'Can Maria edit this document?' is a simple question with a hard implementation, and SpiceDB is the open-source, Zanzibar-inspired database built to answer it and millions like it correctly. You model your product once in its schema language, defining object types like documents and organizations, relations like owner and member, and computed permissions built from unions, intersections, exclusions, and arrows through other objects. Your application then writes relationships as users join groups, create folders, and share files, and SpiceDB evaluates checks against that live graph in milliseconds. Check a single permission before rendering a button, check hundreds at once to filter a dashboard, look up every resource a user can open for search prefiltering, or list every subject who can access a file for an admin screen. Per-request consistency options, anchored by revision tokens, protect you from the classic race where a revoked user briefly keeps access, and caveats add conditional rules based on context like IP address or time. Relationships persist in PostgreSQL for simple deployments or CockroachDB and Spanner when you need multi-region scale, and the same schema files validate in CI with the command-line tool before they ever reach production. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

ParadeDB turns the Postgres you already run into a full search and analytics engine, so your application data, full-text search, vector retrieval, and aggregations all live in one database. Create one ParadeDB index over a table and you can run relevance-ranked BM25 queries with tokenizers, phrase matching, highlighting, and Top-K retrieval using plain SQL. The same index stores pgvector embeddings, so similarity search composes with text predicates and filters, and hybrid queries fuse both rankings when a question needs keywords and meaning at once. Aggregations push into the index too: ordinary GROUP BY queries accelerate, and Elasticsearch-style JSON aggregations return facets, histograms, percentiles, and cardinality for filterable search interfaces. Because the index updates in the same transaction as your writes, search results are never stale and there is no ETL pipeline, sync job, or second system to babysit. JOINs against the rest of your schema keep working, since search is just another index inside your system of record. Teams typically retire a separate search cluster while keeping sub-second relevance search, semantic retrieval for AI features, and faceted analytics on the data they already store. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Every Terraform change becomes a pull request with Atlantis, which runs the plan on your server, posts the output for review, and applies only the exact change reviewers approved. Open a pull request that touches Terraform code and Atlantis automatically runs terraform plan, posting the full output as a comment and a commit status your reviewers can inspect line by line. When the change looks right, a teammate comments atlantis apply and Atlantis executes the exact plan that was reviewed, then reports the result back on the same pull request. Each directory and workspace is locked while a pull request is open, preventing two changes from applying out of order, and locks can be inspected or discarded from the web interface. Apply requirements let you demand an approved review or a mergeable branch before anything runs, and optional policy checks evaluate plans against your rules before they can proceed. Repositories describe their projects, workspaces, and custom workflows in an atlantis.yaml file, including pinned Terraform versions, execution order groups, and parallel planning or applying across projects. Because Atlantis runs inside your infrastructure, cloud credentials never leave your network, and every plan, approval, and apply is preserved on the pull request as an audit trail. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Building healthcare software usually means assembling a FHIR data store, an identity provider, audit logging, and clinical interfaces before any product code gets written, and Medplum ships all of it as one open-source platform. Every clinical record, from patients and encounters to observations, medications, and appointments, lives in a standards-based repository you can query through REST and GraphQL APIs with full search parameters. Sign-in and permissions come built in through OAuth, OpenID Connect, and SMART-on-FHIR, with access policies that control read and write rights down to the resource, compartment, and field level. The included web app lets your team browse and edit any resource, manage project users, clients, bots, and secrets, and review a complete audit trail where every read, write, and login is recorded. Bots run your TypeScript logic inside the platform when resources change, on schedules, or over HTTP, handling jobs like HL7 transforms, eligibility checks, and notifications without another server to operate. Subscriptions push real-time events to your services through webhooks or WebSockets with retries and signing, and projects partition data so each clinic or customer stays isolated on one deployment. Clinicians get ready-made interfaces for charting, scheduling, eligibility, and billing that you can fork and rebrand, while patients reach their records through portals and SMART health links. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Watchtower puts AI-driven security assessments into one web console, where sessions probe your attack surface while every request, finding, and piece of evidence is captured as it happens. The AI session console follows the attack surface, session progress, tool calls, and findings as an assessment runs, so you can watch an engagement unfold instead of reading a log afterwards. A built-in proxy workflow records HTTP and HTTPS traffic history with highlighted patterns, and any captured request can be sent to the Repeater for editing, replay, and response comparison. Mobile work is covered too: connect phones over USB or wireless, capture app traffic separately from accessibility control, and import WeChat mini-program packages to configure an assessment session. A public vulnerability intelligence library can be searched by component, severity, and source and kept synchronized locally, giving assessments current context without sending your targets anywhere. Findings are managed by source, severity, and status, each linked back to its supporting evidence, and the report editor assembles them with a live preview, impact notes, and remediation guidance. The dashboard tracks assets, tasks, AI sessions, token usage, and runtime resources, and task admission is budgeted against physical memory so heavy scans do not starve the host. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

PandaDOS is a self-hosted control plane that turns Claude Code and Codex into long-running coding agents you direct through an issue queue from any browser, instead of babysitting a terminal. You file an issue with the outcome and acceptance criteria, and PandaDOS clarifies missing requirements, plans the work, picks the agent, and drives implementation, verification, and delivery in stages. Three approval levels, cautious, balanced, and automatic, decide which actions proceed alone; safe reversible steps continue automatically while destructive, irreversible, production, or secret-related decisions always come back to you. The browser workspace shows the real agent conversation, a native terminal, project files, Git history and diffs, and an execution summary, so you can inspect or intervene at any moment from a phone or laptop. Agents run on local or SSH-connected executor machines inside tmux sessions, and work sharing one repository is serialized while independent projects proceed in parallel without conflicting edits. Modules keep one assigned agent and durable project knowledge, so context from finished issues carries into the next task instead of evaporating when a chat ends. Teams can sign in through Feishu, ask the project manager questions in chat, and receive subscription notifications and approval cards on their phones. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Type a sentence like 'draw a seaside lighthouse under moonlight, with a small sailboat and stars' and Draw Agent Studio sketches it on a live canvas you can then keep editing by chat. Follow-up messages move objects, change colors, delete elements, and undo or redo steps, so refining a diagram becomes a conversation instead of a wrestling match with shape handles. The same canvas accepts direct manual work: select and drag shapes, draw freehand with the pen, or drop text onto the page to finish details the model missed. Researchers and writers use it to build flowcharts from a paragraph of method notes, grouping stages, adding quality checks and feedback loops, and restructuring sections on request. Canvases save automatically as you work, and finished pieces export as PNG, JPG, WebP, or SVG images, or as editable Excalidraw files for further hand editing elsewhere. You bring your own model connection, choosing OpenAI, Claude, Gemini, Azure OpenAI, Ark, DeepSeek, Kimi, Groq, OpenRouter, Bedrock, Vertex AI, or a local Ollama or OpenAI-compatible endpoint. A built-in connection test sends a real image and verifies recognition and tool calling before you save, and your API keys stay encrypted on the server rather than in the browser. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Zeabur is a self-hosted web platform that deploys and runs your services on your own Kubernetes cluster, presenting the cluster as simple projects and services instead of raw manifests. Every change starts as a readable plan listing the exact fields it will write and who owns them today, and nothing is applied until you confirm it. When something breaks, Zeabur says so in plain words and points at the fix: a worker that restarted fourteen times gets a button straight to the logs from the run before the restart. You deploy from Git repositories, from an uploaded folder or ZIP archive, or directly in the dashboard, then follow live logs, open a terminal inside a container, and watch CPU and memory move over time. Projects are namespaces and all state lives in Kubernetes objects, so there is no Zeabur database to back up, and uninstalling the platform leaves your Deployments, Services, and Ingresses running untouched. Companion pieces add passkey sign-in for kubectl with tokens that expire in minutes, image builds from Git through a BuildKit operator, and a catalog of cluster components and app templates. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Hatchdoor gives your Markdown notes two front doors at once: a fast web interface for you, and an MCP endpoint where AI agents read and edit the very same vault. Point it at any folder of Markdown files, an existing Obsidian vault included, and it indexes everything into a disposable SQLite read model that rebuilds itself from your files if deleted. In the browser you browse folders, follow wikilinks that survive renames, explore backlinks and graph views, and search by keyword or meaning across every vault you mount. The live editor shows Markdown syntax only on the line you are editing and saves automatically, while concurrency checks refuse a save when the note changed underneath you. Agents connect with their own token and start read-only; turn writes on and Claude Code, Codex, Cursor, or Hermes can create, edit, move, and link notes through the same checked operations the interface uses. Saved queries in Obsidian's Bases syntax render as live tables, attachments preview inline, and optional git integration commits and pushes every change back to your vault's repository. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

PdfDing turns a scattered folder of PDFs into a proper library you can read, annotate, sign, and share from any browser. The viewer remembers exactly where you stopped in every document, so a manual opened on your desktop resumes mid-page on your phone, and progress bars in the library show how far you have read at a glance. Workspaces and collections group related documents, multi-level tags classify them, and starring, archiving, and bulk actions keep even a large archive tidy. Inside the viewer you can add text, highlights, and freehand drawings, then review and export your highlights and comments from dedicated sections and attach Markdown notes to a document. A signature you create once is stored on your server and waits for you on every device, ready to drop onto contracts and forms. Sharing a collection or a single PDF takes a link or a QR code, with optional access control over who can open it and for how long. Accounts are protected by OIDC single sign-on and two-factor authentication with TOTP or WebAuthn, and dark mode, an inverted color mode, and multiple layouts keep long reading sessions comfortable. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

AnyCable moves your WebSocket connections out of your application process and into a dedicated realtime server, so live chat, presence, and notifications keep flowing while your app code focuses on business logic. Rails teams feel it first: the Action Cable channels, subscriptions, and broadcasts already in production keep working unchanged once the endpoint points at AnyCable, which handles authentication, subscriptions, and connection churn by calling back into your application over RPC only when channel code needs to run. Anything that can send an HTTP request can publish to connected clients, and teams outside Rails use standalone mode from Node, Python, Go, or PHP services, including Laravel applications looking for a Reverb or Pusher replacement. Broadcast traffic arrives through Redis Pub/Sub, durable Redis Streams, or the HTTP API, so background jobs and other services push messages without holding a single socket open. Operators watch connected clients, broadcast volume, and RPC failures through Prometheus metrics, and can disconnect remote clients or inspect active streams without a restart. Signed-in users stay safe because every connection request passes through your existing authentication before the server accepts it. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Mercure is a realtime hub that pushes updates from your backend straight to browsers over Server-Sent Events, so live dashboards, chat rooms, and activity feeds refresh the moment data changes. Subscribers connect through the browser's built-in EventSource API and choose topics with exact matchers for single resources or URL Pattern matchers for whole families such as /books/:id. Publishers send one form-encoded POST to the hub endpoint, and Mercure fans each update out to every matching connection instantly. JWT access tokens grant publish and subscribe rights topic by topic, so private updates reach only entitled clients while public topics can stay open to anonymous subscribers. If a connection drops, the client reconnects with its last event ID and Mercure replays the updates it missed from stored history. Subscription events announce every arrival and departure, so your application gets live presence and a current list of who is connected. A built-in debug UI shows messages flowing through the hub alongside active subscriptions, turning realtime bugs into something you can watch happen. Optional end-to-end encryption protects sensitive payloads, and any backend able to send an HTTP POST can publish, whatever language it runs. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Running a proper mail server used to mean stitching together half a dozen daemons; maddy folds the whole stack into one binary with one configuration file. It receives mail as your MX, sends as your MTA, stores messages for IMAP clients, and signs and verifies with DKIM, SPF, DMARC, DANE, and MTA-STS so other servers actually trust what you send. The design is composable: checks, modifiers, tables, and delivery targets snap together in the config, so spam scoring, address rewriting, and routing rules read like a pipeline instead of a pile of interlocking config files. Outbound mail queues with retries and backoff, inbound delivery lands in IMAP storage backed by SQLite or PostgreSQL, and a built-in ACME client keeps TLS certificates renewed, including DNS-01 providers. Milter support lets existing filters join the pipeline, authentication spans SASL mechanisms and Dovecot delegation, and Prometheus metrics watch queue length and delivery health from your usual dashboards. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

AI and API products live or die by usage, and OpenMeter is the open-source stack that measures it, rations it, and bills for it. Your application emits CloudEvents for every billable action; OpenMeter validates and deduplicates them, then aggregates usage in real time so dashboards and enforcement checks never wait for a nightly batch. Meters slice that usage by customer, time window, or any dimension you attach, which turns raw events into answers like tokens per workspace this month. Entitlements decide who gets what: metered allowances with balances and overage, boolean switches for features like SSO, and static JSON configuration for per-customer model access. Grants top allowances up once or on a schedule, resets roll balances over each usage period, and one API call tells your app whether a customer still has access right now. On the money side, plans carry flat, per-unit, tiered, package, or dynamic prices; subscriptions, credit balances, and the invoice lifecycle run alongside, with webhooks announcing everything to your other systems. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Think of Zot as the registry equivalent of a well-run warehouse: OCI images and artifacts come in, get cataloged, checked, and shipped back out to any compliant client. The bundled web interface lets you browse repositories and tags, inspect image details, and copy ready-made pull commands for Docker, Podman, and Skopeo instead of memorizing registry URLs. Sync extensions mirror upstream registries such as Docker Hub on a schedule or on demand, which keeps air-gapped and rate-limited environments supplied without manual image ferrying. Scrubbing walks the storage in the background comparing blocks against their SHA-256 checksums, so silent bit-rot gets caught by the registry instead of by a failed production deploy. Signature verification with Cosign and Notation checks that images came from who they claim, search answers queries across the catalog, and CVE scanning flags vulnerable images before they spread. Prometheus metrics, a management API, and webhook events cover the operations side, while the minimal image strips everything but the distribution spec for embedded or high-security deployments. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

One OpenAI-compatible endpoint, 1,600+ models behind it: Portkey Gateway sits between your app and every major LLM provider, deciding in real time where each request should go. When a provider times out or returns errors, automatic retries with exponential backoff kick in, and fallback rules quietly move traffic to your second-choice model before users notice anything. Load balancing spreads calls across multiple API keys and providers by weight, conditional routing sends each request down a different path based on its content or metadata, and per-request timeouts cut off providers that hang. Guardrails inspect inputs and outputs as traffic passes through: block banned words, screen for sensitive content, and enforce the checks your compliance team asked for, with dozens of pre-built rules ready to attach. Text is only the start: the same API shape reaches vision models, speech-to-text, text-to-speech, image generation, and realtime websocket APIs, so multimodal features stop multiplying your integration work. Routing policies live in JSON configs you attach per request or per client, which means experiments, cost controls, and provider migrations ship as configuration changes, not redeploys. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Picture your object storage scattered across a home server, a friend's rack, and a cheap VPS in another country, still answering S3 requests like nothing happened: that is exactly the deployment Garage was built for. Every object is replicated to three zones, so losing a node, a disk, or an entire site degrades the cluster instead of destroying your data. Applications talk to it with the standard S3 API: create buckets, upload objects in multiple parts, list and copy them, and hand out access keys that are scoped per bucket. A separate web endpoint serves static websites straight from buckets with CORS support, which covers personal sites, documentation, and release downloads without another server in the chain. The whole system ships as one dependency-free binary that asks for about a gigabyte of RAM and any x86-64 or ARM CPU from the last decade, second-hand hardware very much included. There is deliberately no consensus protocol to babysit: nodes gossip their cluster layout, tolerate 200-millisecond links, and keep serving reads while parts of the fleet are unreachable. Deuxfleurs runs it in production for their own hosting, and common pairings include restic or rclone backup targets, Matrix media storage, and Nix binary caches. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

FerretDB gives you the MongoDB developer experience without the SSPL: point your existing drivers at it and your document workloads land in PostgreSQL instead. It listens on the standard MongoDB port and translates wire-protocol queries into SQL, so applications, ORMs, and command-line tools connect unchanged, none the wiser. CRUD operations, aggregation pipelines, index creation, findAndModify, and sessions all work today, with new commands landing release after release as compatibility widens. Behind the proxy, Microsoft's open-source DocumentDB extension gives PostgreSQL a native BSON type and document operators, which is also the engine under Azure Cosmos DB for MongoDB vCore. That shared engine means workloads can move between your own FerretDB deployment and Cosmos DB without an export-import project in between. Vector search support covers embedding lookups for AI features, replication covers high availability, and SCRAM-SHA-256 authentication secures connections the way MongoDB operators already expect. Because the license is Apache 2.0, you can embed it, resell it, or offer it as a managed service to your own customers with no SSPL obligations attached. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.