Projects sharing features with Next Terminal

OpenZeppelin Contracts is a library of modular, secure, and reusable smart contract components designed for the development of decentralized applications. It provides a foundational framework for building standard-compliant contracts, offering battle-tested implementations for token standards, access control, and common utility patterns. The project distinguishes itself through its comprehensive support for complex architectural patterns, including proxy-based upgradeability, role-based access control, and account abstraction. It enables developers to implement modular logic injection via hoo

KasmVNC is a web-based VNC server and remote access solution that provides a secure gateway for accessing remote desktop environments through a web browser. It implements the Remote Frame Buffer protocol to transmit pixel data and serves as a secure remote access gateway with integrated user auditing and input controls. The project distinguishes itself through extensive hardware acceleration, using GPU-accelerated frame capture and graphics acceleration to support graphics-intensive tasks with low latency. It employs a multi-threaded compression pipeline and dynamic encoding negotiation to ma

Apache Guacamole is a clientless remote desktop gateway that translates RDP, VNC, and SSH protocols into browser-based sessions. It acts as a remote desktop protocol proxy, allowing platform-independent access to remote machines without requiring specialized client software or plugins. The system functions as an enterprise remote access gateway, integrating with LDAP and Active Directory to manage permissions via corporate credentials. It includes security mechanisms such as multi-factor authentication, connection access restrictions, and the ability to retrieve sensitive credentials from ext

Teleport is a zero-trust access platform designed to provide secure, identity-based connectivity to servers, databases, and Kubernetes clusters. It functions as a centralized gateway that replaces static credentials with short-lived, identity-bound cryptographic certificates, effectively eliminating the need for traditional VPNs and long-term secret exposure. The platform distinguishes itself by orchestrating access through a unified control plane that maps external identity provider claims to granular, role-based infrastructure permissions. It enforces security through mutual TLS gateways an

rtty is a web-based SSH terminal manager and secure gateway designed for remote device administration. It provides a browser interface for accessing Linux shells, managing remote files through binary streams, and routing network traffic to internal device web pages via an HTTP proxy tunnel. The system features a secure gateway using mutual TLS authentication and SSL encryption to protect data transmissions. It includes session orchestration tools for multi-session state management, enabling split-view monitoring and the execution of batch commands across multiple connected devices simultaneou

Mox is a self-hosted email server that runs as a single compiled Go binary, handling the full lifecycle of sending and receiving email through SMTP, IMAP4rev2, and a built-in webmail application. It is designed to be operated without external dependencies or runtime plugins, with all mail services — including spam filtering, queue management, and web interfaces for administration and account management — contained in one executable. The server distinguishes itself through automated TLS certificate management via ACME, DNS-based autoconfiguration for email clients, and file-based configuration

Warpgate is an SSH bastion host that authenticates users and proxies connections to internal servers while recording all session activity. It is distributed as a single standalone binary with no runtime dependencies, stores configuration and session data in a local SQLite database by default, and supports role-based access control to determine which users can reach which targets. The bastion verifies identity through a configurable chain of authentication methods including passwords, one-time codes, single sign-on, and time-limited ticket tokens. It captures and stores SSH session activity as

Nexterm is a centralized management platform for remote server administration, providing a web-based gateway for SSH, VNC, and RDP connections. It serves as a unified interface for managing remote server connectivity, secure access control, and server resource monitoring. The platform integrates a Docker container orchestrator and a virtualization management console to control LXC and QEMU containers. It features an identity gateway that supports OpenID Connect single sign-on and two-factor authentication, alongside an SFTP file manager for remote file transfer and organization. The system i

Octelium is a zero-trust network access platform and identity-aware proxy designed to secure private HTTP, SSH, and SQL resources. It functions as a secure gateway that validates human and workload identities using OIDC, SAML, and FIDO2 passkeys before granting access to internal applications and SaaS APIs. The system is distinguished by its secretless access broker, which injects credentials—such as API keys, passwords, and AWS Sigv4 signatures—at the gateway level so users can access databases and cloud resources without managing secrets. It further specializes in AI gateway administration,

Casbin is an authorization library that provides a model-based engine for enforcing access control across diverse application environments. It decouples authorization logic from application code by using a configuration-driven approach, allowing developers to define access rules and evaluation logic independently. The system supports a wide range of access control models, including role-based, attribute-based, and relationship-based patterns, which are evaluated at runtime to determine if a subject is permitted to perform an action on a resource. The project distinguishes itself through a hig

Boundary is an identity-aware access proxy and privileged access management tool. It brokers secure network connections to infrastructure targets by mapping verified user identities to granular permissions, providing a gateway to servers and databases without the need for static credentials or VPNs. The system distinguishes itself through just-in-time connectivity and automated credential injection, delivering short-lived secrets to users during session initialization. It implements a composable security model using allow-only role-based access control and hierarchical resource scoping to iso

This project is a Docker-based web gateway and Nginx reverse proxy manager. It functions as a containerized network edge designed to route incoming HTTP and HTTPS traffic to backend services using subdomains and subfolders. The system automates the procurement and renewal of Let's Encrypt SSL certificates via the ACME protocol and various DNS plugins. It includes a mechanism to export and share these certificates through persistent volumes so other containers can utilize the same encryption keys. Security is handled through a combination of server intrusion prevention, using Fail2Ban to moni

This backend starter template provides a modular structure for building REST APIs using Node.js, Express, and MongoDB. It includes predefined database models, schema-driven validation, and structured routing to facilitate the development of server-side applications. The application incorporates authentication and security features centered on user registration, login flows, and credential verification. Passwords are protected using cryptographic hashing, and access to protected endpoints is managed through signed token issuance and middleware-based route protection. Additional identity manage

Authorizer is an open-source identity provider that functions as a centralized authentication and authorization platform. It manages user identities and session lifecycles by implementing standard OpenID Connect protocols, allowing for secure verification across web, mobile, and backend applications. The service is designed as a containerized microservice that provides a unified interface for administrative and authentication operations. The platform distinguishes itself through a multi-tenant architecture that isolates authentication rules and user data across different business domains. It

Atmosphere is a Java-based framework for building and coordinating AI agents. It provides a real-time transport layer for streaming data via WebSockets, SSE, gRPC, and WebTransport, alongside a multi-agent orchestration framework for managing agent fleets through sequential, parallel, and graph-based execution workflows. The project features a durable workflow engine that persists agent state as snapshots, allowing long-running tasks to survive system restarts and incorporate human-in-the-loop approvals. It also implements Model Context Protocol servers to expose tools, resources, and prompt

Consul is a distributed coordination service and service mesh tool used for service discovery, health monitoring, and cluster state management across dynamic networks. It provides a platform for locating network addresses of services and managing traffic across distributed infrastructure using DNS and HTTP interfaces. The project distinguishes itself through multi-datacenter network orchestration, enabling the federation of services across different regions using mesh gateways. It secures communication via a service mesh architecture that employs identity-based authorization and mutual TLS en

Ockam is an end-to-end encryption framework and distributed identity provider designed to establish secure communication between applications and devices. It provides a secure network overlay that utilizes cryptographic identities and attribute-based access control to implement zero trust network access. The project distinguishes itself through metadata-driven multi-hop routing and a pluggable transport layer, allowing encrypted traffic to move across diverse network topologies without requiring virtual IP overlays. It specifically enables secure tunneling for legacy applications by wrapping

Vue-typescript-admin-template is a TypeScript-based admin panel starter built with Vue CLI 3, providing a complete foundation for building enterprise back-office interfaces. It enforces type safety across Vue components using TypeScript, reducing runtime errors and improving code maintainability, while offering a dynamic route permission system that controls sidebar navigation and page access by mapping user roles to route permissions at runtime. The template includes a mock API service layer that simulates backend responses for frontend development without a live server, along with internati

Ockam is a zero-trust networking framework designed to secure data transit between distributed applications using an identity-based network overlay. It provides the primitives necessary to establish mutually authenticated and end-to-end encrypted connections, removing the reliance on traditional network-layer security. The project is distinguished by its use of attribute-based access control and verifiable credentials to manage trust at scale. It implements cryptographic identity rotation to maintain identity continuity and integrates with hardware-backed key management systems to secure priv

Digger is a GitOps infrastructure automation system and Terraform orchestrator. It enables the execution of infrastructure plans and applies directly from version control pull requests and CI pipelines. The project provides a framework for policy-based governance and state management. It enforces role-based access controls and custom security policies on infrastructure changes, while centrally storing state files with version history and access controls. The system manages infrastructure workflows through pull request comment triggers and remote execution. It includes capabilities for drift

Gravitino is a federated metadata lake and unified data catalog designed to manage tables, files, and AI models across diverse data sources and cloud storage. It serves as a centralized interface for governing schemas, access controls, and tagging across relational databases, messaging queues, and object stores. The project distinguishes itself by unifying the management of AI assets, such as machine learning models and their version lineages, alongside traditional tabular data. It also implements the Iceberg REST specification to provide a standardized metadata server and proxy for lakehouse

This project is a large language model account management system and multi-user proxy. It provides a gateway that allows multiple authenticated users to share a single premium AI subscription or OpenAI API key. The system functions as a proxy layer that intercepts client requests and forwards them to the official API while injecting shared credentials. It includes a secure backend for centralized credential management and a token-based access control system to validate user identities. To maintain privacy and organization, the project implements session-based context isolation to prevent con

The Common Expression Language specification is a formal standard for a non-Turing-complete expression language designed for safe, portable, and fast logic evaluation. It serves as a cross-language logic standard and a declarative policy language, providing a consistent semantic framework for executing boolean expressions and data transformations across different programming environments. This specification acts as an embedded expression engine that allows applications to integrate portable logic for evaluating user-defined configurations. It is specifically designed to enable safe user-defin

XNU is a hybrid operating system kernel that combines a microkernel architecture with a monolithic layer for system services. It provides a foundation for operating system development, incorporating standardized system-call interfaces, a modular device driver framework, and mandatory access control security. The architecture features a Mach-based microkernel and a BSD-based monolithic layer. It utilizes a message-passing inter-process communication bus for secure data exchange between isolated kernel components and user-space processes, alongside an object-oriented driver framework that decou

Pundit is a Ruby authorization framework that implements policy-based access control. It maps domain models to dedicated logic classes that determine whether a user is permitted to perform specific actions on data objects. The framework utilizes plain Ruby objects to decouple authorization logic from the model. It includes mechanisms for data query scoping to filter record collections based on user permissions, as well as attribute-level permission control to restrict which specific model fields a user can modify. The system provides tools for authorization coverage verification to ensure se

Remotely is a remote desktop management suite and multi-tenant device orchestrator designed for organizing users and machines into isolated organizations. It serves as a centralized system for controlling remote screens, executing scripts on distant machines, and managing remote support ticketing. The platform distinguishes itself through a dedicated remote session archiver that records and saves desktop control sessions to a central server for auditing and security reviews. It also includes a public-facing support portal where end users submit requests that trigger notifications on an admini