over PostgreSQL, with real-time messaging powered by Phoenix Channels and Presence - the same BEAM foundation trusted by Discord and PagerDuty for fault-tolerant, low-latency messaging. Customers see a customizable chat widget that embeds in any site as an HTML snippet, a React component, or even inside React Native apps, with configurable colors, greetings, and away messages. Your team sees a dashboard for managing conversations - close, assign, and prioritize - with Markdown and emoji in replies. The killer workflow is the reply-channel integration: connect Slack or Mattermost and every customer conversation becomes a synced thread your team answers without leaving the tool they already live in, with two-way message syncing handled by webhooks. Email and SMS channels extend intake beyond the widget, an analytics dashboard tracks communication patterns, and the Storytime feature adds real-time screen sharing to watch users navigate while you help them. A documented API supports fully custom chat UIs in Svelte, Flutter, or Vue. MIT-licensed and GDPR-conscious - customer data stays in your PostgreSQL.

Open a project in DooTask and your tasks appear as a Kanban board, a list, a Gantt timeline, or a calendar, with team chat and file sharing beside them. Start from a project or task template and set a task to repeat so each new occurrence links back to the original. Mention colleagues in project and task chats, add emoji, and keep messages protected with asymmetric encryption. Files from chats and tasks gather in a Collaboration Files section, and WebDAV lets you manage My Files and Shared Files from Finder or Explorer. Check the dashboard for what is overdue, due today, or coming up, while department heads switch to a team view charting overdue and incomplete tasks per member. Visit the App Store to install official apps for approvals, OKRs, AI assistants, OnlyOffice, Minder mind maps, and Drawio diagrams. Administrators can add custom apps from an archive, a URL, or a GitHub repository. Add an API key for ChatGPT, Claude, Gemini, DeepSeek, or Grok, or point to Ollama or any OpenAI-compatible URL, then type @AI Robot in a project chat to draft tasks. Log in on the web by scanning a QR code with the mobile app, or use an LDAP or Active Directory username. The free Open Source Edition covers three users; paid editions raise that to ten or unlimited. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 11,000 GitHub stars and now backed by Datadog while remaining fully Apache 2.0 licensed, Quickwit delivers the search performance Elasticsearch users expect at a fraction of the infrastructure cost by moving the index to object storage instead of expensive local SSDs. The Rust-based engine, built on the Tantivy search library with SIMD-accelerated vectorized processing and zero garbage collection overhead, achieves sub-second search latency directly against Amazon S3, Azure Blob Storage, Google Cloud Storage, or any S3-compatible backend like MinIO and Ceph. The Elasticsearch-compatible REST API covers ingest, search, query DSL, and aggregations, enabling existing log shippers including Vector, Fluent Bit, and Syslog to migrate without rewriting configurations. Native OpenTelemetry Protocol endpoints accept logs and traces via gRPC, while Jaeger integration provides a drop-in distributed tracing backend. Ingestion from Apache Kafka, Amazon Kinesis, and Apache Pulsar supports streaming pipelines with multi-index partitioning, and the schemaless JSON indexing mode eliminates the need for upfront schema definitions. Stateless searchers and indexers scale horizontally on Kubernetes or bare metal, with a control plane that distributes indexing tasks and a janitor that manages retention policies and GDPR-compliant deletions. The built-in web UI displays search results and cluster state, while the official Grafana data source enables log exploration dashboards. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

QM is Y Combinator's internal multiplayer agent infrastructure that shifts AI agents from personal assistants to shared company operating layer. The headless TypeScript core runs on Node.js with Fastify handling HTTP, Slack integration via Bolt, and a web UI built with Vite and Lit. PostgreSQL stores sessions, memory, queue state, and audit logs. Every person and every Slack channel gets an isolated sandbox with its own durable file system, installed tools that persist across runs, private memory, keychain view, permissions, and background crons. The harness-agnostic architecture routes agent tasks through Pi, OpenCode, Codex, or Claude Code without vendor lock-in, with production implementations swapping via a single wiring file. Three org-level security postures gate execution: Strict requires human approval for every tool call, Auto applies automated content screening, and Dangerous removes all pauses. Skills are scope-owned and shareable by grant, with admin-gated promotion to the entire organization and skill packs importable from Git repositories. The web apps feature lets agents spin up custom internal applications published to specific users. The qm CLI bootstraps operator-owned deployment directories with digest-pinned release images, infrastructure rendering, secret management, and live verification checks for Docker, Fly.io, or AWS ECS Fargate targets. On RepoCloud, deploy QM on a dedicated VPS with PostgreSQL persistence, Docker socket access, root SSH access, and complete control over your multiplayer agent infrastructure, all under the MIT license.

With over 11,200 GitHub stars and adoption by France's sovereign digital workspace LaSuite serving 20,000+ government users, Grist is the relational spreadsheet that ends the false choice between fragile Excel files and expensive custom database development — storing all data in portable SQLite files while providing true relational structure where VLOOKUPs become actual linked records that update instantly across entire documents. Python-powered formulas replace complex Excel syntax with clear, readable logic using the full Python standard library, while familiar Excel functions remain available for users who prefer them. Granular access rules control permissions at row, column, table, and cell levels — not just entire sheets — enabling multi-department documents where each team sees only their authorized data. The flexible layout system combines spreadsheets, card views, charts, calendars, and custom widgets on configurable dashboard pages that transform raw data into operational interfaces. Real-time collaboration lets multiple users edit simultaneously with automatic snapshot history capturing every change for full audit trails and point-in-time recovery. AI formula assistance connects to OpenAI, Llama, or any OpenAI-compatible endpoint via OpenRouter to generate formulas from natural language descriptions. The REST API and webhooks enable integration with n8n, Zapier, and custom automation, while incremental imports keep external data sources synchronized. Deployable via Docker with OIDC, SAML, and SCIM authentication support. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Modern engineering teams and busy households deploy Octop to run private, autonomous AI agents equipped with persistent memory workspaces, scheduled cron jobs, and direct browser automation. Users can orchestrate specialist agents tailored for software development, IT operations, content generation, and system diagnostics through an interactive React dashboard. The platform connects directly to Discord, Feishu, DingTalk, and WeCom, allowing team members to delegate complex tasks without leaving their everyday messaging apps. An integrated remote desktop and browser control engine lets agents navigate websites, capture screenshots, fill forms, and operate graphical software autonomously. Administrators can assign distinct MBTI personality profiles to agents, establish granular role-based permissions, configure scheduled cron workflows, and integrate custom Model Context Protocol servers for external tool access. Long-term memory persists across conversations through dedicated workspace files, ensuring contextual continuity whenever switching between underlying language models or team collaborators. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Magento's extensibility without PHP, Shopify's polish without the platform tax: EverShop is the TypeScript-first e-commerce platform built on that promise. Architected as a modular monolith on Node.js, it organizes every piece of business logic - catalog, checkout, customers, your custom extensions - into modules that plug in without touching core code, extended through a disciplined set of mechanisms: registry processors for transforming data across modules, hooks that wrap function calls, async event subscribers (product created, order placed), and route middleware. The storefront and the fully-featured admin panel are both React with server-side rendering and hydration, giving fast first paint and SEO-friendly pages, while a typed GraphQL API (plus REST endpoints) serves exactly the data each view needs - the same API that powers headless and PWA builds. Standard commerce is covered: product management with variants and attributes, category navigation, cart and checkout, order and customer management, coupons, and a theme system built on React components and Tailwind for deep storefront customization. PostgreSQL is the default database, deployment is Docker-friendly with near-zero configuration, and the GPL-3.0 license means the entire stack - types, resolvers, and checkout flow included - is yours to read and modify.

evcc turns surplus rooftop solar and the cheapest hours of a dynamic tariff into cheap, clean kilometers by coordinating an EV charger, heat pump, and home battery from one local dashboard. Each charging point offers Off, Smart, and Fast modes. In Smart mode, charging starts once the surplus covers the car's minimum power, follows the sun up and down, pauses when clouds win, and can switch between one and three phases on wallboxes that allow it. A solar share slider lets small systems start earlier, and Always charge keeps fussy cars from being interrupted. Set a departure time and a target charge, and a charging plan picks the cheapest or cleanest hours before it, repeating weekly if you like. Tibber, Awattar, fixed and time-based rates, dynamic feed-in prices, and CO2 and solar forecasts all feed those decisions. A home battery can claim the surplus first or lend a boost for fast charging, and load management keeps several chargers inside a circuit's current limit while honoring grid operator dimming. Hundreds of wallboxes, inverters, meters, heat pumps, and vehicle APIs are supported, including Tesla, BMW, Mercedes-Benz, Skoda, and Volkswagen. Sessions land in a history with charts and CSV export, and REST, MQTT, InfluxDB, Grafana, Home Assistant, and openHAB link evcc to the rest of the house. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Circulation desk, cataloging workbench, acquisitions office, serials room, and public catalog all share one roof in Koha, an open-source library system that scales across school libraries, branch networks, and consortia. Staff search the catalog with facets for availability, authors, holding libraries, and item types, then open a record to see its cover, subjects, classification numbers, and every copy with its call number, status, and barcode. Catalogers edit MARC 21 or UNIMARC records field by field, copy records in via Z39.50 and SRU searches, and link authorities automatically. At the desk, staff check out, check in, and renew items, work with holds, bookings, and claims, and see overdue warnings and outstanding charges beside each patron. Circulation and fine rules vary by library, patron category, and item type. Acquisitions handles vendors, baskets, budgets, and funds. Serials track subscriptions and issue receiving. A guided report wizard, SQL reports, and statistics wizards summarize circulation and collections. Patrons search the public catalog, place holds, save lists, tag and rate titles, and suggest purchases. Staff tools design notices and slips, print patron cards, set holiday calendars, and import or batch-edit patrons. SIP2 serves self-checkout kiosks, OAI-PMH sets share records, and a REST API exposes patrons, holds, checkouts, and biblios. Lending continues during outages with offline circulation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.