Algo VPN is a deployment tool that automates the setup of a personal VPN server on cloud providers or local Ubuntu machines. It uses Ansible to provision a hardened server running strongSwan (IKEv2/IPsec) and WireGuard, with optional DNS encryption via dnscrypt-proxy and privacy enhancements like log rotation and history clearing. The architecture is a set of Ansible playbooks and roles, orchestrated by a shell script entry point (`algo`) that invokes `ansible-playbook`. Cloud provisioning is handled by provider-specific roles (AWS EC2, DigitalOcean, Azure, GCE, etc.), while server configuration roles handle system hardening, PKI certificate generation, VPN service configuration, and client profile generation (mobileconfig, WireGuard .conf, QR codes). The system is designed for security and privacy: it uses strong crypto defaults (ECC secp384r1), minimal logging, and unattended upgrades. External dependencies include Ansible, community.crypto collection, cloud provider SDKs, and the dnscrypt-proxy package. The primary data flow is: user edits `config.cfg` → Ansible playbook runs → cloud VM is created → server is configured with VPN services → client configuration files are generated and stored locally. User management (add/revoke) is handled by a separate playbook. The repository includes extensive unit, integration, and end-to-end tests, with Docker-based integration testing and CI/CD via GitHub Actions.
p2panda is a modular Rust framework for building privacy-respecting, local-first peer-to-peer applications. It provides a complete stack including core data types (append-only logs, CRDT-friendly operations), networking (QUIC via iroh, gossip via HyParView, mDNS, confidential discovery), storage (trait-based with SQLite backend), sync protocols (log sync, topic handshake), encryption (group and two-party schemes with forward secrecy), authentication (decentralized group CRDT with fine-grained permissions), and event stream processing (ingest, causal ordering, pruning, spaces). The architecture is actor-based (ractor) with supervision trees, trait-based abstractions for pluggability, and a pipeline processor for composable event handling. It is under active development (pre-1.0) with frequent releases and extensive CI, but contains some unfinished features and TODO comments. The codebase demonstrates high craftsmanship with clean abstractions, pure functional state updates in encryption, and reusable patterns like the processor pipeline, causal orderer, and deduplication buffer.
This is a Laravel package that provides a robust, extensible system for storing and retrieving application settings in a database. It supports multiple drivers (database, Eloquent), caching with configurable TTL, encryption of sensitive values, team/multi-tenancy scoping, and contextual settings via a Context object. The architecture is clean: a main Settings service class uses traits for cross-cutting concerns (caching, encryption, teams, context, serializers) and delegates persistence to pluggable drivers. Key generators and value/context serializers are also pluggable via contracts. The package includes a facade, helper function, and model trait for easy integration. It is actively maintained, supports Laravel 12/13 and PHP 8.2-8.5, and has comprehensive test coverage. The code demonstrates good software engineering practices with clear interfaces, separation of concerns, and extensibility.
LocalSend is a free, open-source, cross-platform application for secure local file sharing over a local network without internet access. It supports Android, iOS, macOS, Windows, Linux, and a CLI, using a combination of Flutter for the UI and Rust for performance-critical networking, cryptography, and file transfer logic. The architecture is modular: a core Rust library (`packages/core`) implements the LocalSend protocol (v2/v3) with HTTP/HTTPS, multicast discovery, WebRTC, and TLS encryption; a Flutter app provides the graphical interface with state management via Refena (Redux-like) and i18n support for 50+ languages; and a separate CLI and WebRTC signaling server are also included. The app features device discovery, file/message transfer with progress tracking, PIN protection, checksum verification, quick-save, receive history, and a web share mode that allows browser-based downloads/uploads. The codebase demonstrates high craftsmanship with clean separation of concerns, extensive integration tests, and reusable patterns such as typed isolate communication, custom DNS resolution for IPv6 scoped addresses, and connection rate limiting.
Infisical is an open-source end-to-end encrypted secrets management platform used to centralize, secure, and sync secrets across teams and infrastructure. The codebase is structured as a multi-service application with a primary Node.js/TypeScript backend (REST API using Fastify) and a newer Go backend implementing core platform services (authentication, permission evaluation, KMS, audit logging, secret manager). The frontend is a React SPA built with Vite and TanStack Router. The system supports self-hosted (Docker, Helm) and cloud-deployed modes. It provides a rich set of capabilities including dynamic secrets, secret rotation, approval workflows, machine identity federation (AWS, Azure, GCP, Kubernetes, OIDC), PKI management (internal and external CAs), privileged access management (PAM), secret scanning, audit logging, and extensive integration syncs. The architecture follows a modular service-oriented pattern with clear separation of concerns, extensive use of dependency injection and factory patterns for extensibility.
This repository is a browser extension for generating two-factor authentication (2FA) TOTP and HOTP codes. It allows users to securely store account secrets (optionally encrypted with a passphrase), generate codes for login, and provides features such as autofill into web pages, cloud backups (Dropbox, Google Drive, OneDrive), and synchronization across browsers. The extension is built with TypeScript and Vue 2.x, using Webpack for bundling and Vuex for state management. It supports multiple browsers (Chrome, Firefox, Edge) and manifests for Manifest V3. The architecture consists of a background service worker (for handling events and cloud sync), a popup UI (for displaying codes and managing accounts), an options page (for settings), content scripts (for autofill and QR code scanning), and an import page. Data flows involve storing encrypted account secrets in browser storage, generating OTPs from these secrets, and securely backing up and restoring data via cloud services or encrypted files. External dependencies include browser APIs, cloud service APIs (OAuth), and cryptographic libraries (argon2-browser, crypto-js, node-gost-crypto). The codebase demonstrates good engineering practices with clear separation of concerns, reusable abstractions for encryption and storage, and a modular structure for UI components and cloud backup providers. It includes internationalization support, a security advisor for recommendations, and a test suite (unit and end-to-end). While the project faces some technical debt due to its reliance on Vue 2.x and complex backup integrations, it remains actively maintained and functional.
Bouncy Castle for .NET is a comprehensive, production-grade cryptographic library providing implementations of a vast range of symmetric and asymmetric ciphers, hash functions, message authentication codes, digital signatures, key agreement protocols, key encapsulation mechanisms (including post-quantum schemes like ML-KEM, ML-DSA, SLH-DSA), secure random number generation (NIST SP 800-90A DRBG), and ASN.1 encoding/decoding (DER, BER, DL). It supports high-level protocol implementations for TLS/DTLS (client and server, including PSK, SRP, and post-quantum key exchange), OpenPGP (RFC 4880/9580), CMS (Cryptographic Message Syntax), CMP, CRMF, OCSP, TSP, and X.509 certificate generation and validation. The library is designed as a class library with a monolithic architecture organized into namespaces (Org.BouncyCastle.Crypto, .Asn1, .Tls, .Bcpg, .Cms, etc.), exposing both low-level primitives and high-level builders. It targets multiple .NET runtimes with conditional compilation for hardware intrinsics (AES-NI, PCLMULQDQ, SSE/AVX) and Span<T> support. The codebase is actively maintained, with ongoing migration from older algorithm names (e.g., Dilithium → ML-DSA) and extensive use of factory patterns and interface-based abstractions, making it a solid foundation for secure application development.
This repository is Confluent's official JavaScript client for Apache Kafka, wrapping the high-performance C library librdkafka via native Node.js addons. It provides two API surfaces: a legacy callback-based API (node-rdkafka) and a modern promisified API compatible with the popular KafkaJS library. The client supports all core Kafka operations: producing and consuming messages (including transactional and exactly-once semantics), admin operations (topic management, consumer groups, offsets), and stream-based interfaces. Additionally, it includes a full Schema Registry client (TypeScript) with serializers/deserializers for Avro, JSON Schema, and Protobuf, along with a rule execution engine supporting CEL (Common Expression Language), JSONata, and field-level encryption via pluggable KMS drivers (AWS, GCP, Azure, HashiCorp Vault, local). The architecture is layered: a C++ binding layer handles the Kafka protocol, while pure JavaScript/TypeScript implements schema management, rule evaluation, and encryption. Key entry points are `lib/index.js` (node-rdkafka), `lib/kafkajs/index.js` (KafkaJS), and `schemaregistry/index.ts` (Schema Registry). External dependencies include librdkafka, protobuf, avsc, axios, and cloud KMS SDKs. The codebase is production-grade with extensive unit, integration, and e2e tests, performance benchmarks, and CI/CD pipelines across multiple platforms.
This repository provides a collection of shell scripts to automate the setup and management of an IPsec VPN server on Linux. It supports multiple VPN protocols (IPsec/L2TP, IPsec/XAuth, IKEv2) and a wide range of Linux distributions including Ubuntu, Debian, CentOS, Rocky Linux, AlmaLinux, Oracle Linux, and Alpine Linux. The main entry point is `vpnsetup.sh`, which detects the OS and runs the appropriate installer. The project also includes helper scripts for user management, IKEv2 certificate handling, upgrades, and uninstallation. Additionally, it offers an Azure ARM template for cloud deployment. The code is well-structured with OS-specific installers, common bash utility functions, and extensive documentation in multiple languages. It is a mature, widely-used DevOps tool for system administrators.
Twine is a PHP string manipulation library providing an expressive, fluent object-oriented interface. It wraps a string in a `Str` object and offers methods for transformation, encoding, encryption, hashing, comparison, case conversion, and more. The library leverages PHP 8.1 features like enums for configuration and relies on the Multibyte String extension for Unicode support and OpenSSL for encryption. The architecture is a monolith single class using traits to organize functionality, with factory methods and a global helper for easy instantiation. The primary entry point is the `PHLAK\Twine\Str` class, which can be created via constructor, static `make()`, or the `str()` helper. Data flows are method chaining; most methods return new `Str` instances to maintain immutability. External dependencies are limited to PHP extensions (mbstring, openssl). The test suite is comprehensive with high coverage. The library is well-documented with a VitePress documentation site.
govcr is a Go library that records and replays HTTP/HTTPS interactions for testing purposes, acting as an HTTP mock. It wraps an http.Client to intercept requests, either playing back recorded responses from cassette files (JSON) or making live requests and recording them. The library supports various modes (normal, live-only, offline, read-only), cassette encryption (AES-GCM, ChaCha20Poly1305), multiple storage backends (local filesystem, AWS S3), flexible request matching, and request/response transformation via mutators. The architecture centers around a custom http.RoundTripper implementation that integrates cassette storage, request matching, mutation systems, and encryption layers.
Ente is a multi-product, end-to-end encrypted cloud platform providing photo storage (Ente Photos), two-factor authentication (Ente Auth), secure document vault (Ente Locker), social photo sharing (Ente Space), AI chat assistant (Ente Ensu), ephemeral pastebin (Ente Paste), and media casting (Ente Cast). The system is built as a monorepo with a Go server backend, Rust core libraries for cryptography, machine learning, and media processing, and client applications across web (React/Next.js), mobile (Flutter, native Android/iOS), desktop (Electron), and CLI (Go and Rust). Architecture follows a zero-knowledge design: all encryption (XChaCha20-Poly1305, Argon2, X25519) happens client-side, with keys never exposed to the server. The server handles user accounts, file storage (S3-compatible), billing (Stripe), ML indexing, and sharing. Key entry points include the Go server at `server/cmd/museum`, Rust WASM bindings for web crypto, and Flutter apps with native plugins. Data flows involve client-side encryption before upload, server-side metadata storage in PostgreSQL, and decryption on download. External dependencies include PostgreSQL, S3-compatible object storage, Stripe, ONNX Runtime for ML, and various cloud infrastructure (Cloudflare Workers, Grafana, Prometheus).
Trice is an embedded logging and tracing toolchain consisting of a lightweight C instrumentation library for microcontrollers and a Go-based host CLI tool. The C library provides variadic macros that emit compact binary records (ID + values) instead of format strings, drastically reducing flash and bandwidth usage. The Go tool manages Trice IDs (insert, clean, bind), decodes incoming binary streams from targets over UART, RTT, TCP/UDP, or file, and displays formatted logs with timestamps, colors, and filtering. It supports multiple buffer strategies (stack, static, double, ring), framing protocols (COBS, TCOBS), optional XTEA encryption, and local logging on the target itself. The architecture is a classic host-target split: the target runs the C library, the host runs the Go CLI. The codebase is well-tested with a large matrix of CGO test configurations and CI pipelines for multiple STM32 example projects. It is actively maintained with frequent releases and a responsive issue tracker.
Jotty (formerly rwMarkable) is a full-stack, self-hosted productivity application for managing notes, checklists, and Kanban boards. It uses Next.js 16 (App Router), React 19, and TypeScript with a file-based storage system (Markdown files with YAML frontmatter). Key features include rich text editing (TipTap with custom extensions for diagrams, callouts, mentions), drag-and-drop (custom DnD engine for Kanban, @dnd-kit for checklists), user management with multiple authentication methods (local, LDAP, OIDC), MFA (TOTP), encryption (PGP, XChaCha20), granular sharing with permission inheritance, version history via Git, full-text search using grep, audit logging, and a PWA with offline support. The architecture is server-first with Next.js server actions for all mutations and a WebSocket broadcast for real-time updates. The codebase is well-organized with a clear separation of concerns: global UI components, feature-specific components, server actions, types, utilities, and hooks. It has extensive test coverage (Vitest) across server actions, API routes, utilities, and security. While file-based storage imposes scalability limitations, the application demonstrates high craftsmanship in its modular design, custom drag-and-drop implementation, encryption handling, and sharing system. It is actively maintained with regular releases and community contributions.
This repository is a mature Ruby gem (`pdf-reader`) that provides a comprehensive PDF parsing library. It implements a low-level PDF parser conforming to the PDF specification, enabling programmatic access to PDF content without rendering. The library supports text extraction (with UTF-8 conversion), metadata retrieval, page geometry, font handling (Type1, TrueType, Type3, CID), encryption (RC4, AES), and various PDF features like Form XObjects, inline images, and content stream processing. It is designed for document processing, text mining, and automated analysis of PDF files. The architecture follows a receiver/callback pattern for processing content streams, with `PDF::Reader` as the main entry point. Key modules include `PDF::Reader::Page` for high-level page access, `PDF::Reader::ObjectHash` for low-level object access, `PDF::Reader::Parser` for tokenization, and `PDF::Reader::Filter` for stream decompression. The library uses Sorbet for static type checking and includes a comprehensive test suite with over 120 spec files and numerous real-world PDF test fixtures. The codebase demonstrates solid engineering practices: clean abstractions (value objects like `Point`, `Rectangle`, `TextRun`), thread-safe caching (`SynchronizedCache`), optimized matrix operations (`TransformationMatrix`), and a pluggable width calculator system. It is actively maintained with support for multiple Ruby versions (2.1–4.0, JRuby, TruffleRuby) and has a well-documented changelog spanning over a decade of development.
Pluton is a self-hosted, open-source backup application that wraps restic and rclone to provide scheduled, encrypted backups to a wide variety of cloud and local storage providers. The system is built as a full-stack monorepo with a Node.js/Express backend (TypeScript) and a React frontend (Vite), communicating via REST APIs. It manages backup plans, devices, storage locations, and restore operations through a web dashboard, with support for replication, retention policies, integrity checks, and multi-channel notifications (email, Slack, Discord, push). The architecture follows a layered pattern: controllers handle HTTP requests, services orchestrate business logic, stores encapsulate database access (SQLite via Drizzle ORM), and managers/strategies handle execution of backup, restore, and system operations using restic and rclone as child processes. A job queue with cron scheduling drives automated backups, and event emitters decouple progress tracking and notification dispatch. The frontend provides a rich UI with virtualized file browsers, snapshot viewers, and step-by-step wizards for plan creation and restore. The codebase is well-structured with extensive unit tests, CI/CD pipelines, and cross-platform installers (Docker, Linux AppImage, macOS, Windows).
FreakWAN is a LoRa-based wide-area network (WAN) messaging system designed for ESP32 and T-ECHO devices. It implements a fully distributed, open chat network independent of internet or cellular infrastructure. The system supports plaintext and encrypted messaging, group chats, media sharing (small images), sensor data collection, and includes features like duty cycle tracking, automatic retransmission with ACK suppression, and neighborhood discovery via HELLO messages. The codebase is written in MicroPython (with a C port for T-ECHO) and is entirely self-contained, relying only on standard libraries. Architecturally, the application runs as a single asyncio event loop with multiple tasks for periodic message sending, HELLO advertising, serial input handling, and optional IRC/Telegram bot integration. The radio layer is abstracted behind SX1276 and SX1262 drivers, and the display uses a terminal-like Scroller view with splash screen and status icons. The protocol layer defines message types (Data, Ack, Hello, Ping, Pong) and supports encryption via AES-CBC with HMAC integrity. The repository is well-structured, with clear separation of concerns and reusable components that can be extracted for other projects.
Themis is a cross-platform cryptographic library developed by Cossack Labs, providing high-level security primitives such as Secure Cell (symmetric encryption with three modes: Seal, Token Protect, Context Imprint), Secure Message (asymmetric encryption and digital signing), Secure Session (mutual authentication and key exchange), Secure Comparator (zero-knowledge password comparison), and key generation (EC, RSA, symmetric). The core is implemented in C with a cryptographic engine abstraction layer (Soter) that supports OpenSSL, BoringSSL, and a custom Ed25519 implementation. The library exposes consistent APIs across 13+ language wrappers including Python, Go, Rust, Java, Swift, Objective-C, JavaScript (Node.js and WebAssembly), PHP, Ruby, C++, and React Native. The codebase is well-structured with extensive unit, integration, and fuzz testing, CI/CD pipelines for each wrapper, and cross-language compatibility tests. While the repository has deprecated older APIs and maintains multiple backends, it remains actively maintained with regular releases, security patches, and community engagement.
enject is a security-focused CLI tool that prevents AI agents and other processes from reading secrets out of `.env` files. It stores secrets in an encrypted local store (AES-256-GCM with Argon2id key derivation) and injects them into subprocess environments at runtime. The `.env` file on disk contains only `en://` symbolic references, never plaintext values. The tool provides commands to initialize a store, add/update/list/delete secrets, import a plaintext `.env` file (encrypting all values and rewriting it as a template), rotate the master password, and run a subprocess with resolved environment variables. The architecture is a single Rust binary with a clean `Store` trait abstraction separating the encryption backend from command logic. The codebase demonstrates strong security practices: secrets never touch disk as plaintext, nonces are freshly generated on every write, key material is zeroized immediately after use, and unresolved references cause hard errors. It includes comprehensive unit tests and a CI pipeline with linting, formatting, and security auditing.
This repository implements a Linux desktop GUI for managing WireGuard VPN profiles. It is built using the Tauri v2 framework, combining a Rust backend for system-level operations (connection management, encryption, file I/O) with a Next.js 16 (React 19) frontend for the user interface. The application allows users to create, import, export, connect, and disconnect WireGuard tunnels, and provides optional at-rest encryption for profile data using a user-defined PIN. The architecture follows a clean IPC-based separation of concerns. The frontend communicates with the Rust backend exclusively through typed Tauri commands defined in `lib/effects.ts`. The backend in `src-tauri/src/main.rs` manages application state, executes WireGuard commands via shell scripts (`wg.sh`), and handles encryption via a dedicated security module. The UI is built from a comprehensive library of ~40+ composable, accessible components in `components/ui/`, demonstrating a strong commitment to frontend architecture and design system principles. The most reusable assets are the Rust security module (`security.rs`), which implements PIN-based encryption using Argon2id and XChaCha20-Poly1305 in a self-contained manner, and the typed IPC service layer (`lib/effects.ts`), which cleanly decouples the UI from the backend. The UI component library, while styled for this project, follows an architectural pattern (atomic, composable primitives) that is directly transferable to other React projects. The project is actively maintained with CI/CD, E2E testing, and semantic versioning, though it carries some technical drift in its Nix build configuration (targeting Tauri v1) and deprecated plugin permissions.