With over 3,600 GitHub stars and a philosophy of deliberate simplicity, OliveTin eliminates the need for SSH sessions, admin panels, and complex automation platforms by letting you define shell commands in a YAML config file and access them as clickable buttons through a clean browser interface. The Go binary consumes only a few megabytes of RAM, running on everything from tiny ARM and RISC-V devices through Linux VMs, containers, macOS, and Windows. Each button executes a predefined shell command with optional typed arguments that render as dropdowns, text fields, and validated inputs, preventing free-form command entry while giving users controlled access to server operations. Access control lists define exactly who can view or run each action — guests, family members, or junior administrators see only the buttons they are permitted to use. Entity templates generate actions dynamically from lists of hosts, containers, or other resources, creating one template that produces many buttons without manual duplication. Flexible triggers extend beyond browser clicks: cron schedules, webhooks, calendar file events, and filesystem watchers run actions automatically when conditions are met. Authentication supports OAuth2, JWT, and header-based methods for integration with reverse proxies and identity providers. Dashboards organize actions into folders and fieldsets for clear navigation across dozens of commands. No plugin system, no extension marketplace, no premium tiers — every feature ships in the single open-source release. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

When Clarkson, the once-popular fuel logger, stopped receiving updates, Hammond stepped in as its logical successor - a self-hosted vehicle expense tracker. Written in Go with a Vue.js interface and SQLite storage - a single lightweight container, no external database - it tracks every cost your vehicles generate: fuel fill-ups with cost, volume, and odometer readings; maintenance and repairs; and arbitrary other expenses, each attachable with photos and documents stored against the vehicle. The multi-user, multi-vehicle design is what sets it apart from phone apps: a household or small business adds all its vehicles and all its drivers, shares vehicles across users, and every fill-up lands in one ledger no matter who was driving. The Quick Entries feature respects how expenses actually happen - snap a photo of the receipt or pump screen at the gas station, then complete the structured entry later when you have a minute. Reporting works at both the vehicle level (cost per distance, fuel economy trends) and across the whole fleet. Migration matters here: importers for Clarkson, Fuelly, and Drivvo bring years of fill-up history along, so switching does not mean starting your data over.

Follow every sale from first inquiry to final payment inside one self-hosted CRM. Cordys CRM splits the lead-to-cash cycle into connected modules: leads with custom forms and one-click conversion, customers with contact records and shared follow-up among team members, and opportunities that advance through configurable stages from needs confirmation to won or lost. Quotations and contracts come next, with contracts carrying payment plans, payment records, business titles, and invoice records so every collection stays traceable. Orders link to contracts and move through a customizable status flow covering shipment requests, partial and full shipment, inspection, and completion. Approval workflows route requests to reviewers and keep an approval history, and real-time notifications reach users while they work. Administrators draw the organization chart, assign role-based permissions, configure modules and form fields without code, and review system logs. An MCP server secured with per-user API keys lets MaxKB agents search records, create leads, customers, opportunities, and contacts, log follow-ups, and update accounts, while an Agents module embeds those assistants in the CRM and CRM Skills connect OpenClaw and WorkBuddy to the sales process. Sales data can feed DataEase dashboards, WeCom, DingTalk, and Lark integrations link departments and messages to the office platforms teams already use, and the interface ships in English and Chinese. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed with FIT2CLOUD branding terms.

Wag is an authentication gateway for WireGuard that lets each device reach only the routes it should, and asks for a second factor before the sensitive ones open. Admins write access policies for everyone, groups, or single users, marking subnets, hosts, ports, and protocols as MFA-required, always allowed, or denied, and the most specific prefix wins, so one allowed address can sit inside a protected range. Devices join with a registration token, and the public endpoint answers with a finished WireGuard profile. Users then confirm a TOTP code, a WebAuthn security key, an OIDC single sign-on login that maps identity provider groups into Wag groups, or a PAM prompt, and repeated failures lock the account. Session lifetime and idle timeouts decide when they must prove themselves again. The browser portal lists users, devices, rules, registration tokens, and webhooks with real-time notifications, while a command line locks devices, resets MFA, and manages administrators. Webhooks turn JSON from an HR or identity system into new tokens or removed users and devices, and clients can fetch the list of guarded routes from a small API. Remote staff, contractors limited to one host, and homelabs are typical uses. When a server fails, the VPN remains reachable through clustering with witness nodes or an external etcd, and certificates arrive through ACME with HTTP-01 or Cloudflare DNS-01. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.

AI and API products live or die by usage, and OpenMeter is the open-source stack that measures it, rations it, and bills for it. Your application emits CloudEvents for every billable action; OpenMeter validates and deduplicates them, then aggregates usage in real time so dashboards and enforcement checks never wait for a nightly batch. Meters slice that usage by customer, time window, or any dimension you attach, which turns raw events into answers like tokens per workspace this month. Entitlements decide who gets what: metered allowances with balances and overage, boolean switches for features like SSO, and static JSON configuration for per-customer model access. Grants top allowances up once or on a schedule, resets roll balances over each usage period, and one API call tells your app whether a customer still has access right now. On the money side, plans carry flat, per-unit, tiered, package, or dynamic prices; subscriptions, credit balances, and the invoice lifecycle run alongside, with webhooks announcing everything to your other systems. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Haven gives your community a private chat server with voice calls, screen sharing, and end-to-end encrypted direct messages where friends join via invite link in their browser without installing apps or creating third-party accounts. Real-time messaging supports image uploads via paste and drag-drop, emoji reactions, replies, threads, typing indicators, @mentions with autocomplete, and inline GIF search through Tenor or GIPHY. Peer-to-peer WebRTC voice chat includes per-user volume sliders, mute and deafen controls, talking indicators, and screen sharing with picture-in-picture mode. Direct messages use ECDH P-256 key exchange with AES-256-GCM symmetric encryption where private keys never leave the browser, ensuring not even the server operator can read them. Twenty-plus visual themes with stackable effects including CRT scanlines, Matrix Rain, Cyberpunk Text Scramble, Snowfall, and Campfire Embers let users personalize the experience with configurable intensity sliders. Rich Presence integration shows what members are playing or listening to via Last.fm, Steam, and Spotify. A built-in bot API supports webhooks and custom slash commands, while Discord history import preserves channels, threads, forums, reactions, pins, and avatars. The Node.js server deploys via Docker Compose or a single batch file that auto-handles dependencies, SSL certificates, and configuration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Comp AI turns the months-long slog of SOC 2, ISO 27001, HIPAA, and GDPR certification into a largely automated process by connecting to your existing infrastructure and continuously collecting the evidence auditors actually ask for. Point it at your AWS account, Google Cloud project, GitHub organization, or any of 580+ supported integrations, and autonomous agents pull configuration snapshots, access logs, encryption status, and policy compliance data on a recurring schedule so your compliance posture reflects reality rather than last quarter's manual export. The AI policy engine analyzes your tech stack, team structure, and risk tolerance to generate organization-specific policies for information security, access control, incident response, data retention, and vendor management; no two companies get the same boilerplate. An open-source device agent runs on employee machines checking disk encryption, firewall status, screen lock settings, password length, and antivirus presence around the clock, flagging failures the moment they occur instead of surfacing them during an audit. Built-in penetration testing agents scan your codebase and API endpoints for vulnerabilities like SQL injection and output audit-ready reports. The vendor risk management module scores third-party services and surfaces compliance gaps before they become findings. A public trust center lets prospects verify your compliance status directly, eliminating security questionnaire bottlenecks. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Plain-text recipes in, a phone-friendly recipe site out: CookCLI reads Cooklang files and serves them with scaling, search, shopping lists, meal plans, and pantry tracking. Write ingredients, cookware, and timers inline. Open any recipe from a phone or laptop on your network. Change the serving count and the quantities recalculate. Search by ingredient or by text. Plan a week in a .menu file and get one shopping list, merged across recipes, grouped by store aisle from your own aisle configuration, with pantry items already subtracted. The pantry file holds quantities, expiry dates, and low-stock thresholds. Ask which items are depleted or expiring, or which dishes you can cook right now, near matches included. In the terminal, print any recipe as Cooklang, JSON, or Markdown, run template-driven reports, and let a doctor command check your files. Import a recipe from a web page with an OpenAI API key. Switch on sign-in so everyone can browse but only signed-in users can edit recipes, the pantry, or the shopping list. A documented HTTP API feeds other tools. The whole collection also builds into a static website. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Flexprice is a developer-first billing platform built specifically for AI-native and SaaS companies that need usage-based, credit-based, and hybrid pricing models without building custom billing infrastructure. The metering engine ingests millions of usage events in real time through HTTP APIs or SDK calls, supporting sum, count, unique count, latest value, and multiplier aggregation strategies across custom event schemas like API calls, token counts, compute minutes, and GPU time. Credit management handles prepaid wallets with promotional grants, rollover caps, auto top-ups, and priority-based credit application during invoice generation. The pricing engine supports per-unit, tiered, volume, package, and flat-rate models with per-customer overrides, committed minimums, and enterprise contract terms. Feature entitlements enforce boolean toggles, metered usage limits, and configuration values per plan, enabling applications to gate functionality through simple API checks. Automated invoicing calculates charges from real-time usage data with proration for mid-cycle upgrades and downgrades, generating detailed line items linked to tracked consumption. The architecture separates event ingestion through Kafka from billing computation via Temporal workflow orchestration, allowing each layer to scale independently with ClickHouse handling high-performance usage aggregation. Stripe Connect integration processes payments and manages customer payment methods. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPLv3 licensed.

To protect self-hosted web services behind a unified single sign-on portal without deploying complex enterprise identity suites, Tinyauth acts as an OpenID Certified authentication server and reverse proxy middleware. Homelab operators and infrastructure teams place it in front of internal dashboards, media servers, and administrative tools routed through Traefik, Caddy, Nginx, Nginx Proxy Manager, or LinuxServer SWAG. Users can sign in with local bcrypt-hashed credentials, scan QR codes to enroll time-based one-time password authenticators for two-factor verification, or authenticate through external OAuth providers like GitHub, Google, and Pocket ID. Organizations running centralized directories can bind Tinyauth directly to an LDAP server such as LLDAP or OpenLDAP and automatically synchronize group memberships for role-based authorization. Fine-grained access control rules configured via dynamic Docker container labels or environment variables let administrators whitelist or block specific usernames, OAuth email regex patterns, OIDC groups, client IP CIDR ranges, and URL path prefixes per subdomain. For applications that support native federated login, the built-in OpenID Connect 1.0 discovery endpoint, authorization code flow, and userinfo API allow seamless single sign-on with optional consent skipping for trusted clients. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Powering distributed teams seeking full visibility into work patterns and productivity, Ever Teams is an open-source platform unifying time tracking, task management, project coordination, and team collaboration in a single self-hosted application. The real-time timer tracks work against tasks and projects with one-click start/stop, while the Electron desktop app captures periodic screenshots at configurable intervals, monitors keyboard and mouse activity levels, detects idle periods, and syncs offline sessions automatically. Kanban boards with drag-and-drop, calendar views, and daily planning tools organize work across custom statuses, priorities, and sizes. Built-in video conferencing powered by Jitsi or LiveKit enables meetings without leaving the platform. Timesheet management supports submission, review, and approval workflows with configurable time limits and budgets. The backend runs on the Ever Gauzy NestJS platform providing REST and GraphQL APIs, multi-tenant architecture with organization and team scoping, role-based access control, and an integration framework connecting GitHub issues and pull requests bidirectionally plus JIRA import and sync. Infrastructure includes PostgreSQL, Redis for caching and pub/sub, MinIO for S3-compatible storage, Elasticsearch for full-text search, and Cube.js for OLAP analytics. Built with Next.js 16, React 19, Tailwind CSS, and Recoil, with native iOS and Android clients via Expo, Electron desktop apps for Windows, macOS, and Linux, and Plasmo browser extensions for Chrome and Firefox. Internationalization spans 13-plus locales with dark, light, and system themes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL v3.0 licensed.

With nearly 3,000 GitHub stars and 14 releases since its June 2025 launch, Kite delivers a lightweight Kubernetes dashboard that replaces the fragmented workflow of switching between kubectl, Lens, and separate monitoring tools with a unified multi-cluster management platform. The dashboard automatically discovers clusters from kubeconfig files and supports independent Prometheus configurations per cluster, providing real-time CPU, memory, and network charts alongside live pod log streaming with filtering and search. A built-in web terminal opens shells directly into pods and nodes without kubectl port-forward, while the Monaco-based YAML editor offers syntax highlighting and validation for in-place resource editing. The integrated AI agent, powered by OpenAI or Anthropic models via native Go SDK integrations, translates natural language into precise client-go API calls — querying cluster health, analyzing pod logs, scaling deployments, patching resources, and cleaning up failed jobs — all operating strictly within the logged-in user's RBAC permissions. Enterprise governance includes OAuth 2.0 single sign-on, multi-factor authentication, FIDO2 passkeys, granular role-based access control with per-namespace permissions, and comprehensive audit logging. Helm chart management enables browsing, installing, and upgrading releases directly from the UI, while the Docker registry integration provides quick image tag selection. Deploy via a single Docker container with SQLite or use the official OCI Helm chart with PostgreSQL or MySQL for production. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Aegra runs your LangGraph agents on your own infrastructure with the same SDK and APIs you would use on the managed platform, so moving in does not mean rewriting your agents. You deploy an agent once and clients connect through Agent Chat UI, LangGraph Studio, or CopilotKit, while threads, runs, and checkpoints persist between sessions instead of vanishing when a process restarts. Streaming answers arrive token by token over server-sent events, and if a connection drops, the stream reconnects and replays missed events rather than losing the run. Human-in-the-loop gates pause an agent at the step you choose, wait for a person to approve or edit, and then resume from exactly that state. Scheduled cron jobs trigger runs on standard or seconds-level expressions with timezone support, which turns agents into recurring workers for reports, checks, and follow-ups. When traffic grows, Redis-backed workers process runs with lease-based crash recovery, so a dead worker's job is picked up instead of disappearing. Authentication handlers plug in JWT, OAuth, or Firebase, custom endpoints sit beside the agent API, and traces fan out to the observability backend you already run. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Instead of trusting one search company with every query, degoog is a self-hosted search aggregator that fans each one out to the engines you choose, from your own server, and merges the answers into one deduplicated, ranked list. It installs with no engines at all; a first-run tour then walks you through picking Google, Bing, DuckDuckGo, Brave, Startpage, Reddit, or Wikipedia from the built-in Store. Pages found by several engines collapse into a single row that lists every source, while a sidebar times each engine, explains failures like rate limits or CAPTCHAs, and retries only the one that failed. Tabs appear for each search type your engines serve, and the Images tab adds size, color, layout, and safe-mode filters beside a zoomable preview panel. Bangs target one engine or run commands (!w for Wikipedia, !ip, !speedtest, !uuid), and Store plugins add weather, definitions, QR codes, and search across your own Jellyfin or Meilisearch libraries. Owners can block, rewrite, or score domains, serve a script-free page to text browsers, and turn on an indexer that remembers seen results for later recall. A JSON search API, a SearXNG-compatible response mode for Open WebUI, and an MCP companion feed the same results to scripts and LLM clients. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Cinephage puts your movies, series, live TV, subtitles, indexers, and download clients into one self-hosted media command center instead of a stack of separate automation services. Browse and organize libraries from a responsive interface that works on desktop and mobile, with file scanning and metadata matching keeping titles identified correctly. Search across configured indexers, compare releases with quality profiles and custom scoring rules, and send chosen downloads to your client without repeating setup for each media type. Let monitoring tasks watch for missing episodes, upgraded releases, and newly aired content, while the blocklist stops failed releases from coming back. Pull subtitles from multiple providers with language profiles, create dynamic smart lists from list sources or custom queries, and add matching titles automatically. Generate streaming links as .strm files for players such as Jellyfin, Emby, and Kodi, try live TV channels with guide data where configured, and receive library update notifications in your media server. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Allocating every incoming dollar into purposeful spending and savings buckets before transactions occur, OpenBudgeteer gives households complete financial control through a self-hosted zero-based envelope budgeting platform. Users can organize expenditures into customizable bucket hierarchies, grouping everyday living costs, debt repayments, and sinking funds into distinct categories with target balances. Financial planners can import bank statement files via flexible CSV mapping profiles that parse transaction descriptions, clean up merchant strings, and auto-assign records to corresponding expense buckets. The transaction registry provides split-transaction functionality, allowing shoppers to divide a single department store receipt across grocery, household, and clothing envelopes with exact currency precision. Interactive progress bars display bucket health throughout the billing month, signaling when spending velocity threatens allocated limits and calculating suggested contributions for forthcoming paychecks. Advanced forecasting reports plot multi-month net worth trajectories, track category expenditure patterns, and calculate burn rates against long-term retirement and emergency savings goals. Account balances synchronize across multiple physical checking accounts, credit cards, and cash wallets, ensuring total bucket balances reconcile perfectly against real bank reserves. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL v3 licensed.

Juggling separate API keys, incompatible payload schemas, and unpredictable rate limits across OpenAI, Anthropic, and Google Gemini slows down every AI workflow, and Octopus solves it by consolidating all your upstream model providers into one self-hosted API gateway. Point Claude Code, OpenAI Codex CLI, or any SDK client at a single gateway URL and translate requests transparently between OpenAI Chat Completions, OpenAI Responses, Anthropic Messages, and Google Gemini endpoints without modifying client code. Group multiple provider channels under a unified model alias so your coding agents automatically fail over to backup providers and shield active tasks from upstream HTTP errors or rate limits. Watch live end-to-end request routing on the interactive topology canvas as prompts flow from client applications through model groups to specific upstream channels. Synchronize available model catalogs directly from connected providers and pull up-to-date token pricing from models.dev, or define custom per-million input, output, and cache-read rates for private deployments. Inspect detailed request logs, monitor token consumption trends, and audit daily API spend across every channel from the web dashboard. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Together with relatives and fellow researchers anywhere in the world, family historians can build, visualize, and preserve shared ancestry databases using Gramps Web, a self-hosted collaborative genealogy platform. Interactive family tree charts let you explore ancestor, descendant, hourglass, relationship, and fan views across configurable generation depths, while inline editing buttons allow you to add parents, spouses, and children directly inside the graph and export finished diagrams as SVG files. When tracing where ancestors lived and migrated, the interactive map plots life events across OpenStreetMap and OpenHistoricalMap layers with a historical time slider and custom image overlays, complemented by a zoomable chronological timeline spanning centuries. Photograph collections become searchable archives through automated face detection that tags relatives in two clicks, alongside an integrated family history blog for publishing illustrated biographical stories. Researchers can also analyze autosomal DNA match segments in an interactive chromosome browser, determine patrilineal Y-DNA haplogroups locally without sending genetic data to third parties, and query people, places, citations, and notes using Gramps Query Language filters or a conversational AI assistant. Bidirectional synchronization with Gramps Desktop, full transaction history with undo, role-based privacy controls for living individuals, and pre-filled searches for FamilySearch and Ancestry keep every record accurate and protected. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.