Certificate lifetimes are collapsing toward 47 days, which turns TLS from a yearly chore into a weekly one, and CertMate is the control plane that makes that schedule boring. It issues and renews certificates from Let's Encrypt, ZeroSSL, Google Trust Services, Actalis, DigiCert, SSL.com, Sectigo, or your own private CA, validating by DNS-01 through 29 DNS providers, HTTP-01, or a CSR whose private key never leaves the device. Renewals run automatically, earlier when a certificate's life is short or the CA moves the date through ARI, and deploy hooks push each renewed certificate where it is actually served, then probe the live endpoint to prove the new certificate answers. Discovery watches hosts and certificate transparency logs for certificates you did not issue, folding them into one inventory of what is served where and when it expires. Certificates rest on local disk or in Azure Key Vault, AWS Secrets Manager, HashiCorp Vault, Infisical, or S3 storage, with encrypted backups copied off-site. Its built-in CA issues client certificates for mTLS with OCSP and CRL, and can serve ACME itself, so certbot, lego, acme.sh, and cert-manager get internal certificates under EAB rules you define. Every action lands in a tamper-evident, hash-chained audit trail you can export and verify independently. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

TryPost is an open-source social media scheduler that publishes natively to thirteen networks from one composer, calendar, and queue, whether the author is a person on your team or an AI agent connected over MCP. Write a post once and it adapts per network, with a live preview of each version, character quirks handled, and an AI assistant in the editor to rephrase, shorten, or expand when a caption fights back. Posts land on each channel's own posting times in its queue, the calendar shows the whole month at a glance, and anything can be dragged to a new slot when plans change. Members who need a second opinion send work for approval, and admins approve or reject in one click, which is how agencies keep many brands from becoming many headaches. Workspaces keep every client apart with its own channels, members, and settings, while signatures save the hashtag and call-to-action blocks you refuse to retype and labels color-code the calendar. Insights follow followers and post performance across channels, Repurpose copies videos you posted elsewhere onto your other networks automatically, and webhooks announce every created, published, or failed post to your other tools. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 2,200 GitHub stars and a philosophy that your notes should be files you own rather than rows in a database, ZenNotes is the keyboard-first Markdown editor that runs as a self-hosted web app backed by a Go server accessible from any browser on your network. Every note is a plain .md file in a vault directory you mount, with zero proprietary lock-in. Modal editing with real Vim motions, leader-key flows, and a command palette keeps your hands on the keyboard through edit, split, and preview modes. The rendering engine handles KaTeX math, Mermaid diagrams, TikZ graphics, and JSXGraph plots directly from Markdown syntax alongside wiki links and callout blocks. A first-party MCP server ships in the box with one-click integration for Claude Desktop and Cursor, letting AI assistants read and write the same Markdown files on disk without sync layers or duplicate copies. The bundled zen CLI provides note creation, search, tagging, task toggling, and piped capture with JSON output for shell scripting. Board views render plain CSV files as Kanban columns. Daily notes, quick capture, archive, and trash round out the vault workflow. The Go backend serves the browser frontend on port 7878 with token-based authentication, configurable browse roots, TLS proxy support, and file permission hardening at 0600/0700 defaults. Deploy via the multi-arch Docker image for linux/amd64 and linux/arm64. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Accounted is an open-source accounting platform built for Swedish sole traders and limited companies that keeps double-entry bookkeeping, invoicing, payroll, and tax filings compliant with Swedish accounting law. Create and send customer invoices with mixed VAT rates, generate PDFs, and track payment status, while supplier invoices record input VAT and feed batch payment files your bank can upload. Connect the bank feed to reconcile transactions automatically, then watch matched entries clear in passes instead of hunting through statements line by line. VAT declarations map onto the SKV 4700 form with per-rate breakdowns, and tax reports export in the formats the tax agency expects for sole traders and companies. Run payroll with salary runs and payslips, file employer declarations, and sync the tax account so booked movements reconcile against the agency record. Every receipt and document lands in an archive with integrity checks and seven-year retention, and period locks with sequential voucher numbers keep the books audit-ready. An AI agent can categorize transactions, draft vouchers, and prepare declarations through the built-in agent tools, while every posting waits for your approval before it commits. Import or export the standard SIE format to move between Swedish accounting systems, and send or receive electronic invoices through the Peppol network. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Paca is a self-hosted project management platform and Scrumban workspace where autonomous artificial intelligence agents collaborate with human software engineers as first-class Scrum teammates instead of external chat assistants. Engineering teams manage sprints, backlogs, and task lifecycles through a shared real-time board powered by Socket.IO where both humans and agents pick up assignments and post progress updates. A native Model Context Protocol server connects external coding assistants such as Claude Desktop and Claude Code directly into projects, tasks, and sprint data without custom scraping scripts. Distributed agents execute in isolated runtime sandboxes powered by the OpenHands software development kit, co-authoring behavior-driven development Gherkin scenarios with product owners and maintaining living system design documents. Visual event-driven automation builders compose multi-branch trigger, condition, and action pipelines that evaluate task dependency gates and cron schedules. A sandboxed WebAssembly plugin runtime allows developers to write custom backend logic and custom board views using Go or Rust. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

One REST call, 130+ notification services: Apprise API wraps the well-known Apprise library in a lightweight Django/Gunicorn microservice, so "send an alert" works the same whether it goes to Slack, Discord, Telegram, Teams, email, SMS, Pushover, or PagerDuty - each addressed by a simple URL scheme. It solves the credential-sprawl problem cleanly: instead of embedding provider tokens in every app, cron job, and CI pipeline, you centralize them here and everything else just POSTs a body and title. Two modes cover every workflow. Stateless calls to /notify carry target URLs in the payload (or fall back to a default set via APPRISE_STATELESS_URLS); stateful mode stores named configurations server-side under keys, so /notify/{KEY} fans out to everything registered - with tag-based routing (comma for OR, space for AND) selecting which endpoints fire per message. Messages take info, success, warning, or failure types in text, Markdown, or HTML, with attachments up to a configurable size. A built-in web UI manages and tests configurations, APPRISE_CONFIG_LOCK makes the store read-only, service allow/deny lists restrict which schemes work, webhook remapping adapts third-party payloads, and a Prometheus /metrics endpoint watches the gateway itself.

dyrector.io gives teams a visual web interface for deploying and managing containerized applications across Docker, Kubernetes, and Podman environments, replacing repetitive CLI commands and YAML editing with point-and-click configuration. Lightweight Go agents installed on target infrastructure communicate with the central TypeScript platform, enabling deployments to AWS, GCP, Azure, and on-premises servers without requiring infrastructure migration. Unified configuration screens eliminate redundant YAML editing across environments with support for all three container runtimes. Version management lets teams configure OCI-compatible container images once and deploy them as versioned releases with auto-generated changelogs and release notes. Multi-instance deployment enables simultaneous rollouts to multiple nodes with environment-specific configuration overrides, secret management, and instant test environment provisioning from any branch. The fine-grained RBAC system controls user access at project and environment levels, while audit logging tracks every deployment action. Registry integrations support Docker Hub, GitLab, GitHub, Google, and Azure container registries for image sourcing. ChatOps notifications integrate with Slack, Discord, and Microsoft Teams for deployment status alerts. Scheduled releases and workflow support enable automated deployment pipelines triggered by CI events via the REST API with JWT authentication. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Transform folders of DRM-free PC installers and retro game archives into a browsable, cover-art-rich digital storefront with Gameyfin, a self-hosted video game library server for LAN parties, homelabs, and family networks. Point the server at your mounted storage directories and its automated scanner indexes game archives, executables, and multi-part installers while showing real-time progress and estimated completion times. Bundled metadata plugins pull game synopses, release dates, developer credits, screenshots, and high-resolution box art from IGDB, Steam, and SteamGridDB according to your configured provider priority. Players can browse collections by genre or platform, inspect detailed game pages, and download installers directly through their web browser or via a built-in BitTorrent tracker and seeding client that distributes bandwidth across LAN participants. Administrators can manage multiple isolated libraries, trigger quick or full folder scans, customize UI themes including colorblind-accessible palettes, and enforce single sign-on via OAuth2 and OpenID Connect identity providers. Every cover image and metadata record is cached locally on disk so offline LAN events keep full browsing and download functionality without internet access. Built-in Prometheus actuator endpoints expose library and runtime metrics for infrastructure monitoring dashboards. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Mapping every physical server, virtual machine, container, and network link across a sprawling homelab into a live interactive canvas, Circuit Breaker gives infrastructure operators real-time topology visualization, IP address management, and rack elevation modeling on a single screen. Operators can switch between hierarchical, concentric, cortex ring, radial, and force-directed graph layouts where animated edges reflect link speeds and color-coded status rings display live hardware health. Automated discovery scans local subnets using nmap, SNMP, and ARP while querying Proxmox VE clusters, TrueNAS storage pools, and UniFi controllers, staging newly detected nodes in a review queue before adding them to the map. For multi-site labs or isolated VLANs, lightweight remote agents connect outbound over Noise-encrypted links after fingerprint approval to report host telemetry and run scoped network scans without opening inbound firewall ports. Rack diagrams let administrators drag servers into U slots with cabling overlays using a built-in catalog covering Dell, HPE, Supermicro, Ubiquiti, MikroTik, Synology, and APC gear alongside live iDRAC, iLO, and UPS metrics. Role-based access control, OIDC single sign-on, TOTP multi-factor authentication, encrypted full-state snapshots, and a SHA-256 hash-chained audit log keep multi-user operations accountable. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

When a power outage hits your server rack, deciphering raw command-line output from Network UPS Tools should not stand between you and a safe shutdown; PeaNUT wraps your NUT servers in a real-time web dashboard that monitors battery charge, load capacity, and voltage telemetry across every uninterruptible power supply on your network. Operators can connect multiple local or remote NUT servers into a single interface and switch between devices with one click. Live gauges track battery percentage, estimated runtime, real power draw in watts, and apparent power in volt-amperes. Interactive line charts plot input and output voltage alongside load fluctuations over time. Need to test a battery or silence an alarm? You can execute instant UPS hardware commands, edit writable device variables, or open a browser-based terminal directly to the underlying NUT daemon without leaving the web interface. Configuration works either through the visual settings panel or a declarative YAML file, protected by built-in account authentication. For broader infrastructure observability, you can stream time-series power data to InfluxDB v2, scrape the native Prometheus metrics endpoint into Grafana, query the REST and WebSocket APIs, or embed live UPS status cards inside Homepage and Glance dashboards. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Centralizing BorgBackup usually means hand-creating Unix users, wiring SSH keys, and remembering which machine stopped backing up three weeks ago; BorgWarehouse replaces that terminal work with a dashboard built for exactly this job. Add a repository and it provisions the dedicated user, authorized key, and storage quota for you, then hands back ready-to-paste client commands so a new machine is backing up in minutes. Every repository carries a freshness threshold: when no modification lands within the window you set, its status dot turns red and an alert goes out by SMTP email, through Apprise to Discord, Telegram, Slack, Gotify, or ntfy, or as a signed webhook POST to tools like n8n and Uptime Kuma, rate-limited to one alert per repository per day. Append-only mode is enforced on the server, so even a fully compromised client can add archives but never destroy existing ones, which is the property that keeps ransomware from eating your backup history. The monitoring view tracks storage consumption against each quota, a setup wizard walks new clients through onboarding (with a LAN variant for local transfers), and sign-in can delegate to GitHub, Google, Microsoft, GitLab, or any OIDC provider. A versioned REST API automates provisioning, and your passphrase never reaches the server: backups stay end-to-end encrypted on the clients. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Why export timesheets from one tool, manage Kanban tasks in a second, and copy billable hours into a third just to send a client invoice when TimeTracker handles the entire agency workflow in one self-hosted platform? Start a persistent server-side timer from any browser or log hours manually using saved templates, bulk entry forms, and automatic idle detection. Project managers organize deliverables across drag-and-drop Kanban boards, Gantt timelines, and threaded task comments while monitoring real-time project budgets and cost burn rates. A built-in CRM tracks client contacts, lead scores, and sales pipeline stages before work even begins. When billing day arrives, you convert unbilled hours, reimbursable receipts, mileage logs, and per diem allowances directly into branded multi-currency invoices without double-billing a single minute. Finance teams can customize PDF invoice layouts, automate recurring billing schedules, and transmit EN 16931 compliant electronic invoices via Peppol or embedded ZUGFeRD/Factur-X XML. Interactive analytics dashboards and scheduled CSV or Excel exports give every stakeholder complete visibility into billable utilization. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Point your RustDesk clients at CortenDesk and the bare open-source server turns into a managed fleet console with a real address book, real access control, and a remote client that lives in the browser. One container runs the ID server, the relay, and the console together, and existing key pairs and device IDs move in unchanged, so migration is a hostname change rather than a rebuild. The fleet view shows live presence, platform, aliases, owners, and last-seen for every machine, organized into folders that double as the unit of access control. People see only their own devices plus the groups granted to them, and the same scoping is enforced in the RustDesk client API, not just the web pages. Policies push client settings over the heartbeat, covering permissions, password rules, and capture behavior, and enforced policies revert local changes automatically. Five audit logs record connections, file transfers, sign-ins, security alarms, and console actions, all filterable and exportable to CSV. When a browser is all you have, the built-in web client views and controls machines with file transfer, clipboard, audio, and multi-monitor switching, no installer required. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Log a date, amount, and category; get a clean monthly pie chart and a cashflow strip showing income, expenses, and net balance - ExpenseOwl is expense tracking stripped to what actually matters. The MIT-licensed Go application deliberately is not a budgeting system - no envelopes, no accounts, no double-entry, no bank sync - because its author found tools like Firefly III and Actual too heavy for the simple question "where did this month's money go?" The dashboard makes that question fast: click a pie slice to exclude fixed costs like rent and see discretionary spending clearly, then drill into a chronological table view to inspect or delete individual transactions. Recurring transactions handle salaries and subscriptions automatically, optional tags add a second classification axis, and settings cover custom categories, currency symbol, and a configurable month start date for non-calendar pay cycles. CSV import migrates data from virtually any other tool, and CSV export keeps your data portable. It ships as a self-contained binary and multi-architecture Docker image with zero internet interaction, stores data in flat JSON files by default (PostgreSQL optional), and installs as a PWA on phones. Single-user by design; pair it with an authenticating reverse proxy if exposed publicly.

Kodus AI automates pull request code review with inline AI comments across GitHub, GitLab, Bitbucket, and Azure DevOps, supporting any LLM provider at cost with zero token markup. The multi-service TypeScript architecture deploys via Docker Compose, running an API server, background worker, webhooks service, and React dashboard backed by PostgreSQL with pgvector, MongoDB, and RabbitMQ. Integration covers both cloud platforms and their enterprise flavors (GitHub Enterprise Server, GitLab Self-Managed, Bitbucket Data Center) using standard OAuth flows and webhook signing to keep the review loop entirely inside your network. The platform is model-agnostic with Bring Your Own Key support for Claude, GPT, Gemini, Llama, and any OpenAI-compatible endpoint including locally-hosted models. Custom review rules combine your team's coding standards with requirements pulled from Jira, Linear, and Notion, automatically checking every PR against documented specifications. The CLI enables local reviews against working trees, staged diffs, branches, or specific commits, integrating into CI/CD pipelines as pre-merge gates. Source code is never stored and never used for model training, with all data encrypted in transit and at rest. 1,270+ stars and 129+ releases since March 2025. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

PRISM consolidates passive reconnaissance, credential leak detection, and network asset mapping into a unified operational dashboard to replace fragmented command-line security tools. Analysts can launch simultaneous multi-source investigations against domains, internet protocol addresses, email mailboxes, phone numbers, and online handles to uncover domain registrations, open network ports, cryptographic certificates, and historical web archives. The platform interrogates threat feeds and leak repositories to expose credential leaks, dark web mirrors, and email routing anomalies with automated SMTP mailbox verification. Cross-platform identity engines crawl thousands of social networks and public registries to correlate aliases, discover leaked commit identities, and trace digital footprints across the web. Discovered assets render into interactive entity relationship graphs alongside geographic internet protocol maps to help investigators visualize infrastructure clusters and ownership links. An automated operational security calculator evaluates exposure vulnerabilities across identity, web, and infrastructure vectors, producing an aggregated risk score with granular hardening recommendations. Scheduled watchlists continually monitor target infrastructure, dispatching webhook notifications to chat channels whenever new subdomains, ports, or credential leaks appear. Investigators can export comprehensive audit dossiers as self-contained HTML files, styled PDF documents, or structured spreadsheets. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

MikroTik Manager is a web control plane for whole RouterOS fleets, built so that a bad VLAN change reverts itself instead of costing you a drive to the site. Before any risky edit, Change Guard saves a restore point on the device and arms a scheduler; if a fresh connection cannot reach the router afterwards, it rolls itself back. Lockout prediction simulates each change against live device state and refuses one that would cut management access, naming the exact port and VLAN at fault. Config Health audits for settings RouterOS accepts but silently ignores. Day to day, a live dashboard tracks availability, wireless clients, and alerts delivered by email, Slack, Discord, Telegram, or ntfy. Switch faceplates, per-port client views, VLAN copy wizards, bulk SSID deployment, RF health charts, rogue AP detection, and a guest Wi-Fi captive portal wizard cover the wired and wireless side. A rule builder handles firewall and NAT, topology maps come from LLDP, CDP, and MNDP, and a built-in NetFlow collector attributes traffic to clients and applications. Firmware rolls out in canary waves that halt on failure, and every configuration snapshot supports diffs and one-click rollback. OIDC single sign-on, TOTP two-factor, role-based access, and scoped API tokens protect the console, while sites group devices per customer network. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

MCPJungle puts every MCP server your AI tools use behind one endpoint, so Claude, Cursor, Codex, and your own agents all connect to a single gateway instead of a tangle of per-client configurations. Register remote HTTP servers and local STDIO servers once, and their tools, prompts, and resources become discoverable through the gateway in one place. Tool groups expose curated subsets at their own endpoints, so a coding agent sees only the tools its job needs instead of hundreds of irrelevant ones competing for context. The dashboard gives you a visual registry of servers, tools, and groups for everyday management, while the CLI and REST API cover scripting and automation. Development mode runs with zero authentication for a personal setup; enterprise mode adds per-client tokens that allow-list exactly which servers each client may reach. User accounts and manual server initialization give teams a governed shared deployment, with OpenTelemetry metrics showing what clients call and how the gateway performs. Upstream servers can authenticate with bearer tokens or OAuth, so credentials stay centralized in the gateway rather than copied into every client config. Registry data persists in a local file for solo use or in PostgreSQL when the gateway becomes shared team infrastructure. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MPL-2.0 licensed.