LinguaCafe turns your own reading material, novels, news sites, ebooks, and video subtitles, into a private language tutor that lives entirely on your server. Import a text and every word starts out highlighted as new; as you read and mark words known, the highlighting thins out until whole pages sit clean. When an unknown word stops you, the built-in vocabulary search shows its dictionary form, so inflected verbs surface as their infinitive and nouns carry their gender, while optional DeepL translation covers anything the dictionaries miss. Marking a word adds it to your vocabulary, and multi-word selections become phrases that stay highlighted everywhere they appear again. Chapters track how many new, highlighted, and known words they contain, which makes judging a text's difficulty a glance instead of a guess. The review system cycles highlighted words through Leitner-style spaced repetition, and anything you collect can be exported or pushed straight into Anki through AnkiConnect for study on your phone. Japanese learners get kanji and radical breakdowns beside the reading pane. Everything stays local: your books, your words, and your progress never leave the machine. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Transforming your Stalwart Mail Server into an all-in-one private communication hub, Bulwark Webmail delivers fast web-based email, collaborative calendars, shared contacts, and cloud files in a single unified interface. Users can manage multiple email accounts from an integrated inbox with conversational message threading, nested organizational tags, scheduled delivery, and instant full-text search across thousands of archived messages. The rich text composer provides markdown shortcuts, inline image embedding, reusable canned response templates, and automated draft synchronization. Team members can coordinate schedules across day, week, month, and agenda calendar views with drag-to-reschedule adjustments, interactive iMIP meeting invitations, and external CalDAV calendar subscriptions. The integrated address book organizes individual contacts into custom groups with full vCard import and export support, while the files module lets users browse server storage, preview incoming attachments, and upload documents directly through the browser. Built-in security safeguards enforce multi-factor authentication, cryptographic S/MIME signatures, client-side encryption at rest, and automated HTML luminance remapping to keep dark emails legible. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL v3 licensed.

Where Miniflux strips reading down, FreshRSS gives you knobs - the feature-rich pole of self-hosted RSS, comfortable with thousands of feeds. It's a multi-user PHP aggregator (host family and friends on one instance, with an anonymous reading mode) with the reading workflow refined over a decade: favorites, custom tags, powerful filter and search queries, three reading views, and statistics that reveal each site's publishing frequency - useful for pruning subscriptions. Two properties make it the standard choice. First, the Google Reader-compatible API (plus a Fever API) syncs with virtually every serious RSS client - Reeder, NetNewsWire, ReadYou, FeedMe, Fluent Reader - so your phone reads from your server. Second, native WebSub support means compatible sources (WordPress, Blogger, Medium, Friendica) push new articles instantly instead of waiting for polling. A 50+ extension ecosystem adds what truncated feeds omit - full-text content fetching, reading-time estimates, trending views, auto-unsubscribe for dead feeds - alongside community themes and custom CSS. OPML import/export keeps subscriptions portable, a CLI handles administration, and article sharing posts to many services. AGPL-licensed, running on SQLite, MySQL, or PostgreSQL. Feedly Pro's feature set, minus Feedly's subscription and its algorithms.

Small teams that have outgrown spreadsheets but balk at per-seat CRM pricing can run Django-CRM on their own server, with leads, deals, tasks, and email campaigns in one self-hosted system. Requests from website contact forms arrive automatically, email requests are imported from the company mailbox, and each gets a unique ticket and is matched against existing companies, contacts, and leads. When nothing matches, a new lead is created and later converted into a company and contact person. Deals carry products, payments, currencies, and price tiers, and the price list exports to Excel. Tasks can be individual or team-based with subtasks, memos can spawn tasks or projects, and participants chat and share files inside each one. Eight analytics reports cover the sales funnel, income forecasts, lead sources, conversions, and closing reasons. The built-in email client works over SMTP and IMAP, supports Gmail through OAuth 2.0, and links each message to its request, lead, or deal. Mass mailings are spread through the workday and can use additional mailboxes to protect managers' main accounts from spam filters. Web forms are protected by reCAPTCHA v3, IP geolocation fills in each requester's country and city, and VoIP callbacks and WhatsApp or Viber messages are supported. Object-level permissions control who can view, add, change, or delete each record, and the interface offers 22 languages. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

When a regulatory audit, legal discovery request, or employee offboarding requires years of verifiable email records, Open Archiver provides a tamper-evident, self-hosted vault for every message across your organization. Connect Google Workspace domains, Microsoft 365 tenants, personal Outlook OAuth accounts, or standard IMAP servers for continuous background synchronization, or upload historical PST, MBOX, and zipped EML archives in bulk. Every ingested message is deduplicated, compressed, and stored in standard EML format on local disks or S3-compatible object storage while SHA-256 cryptographic hashes verify file authenticity on demand through built-in Integrity Reports. Instant full-text search scans both message bodies and attached PDF or DOCX documents, letting compliance teams reconstruct complete conversation threads and enforce automated retention policies. Granular access control backed by an AWS IAM style policy engine, TOTP two-factor authentication, and an immutable audit trail keeps sensitive correspondence locked down. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

FreeSBC sits at the edge of your phone system so your FreeSWITCH or Asterisk never has to face the public internet. It is the only element with a public address: phones register through it over SIP on UDP, TCP, or TLS, browsers call through WebSocket with WebRTC terminated at the edge (ICE-Lite, DTLS-SRTP, and RTCP-mux, relayed onward as plain RTP), and carriers reach your switch through it as an outbound proxy, with the switch's private addresses hidden from every SDP body, Contact, and Request-URI it constructs. The switch stays on a private LAN as the registrar and call brain, holding credentials and carrier accounts, while FreeSBC anchors all media on its own ports with hardened first-packet latching and a silence watchdog, and never transcodes. Against the background radiation of SIP scanning, it applies per-IP rate limits with separate limits for carrier sources, scanner fingerprinting with in-memory bans, and admission control for public INVITEs and REGISTER enumeration, and every denial is a silent drop. A multi-switch pool hashes users across switches, and one fixed private socket keeps the trusted side simple. The embedded WebUI, REST API, and Prometheus metrics sit behind a bcrypt-checked admin login, showing live calls and media ports. One static binary, one YAML file, no database, no Redis, and no separate media process to babysit. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

With 2,400+ GitHub stars, HolyClaude replaces a two-hour manual setup process with a single docker compose up command that launches a fully configured AI coding workstation. The container ships with Claude Code pre-installed alongside seven additional AI CLIs — Gemini CLI, OpenAI Codex, Cursor, TaskMaster AI, Junie, OpenCode with OpenRouter multi-provider support, and Pi Coding Agent — all accessible through the CloudCLI browser-based web interface on port 3001. A headless Chromium browser running on Xvfb display :99 comes pre-configured with Playwright 1.61 for automated screenshots, testing, and web scraping without additional setup. The development toolchain includes Node.js 26, Python 3, TypeScript, git, GitHub CLI, database clients for PostgreSQL, SQLite, and Redis, plus deployment CLIs for Vercel, Wrangler, Netlify, and Azure. Process management uses s6-overlay for automatic restarts and graceful shutdown, while bind mounts to ./data/claude and ./workspace ensure credentials, configuration, and project files persist across container rebuilds. The full image supports AMD64 and ARM64 architectures, running on Linux, macOS with Docker Desktop, Windows with WSL2, and Synology or QNAP NAS hardware. A slim tag at roughly 2GB omits the browser stack for environments that do not need it, while the full image at 4GB includes everything. Users authenticate with their existing Anthropic account directly through Claude Code with no credential relay or proxy involved. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Watching a MikroTik RouterOS v7 router in real time is what MikroDash is for: live traffic, connections, Wi-Fi clients, DHCP leases, and WireGuard peers reach the browser the moment anything changes. Cards drag into any layout, and the arrangement follows your account to every browser. Managing a fleet happens on the Devices page, which shows routers as cards, a list, or a world map with 24-hour connectivity, last backup, open alerts, and pending updates. Rolling out a change starts in Config Management: choose one of 20 ready-made templates or capture your own, then deploy to one router or the fleet with a restore point, a canary router, and an automatic revert if a change cuts MikroDash off. Scheduled backups are kept only when something changed, with a diff and a guarded restore. New sites join through a generated script that calls home over a built-in WireGuard tunnel, even from behind NAT. Alerts reach SMTP, Telegram, ntfy, Discord, Slack, Gotify, Pushover, and Apprise. Troubleshooting stays in the browser with ping, traceroute, torch, bandwidth tests, a packet sniffer, and a RouterOS terminal. Read-only API access covers every page and alert, while roles, OpenID Connect sign-in, and an audit trail of every write govern shared use. Off by default, an optional assistant answers from live router data and asks before changing anything. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Cyclists, runners, hikers, and kayakers can log every GPS route in FitTrackee, a workout tracker where each workout stays private until shared. Upload a GPX, FIT, KML, KMZ, or TCX file and the workout appears with a map and charts. Zip archives and manual entry work too. Charts plot speed or pace, elevation, heart rate, cadence, and power on one graph or several. Each workout holds 20 photos at most, and photos with GPS coordinates appear on the map. Twenty-seven sports are available, including cycling, running, kayaking, and swimrun. Shoes, bikes, and boards each tally distance, duration, and workouts, and sports can have default equipment. The dashboard shows a monthly chart and a calendar of workouts and records, and statistics group totals by day, week, month, year, or sport. Filters narrow the workouts list by date, sport, equipment, location and radius, distance, or speed, and results can be mapped. A global map plots workouts, filtered by date and sport. Workout data, charts, map, and photos each get a visibility setting: private, followers only, or public. Follow requests need approval by default, and unwanted users can be blocked. Comments accept limited Markdown, and the five latest public workouts publish as an Atom or RSS feed. Data export bundles an account's workouts and uploaded files. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

When warehouse data never reaches the CRM, ad platform, or help desk that needs it, Multiwoven is the open-source reverse ETL platform that syncs it there on a schedule. Sources include Snowflake, BigQuery, Redshift, Databricks, PostgreSQL, ClickHouse, MariaDB, Oracle, Amazon S3, and SFTP. Models define what to move: write SQL with a 100-row preview, pick tables in a visual selector, or reuse existing dbt models. Destinations span Salesforce, HubSpot, Klaviyo, Mailchimp, Zendesk, Slack, Airtable, Google Sheets, Stripe, Facebook Custom Audiences, HTTP endpoints, and vector stores such as Pinecone, Qdrant, and Weaviate. Each sync maps model columns onto destination objects like Salesforce Account, Contact, or Opportunity, then runs as a full refresh or as an incremental sync that moves only new or changed rows, optionally tracked by a cursor field. Schedules can be manual, an interval from minutes to weeks, or a cron expression. A dashboard reports sync activity, each run records its status with successful and failed row counts, and failed runs can trigger status emails. Workspaces keep sources, models, syncs, and destinations separate for each team, while Admin, Member, and Viewer roles and email invitations control access. A connector framework lets teams add sources or destinations that are not yet supported. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Measure is an open-source mobile monitoring platform that shows mobile teams what broke, how often, and what the user did right before it happened. Crashes, ANRs, and app hangs are grouped into single issues, and each fatal error arrives with a session replay: an ordered timeline of screens opened, taps, network calls, logs, and lifecycle events, with CPU and memory charts alongside screenshots and wireframe layout snapshots. Bug reports can be filed with a device shake or an SDK call and carry the same history of user actions. Performance traces and spans break slow startups and screens into steps, and network monitoring ranks the slowest and most error-prone endpoints. Funnels built from custom events show conversion and drop-off at each step, with a Friction view that ties every step to the crashes, errors, slow traces, and network requests users hit there. User journeys chart how people move between screens, and Adaptive Capture changes sampling, replay length, and screenshot masking remotely, with no new app build. SDKs cover Android, iOS, Flutter, React Native, and Kotlin Multiplatform. Teams sign in with Google or GitHub, invite colleagues by email, and send alerts to Slack, and an optional Measure Agent lets a coding agent or Slack help debug production issues. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

The CAPTCHA bargain - annoy your users and feed their behavior to Google - gets replaced with economics by mCaptcha. Instead of image puzzles, it uses SHA256 proof-of-work: every visitor's browser silently solves a small computational challenge (via a WebAssembly library) before submitting a form. Humans never notice the milliseconds; bots hammering your site must burn more compute sending requests than your server spends answering them, which makes attacks more expensive than defense - the property that also makes mCaptcha genuine DoS protection, not just bot filtering. Written in Rust, the system is fully automated: difficulty scales with traffic, so challenges stay trivial in normal conditions and harden under attack. The privacy and accessibility wins are structural rather than promised: no tracking, no profiling, no user-pattern data collection, and no visual puzzles that exclude users with visual or cognitive impairments - the design was published in Communications of the ACM. Rate limiting is IP-independent, so users behind NATs, VPNs, or Tor get the same experience instead of endless challenge loops, and proofs resist replay attacks, neutering captcha farms. Migration is deliberately easy: the API is compatible with reCAPTCHA and hCaptcha, making it a drop-in replacement. AGPL-licensed core with proprietary-friendly client libraries.

Getting non-technical friends and family onto a media server is its most tedious chore - Wizarr solves it. Instead of manually creating accounts, dictating server addresses, and explaining which app to install, you send one invite link. When the recipient clicks it, Wizarr creates their account on your server automatically - Plex, Jellyfin, Emby, Audiobookshelf, Komga, Kavita, and Romm are all supported - then walks them through a mobile-first, app-like onboarding wizard: download the right client, sign in, and learn how to request movies through your Overseerr or Ombi instance, with an optional Discord server invite along the way. Invitations are genuinely manageable: set expiration dates, usage limits, passphrases, library-scoped access tiers, and time-limited memberships that end access automatically. The wizard itself is fully customizable - Markdown-based steps managed from the admin UI, organized into pre-invite and post-invite phases (terms of service before joining, app setup after), reorderable bundles assignable to specific invitation types, and combined flows for invites spanning multiple servers. Multi-server and multi-admin support manages several backends from one dashboard, SSO support is plug-and-play, and a REST API with OpenAPI/Swagger documentation covers automation. A Flask/HTMX app in a single Docker container.

VyManager puts every VyOS router you run, across every site, into one web control plane with live dashboards and per-site permissions. Organize instances into logical sites, from the datacenter core to the smallest branch office, and add or remove routers without touching a command line. Live dashboards stream interface counters, system information, network graphs, and WireGuard peer status, so a saturated link announces itself before your users do. Configuration adapts to each router's VyOS version, with 1.4, 1.5, and rolling releases supported side by side during the longest upgrade cycle. Access is granted per site with OWNER, ADMIN, and VIEWER roles, API keys authenticate the machines, and SSH credentials stay encrypted at rest. A setup wizard walks a fresh deployment to its first managed router, and light, dark, and custom themes keep the night shift comfortable. For automation, AI assistants can be connected through the companion MCP integration, and the whole stack arrives as Docker Compose services you can redeploy in minutes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

When household readers want a single web portal to search, request, and deliver ebooks and audiobooks without juggling separate indexers or download clients, Shelfmark unifies the entire acquisition pipeline in one self-hosted hub. Universal search mode queries Hardcover, Open Library, and Google Books for rich cover art, series order, and edition metadata before aggregating matching releases across every configured source. Direct search mode queries individual providers immediately for rapid title lookups. You can connect Prowlarr torrent and Usenet indexers, direct web download mirrors, IRC book channels, and Soulseek peers through slskd inside one unified interface. Multi-user accounts support granular request policies where family members or friends submit book or release requests for admin approval, complete with per-user language preferences and custom delivery targets. Completed downloads automatically rename and route files into Calibre, Calibre-Web, Grimmory, BookLore, or Audiobookshelf watch folders, or dispatch directly to e-readers over SMTP email. Built-in authentication supports local credentials, reverse proxy headers, OpenID Connect single sign-on, and existing Calibre-Web user databases. Optional WireGuard VPN with a fail-closed kill switch and Tor routing keep external indexer queries private. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Design posters, social posts, presentations, invitations, resumes, thumbnails, and business cards in your browser with Doory, a self-hosted design editor that keeps your files, fonts, and brand assets on your own server. Start from one of ten starter templates or a blank canvas, then place text, shapes, lines, arrows, emoji, stickers, QR codes, and roughly 27,500 built-in icons anywhere on the page. Photo tools cover cropping, masks, filters, in-browser background removal, and 2x to 4x image upscaling, with stock photo search through Unsplash or Pexels. Layers can be renamed, locked, hidden, grouped, and reordered, while guides, snapping, rulers, per-page sizes, and format resizing keep multi-page designs tidy. Animations add 27 enter and exit effects, 12 emphasis motions, and 16 page transitions, plus Creative Commons music loops and sound effects, so decks can be presented live with speaker notes or exported as MP4, WebM, or GIF. Share links grant view, comment, or edit access with an optional password, and collaborators can pin comments, co-edit in real time, and roll back through version history. Brand kits store your colors, fonts, and logos so recurring posts stay on-brand, and exports cover PNG, JPG, SVG, and print-ready PDF with bleed and crop marks. An optional MCP server lets AI assistants create and fill designs from prompts, including bulk template filling from spreadsheet-style rows. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Attribution Assurance License licensed.

Instead of wrestling with raw command-line flags and YAML configuration files for every device on your self-hosted Headscale mesh VPN, Headplane gives you a Tailscale-style web administration console to manage machines, users, DNS records, and access policies from any browser. From the machines overview, network administrators can inspect connected nodes, view Tailnet IPv4 and IPv6 addresses, rename devices, reassign ownership across users, toggle key expiration, and approve advertised subnet routes or exit nodes in a couple of clicks. Built-in Access Control List (ACL) management lets you edit security policies, define user groups, assign node tags, and configure auto-approvers without manually SSHing into your control server. When someone needs immediate shell access to a remote Linux host on the mesh, the integrated WebSSH console opens an interactive terminal session right inside the browser tab over Tailscale SSH. You can also manage MagicDNS settings, configure split DNS nameservers, and add custom DNS records that automatically reload your Headscale instance. Multi-user administration supports OpenID Connect (OIDC) single sign-on with identity providers like Okta, Authentik, Authelia, and Google Workspace, alongside granular role assignments and pre-authentication key generation for unattended server enrollment. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Once a voice agent is imported or built, Lampline connects it to a phone line, sends an AI caller to grade real calls, and keeps it all on your own server. Start by importing a Dialogflow CX or CX Agent Studio export along with a report of anything to check, or build fresh in a drag-and-drop builder that mixes LLM steps with scripted pages for exact lines and form fields. Next, pick one of 20 model providers, including Claude, OpenAI, Gemini, Bedrock, Groq, and DeepSeek, or run Ollama with local speech and no API keys. Test by chat or microphone while each step lights up, and let agents call HTTP and MCP tools and save records in collections of their own. Then connect callers through Twilio, Telnyx, or any SIP trunk, PBX, or session border controller via jambonz, with transfers to a person that carry the call's details as SIP headers. Finally, evals phone the agent over a real line, where an AI Test Caller brings background noise, accents, and interruptions, grades each transcript check by check, and reports typical and p95 response times as callers hear them. Each agent stays a folder of YAML and Markdown that you can review in git and lint or test with the vk CLI. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.