Mediary Scout is a self-hosted media acquisition system that automates the discovery, transfer, and organization of media files from various cloud storage providers (such as 115, Quark, Tianyi, etc.) into the user's own storage. It features an agent-driven workflow powered by LLMs to decide acquisition steps, a web interface (Next.js) and desktop client (Electron) for management, and background workers for processing tasks. The system includes remote access via Cloudflare Tunnels (through the scout-connect service) with subscription management (Alipay payments), and supports both single-user and multi-user modes with a demo option for demonstration.
Dokku is a production-grade, self-hosted Platform as a Service (PaaS) that manages the full lifecycle of containerized applications. Its architecture is a plugin-based monolith orchestrated by a core Go binary, where every feature (builders, schedulers, proxies, storage, config) is a self-contained plugin that hooks into lifecycle triggers (plugn system). It supports deployment via git push, archives, or Docker images, and can schedule containers locally via Docker or on Kubernetes clusters via its k3s scheduler. The codebase demonstrates high craftsmanship in its plugin architecture and state management. The `common` plugin provides a robust property store, parallel execution engine, and safe command execution utilities that are used across all plugins. The `scheduler-k3s` plugin is a standout, featuring a custom Helm diff engine for previewing infrastructure changes and complex Helm chart generation for Kubernetes resources. The `storage` and `docker-options` plugins contain well-structured parsers for their respective domain-specific languages. While the core Go code is well-structured and heavily tested (Go unit tests, BATS integration tests), the codebase has medium technical drift. The extensive use of shell scripts for plugin triggers introduces fragility, and the Kubernetes scheduler hardcodes specific versions of external tools (cert-manager, KEDA, Traefik) that require manual updates. Despite this, the project is actively maintained with frequent releases, comprehensive migration guides, and a clear deprecation policy, making it a strong example of a long-lived open-source PaaS.
highlight.io is an open-source, full-stack observability platform that provides session replay, error monitoring, logging, distributed tracing, and metrics dashboards. The system is architected as a monorepo with a Go backend (serving GraphQL APIs via gqlgen), a React/TypeScript frontend (using Vite, Apollo Client, and a custom UI component library), and SDKs for over a dozen languages and frameworks (JavaScript/TypeScript, Go, Python, Ruby, Java, Rust, Elixir, .NET, etc.). Data is ingested via OpenTelemetry (OTLP) and custom SDKs, processed through Kafka queues, stored in ClickHouse for analytics and PostgreSQL for relational data, with Redis caching and S3 for session replay assets. The platform includes alerting (Slack, Discord, Microsoft Teams, webhooks), integrations with GitHub, Jira, Linear, Vercel, and more, as well as AI-powered features like session insights and error grouping. The primary entry points are the frontend SPA (routed via React Router) and the backend GraphQL endpoints (private-graph for authenticated users, public-graph for data ingestion). Key data flows include: browser SDK capturing session events and errors → public-graph → Kafka → ClickHouse/Postgres; server SDKs sending logs/traces/metrics via OTLP → OpenTelemetry collector → ClickHouse; and background workers (Lambda functions) for digests, session exports, and alert evaluations. The system is designed for both cloud-hosted and self-hosted deployments (Docker Compose, AWS ECS). While primarily an application, the repository contains significant data engineering components: ClickHouse materialized views for aggregations, Kafka for stream processing, and custom query parsing (ANTLR grammar) for search across logs, traces, and sessions. The codebase demonstrates high craftsmanship with a well-structured monorepo, extensive testing (Go unit tests, e2e tests across frameworks), and a reusable UI component library. However, the large number of SDKs and integrations introduces maintenance complexity, and some legacy patterns (e.g., coexistence of old and new dev tools) indicate ongoing refactoring.
Tandoor is a self-hosted, multi-tenant recipe management web application. The system is a monolithic Django application (cookbook app) exposing a Django REST Framework API, paired with a Vue 3 + Vuetify single-page frontend that consumes an auto-generated TypeScript OpenAPI client. Core production domains, verified in code, are: structured recipes (steps, ingredients, scaling), a tree-based hierarchical food database with nutritional properties and USDA FDC IDs, meal planning with iCal export, shopping lists with supermarket categories and offline sync queues, inventory/pantry booking, cookbooks, share links, and view/cook logging. Tenancy is enforced through Space/Household/UserSpace models with django-scopes middleware and granular guest/user/admin permission classes rather than through database row-level security. The largest subsystem is recipe import/export: an abstract Integration base class with 20+ adapters for other recipe managers (Paprika, Mealie, Cooklang, Gourmet, ChefTap, etc.), URL scraping via recipe-scrapers/microdata/pytubefix, cloud storage sync providers (Dropbox, Nextcloud, WebDAV, local), a bulk open-data importer for USDA-derived reference foods/units/conversions, and an embedded PDF.js viewer for external recipe files. A connector/event layer dispatches async updates to external services such as Home Assistant, a Telegram bot webhook writes shopping list entries, and recent AI features (litellm-based, per-space credit tracked) handle image/PDF recipe import, step sorting, and nutrition extraction. Background work is done via threads rather than a task queue. Craftsmanship is above average: clean abstract patterns (Integration, Provider, Connector ABCs), chainable queryset managers, mixin-based permission/merge/tree logic, a strong permission-matrix test suite, and genuinely reusable helper algorithms (BFS unit conversion, ingredient parsing, Cooklang parsing). However, the codebase carries notable debt: 240+ migrations with heavy schema churn, a ~3000-line monolithic api.py view file, committed auto-generated OpenAPI client code that can drift, vendored PDF.js binaries, some tests that suppress tenant scoping via scopes_disabled, and copy-paste duplication inside the open-data importer. Overall it is a well-maintained, actively developed application with solid architecture for its scale.
ProjectSend is a self-hosted secure file sharing platform built as a modular Laravel application with an Inertia.js + React frontend. The codebase is organized into domain modules — Files, Clients, Groups, Identity, Comments, Notifications, Audit, Platform, and Api — each containing controllers, services, policies, models, and event hooks. Staff members upload and share files with clients or groups, manage roles and permissions, enforce download limits, expire or version files, and monitor activity through a detailed audit log. Clients access their own portal with four switchable themes (default, compact, drive, gallery), and public share links support additional presentation themes with pagination, previews, and controlled downloads. The application is a monolith with strong modular boundaries rather than microservices. Authentication supports local accounts, LDAP, social login/SSO via OIDC, two-factor authentication, CAPTCHA, and password policies. A REST API protected by Sanctum tokens offers scoped abilities, RFC 7807 problem details, polling-based pagination, and an OpenAPI contract that is drift-tested against the live route surface. Background jobs handle zip downloads, email digests, thumbnails, file cleanup, and scheduled maintenance. The system persists settings, activity logs, notification preferences, and upload metadata in a relational database, while file payloads can be stored on local disks, S3-compatible storage, or Google Cloud Storage. The code is notably security-conscious: secrets are encrypted at rest, old input flashing excludes credentials, CSRF cookie naming is customized to avoid collisions, download paths are never exposed in API responses, and regression tests cover disclosure boundaries, permission scoping, token revocation, and account erasure. The test suite is extensive, using Pest feature tests to exercise permissions, file lifecycle edge cases, version chains, comment visibility, API contracts, and authentication flows. The architecture favors event-based extension points and registry patterns, making modules independently testable and partially reusable, though the project remains an application rather than a framework or library. Overall this is a well-crafted, actively maintained application with clean engineering practices, clear separation of concerns, and unusually thorough security regression coverage. Its main complexity is the large surface area of interchangeable themes, editions, authentication backends, and storage drivers, which creates some ongoing drift risk, but current CI, recent commits, and dependency management show the project is keeping pace with its ecosystem.
Atomic Chat is a full-featured desktop application for running local large language models and connecting to cloud AI providers. Built with Tauri v2 (Rust backend) and a React/TypeScript frontend, it provides a unified chat interface, agent mode with tool execution, MCP server integration, model hub, and an OpenAI-compatible local API server. The application supports multiple inference backends (llama.cpp, MLX, Apple Foundation Models) and handles model downloads, hardware detection, and agent orchestration. It includes extensive testing, telemetry (PostHog/Sentry), and a plugin architecture for extensibility. The codebase demonstrates clean separation of concerns through a service hub pattern, consistent state management with versioned persistence, and robust resource handling for MCP lifecycle and grammar-safe tool calling. Some duplication exists between two llama.cpp provider plugins, but overall architecture is well-structured.
This repository implements an MCP (Model Context Protocol) server that bridges AI assistants with SearXNG, a privacy-respecting metasearch engine. It exposes four primary tools: `searxng_web_search` for web queries, `searxng_search_suggestions` for autocomplete, `searxng_instance_info` for capability discovery, and `web_url_read` for fetching and converting web pages to markdown. The server runs in two transport modes: STDIO (default) for simple MCP integration, and HTTP for stateful/stateless remote access with optional OAuth and static bearer authentication. The architecture is modular and security-focused. Core modules include a proxy layer with per-type agent selection, SSRF protection via private IP blocking and DNS rebinding detection, a browser solver chain (FlareSolverr/Byparr) for challenge solving, worker-threaded PDF extraction, and multi-instance failover/fanout for SearXNG replicas. All credential-bearing output (logs, errors, MCP resources) is redacted by a centralized sanitizer. Extensive environment-variable configuration (~40+ knobs) controls caching, timeouts, rate limiting, TLS, and result formatting. Highlights include a strict integer parser that rejects unsafe or malformed values, an LFU cache with age tie-breakers and configurable TTL, and a comprehensive URL security module covering both IPv4 and IPv6 private ranges. The test suite achieves over 90% line coverage and includes integration, unit, fuzz, and e2e tests, with documentation tests that verify README and configuration docs match source contracts. The project is actively maintained with frequent releases, pinned dependencies, and a verification gate that enforces zero-vulnerability audits before publishing.
PocketRisu is a self-hosted AI roleplay chat platform, forked from RisuAI. It runs as a Node.js server with a Svelte 5 frontend, accessed via browser. The system supports multiple AI providers (OpenAI, Anthropic, Google Gemini, etc.) through a pluggable adapter pattern, and includes character management, lorebooks, plugins, MCP (Model Context Protocol) tools, translation, TTS, image generation, and a comprehensive data-driven settings system. Data is stored in SQLite with content-defined chunking for large values, and the architecture is a monolith with a client-server split: the server handles persistence, backup, asset manifests, and model job processing; the client handles UI, state management, and direct AI API calls (with optional server-side proxy). Key entry points include src/main.ts (client bootstrap), server/node/server.cjs (server), src/ts/storage/database.svelte.ts (central store), and src/ts/process/request/ (AI request handling). External dependencies include Node.js, SQLite, various AI provider APIs, MCP servers, and browser APIs (File System Access, IndexedDB). The codebase is well-tested with unit and integration tests, and features a sophisticated plugin system with sandboxed execution, a model preset registry with remote sync, and a chat delta sync mechanism for efficient data transfer.
Gitea is a self-hosted Git service providing a full DevOps platform including repository hosting, issue tracking, pull requests, wiki, CI/CD (Actions), package registry, and more. The architecture is a monolithic Go web application with a Vue.js frontend, using a SQL database (MySQL, PostgreSQL, SQLite, MSSQL) and supporting various storage backends (local, S3, Azure). Key entry points are the web server (port 3000), SSH server (port 22), and CLI commands for administration. Data flows involve Git operations, webhook notifications, and background job queues. External dependencies include Git, a database, and optional services like Redis, Elasticsearch, and object storage. The codebase is well-structured with extensive testing, but carries some technical debt from a long migration history and dual Git backends.
Huginn is a self-hosted, hackable automation platform built as a Ruby on Rails application. It allows users to create and chain 'agents' that monitor, scrape, transform, and act on data from hundreds of sources (web, RSS, email, Twitter, Telegram, Slack, OpenAI, etc.) via an event-driven architecture. Agents are polymorphic Ruby classes with a consistent lifecycle: scheduled checks, event reception, and event emission. The system supports Liquid templating for dynamic configuration, OAuth services, file pointers, and background job processing via DelayedJob. The codebase is extensive with 80+ agent types, reusable concerns (WebRequestConcern, LiquidInterpolatable, FormConfigurable), and a comprehensive test suite. While primarily an application, it includes a small research dataset (ANEW sentiment norms) used by a sentiment analysis agent, but the dominant character is clearly a production automation service.
SiYuan is a privacy-first, local-first personal knowledge management system with a block-based WYSIWYG editor, AI assistant integration, cloud sync, and a plugin ecosystem. It is architected as a Go kernel (Gin HTTP API + WebSocket) paired with a TypeScript/Electron frontend, supporting desktop (Windows, macOS, Linux), mobile (Android, iOS, HarmonyOS), and browser/Docker deployment. The kernel handles all data operations: block tree persistence as JSON `.sy` files, SQLite indexing with FTS5 and SQLCipher encryption, attribute-view databases (tables, galleries, kanban), backlink resolution, full-text search, and sync via multiple providers (SiYuan cloud, S3, WebDAV, LAN). The frontend provides a rich editing experience with Markdown, LaTeX, Mermaid, mind maps, PDF annotation, flashcards (FSRS), and an agent chat interface. External dependencies include the Lute Markdown parser, dejavu sync library, Pandoc for document conversion, and PDF.js for PDF rendering. The system exposes a comprehensive REST API with contract-based validation and auto-generated TypeScript types, enabling third-party integrations and a community marketplace for plugins, themes, and templates.
Umami is a self-hosted, open-source web analytics platform that serves as a privacy-focused alternative to Google Analytics. The system tracks pageviews, sessions, events, funnels, journeys, retention, attribution, revenue, and performance metrics (Core Web Vitals) through a dual-database architecture using PostgreSQL (via Prisma ORM) and ClickHouse for analytics queries. It provides real-time dashboards, session replay, heatmaps, and a customizable board/dashboard system with shareable views. The application is built with Next.js (App Router) and React, using TypeScript throughout. It features a comprehensive REST API with auto-generated OpenAPI contracts, a generated TypeScript API client package, and an MCP (Model Context Protocol) server for AI/LLM integration. Authentication supports API keys, JWT, two-factor authentication (TOTP with backup codes), and team-based multi-tenancy with role-based permissions. Key architectural patterns include a dual-database query dispatcher (`runQuery`) that selects between Prisma and ClickHouse implementations for every analytics query, a centralized request parsing and validation layer using Zod schemas, and a hook-based React data layer with TanStack Query for caching and invalidation. The codebase also includes comprehensive test coverage with Vitest unit tests, Playwright API tests, and E2E tests, plus a coverage oracle that enforces every API endpoint is documented in the OpenAPI spec.
Hermes Studio is a self-hosted AI agent orchestration platform providing a unified interface for multiple AI agents (Hermes, Ekko, Claude Code, Codex, Pi) with chat, workflow automation, agent management, and skill-based extensibility. The architecture features a Vue 3 frontend, Node.js/Koa backend, Electron desktop client, and hybrid TypeScript/Python agent runtime. Key capabilities include real-time collaboration via Socket.IO, voice processing with multiple STT/TTS providers, file management with preview capabilities, usage analytics, and Model Context Protocol (MCP) integration for extending agent tools. The platform supports social messaging integrations (Feishu, Telegram, Weixin) and MCU device support for embedded voice processing.
DashBeam is a peer-to-peer encrypted file transfer application that operates without a central server. Built on the Iroh networking stack (QUIC, BLAKE3, relays), it enables direct device-to-device transfers with end-to-end encryption, NAT traversal via relays, and local LAN discovery via mDNS. The application is cross-platform, targeting desktop (Windows, macOS, Linux via Tauri), Android, and web (via a Rust WASM bridge). Its architecture cleanly separates a core protocol crate (P2P wire format, pairing, identity) from platform-specific I/O crates (native disk I/O for desktop/mobile, in-memory for web), all wrapped by a unified engine facade. The frontend is a modern React/TypeScript SPA with Zustand state management, a comprehensive UI component library built on Base UI, and 20+ locale translations. The system supports one-time share tickets, permanent device pairing, broadcast mode, transfer progress with resume, and self-hosted infrastructure. No telemetry or accounts are required, and the AGPL-3.0 license ensures openness.
Morphic is a self-hostable AI answer engine and chat application. In production it streams LLM research results into a rich chat UI: it runs an agentic researcher loop that calls search tools (SearXNG, Tavily, Brave, Exa, Firecrawl), fetches and extracts page content, allocates numbered citations, and emits a JSONL-based 'spec' stream that a generative UI renderer turns into structured cards, grids, headings, buttons, and inline images. Alongside the core chat it ships usage-budget metering, guest/anonymous chat, file uploads to S3-compatible storage, a notes/library feature, feedback collection, model discovery and selection, chat sharing, admin invitations, and an analytics relay that forwards scrubbed PostHog events without exposing authentication tokens.
solidtime is an open-source time tracking application designed for freelancers and agencies. It provides a full-stack solution with a PHP backend (using a custom Laravel-like framework with strict typing) and a Vue 3 frontend served via Inertia.js. The system supports multi-tenant organizations with role-based permissions (Owner, Admin, Employee, Placeholder), project and task management, client and tag tracking, billable rates, goals, and detailed reporting with export to CSV, PDF, ODS, and XLSX. It also includes importers for Toggl, Clockify, Harvest, and generic CSV formats, as well as a native solidtime format. The architecture is a monolith with a RESTful API (versioned under /api/v1) and web controllers driven by Inertia.js. The backend uses a custom PHP framework that resembles Laravel but employs non-standard syntax (declare strict_types, use traits, fn closures). Key entry points include API controllers for time entries, projects, clients, tags, goals, reports, and import/export; console commands for administrative tasks, telemetry, and database consistency checks; and a Filament admin panel for CRUD operations. The frontend is built with Vue 3, Pinia stores, TanStack Query for caching, and a shared UI component library (packages/ui) that provides reusable primitives like dialogs, selects, calendars, and context menus. Data flows center around time entries, which are created via a timer or manual entry, associated with projects, tasks, clients, and tags, and aggregated for reporting and goal tracking. The system uses PostgreSQL as its primary database, with Redis for caching and queueing. External dependencies include a mail driver (Mailpit in dev), storage drivers (local/S3), and optional services like Gotenberg for PDF rendering and Paddle for subscriptions. The codebase is extensively tested with PHPUnit (unit/feature), Vitest (JS unit), and Playwright (E2E), and includes CI/CD pipelines for building, linting, and testing.
WhoDB is a self-hosted, multi-database workspace and management platform by Clidey (Apache-2.0). The production system is a Go backend (chi router, gqlgen GraphQL API, BAML-generated LLM clients) served alongside a React/TypeScript SPA (Vite, Apollo, Redux), plus a Cobra/Bubbletea CLI/TUI, a Wails desktop app, an MCP server exposing database tools to AI agents, and multi-language SDKs (Python, TypeScript, Go, Rust, Java) targeting the hosted platform API. It lets users browse/edit/query rows, inspect schemas and relationships, run arbitrary SQL/NoSQL commands, import/export CSV and Excel, generate mock data, and chat with an AI assistant that produces SQL, explains queries, and executes verified operations. Supported engines include PostgreSQL, MySQL/MariaDB, SQLite, CockroachDB, TiDB, DuckDB, ClickHouse, QuestDB, YugabyteDB, MongoDB, Redis/Valkey/Dragonfly, Elasticsearch/OpenSearch, and Memcached, with automatic discovery of cloud-hosted instances on AWS, Azure, and GCP. Architecturally the backend is a database-plugin registry: every engine implements a PluginFunctions interface, mostly by embedding a shared GORM-based SQL plugin and overriding dialect specifics (constraint parsing, batch operations, SQL builders); non-relational stores use native adapters. Security is treated seriously: a SQL guard classifies commands as read-only vs mutating across SQL/MongoDB/Redis, egress validation blocks SSRF targets including cloud-metadata IPs, sessions use hashed cookie tokens with CSRF double-submit, and audit logging classifies events into telemetry/access/compliance. The frontend uses registry patterns (component-registry, route-registry, sidebar-registry) to keep CE/EE edition differences declarative. The most reusable pieces are security components (sqlguard read-only classification, egress SSRF filter), the mock-data generator's column-pattern matching, and the schema-diff engine — all self-contained enough to extract into other projects. The codebase is actively maintained with extensive CI/CD (Docker, npm, Snap, Windows Store, macOS releases), per-database e2e suites, and accessibility checks. Weaknesses are inherent complexity: five SDKs must stay synchronized with a generated manifest, BAML generation introduces platform-specific build stubs, cloud-provider connectivity logic is duplicated across AWS/GCP/Azure, and the broad plugin interface gives new database adapters a large implementation surface.
zrok is a production-grade, self-hostable secure resource sharing platform built on OpenZiti overlay networking. It enables users to share web services, files, TCP/UDP tunnels, and VPN connections through firewalls and NAT without requiring inbound connectivity. The system supports both public and private sharing modes, OAuth authentication (GitHub, Google, OIDC), and includes a full REST API (v2), a CLI tool (`zrok2`), a React web console, a background agent daemon with gRPC remote control, and SDKs in Go, Python, and Node.js. Architecturally, zrok follows a controller-agent pattern. The controller is a Go REST server that manages accounts, environments, shares, accesses, frontends, namespaces, organizations, and bandwidth limits. It uses SQLite3 or PostgreSQL for persistence with versioned migrations, and integrates with InfluxDB for usage metrics and RabbitMQ (AMQP) for dynamic proxy mapping updates. The agent runs as a background process on the user's machine, managing child processes for each share/access and exposing a gRPC API for remote management. Frontend proxies (public, dynamic, socks, Caddy) handle incoming traffic with OAuth, basic auth, and interstitial pages. Key entry points include the CLI commands under `cmd/zrok2/` (e.g., `share`, `access`, `enable`, `admin`), the controller REST handlers in `controller/`, the agent gRPC service in `agent/agentGrpc/`, and the SDK packages in `sdk/golang/sdk`, `sdk/python/src/zrok2`, and `sdk/nodejs/sdk`. The system also includes a canary testing framework for continuous health validation and a comprehensive metrics/limits engine for bandwidth enforcement. External dependencies include OpenZiti (overlay network), InfluxDB (metrics), RabbitMQ (messaging), Caddy (optional web server), and various OAuth providers. The project is actively maintained with frequent commits, automated CI/CD, and multi-platform release pipelines (Linux, macOS, Windows, Docker).
Retrom is a self-hosted game library manager and emulation frontend that lets users manage their DRM-free game collection across devices. Its server component (Rust, gRPC, REST, WebDAV) handles library scanning, metadata enrichment (IGDB, Steam), cloud save synchronization (Ludusavi, WebDAV), and emulator configuration. The desktop client (Tauri) and web client (React, TanStack Router) provide a unified interface with both windowed and fullscreen modes, including in-browser emulation via EmulatorJS. The architecture follows a monorepo structure with well-separated packages for the database layer (Diesel/PostgreSQL), gRPC service handlers, UI components, and Tauri plugins, enabling reuse and independent development.
chasquid is a production-grade SMTP (email) server written in Go, focusing on simplicity, security, and ease of operation. It handles incoming and outgoing email with full support for modern email security standards including STARTTLS, DKIM signing and verification, SPF checking, MTA-STS enforcement, and per-domain security level tracking. The server architecture is modular: the main daemon delegates SMTP protocol handling to the internal/smtpsrv package, manages a persistent email queue via internal/queue, performs alias resolution with hooks via internal/aliases, and delivers mail either locally through an LMTP-based MDA (cmd/mda-lmtp) or remotely via SMTP courier with TLS and MX fallback. Authentication integrates with Dovecot or a local user database using scrypt password hashing. Configuration is defined via protobuf text format, supporting hot reload of domains, users, and aliases without restart. The repository includes CLI tools for administration (chasquid-util), SMTP connectivity checking (smtp-check), and Dovecot authentication testing (dovecot-auth-cli). A comprehensive test suite covers unit, integration, and fuzz tests, with test data for DKIM, SPF, aliases, and various protocol edge cases. The repository also provides a Dockerfile for containerized deployment and extensive documentation in Markdown and man pages. While primarily an application, the codebase contains several well-designed internal packages that could be extracted for reuse, such as the network tracing library, safe I/O utilities, and OpenMetrics exporter.