Runtipi is a self-hosted homeserver orchestrator: a web-based control plane for installing, updating, backing up, and managing Docker Compose applications on a single server. In production it runs as a NestJS backend, a React frontend, and a shared TypeScript schema package, with PostgreSQL as the primary datastore, RabbitMQ for asynchronous job queues, Dockerode for container control, and Traefik as the reverse proxy and TLS/forward-auth gateway. The app-store model clones external git repositories containing app manifests and compose definitions, then validates and renders them through a dynamic form system. The architecture is a monolithic backend organized around modules for app lifecycle, marketplace, app stores, backups, auth, links, settings, and i18n; long-running operations are executed through a command/handler pattern with per-app async mutexes and schema-validated RabbitMQ event queues.
Grocy is a self-hosted web application for household inventory and chores management. It provides a monolithic PHP backend (Slim 4, custom MVC) with a SQLite database, server-rendered Blade templates, and a JavaScript frontend (jQuery, Bootstrap 4, DataTables, FullCalendar). The system tracks stock (purchases, consumption, inventory, transfers), manages shopping lists, recipes, meal plans, chores, batteries, tasks, and equipment. It exposes a REST API for programmatic access, supports barcode scanning (including custom Grocycode format), external barcode lookup plugins, webhook-based label printing, multi-user permissions, and extensive localization via gettext. The codebase demonstrates solid engineering with a service layer, generic API controllers, feature flags, and a plugin system, but relies on an older frontend stack and a custom framework that may hinder contributor onboarding.
This repository implements a lightweight, self-hostable web service that serves SVG badges displaying GitHub profile view counts. The core logic is a single PHP entry point (`public/index.php`) that parses query parameters (username, label, color, style, base count, abbreviation flag), increments a view counter via a repository abstraction, and renders a badge image using the Poser library. The architecture follows a clean separation of concerns: value objects (`Username`, `Count`) enforce validation, a repository interface (`CounterRepositoryInterface`) abstracts storage, and a factory (`CounterRepositoryFactory`) selects between file-based or PDO-based persistence based on environment configuration. The file repository includes careful file locking to handle concurrent requests safely. The service is designed to be deployed via Docker with Nginx and PostgreSQL, but can also run with simple file storage for minimal setups. External dependencies are minimal and pinned via Composer. The code is well-structured, uses strict types, and demonstrates solid PHP engineering practices for a small service.
HeadlessX is a self-hosted web scraping and browser automation platform with anti-detection capabilities. It provides a Next.js 16 dashboard, an Express 5 API with Prisma/PostgreSQL, a BullMQ queue worker, and a published CLI. The core value proposition is anti-detection scraping via the headfox-js package (Camoufox-compatible Firefox bundles), fingerprint generation, CAPTCHA solving, and LLM-friendly markdown output. The system supports multiple operators: website scraping/crawling/mapping, Google AI Search, Tavily search, Exa search, and YouTube extraction. It includes sidecar services for HTML-to-Markdown (Go) and YouTube extraction (Python FastAPI). The architecture is a monorepo with Nx orchestration, Docker Compose deployment, and an MCP endpoint for AI assistant integration. External dependencies include Redis, Postgres, Playwright, MaxMind GeoIP, and external APIs (Tavily, Exa, Google). The codebase is well-structured with clear separation of concerns, modern TypeScript, and reusable patterns in both frontend and backend.
Gmail Cleaner is a self-hosted, privacy-focused web application for bulk Gmail management. It allows users to unsubscribe from mailing lists, delete emails by sender, mark emails as read, archive, and manage labels—all via a FastAPI backend with a vanilla JavaScript frontend. The architecture follows a modular service layer: each Gmail operation (scan, delete, mark-read, unsubscribe, etc.) lives in its own file under `app/services/gmail/`, coordinated by an in-memory `AppState` singleton. Background tasks handle long-running operations, and the frontend polls status endpoints to show progress. Authentication uses Google OAuth 2.0 with two modes (local desktop web server and manual URL copy for Docker). The tool is designed to run 100% locally, with no external data collection, and uses batch Gmail API requests (100 per call) for efficiency. The codebase includes comprehensive unit tests, integration test plans, and CI/CD via GitHub Actions.
Jpom is a production-grade, self-hosted DevOps platform built with Java (Spring Boot) and Vue 3. It adopts a server-agent architecture: a central server manages multiple agent nodes via HTTP/WebSocket, enabling remote project deployment, process lifecycle management, script execution, Docker container orchestration, SSH command dispatch, and real-time log monitoring. The server provides a web UI and REST API for configuration, while agents execute operations locally. The codebase is modular, with clear separation into `server`, `agent`, `common`, `storage-module`, and `sub-plugin` modules, plus a Vue frontend with internationalization (i18n) support. Key features include CI/CD build pipelines (Git/SVN), artifact distribution ('outgiving'), trigger tokens for webhook automation, role-based access control with workspaces, database-backend abstraction (H2, MySQL, PostgreSQL), and a plugin system for extensibility (Git, SVN, Docker, encryption, email, webhook). The architecture demonstrates strong engineering practices: SPI-based plugin loading, annotation-driven validation and permission checks, a layered service model with database-agnostic storage, and comprehensive WebSocket handling for real-time features. The codebase is actively maintained with frequent releases and a detailed changelog. While some modules show code duplication (e.g., `SocketSessionUtil` in server and agent) and a number of test files are exploratory or stale, the overall design is clean, the plugin system is genuinely reusable, and the storage abstraction layer (H2, MySQL, PostgreSQL) is a highlight for multi-dialect support. This is a solid implementation of a complex distributed management tool, suitable for teams needing a self-hosted alternative to commercial CI/CD or server management platforms.
RetroAssembly is a full-stack web application for self-hosting a personal retro game collection and playing it directly in the browser via emulation. It provides a complete library management system for ROMs, save states, favorites, and launch history, with a rich UI built on React 19, Radix UI, and Tailwind CSS 4. The backend uses Hono with Drizzle ORM and SQLite (Node.js) or Cloudflare D1 (Workers), with file storage abstracted for local filesystem or Cloudflare R2. Emulation is powered by Nostalgist.js using libretro cores, supporting dozens of platforms with per-platform core options, BIOS validation, shaders, rewind, and auto-save. The app features multi-user accounts with shared library mode, keyboard/gamepad navigation via spatial navigation, a virtual gamepad for touch devices, internationalization with 12 languages, and a Docker-first deployment model. The architecture is dual-runtime (Node.js or Cloudflare Workers), with a Vite-based build system and pnpm workspaces. While the codebase is well-structured and demonstrates strong engineering patterns, it carries medium technical drift due to pinned CDN commit hashes, patched third-party packages for SSR compatibility, and the complexity of maintaining dual runtimes.
Firefly III is a self-hosted personal finance management application built on the Laravel PHP framework. It provides comprehensive double-entry bookkeeping with support for multiple currencies, accounts, budgets, categories, bills, piggy banks, recurring transactions, and rules. The system exposes both a full web UI using Blade templates and Alpine.js (with legacy jQuery components) and a RESTful JSON API (v1) for programmatic access. Key features include transaction splitting, budget limits, auto-budgeting, rule-based transaction processing, exchange rate management, webhook integration, multi-user with group administration, and detailed reporting with charts. The codebase follows a repository pattern with interfaces, uses events and listeners for side effects, and includes a substantial set of artisan commands for maintenance, upgrades, and data corrections.
RSS-Bridge is a PHP web application that generates RSS, Atom, and JSON feeds for websites that do not natively provide them. The core architecture is a plugin framework: each of the 447 'bridges' in bridges/ extends BridgeAbstract (or FeedExpander/XPathAbstract/CssSelectorBridge) and implements collectData() to scrape HTML, consume JSON APIs, parse embedded JSON-LD/Next.js state, or expand existing feeds into a standardized item structure. A front controller (index.php) dispatches through a middleware pipeline (security, caching, basic/token auth, exception handling) to actions such as DisplayAction, FrontpageAction, ListAction, and FindfeedAction, then renders items via pluggable output formats (Atom, MRSS, JSON Feed, HTML, Plaintext, Sfeed). Both web and CLI request paths are supported, and the Docker deployment is production-ready with nginx + PHP-FPM and curl-impersonate for anti-bot evasion. The framework itself demonstrates solid engineering: a lightweight DI container, factory classes for bridge/format/cache discovery, a well-designed HTTP client layer with retry logic and CloudFlare detection, a standalone RSS 1.0/2.0/Atom/MediaRSS feed parser, systematic SEO/JSON-LD metadata extraction, and multiple cache backends (file, SQLite WAL, memcached, null) with TTL policies. PHPUnit tests cover feed parsing, format output snapshots, cache implementations, parameter validation, and BridgeImplementationTest enforces structural conventions across all bridges. The bridge base-class conventions (PARAMETERS arrays, contexts, detectParameters, throwClientException/throwServerException) are consistent and well-documented. The dominant weakness is inherent to the scraping domain: most bridges rely on brittle CSS selectors, undocumented APIs, or hardcoded endpoints that break as upstream sites change. Known issues visible in code include hardcoded API keys (Formula1, Giphy, Instructables, TwitterClient), deprecated/duplicate bridges (VkBridge states 'Does not work anymore'; Mozilla and Kernel BugTracker bridges defer to BugzillaBridge), logic bugs (Modrinth parameter key typo, GGDeals assignment-in-condition, Steam assignment-in-condition), a PHP 7.4 compatibility floor (EOL since 2022), and bundled Parsedown 1.7.4. The anti-bot arms race adds ongoing maintenance burden, and many low-traffic bridges appear effectively unmaintained. Overall, the core framework is a strong, extensible example of plugin-style feed generation architecture with genuinely reusable components; the bridge corpus is heterogeneous in quality, mixing well-crafted adapters with fragile scrapers. The project is actively maintained with recent commits, CI workflows, and a large contributor base.
Local Deep Research is a self-hosted, privacy-focused AI research assistant that performs deep, agentic research using multiple LLMs and web searches. It provides a full-stack web application (FastAPI + JavaScript), a programmatic API, and a Model Context Protocol (MCP) server. The system ingests user queries, decomposes them, executes parallel searches across web and academic sources (SearXNG, Google, arXiv, PubMed, Semantic Scholar, etc.), fetches and extracts content, evaluates evidence, and synthesizes reports with citations. It features per-user encrypted SQLCipher databases, a settings system with environment variable overrides, a RAG library with FAISS vector store, journal quality scoring, news subscriptions, and extensive security controls (egress policy, SSRF protection, credential scrubbing). The codebase is heavily tested with unit, integration, UI, accessibility, and security tests. It is a hybrid of a web application and a research data pipeline, but the dominant character is a production-grade application.
ElegantFin is a comprehensive CSS theme for the Jellyfin media server, providing a modern, dark UI overhaul inspired by Jellyseerr. It is delivered as a single CSS import and relies entirely on CSS custom properties (design tokens) for customization, allowing users to adjust colors, layout, and visibility toggles. The theme is built with PostCSS and includes optional add-on stylesheets for custom media covers and third-party plugin support. The codebase consists of versioned, monolithic CSS files that override Jellyfin's default styling across desktop, mobile, and TV layouts. It is not an application backend or data pipeline; it is a pure client-side presentation layer. The theme demonstrates strong CSS craftsmanship through extensive use of modern selectors (`:has()`, `@container`, `@supports`), responsive card grids, and design token abstraction, though it suffers from duplication across versions and reliance on external CDN resources.
This monorepo houses the entire Start9 ecosystem, centered on StartOS—a self-hosted Linux distribution for personal servers. The repository encompasses multiple products: StartOS (server OS with container orchestration, backup, networking, and marketplace), StartWRT (router firmware based on OpenWrt), StartTunnel (WireGuard-based tunnel service), StartCLI (command-line tool), StartRegistry (package registry), and StartSDK (TypeScript SDK for building service packages). The architecture is a hybrid of Rust backend services (using async Tokio, axum, and a custom RPC toolkit) and Angular frontends (using Taiga UI and a reactive PatchDB state store). Key orchestration is handled by the container runtime (Node.js with LXC) and a custom diff-based database (PatchDB) for real-time UI synchronization. The system manages service lifecycle, ACME certificates, DNS, port forwarding, VPNs, encrypted backups, and firmware updates. External dependencies include Linux kernel features (LXC, btrfs, eCryptFS, FUSE, nftables), WireGuard, and standard Rust/Angular libraries. The codebase is actively maintained with frequent version migrations and CI/CD pipelines, but carries some duplication across products and technical debt from rapid evolution.
Pneumatic is an open-source SaaS workflow management system built with a Django backend and React/TypeScript frontend. The platform enables users to create workflow templates, execute workflows, manage tasks, collaborate with teams, and track progress through a comprehensive UI. It features multi-tenancy, payment processing (Stripe integration), notification systems, file attachments, reporting, and various third-party integrations. The architecture follows a microservices-like separation using Docker Compose, with distinct services for backend, frontend, database (PostgreSQL), caching (Redis), messaging (RabbitMQ), and file storage. The codebase demonstrates solid engineering practices with clear separation of concerns, though it shows some technical debt from using Django 2.2 and accumulated migration complexity.
FeedCraft is a self-hosted feed processing service that transforms raw sources (RSS, Atom, HTML, JSON, search results, inbox pushes) into customized RSS feeds through composable processing pipelines called 'crafts'. The system is a monolith Go backend with a Vue 3 admin dashboard, exposing REST APIs for feed ingestion, transformation (AI-powered translation, summarization, full-text extraction, filtering), and aggregation into 'topic feeds'. The architecture follows a clean separation of concerns: source fetching/parsing, craft processing (atomic operations and flows), engine runtime, and administrative controllers. External dependencies include SQLite/PostgreSQL, Redis, an OpenAI-compatible LLM, a browserless service for dynamic content, and optional embedding APIs for semantic filtering. The codebase demonstrates solid engineering with interfaces for sources, parsers, crafts, and caching, though it carries some migration complexity from legacy craft models to newer ones.
OpenAgentd is a local-first, coding-focused AI agent platform that provides a desktop application (Tauri), mobile companion (iOS), browser-based UI (React/Vite), CLI, and an API server. The system orchestrates an agent loop with pluggable LLM providers (Anthropic, OpenAI, DeepSeek, Grok, Ollama, etc.), MCP tool integration, filesystem tools, code analysis, and a scheduler for recurring tasks. It features a dual backend architecture: a legacy Python/FastAPI implementation and a newer Rust v3 rewrite (axum-based) that is progressively replacing the Python version. The web frontend is a rich SPA with real-time streaming, workspace management, telemetry/observability dashboards, and extensive settings panels. The repository also includes code health analysis scripts, document chunking for RAG, and a comprehensive test suite across all layers.
DataEase is a self-hosted, open-source business intelligence (BI) platform that enables users to connect to diverse data sources, build datasets, create interactive charts and dashboards, and share insights via links or embedded widgets. The codebase is a full-stack monolith with a Java Spring Boot backend (JPA, Calcite SQL parser, Quartz scheduling) and a Vue 3 frontend (AntV G2/G2Plot/L7 for charts, UniverJS for spreadsheets). It supports a wide range of database connectors (MySQL, PostgreSQL, Oracle, ClickHouse, StarRocks, Elasticsearch, MongoDB, etc.), dataset types (SQL, union, custom fields), chart types (bar, line, pie, map, table, indicator, etc.), and enterprise features like row/column-level permissions, scheduled sync, report delivery, and multi-factor authentication. The architecture includes an SDK layer for extensions (datasource providers, sync providers, chart plugins) and a separate Xpack module for commercial features. The platform is deployed via Docker Compose with APISIX gateway. The codebase is actively maintained (24k+ stars, recent commits) but exhibits some technical drift due to deep inheritance hierarchies in chart handlers, code duplication across engine providers, and tight coupling to specific library versions (AntV G2, UniverJS). Overall, it is a solid, production-grade BI tool with good separation of concerns but with room for refactoring in certain areas.
Certimate is a self-hosted SSL certificate automation tool that manages the full lifecycle of TLS certificates: issuance via ACME protocol, deployment to a vast array of cloud providers (CDN, WAF, load balancers, object storage, hosting panels), and notification via chat bots and email. The system is a single-binary application with an embedded PocketBase backend (SQLite) and a React frontend. The backend is written in a Go-like language and exposes REST APIs for managing certificates, workflows, and settings. The frontend provides a visual workflow designer for creating automation pipelines with nodes for ACME issuance, deployment, upload, monitoring, and notification. Architecture: The application is built around a plugin-style provider architecture. Core interfaces (Deployer, Certmgr, Notifier, ACMEChallenger) are implemented by dozens of providers for different cloud services. A workflow engine executes directed acyclic graphs of nodes, with support for conditions, try/catch, delays, and parallel branches. The system uses PocketBase for persistence, cron-based scheduling, and admin authentication. The UI is built with React, Ant Design, and a flow editor library. Key entry points: main.go (CLI entry), cmd/serve_*.go (server startup), internal/rest/handlers/ (REST endpoints), internal/workflow/engine/ (workflow execution), internal/certacme/ (ACME client), internal/certmgmt/deployers/ (deployment registry), internal/notify/ (notification service). Data flows: User configures access credentials and workflows via UI. Workflows are scheduled via cron and executed by the engine, which calls ACME challengers to issue certificates, then deployers to install them, and notifiers to send alerts. Certificate and workflow state is persisted in PocketBase. External dependencies: PocketBase for storage and admin auth, lego (go-acme) for ACME protocol, dozens of cloud provider SDKs (Alibaba, AWS, Tencent, Huawei, etc.), and various third-party APIs for DNS challenges and deployment. The project also includes trimmed/patched copies of several SDKs to reduce dependency footprint.
Ladder is a self-hosted HTTP web proxy written in Go, designed for testing and analyzing paywall implementations, content delivery, and access control behavior on modern websites. It intercepts client requests, applies domain-specific YAML rulesets to modify request headers, URLs, and response content (e.g., removing CORS/CSP headers, injecting scripts, rewriting relative URLs), then fetches the target site and returns the modified response. The proxy exposes a web form, a JSON API, a raw HTML endpoint, and a ruleset endpoint, and supports optional FlareSolverr integration for bypassing Cloudflare challenges. It is deployable as a binary, Docker container, or Helm chart, and is configured via environment variables and CLI flags. The architecture is a single Go binary using the Fiber web framework. The main entry point (cmd/main.go) sets up routing, basic auth, and middleware. Core logic lives in handlers/proxy.go, which handles URL extraction, ruleset application, HTTP fetching, HTML rewriting, and FlareSolverr integration. The pkg/ruleset package provides a clean, reusable ruleset loader supporting local files, directories, remote URLs, and gzip-compressed YAML. The codebase is generally well-structured with some global state and a few misnamed test files (e.g., proxy.test.go instead of proxy_test.go) that are not executed by Go's test runner. Despite these minor issues, the project is actively maintained, uses current dependencies, and demonstrates solid engineering practices for a focused tool.
Attic is a self-hostable Nix binary cache server written in Rust. It provides a multi-tenant, globally deduplicated cache for Nix store paths, supporting both local filesystem and S3-compatible storage backends. The system consists of a server binary (`atticd`) that implements the Nix binary cache HTTP API and a client CLI (`attic`) for authentication, pushing store paths, and managing caches. Authentication is stateless via signed JWTs (RS256/HS256) with fine-grained permissions per cache. The server uses content-defined chunking (FastCDC) to split NAR archives into variable-sized chunks, enabling deduplication at both the NAR and chunk levels. Compression (brotli, zstd, xz) is applied during upload with simultaneous hash computation for integrity verification. Garbage collection supports per-cache retention periods and cascading deletion from local caches to global chunk storage. The codebase is organized as a Cargo workspace with four crates: `attic` (core library with chunking, hashing, Nix store FFI), `server` (HTTP server, database, storage, garbage collection), `client` (CLI with push, watch-store, cache management), and `token` (JWT creation and verification). The architecture is modular, with clear separation between API handlers, database entities, storage backends, and authentication. While the project is still in early prototype stage with many TODOs and some fragile FFI bindings to Nix's C++ store library, it demonstrates solid engineering practices with reusable components like streaming hash readers, compression streams, and a custom serde serializer for Nix manifest format.
Photonix is a self-hosted, full-stack photo management application with AI-powered classification and search. The backend is a Django monolith exposing a GraphQL API, with background workers for importing, thumbnail generation, raw processing, and ML classification (color, objects, faces, location, style, events). The frontend is a React 19 single-page app built with TanStack Router, Apollo Client, Zustand state management, and a dark-themed shadcn/ui component library. The system supports multi-user libraries, invitations, map view, albums, and fine-grained search with facets. The architecture relies on a PostgreSQL database, Redis for task coordination and locks, and supervisor to manage numerous background processes. While the project shows solid engineering and a modern tech stack, it carries some technical debt from vendored ML models, TensorFlow 1.x compatibility, and hardcoded download URLs, and is explicitly not yet feature-complete.