Starred by over 6,500 users on GitHub and trusted by organizations including Toyota, CTFd has been the leading open-source platform for hosting cybersecurity competitions since 2015, providing everything needed to run professional Capture The Flag events through a clean web-based administration panel without touching a database query. The framework supports both individual and team-based competitions with automatic tie resolution, configurable score freezing, and scoregraphs comparing the top teams with detailed progress tracking. Challenge creation offers static and regex-based flags, dynamic scoring that adjusts point values based on solve count, unlockable hints purchasable with points, file attachments uploaded to local storage or Amazon S3-compatible backends, and challenge attempt limits with automatic bruteforce protection. Version 3.8 introduced challenge logic fields controlling flag submission behavior with any, all, and team modes, integrated dynamic scoring into the standard challenge type, participant ratings and reviews on challenges, and admin-stored challenge solutions viewable after competition. The Markdown-based content management system enables custom pages for rules, FAQs, and resources, while SMTP and Mailgun integration handles email confirmation and password recovery. The plugin architecture supports custom challenge types, flag validators, and scoring algorithms, while the theme system provides complete visual customization. Import and export functionality preserves entire competition configurations for archival and reuse across events. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Keystone turns TypeScript schema definitions into a complete GraphQL API and React Admin UI automatically, eliminating the gap between data modeling and application scaffolding. Nearly 10,000 GitHub stars and over 270 contributors across a decade of development back a framework where list definitions map directly to Prisma models on PostgreSQL or SQLite, generating database migrations and exposing every field relationship through Apollo Server's GraphQL endpoint. Granular access control operates at the list, field, and operation level with filter-based restrictions that limit which records users can see, create, update, or delete based on session data and custom logic. The document field provides a structured WYSIWYG editor with content blocks, inline relationships, and custom React components that render consistently across the Admin UI and frontend applications. Event hooks fire before and after create, update, and delete operations for validation, side effects, and external service integration. Custom GraphQL queries and mutations extend the API beyond auto-generated CRUD for bespoke business logic. The Admin UI built with Next.js and the Keystar UI component library supports custom pages, branded navigation, and internationalized interfaces. OpenTelemetry tracing provides observability into operations, queries, and hook execution. Deploys via Docker or any Node.js host with Prisma managing schema evolution. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

More than 70 automated checks sniff out broken links, redirect chains, and missing meta tags across your whole site, and SEOnaut, the self-hosted SEO audit crawler, sorts every finding into critical, alert, or warning so you know what to fix first. Add a website as a project, press Crawl Now, and watch URLs stream in with their status codes; a Stop button ends any run that wanders off. Reports also cover duplicate titles and descriptions, heading order, hreflang, canonicals, image alt text, thin content, orphan pages, and non-HTTPS URLs, while a passed-checks list shows what is already healthy. Dashboard charts follow crawl history, issue trends, status codes, link types, and page depth. Crawl options are set per project: ignore robots.txt, follow nofollow links, include noindex pages, read the sitemap, allow subdomains, check external links, or authenticate with HTTP Basic to audit a password-protected staging site. Page Details opens any URL with its inlinks, outgoing links, redirections, and images, and URL Explorer searches the crawled pages by term. Export sitemap.xml, CSV lists, or a replayable WACZ archive. Each person picks a light or dark theme and one of five interface languages. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Unlimited domains, unlimited keywords, daily Google position checks with stored history and trend charts: SerpBear is an open-source search engine rank tracker. Retrieval works through your choice of third-party SERP APIs - ScrapingAnt, ScrapingRobot, SerpApi, SearchApi, HasData - or your own proxy IP pool, and a flexible scrape-strategy system (Basic, Custom, or Smart, set globally or per domain) works around Google's removal of the 100-results-per-page parameter by choosing how many pages to check per keyword. Google Search Console integration adds real visit counts, impressions, and click-through rates per tracked keyword and surfaces top-performing pages and countries; Google Ads integration supplies monthly search volumes and auto-generates keyword ideas from your site's content. Email notifications report position changes daily, weekly, or monthly, a built-in REST API feeds dashboards and reporting tools, and data exports to CSV. Built with Next.js on SQLite, deployed via Docker, installable as a PWA on mobile - with no per-keyword or monthly SaaS fees.

A federated bookmark manager written in Rust: Ties (formerly linkblocks) is your own small corner of the web for saving, organizing, and sharing good pages, connected to the fediverse over ActivityPub. Instead of rigid folders, bookmarks live in arbitrarily nested lists that link together into a knowledge graph. Saved pages are fetched, converted to a readable archived version, and stored in the database, so full-text search covers titles, URLs, and the actual page text - and the content survives if the original disappears. The federation model is deliberately anti-viral: there is no global timeline and no algorithmic feed. You publish public lists for anyone, follow users whose taste you trust, and mark trusted users whose bookmarks become part of your search range - extendable to trusted-users-of-trusted-users for a wider net. Public bookmarks post to Mastodon timelines, and WebFinger lookup makes your handle discoverable across fediverse platforms. Operationally it is about as light as web software gets: a single binary with all assets baked in, integrated TLS so it can run without a reverse proxy, PostgreSQL as the only dependency, OIDC single sign-on, and a bookmarklet for one-click saves. Note the project is alpha: single-user instances only, and all data should be considered public. AGPL-3.0 licensed, built with Rust and htmx.

If your money is split across a bank app, a brokerage portal, and a half-abandoned spreadsheet, YAFFA, a self-hosted personal finance application, gathers it into one ledger with budgets, scheduled transactions, and forecasts. Record withdrawals, deposits, and transfers across unlimited accounts, and split a single supermarket receipt across categories so it lands in both Food and Household. Suggestions surface your most-used accounts and payees, and each payee's default category fills in automatically. Define rent, salary, or a loan payment once as a scheduled transaction; it appears on the dashboard calendar, enters with one action or records itself, and feeds the forecast. Import bank history from CSV or QIF files with rules for country- and bank-specific formats, and review every row before it is recorded. Optional AI document processing turns a receipt, invoice, or forwarded email into a draft transaction with payee, date, amount, and line items, using your own OpenAI or Gemini key and self-hosted Tesseract OCR for images. Accounts in different currencies roll up into your default currency using daily rates from the free Frankfurter service. Investments track gain and loss, with optional daily prices from Alpha Vantage. The dashboard summarizes accounts and upcoming schedules, the cash flow report can look ahead with a forecast, and Find Transactions filters history by payee, category, tag, or date. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 400 GitHub stars and growing, Pythia transforms a local LLM into a self-calibrating geopolitical oracle that watches the entire planet and predicts what happens next — no API keys, no cloud, no cost. The Osiris-based Three.js globe frontend streams 30+ concurrent live feeds including GDELT geopolitics, armed conflict events, USGS earthquakes, NWS storm polygons, EONET disasters, FIRMS wildfires, Polymarket crowd odds, cryptocurrency and commodity prices, UNHCR displacement data, WHO disease outbreaks, and WFP food insecurity indicators. The FastAPI backend fuses these heterogeneous sources into a unified world brief, pipes it through Ollama, and generates located predictions across 24-hour, weekly, monthly, and yearly horizons — each carrying a probability, reasoning, and geocoordinates that fly the globe to the event. A council of four specialist swarm agents — Strategist, Economist, Naturalist, and Skeptic — re-scores every forecast, surfacing consensus, dissent, and splits through Brier-weighted voting where historically accurate personas earn louder votes. The engine maintains a persistent ledger graded by an LLM judge against archived world state, producing running Brier scores and calibration charts. Signal rules fire browser notifications and webhooks when conditions match, a morning brief digest summarizes overnight changes, and the agent API at port 8088 delivers the complete world view in a single JSON call compressed to approximately 50 tokens for AI agent consumption. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

CrowdSec Web UI provides a centralized web console for monitoring intrusion detection telemetry, managing firewall remediation decisions, and auditing security events across multiple CrowdSec security engines. Administrators can connect several CrowdSec Local API endpoints simultaneously, aggregating threat intelligence and active bans into a unified visual interface. The dashboard displays geographic origins of attacking IP addresses, active remediation durations, and specific scenario triggers such as brute-force authentication attacks or web vulnerability probes. Operators can search through historical alert logs, inspect raw HTTP request details, and drill down into individual IP behaviors to differentiate authentic threats from false positives. Manual intervention tools let security teams enforce custom IP bans, adjust expiration timers, or immediately revoke erroneous bans across all connected bouncers with a single click. Integrated notification pipelines dispatch real-time security alerts to external destinations including ntfy, Gotify, and MQTT message brokers whenever critical thresholds are breached. Built-in Prometheus metrics dashboards visualize processing latencies, parser throughput, and decision counts over customizable time windows. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

HyperDX correlates logs, metrics, traces, session replays, and errors in a single interface so engineers can resolve production incidents in minutes instead of hours. Nearly 10,000 GitHub stars reflect its role as the integrated UI layer for the ClickStack blueprint endorsed by ClickHouse. The platform connects to any ClickHouse cluster as its storage backend, working with existing table structures without requiring data migration or proprietary ingestion formats. An intuitive Lucene-like search syntax supports full-text queries and property filtering like level:err or service.name:api without needing SQL, while native JSON string querying and event delta analysis surface anomalies in high-cardinality datasets. One-click cross-signal correlation lets you jump from a log line to its distributed trace, from a slow span to associated logs, or from a frontend session replay to the backend errors it triggered. The OpenTelemetry Collector accepts telemetry via OTLP on gRPC port 4317 and HTTP port 4318, supporting automatic instrumentation for Node.js, Python, Java, Go, Ruby, and browser applications. APM tracks HTTP request latency, database query duration, and external service calls with trace waterfall visualizations. Configurable alerts trigger via webhook, Slack, PagerDuty, or email when thresholds are breached. Deploys via Docker Compose with ClickHouse, MongoDB, Redis, and the OpenTelemetry Collector. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

If your books live in a plain-text Beancount ledger, Fava turns that file into a browsable dashboard of statements, charts, and a built-in editor. Income Statement, Balance Sheet, Trial Balance, Journal, Holdings, and Statistics reports render as tables and charts, with stacked or single bars, monthly breakdowns, and at-cost conversion. Three top-bar filters narrow every report. Match by date, account pattern, #tag, ^link, payee, metadata, or amount; spaces require all conditions, commas accept any. The Query page runs Beancount Query Language statements like bean-query. Two-column results become line or treemap charts, and every result exports to CSV, plus XLSX and ODS with the Excel extra. The browser editor autocompletes accounts, payees, and tags. Press n for a quick-add form that records a new transaction. Drag a receipt onto an account name to file it in that account's documents folder, or onto a Journal row to attach it to the transaction. Budget directives from daily to yearly show remaining amounts in charts and reports. Colored indicators flag passed or failed balance checks on opted-in accounts. Importers feed a review list; extensions add custom report pages. Gmail-style keyboard shortcuts speed up daily use. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Software makers who would rather not rent a licensing backend use Keygate to issue, sell, and enforce license keys from infrastructure they control. You create desktop, SaaS, or hybrid products and sell them as subscriptions, perpetual licenses, perpetual licenses with a maintenance period, trials, or floating concurrent licenses that are checked out, heartbeated, and returned automatically. The admin dashboard manages products, plans, customers, licenses, API keys, webhooks, analytics, audit logs, team members, email templates, and branding, with search, filters, and CSV or JSON export. Your application activates and verifies keys through the license API, enforces per-device or per-user activation limits with grace periods, and can verify Ed25519 signed tokens offline with a public key. Usage metering tracks API calls, storage, bandwidth, or custom metrics against quotas with hourly, daily, monthly, or yearly reset cycles and webhook threshold warnings. Connecting Stripe makes checkout create licenses automatically, follows plan and seat changes with proration, handles refunds and cancellations, sends dunning emails after failed payments, and gives customers a billing portal and self-service license management. Team seats, feature entitlements, purchasable add-ons, scoped API keys, and optional S3-backed release hosting round out the selling stack in one binary with one PostgreSQL database. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

To uncover deep viewing insights and AI-powered content recommendations across your self-hosted Jellyfin media server, Streamystats delivers a comprehensive analytics and watch-history platform. Once connected to one or more Jellyfin instances using native MediaBrowser authentication, the dashboard tracks live playback sessions, per-user watch durations, device and client breakdowns, and library-wide growth metrics without requiring third-party reporting plugins. You can import existing historical logs from Jellystat or the Playback Reporting plugin so years of viewing habits carry over immediately, then explore interactive watch-time graphs, genre radar charts, actor and director leaderboards, and a yearly Wrapped summary. When you enable vector embeddings through OpenAI, OpenRouter, Google Gemini, Voyage AI, or a local Ollama model, the recommendation engine calculates cosine similarity against your watch history and explains exactly which watched movies or series inspired each suggestion. An integrated AI chat assistant equipped with thirteen specialized function-calling tools lets you search your catalog semantically, ask natural-language questions about your viewing statistics, and generate shared movie recommendations for multiple household members at once. Administrators can also mark titles as watched or unwatched with automatic watch-time inference, manage watchlists over an external API, and connect Janitorr for automated media cleanup. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Turn company knowledge into structured courses in minutes: ClassroomIO's AI course builder takes your documents, policies, or topic outlines and generates complete lessons with exercises using Gemini, GPT-4o, or Claude — then an in-lesson AI tutor helps employees study the material at their own pace. The SvelteKit 5 and Hono API architecture backs a platform purpose-built for employee compliance training, customer education, and partner certification programs. Programs group courses into cohorts with team management, progress tracking, and goal setting. Live Kahoot-style quizzes drive real-time engagement during training sessions with automatic scoring and leaderboards. Exercises support multiple question types with automatic grading for multiple choice and AI-assisted evaluation for open-ended responses — teachers review and override all AI decisions. Branded certificates with custom IDs reward course completion. Custom domain mapping through Cloudflare lets organizations serve their learning portal under their own brand. MinIO provides S3-compatible storage for documents and video uploads. The REST API and signed webhooks enable programmatic enrollment and completion tracking, while an MCP server on npm supports AI-native authoring workflows. An embeddable widget drops the course catalog onto any website. Better Auth handles sessions and OAuth with optional SSO. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Turn your scattered collection of liquor bottles and bar tools into a master mixology station with an intelligent digital cellar. Bar Assistant tracks your personal liquor cabinet, inventory levels, and available mixers against a catalog of more than 500 cocktail recipes. The platform calculates exact alcohol by volume ratings, computes ingredient costs per serving, and dynamically highlights every cocktail you can craft with on-hand supplies. Built-in recipe scrapers extract formula details, measurements, and glassware requirements directly from web links, JSON payloads, or YAML files. Multi-bar workspaces allow home mixologists and commercial venues to separate private collections from communal drink menus while handling complex ingredient substitutions, custom infusions, and shopping lists. Integrated Meilisearch indexing powers instant typo-tolerant searches across spirit categories, flavor tags, and cocktail strengths. Visual cocktail cards display high-resolution drink photography, user ratings, glassware requirements, and step-by-step garnish instructions. Deploy Bar Assistant on RepoCloud with dedicated VPS compute, full root SSH credentials, and in-browser console access, backed by an open-source MIT license.

RushDB is a database your AI agents can actually understand, because it remembers the shape of everything you write. Send nested JSON and each object becomes a record, automatically linked to its parent, while field names, types, and values are cataloged on every write. Agents introspect that catalog before querying, so they ask questions the data can answer instead of hallucinating tables that never existed. The same records answer five query styles: a JSON query language, SQL over the PostgreSQL wire protocol, Cypher over HTTP or Bolt, Gremlin, and Mongo-style document queries. Vector, full-text, and hybrid search run against the same store, so an agent can find the record that mentions a phrase and the records merely similar to it. Everything ships as one binary with one data directory, speaking HTTP on port 3000, PostgreSQL on 5432, and Bolt on 7687 to the drivers and tools you already use. Point your SDKs, SQL clients, BI tools, or local MCP-connected agents at it, and back it up, replicate it, or restore to a point in time with the engine's own tooling. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Every server, embedded board, and edge gateway you manage becomes reachable through one SSH address in ShellHub, even when it sits behind NAT with no public IP and no open inbound port. A small agent on each device dials out to your server, so a box on a customer LAN or a cellular link needs nothing beyond outbound web access. Connect with the stock ssh client by typing [email protected]@server, or open a terminal in the browser, and scp, sftp, rsync, and port forwarding work unchanged. SSH identities tie every key to a named team member, so removing someone ends their access on every device at once. Default-deny access policies grant or block members, roles, users, or API keys by device tag, Linux login, and source address, and can require a fresh browser confirmation before a session opens. Provisioning keys enroll whole fleets through automatic, manual, webhook, or allowlist acceptance, with usage limits, expiry dates, and tags. The Sessions page records who connected to which device, as which login, and from where, and browser terminals can be recorded and replayed. A Docker connector turns containers into devices that policies can grant one by one. Four member roles shape what each person can change, and the HTTP API, API keys, and an MCP server let scripts and AI assistants list devices and review sessions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

With over 3,600 GitHub stars and a philosophy of deliberate simplicity, OliveTin eliminates the need for SSH sessions, admin panels, and complex automation platforms by letting you define shell commands in a YAML config file and access them as clickable buttons through a clean browser interface. The Go binary consumes only a few megabytes of RAM, running on everything from tiny ARM and RISC-V devices through Linux VMs, containers, macOS, and Windows. Each button executes a predefined shell command with optional typed arguments that render as dropdowns, text fields, and validated inputs, preventing free-form command entry while giving users controlled access to server operations. Access control lists define exactly who can view or run each action — guests, family members, or junior administrators see only the buttons they are permitted to use. Entity templates generate actions dynamically from lists of hosts, containers, or other resources, creating one template that produces many buttons without manual duplication. Flexible triggers extend beyond browser clicks: cron schedules, webhooks, calendar file events, and filesystem watchers run actions automatically when conditions are met. Authentication supports OAuth2, JWT, and header-based methods for integration with reverse proxies and identity providers. Dashboards organize actions into folders and fieldsets for clear navigation across dozens of commands. No plugin system, no extension marketplace, no premium tiers — every feature ships in the single open-source release. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Think of Storyden as running your own small Reddit, except the knowledge your community produces does not scroll away and die in the feed. Discussion happens in threaded forums organized by categories and tags, where posts collect replies, likes, emoji reactions, and saves into personal collections. Beside the chatter sits the Library, a tree of rich pages your members build together into wikis, directories, catalogs, and guides that stay findable. Library pages carry typed properties, attached files, and table views, so a car club can track vehicles as data instead of arguing over a spreadsheet. Threads can reference Library pages and pages can link back to threads, letting a great answer graduate into permanent knowledge. Optional AI assistance helps organize titles, tags, and summaries, while the recommendation engine surfaces posts each member is likely to care about. The first account registered becomes admin, roles and permissions govern who can post or moderate, and community settings live in the admin panel rather than config files. One container starts everything with an embedded database and local file storage, and OpenAPI documentation is served from the same address. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MPL-2.0 licensed.