Huginn is a self-hosted, hackable automation platform built as a Ruby on Rails application. It allows users to create and chain 'agents' that monitor, scrape, transform, and act on data from hundreds of sources (web, RSS, email, Twitter, Telegram, Slack, OpenAI, etc.) via an event-driven architecture. Agents are polymorphic Ruby classes with a consistent lifecycle: scheduled checks, event reception, and event emission. The system supports Liquid templating for dynamic configuration, OAuth services, file pointers, and background job processing via DelayedJob. The codebase is extensive with 80+ agent types, reusable concerns (WebRequestConcern, LiquidInterpolatable, FormConfigurable), and a comprehensive test suite. While primarily an application, it includes a small research dataset (ANEW sentiment norms) used by a sentiment analysis agent, but the dominant character is clearly a production automation service.
Glances is a cross-platform, real-time system monitoring tool written in Python. It collects system metrics (CPU, memory, disk, network, processes, sensors, containers, GPU, NPU, etc.) via the `psutil` library and optional hardware-specific backends, and renders them through multiple interfaces: a curses-based terminal UI, a web UI (Vue.js + FastAPI REST API), a pure JSON/CSV stdout mode, a Model Context Protocol (MCP) server for AI assistant integration, and exports to 20+ time-series databases and message brokers (InfluxDB, Prometheus, Kafka, Elasticsearch, etc.). The architecture is modular and plugin-based: each metric domain is a self-contained plugin inheriting from a common base class, and each export target is a separate module. Glances can run standalone (local monitoring), in client/server mode (XML-RPC or REST), or as a central browser that discovers and displays multiple Glances instances via Zeroconf. The project is production-grade, with extensive test coverage, CI/CD across multiple OSes, Docker images, and active security maintenance. Its primary use case is real-time monitoring of single or distributed systems, with optional historical data export for long-term analysis.
InfluxDB 3 Core (IOx) is a production-grade, open-source time-series database written in Rust. It ingests data via line protocol (HTTP/gRPC), stores it in Apache Parquet on object storage (S3, Azure, GCP, local), and serves queries via SQL (DataFusion), InfluxQL, and FlightSQL. The architecture is a single binary (`influxdb3`) that combines an HTTP server (port 8181), gRPC FlightSQL endpoint, CLI, and an embedded Python processing engine for plugin-based triggers. The system is designed for low-latency last-value queries, high-throughput writes, and efficient columnar storage with catalog persistence as versioned binary logs and snapshots on object store. The codebase is a large Rust workspace (~40+ crates) with a clear separation of concerns: core libraries (`core/`) for query planning, Arrow utilities, authorization, and metrics; server crates (`influxdb3_*`) for catalog management, write buffering, processing engine, and system tables. Key entry points include `influxdb3/src/main.rs` (CLI), `influxdb3_server/src/unified_service/` (HTTP/gRPC routing), and `influxdb3_catalog/src/` (catalog operations). The query engine is built on a forked DataFusion with custom physical optimizers (gapfill, dedup, sort, union) and InfluxQL planning. External dependencies include object store backends, protobuf for gRPC, and Python (via PyO3) for plugins. The repository demonstrates high craftsmanship with several reusable patterns: a versioned binary record format for catalog persistence with forward-compatibility guarantees, a hook-based cache system with S3-FIFO eviction, a generic copy-on-write repository pattern, and a run-optimized merge sort for streaming sorted data. However, the large workspace, forked DataFusion pinned to a commit, and multiple catalog versions (v1–v4) introduce maintenance drift risks. The codebase is actively maintained with extensive tests, benchmarks, and CI/CD.
changedetection.io is a self-hosted web application for monitoring web pages for content changes. It periodically fetches URLs, computes diffs (text, JSON, image, or stock/price), and sends notifications via 100+ channels (Apprise). The system is built on Flask with Socket.IO for real-time UI updates, a pluggable processor architecture (text_json_diff, restock_diff, image_ssim_diff), and an LLM integration layer (via litellm) for intelligent change summarization and intent-based filtering. It supports multiple fetcher backends (requests, Playwright, Selenium, Puppeteer), browser automation steps, RSS feeds, and a REST API with OpenAPI spec. Architecturally, it is a monolith with background workers: a priority queue (RecheckPriorityQueue) dispatches watch rechecks to async workers, which fetch content, run processors, and trigger notifications. The datastore is file-based JSON with atomic writes and schema migrations. The frontend uses jQuery, SCSS, and custom JavaScript for diff visualization, visual selectors, and real-time queue monitoring. The plugin system (pluggy) allows extending fetchers, processors, conditions, and UI elements. Key entry points include the CLI (changedetection.py), the Flask app factory (flask_app.py), the worker pool (worker_pool.py), and the notification service (notification_service.py). External dependencies include Playwright, Apprise, litellm, lxml, and various image processing libraries (OpenCV, libvips). The codebase is well-tested with over 120 test files covering security, integration, and unit tests.
This is a Kubernetes operator that manages the lifecycle of Prometheus, Alertmanager, and related monitoring components (Thanos Ruler, Prometheus Agent) as Kubernetes native resources. It provides Custom Resource Definitions (CRDs) for declarative configuration and automates deployment, scaling, configuration generation, TLS management, and reconciliation. The operator ensures that Prometheus and Alertmanager instances are correctly configured, updated, and monitored within a Kubernetes cluster, handling tasks such as secret injection, config reloading, and pod repair. The architecture is a monolithic Go binary using the controller-runtime pattern. It includes multiple sub-components: an admission webhook for validation and mutation of CRDs, a prometheus-config-reloader sidecar for dynamic config reload, and a kubelet controller for node endpoint management. The codebase is heavily generated (client-go, apply configurations, informers) and relies on Kubernetes APIs, Prometheus/Alertmanager container images, and optional cloud SDKs (AWS, Azure) for service discovery. Key entry points are `cmd/operator/main.go` (main operator binary), `cmd/admission-webhook/main.go` (webhook server), and `cmd/prometheus-config-reloader/main.go` (config reloader). Data flows: users define CRDs → operator reconciles into StatefulSets/DaemonSets, generates Prometheus/Alertmanager config files with TLS/auth, and manages config reloads. External dependencies include a Kubernetes cluster, Prometheus/Alertmanager container images, and optional cloud services for scrape config discovery.
OpenStatus is a production-grade, self-hostable uptime monitoring, incident management, and status page platform. In production, it runs multi-region synthetic checks (HTTP, TCP, DNS, ICMP, gRPC) from Go-based checker and private-location services, streams check results into Tinybird for time-series analytics, persists workspace state (monitors, pages, incidents, API keys, OAuth clients) in SQLite via Drizzle ORM, and renders results through a Next.js dashboard and a public, i18n-enabled status page app with custom-domain proxy support, password/email/IP access gating, themes, and RSS/JSON/markdown feeds. A Hono-based API server exposes three API surfaces - a frozen legacy REST v1 (OpenAPI), tRPC, and ConnectRPC - plus an MCP server for AI agents and a Slack bot that can resolve incidents conversationally. The architecture is a deliberately polyglot monorepo: 8+ apps (dashboard, status-page, web marketing, Hono server, Go checker, Go private-location, Deno workflows, Go ssh-server) and 20+ internal packages. Business logic is centralized in packages/services behind a consistent ServiceContext + withTransaction + requireScope + emitAudit mutation pattern, then adapted to tRPC, ConnectRPC, and REST entry points. Multi-tenant workspaces include plan-based limits, API keys with scopes, a full OAuth 2.0 authorization server (PKCE), WorkOS SSO, Stripe billing, and append-only audit logging. Background Deno workflows handle cron maintenance: outbox draining, status drift repair, OAuth client pruning, and uptime freezing. Craftsmanship is strong: the service-layer pattern is applied uniformly, there is an explicit ServiceError hierarchy mapped to both tRPC and gRPC errors, external services (Upstash, Tinybird, Slack, analytics) have thorough test doubles, and several packages are genuinely standalone and reusable (CDN header analysis, assertion engine, schema-driven data-table filters, Effect-based status fetchers). Caveats are real but not disqualifying: the REST v1 API is explicitly frozen and bypasses the service layer, identical composition/chart utilities are duplicated across dashboard and status-page apps, a deprecated screenshot-service remains in-tree, the Go/TypeScript protobuf boundary requires manual synchronization, and an in-progress auth migration has left Clerk-era references alongside NextAuth. Overall this is a well-architected, actively maintained codebase that does what it claims.
MangoHud is a Linux-first, in-process performance monitoring overlay for Vulkan and OpenGL games. It injects a HUD that shows FPS, frame times, CPU/GPU load, temperatures, clocks, power, VRAM/RAM usage, I/O, network, battery, and media player metadata. The code implements this through multiple low-level integration paths: a Vulkan implicit layer, OpenGL/EGL/GLX swapchain hooks, LD_PRELOAD shims, a gamescope companion app (mangoapp), and a Windows DLL path that uses kiero to hook D3D11/D3D12 and DXGI. Hardware metrics are collected from Linux sysfs/proc interfaces, vendor libraries like NVML and XNVCtrl, and vendor-specific DRM/hwmon backends for AMD, Intel, NVIDIA, Panfrost/Panthor, and Qualcomm GPUs.
WorldMonitor is a full-stack, open-source global intelligence platform providing real-time monitoring of geopolitical, economic, military, supply chain, and natural events. The codebase is overwhelmingly an application (single-page web dashboard, Vercel Edge API, Convex backend, Tauri desktop app, CLI, and SDKs) with a secondary data pipeline character (consumer price scraping, external API seeding). It powers a commercial SaaS with free and Pro tiers, featuring a map-based dashboard with 100+ configurable panels, an MCP (Model Context Protocol) server for AI agents, and extensive multi-language support (28 locales). The architecture follows a seed-cache pattern where Railway cron jobs fetch external data into Redis, and serverless Edge functions read cached JSON for low-latency responses. The frontend uses vanilla TypeScript with Vite, deck.gl/MapLibre for mapping, and a panel system for modular UI composition. The system is actively maintained, with daily commits, comprehensive test coverage (unit, integration, E2E with Playwright), and a well-documented API surface with 298 protobuf definitions across 36 domain services. While the codebase is large and occasionally duplicates shared constants across modules, it demonstrates strong software engineering practices including circuit breakers, idempotency keys, rate limiting, and a consistent handler pattern.
PM2 is a production process manager for Node.js applications with built-in load balancing, monitoring, and deployment capabilities. It keeps applications alive forever, enables zero-downtime reloads, and provides comprehensive system administration features. The architecture features a daemon-based design with CLI and programmatic APIs communicating via IPC (pm2-axon). Key capabilities include process clustering, log management, metrics collection, Docker integration, startup script generation, and a plugin system for extensibility. The codebase demonstrates strong engineering practices with internalized dependencies to reduce supply chain risk, comprehensive test coverage, and active maintenance with regular updates supporting Node.js >=18 and Bun.
Alibaba Druid is a production-grade Java library providing a high-performance JDBC connection pool, a multi-dialect SQL parser, an SQL injection firewall, and built-in monitoring/statistics. In production, it replaces or augments standard connection pools (HikariCP, DBCP) with advanced features like connection leak detection, PSCache, and web console monitoring. The SQL parser supports 30+ dialects (MySQL, PostgreSQL, Oracle, Hive, ClickHouse, etc.) and is used for SQL formatting, parameterization, and analysis. The WallFilter provides configurable security rules to block SQL injection and dangerous operations. The library integrates deeply with Spring Boot via dedicated starters for Boot 2/3/4, and exposes metrics through JMX. Architecture is organized around a filter chain pattern for intercepting JDBC calls, a visitor pattern for AST manipulation, and an SPI-based provider system for firewall rules.
HyperDX / ClickStack is a full-stack observability platform for ingesting, storing, querying, and visualizing logs, traces, metrics, and session replays. The system is architected as a monorepo with a Next.js frontend (React, Mantine, CodeMirror, Recharts), an Express.js API backend (MongoDB metadata, ClickHouse primary data store), a CLI tool (ink-based TUI), and an OpenTelemetry collector for ingestion. Key capabilities include real-time dashboards with drag-and-drop tile layout, multi-channel alerting (webhook, Slack, incident.io), advanced search with Lucene and SQL, log pattern mining (Drain algorithm), session replay, service maps, Kubernetes monitoring, and a Model Context Protocol (MCP) server that exposes observability tools to AI assistants. The platform supports authentication via local accounts or OIDC, OpAMP agent configuration, and includes an evaluation framework (hdx-eval) for benchmarking agent performance on SRE scenarios. Although the repo is primarily an application, it contains data-intensive components like the log miner and analytics query engines that cross over into data engineering territory.
Robusta KRR is a CLI tool for optimizing Kubernetes resource allocation by recommending CPU and memory requests/limits based on Prometheus metrics. It features a modular architecture with pluggable strategies for recommendation algorithms, multiple output formats, and integrations with various Prometheus-compatible systems. The project includes an enforcer component (mutating webhook) for automatic application of recommendations. The codebase demonstrates good engineering practices with clear separation of concerns, proper error handling, and extensible design patterns.
Kubenurse is a Kubernetes DaemonSet that monitors network connectivity within a cluster by performing periodic checks on API server access (direct and DNS), service/ingress reachability, and inter-node communication. It exports detailed Prometheus metrics including request duration histograms, error counters, and a neighbourhood incoming checks gauge. The architecture uses a controller-runtime client for Kubernetes API discovery, implements an efficient O(N) neighbourhood filtering algorithm based on SHA256 hashing to avoid quadratic scaling, and leverages Go's httptrace package for granular connection metrics. The application features graceful shutdown, TLS support, readiness probes that respect node schedulability, and extensive configuration via environment variables or Helm values.
PGO (Crunchy Data Postgres Operator) is a production-grade Kubernetes operator that manages the full lifecycle of PostgreSQL clusters, including deployment, high availability via Patroni, backup/restore via pgBackRest, connection pooling via PgBouncer, monitoring via OpenTelemetry and pgMonitor, and a web UI via pgAdmin. The operator uses custom resource definitions (CRDs) for PostgresCluster, PGAdmin, and PGUpgrade, and reconciles desired state using controller-runtime with server-side apply. It manages StatefulSets, PVCs, Services, ConfigMaps, Secrets, Jobs, and RBAC across multiple namespaces. Architecturally, the operator is a single binary with multiple controllers (postgrescluster, standalone_pgadmin, pgupgrade) and sidecar containers for pgBackRest, PgBouncer, pgAdmin, and the OpenTelemetry collector. It uses feature gates to enable optional capabilities like volume snapshots, auto-grow volumes, and OpenTelemetry logging/metrics. The codebase is well-structured with distinct packages for naming conventions, PKI certificate management, PostgreSQL parameter management, and shell command construction. Extensive unit and e2e tests (using kuttl and chainsaw) cover most scenarios, including backup/restore, scaling, upgrades, and security contexts. Key external dependencies include controller-runtime, client-go, Patroni, pgBackRest, PgBouncer, pgAdmin, OpenTelemetry SDK, and pg_query_go for SQL parsing. The operator is deployed via Kustomize and supports multiple PostgreSQL versions (11-18) with PostGIS extensions.
This repository is a personal Nix configuration (dotfiles) for managing a heterogeneous fleet of machines: NixOS desktops and servers, macOS laptops (via nix-darwin), and Kubernetes clusters (k3s, KubeVirt). It is structured as a Nix flake with modular components for system configuration, home-manager profiles, package overlays, secrets management (agenix), and infrastructure monitoring (Grafana, Prometheus, VictoriaMetrics, Loki). The codebase demonstrates advanced Nix patterns: parameterized module generators for K3s and KubeVirt, automatic file scanning for module imports, declarative disk partitioning (disko), ephemeral root filesystems with persistent state (preservation), and sandboxed GUI applications (nixpak, bwrap). It also includes a custom desktop shell (noctalia) and extensive input method customization (Rime/Fcitx5). While highly personalized and not intended for direct reuse, the architectural patterns and modular design serve as a reference for building complex Nix-based infrastructure. The repository is actively maintained with eval tests and CI, but lacks integration tests for runtime services.
Homer is a production-grade, all-in-one HEP (Homer Encapsulation Protocol) capture and API server for SIP, RTP, RTCP, OTLP, and log data. It powers Homer 11.x data lake with DuckDB, Parquet, and Apache Arrow. The system ingests packets over UDP, TCP, TLS, HTTP, and WebSocket, decodes them using a custom zero-copy SIP parser, and stores them in a columnar DuckLake (DuckDB-backed) storage with SQLite catalog, supporting S3 and Azure backends. It provides a REST API (Echo) for search, dashboards, alerts, and configuration, an Arrow FlightSQL server for Grafana integration, and a React/TypeScript dashboard with drag-and-drop widgets, call flow visualization, and even browser-based games (chess, Doom). Architecture is modular with four main components: Ingest (transport servers), Storage (DuckLake manager with sharded writers, compactor, tiered mover), Node (FlightSQL server, catalog metadata), and Coordinator (REST API, auth, Lua correlation engine, LLM integration). Data flows from HEP/OTLP/Line Protocol receivers through decoders into DuckLake, then served via FlightSQL or REST. External dependencies include DuckDB, S3/Azure SDKs, Lua (golua), OTLP protobuf, and InfluxDB Line Protocol parser. The codebase demonstrates strong engineering practices: object pools for hot-path allocations, idempotent stop patterns, retry with backoff for catalog operations, and a Lua sandbox for scripting. However, it also carries some feature creep (games, LLM) and technical debt (dual SIP parsers, SQL injection risks via string interpolation in some services, and a few commented-out tests). Overall, it is a well-maintained, high-quality observability platform for VoIP and telemetry data.
1Panel is a production-grade, open-source Linux server management panel built on a distributed core-agent architecture. The system provides a comprehensive web-based GUI (Vue 3 frontend) and a REST API (Go/Gin) that orchestrates an agent running on each managed host. It covers the full server lifecycle: website management (Nginx/OpenResty with custom config parser), database administration (MySQL, PostgreSQL, MongoDB, Redis), Docker container orchestration, firewall management (abstraction over iptables, nftables, firewalld, UFW), system monitoring, backup/restore to multiple cloud storage providers, cron jobs, SSL certificate automation via ACME, and terminal access (local, SSH, container) with AI-assisted command generation. The architecture splits control plane (core) and execution plane (agent) communicating over Unix sockets or HTTPS, supporting multi-node environments. Notable engineering highlights include a reusable task framework with retry/rollback, a firewall lifecycle abstraction with rule identity hashing, a custom Nginx config lexer/parser, and an enterprise extension system via Go build tags and frontend dynamic imports. The codebase is actively maintained with frequent commits and a large open-source community (37k+ stars). However, there is significant code duplication between core and agent packages, and some hardcoded paths and legacy migration logic add complexity.
DynamicTp is a Java library for dynamic thread pool management, primarily targeting Spring Boot applications. It allows runtime modification of thread pool parameters (core size, max size, queue capacity, etc.) via configuration centers like Nacos, Apollo, Zookeeper, Consul, Etcd, and Polaris. The library provides a rich set of executor variants (eager, ordered, priority, scheduled) and integrates with over a dozen middleware frameworks (Dubbo, gRPC, RocketMQ, RabbitMQ, Tomcat, Jetty, Undertow, Hystrix, Motan, OkHttp3, Thrift, SofaRPC, Tars, LiteFlow, brpc) by wrapping their native thread pools. It includes comprehensive monitoring and alerting: metrics collection via Micrometer, JMX, and logging; notification channels for DingTalk, WeChat, Lark, email, and custom notifiers; and alarm thresholds for capacity, liveness, rejections, and timeouts. The architecture is modular: a core module defines executors, registries, and lifecycle management; a common module provides utilities, parsers, queues, and SPI extension points; adapter modules wrap middleware executors; starter modules provide Spring Boot auto-configuration; and extension modules add optional features like Redis rate limiting and OpenTelemetry tracing. Key entry points are the @EnableDynamicTp annotation, DtpRegistry for executor registration, and ThreadPoolBuilder for programmatic pool creation. External dependencies include Spring Boot, Guava EventBus, ByteBuddy (for interception), Micrometer, and various config-center client libraries.
Ciao is a self-contained, zero-external-dependency HTTP(S) endpoint monitoring application built with Ruby on Rails 8. It schedules periodic health checks with cron syntax using the in-process rufus-scheduler, stores state in a local SQLite database, and notifies users of status changes via email or configurable webhooks (e.g., Slack, Rocket.Chat). The application also monitors TLS certificate expiration for HTTPS endpoints and sends alerts when certificates are due to expire. It provides a web UI with a dashboard, a RESTful JSON API, optional Prometheus metrics, and HTTP Basic authentication. The codebase is a standard Rails monolith with a single process for web server, scheduler, and background work, making it easy to deploy (Docker, Helm chart, or direct Ruby). The architecture is simple but effective for small-to-medium monitoring needs.
picosnitch is a Linux daemon for per-executable network bandwidth monitoring using eBPF (CO-RE) and fanotify. It tracks which executables make network connections, records bytes sent/received, timestamps, and metadata (SHA256 hashes, optional VirusTotal and GeoIP lookups). The system provides real-time and historical views via multiple interfaces: a curses TUI (both live top and historical browser), a web UI, and a UNIX socket live feed. The daemon uses a multiprocess architecture with privilege-separated subprocesses for monitoring, event processing, database writes, notifications, and external API queries. It supports local SQLite storage and optional remote SQL (MariaDB/MySQL/PostgreSQL) for tamper-evident logging. The repository also includes a comprehensive comparative benchmark suite (bench/) that tests picosnitch against nine other network monitors across 24 scenarios, with a reusable ToolAdapter framework for running controlled experiments.