Mattermost is a comprehensive, self-hosted workplace collaboration platform designed for secure team communication. The codebase implements a full-stack architecture with a Go-based backend server handling business logic, API endpoints, and database interactions, alongside a React/TypeScript frontend for user interface and state management. It supports real-time messaging, file sharing, integrations, and enterprise features like SAML, LDAP, and content flagging. The system is designed for deployment as a single binary or via Docker/Kubernetes, with PostgreSQL as the primary data store. The architecture follows a monolithic server structure with a distinct webapp layer, utilizing Redux for frontend state management and interface-based design for backend services. Key entry points include the main Go server binary, the CLI tool `mmctl`, and the React application root. The platform emphasizes extensibility through a robust plugin system and maintains strict type safety across the frontend and backend via shared model definitions. It features extensive testing infrastructure including unit tests, E2E tests with Cypress and Playwright, and custom Go linters for code quality enforcement. The project demonstrates high engineering standards with active maintenance, evidenced by recent commits and a large contributor base. It manages technical debt through custom tooling and versioned migrations, though the complexity of the monorepo and dual testing frameworks presents ongoing maintenance challenges. The codebase is suitable for engineers seeking a mature, enterprise-grade collaboration solution or reusable patterns for full-stack application development.
Pocket ID is a self-hosted OpenID Connect and OAuth 2.0 identity provider centered on passkey (WebAuthn) authentication. In production it acts as an authentication gateway: it serves the OIDC/OAuth endpoints (authorization code with PKCE, device authorization, client credentials, pushed authorization requests, token introspection, userinfo, end-session), performs WebAuthn registration/login ceremonies, issues and rotates signed JWTs, and exposes a SvelteKit admin console for managing users, groups, OIDC clients, API permissions, API keys, application config, and audit logs. It also supports SCIM 2.0 provisioning, LDAP directory sync, one-time access codes, email verification, signup flows, and transactional email notifications with per-user locale. Architecturally it is a modular monolith: a Go backend (backend/cmd/main.go as the entry point) built on Gin, GORM, and a fork of the Fosite OIDC framework, with the SvelteKit frontend embedded and served by the same process. Data flows are typical of an IdP: browser/SP clients hit OIDC endpoints, the backend persists users, tokens, clients, and audit events to SQLite or PostgreSQL (50+ up/down migrations for each), reads/writes user content through a filesystem/S3/database storage abstraction, and delegates ephemeral state and cron jobs (token cleanup, API key expiry, back-channel logout, rate limiting) to the Francis actor runtime. External dependencies include SMTP servers, LDAP directories, SCIM providers, MaxMind GeoLite2 downloads for audit-log geolocation, optional S3-compatible object storage, and optional standalone Francis. The codebase shows strong engineering discipline: dependency-injected services, a layered DTO mapping and validation layer with stable error codes, an authorization scope catalog enforced at the router level, middleware for CSP/CORS/rate limiting/CSRF, a generic TTL cache with singleflight, SSRF-guarded outbound HTTP with per-purpose host allowlists, field-level encrypted strings, and callback-URL wildcard validation. Tests are extensive and include Go unit tests, migration parity checks between SQLite and PostgreSQL, route-scope coverage tests, and Playwright E2E suites. The main maintenance risks are the forked Fosite dependency, the non-trivial operator complexity of the Francis actor runtime, and a high rate of schema migrations; HA mode is explicitly experimental. This is unambiguously an application repository; its only data-adjacent features are IP-geolocation enrichment and an opt-in analytics heartbeat.
CPA Manager Plus is a full-stack, self-hosted management panel for AI gateway proxies (CPA / CLIProxyAPI). It provides a rich React dashboard to monitor usage across multiple AI providers, manage credentials and API keys, configure provider-specific settings, automate quota cooldowns and account health actions, and inspect credential health via Codex/xAI probes. The Go backend persists all data in SQLite, runs background workers for data rollups, migrations, and collector polling, and exposes a comprehensive REST API. The codebase is well-structured with a clean layered architecture (HTTP handlers, services, repositories), extensive unit and integration tests in both Go and TypeScript, a demo mode with synthetic data, and i18n support. It is actively maintained with a rigorous release process and frequent updates.
One API is a production-ready OpenAI API gateway that aggregates 30+ LLM providers (OpenAI, Anthropic, Google Gemini, Azure, Baidu, Alibaba, Zhipu, Moonshot, DeepSeek, Ollama, etc.) behind a single OpenAI-compatible endpoint. The Go backend implements a sophisticated relay system with provider-specific adaptors that translate OpenAI-format requests to each provider's native API. It features token-based quota management with group/channel multipliers, load balancing across channels, automatic failover, channel health monitoring with metric-based auto-disable, and multi-node deployment with Redis synchronization. The React frontend (three themes: default, berry, air) provides admin dashboards for channel/token/user management, billing visualization, and system configuration. The codebase demonstrates strong engineering practices: clean adaptor pattern for provider extensibility, comprehensive middleware chain, batched database updates for performance, and well-structured configuration management.
Manifold is an AI agent platform enabling multi-step workflow automation through teams of AI assistants. The system provides a chat interface for interacting with configurable specialist agents, a visual workflow editor (WARPP) for creating reusable automation, and an experimentation playground for testing prompts and models. Built with a Go backend and Vue.js frontend, it features extensible tool systems, layered memory architectures (belief, evolving, decision), MCP integration for external tools, and comprehensive observability via OpenTelemetry. The architecture emphasizes modularity with clear separation between agent execution, persistence, tool discovery, and memory subsystems.
PanSou Web is a Dockerized web application that provides a unified interface for searching cloud storage resources across multiple platforms including Telegram channels and various cloud storage plugins (Baidu, Alibaba Cloud, etc.). The application features a Vue.js frontend with a Go-based backend service, Nginx reverse proxy, and specialized management interfaces for accounts on services like QQ频道, 观影 (media), 盘链, and 微博. It includes advanced search filtering, link health checking with visibility-based triggering, result export functionality, and real-time system health monitoring. The architecture follows a traditional web application pattern with clear separation between frontend UI and backend API services.
Kubewall is a production-grade, open-source Kubernetes dashboard that provides real-time multi-cluster management through a single-binary web application. It combines a Go backend (Echo framework, client-go informers) with a React/TypeScript frontend (Redux Toolkit, shadcn/ui, TanStack Router) to offer live monitoring, YAML editing, pod log streaming, port forwarding, and an AI-powered troubleshooting assistant (kwAI). The architecture relies on Server-Sent Events (SSE) to push Kubernetes resource updates to the browser, with an in-memory informer cache per cluster. The backend exposes REST endpoints for every standard Kubernetes resource type as well as Custom Resource Definitions (CRDs), while the frontend uses virtualized data tables, Radix UI primitives, and lazy-loaded Monaco editor for editing. The system supports multiple kubeconfig authentication methods and includes a Helm chart for deployment.
This is a self-hosted social timeline application (moments/朋友圈) that allows users to post short updates (memos) with rich media: images, videos, music, links, and Douban (Chinese media database) book/movie references. The architecture is a single Go binary that embeds a Nuxt.js static frontend and connects to a SQLite database. The backend provides a REST API with JWT authentication, supports file upload (local or S3), comment system with email notifications, RSS feed generation, and database backup on version changes. Noteworthy features include automatic database backup with cleanup, image thumbnail generation, Google reCAPTCHA integration, and a calendar-based search for memos. The codebase is well-organized with dependency injection (samber/do), proper route grouping, and data migration scripts. The frontend is a Nuxt 3 SPA with Tailwind CSS and component-based UI. The project is actively maintained with frequent commits and a responsive issue tracker.