Open-source alternatives to Nextcloudpi

This project is a comprehensive set of guides and frameworks designed to secure software-as-a-service infrastructure and company operations. It provides a collection of technical checklists, architectural patterns, and best practices for hardening cloud applications against cyber attacks. The project differentiates itself by providing specialized manuals for risk management and compliance readiness. It offers structured approaches to threat modeling, incident response planning, and the preparation of audit evidence required to meet industry security certifications and enterprise customer requ

Webmin is a web-based administration interface for Unix systems. It provides a centralized console for managing the full range of server administration tasks — users and groups, software packages, storage, network configuration, system services, and security — all through a browser. Its modular architecture allows separate modules to handle databases (MySQL, MariaDB, PostgreSQL), web servers (Apache), DNS (BIND), email (Sendmail, Dovecot), file sharing (Samba, NFS), and more, with a unified access control system that restricts what each administrator can see and do. What sets Webmin apart is

Runtipi is a home server dashboard and orchestration tool designed for deploying and managing containerized applications. It provides a web-based interface for discovering and installing software from a curated app store, utilizing a Docker Compose orchestrator to handle the deployment of self-hosted services. The system integrates a reverse proxy and SSL manager to route external traffic to internal containers, automating HTTPS certificate renewal and domain assignment. It also features a built-in backup and update manager that uses cron-based scheduling to perform automatic security patchin

This project is a multi-provider dynamic DNS client and synchronizer that monitors local IPv4 and IPv6 addresses and automatically updates DNS records across various cloud providers. It functions as an IP address monitoring tool and a network IP update webhook, ensuring that domain names remain pointed to current network addresses. The system distinguishes itself through a wide range of native provider integrations, including Cloudflare, AliDNS, DNSPod, Huawei Cloud, and HE.net. Beyond simple record updates, it allows for the management of CDN proxy status, TTL durations, and regional routing

This project is a Kubernetes deployment guide and infrastructure provisioner designed for hobbyist and home lab environments. It provides a framework for setting up multi-node clusters across various cloud providers and physical or virtual nodes, acting as a self-hosted cluster orchestrator. The project focuses on security hardening and infrastructure stability through specific implementation guides. This includes a framework for network security that covers host firewalls and encrypted network overlays, as well as detailed instructions for configuring ingress routing to manage external publi

This project is a GitOps infrastructure framework designed for managing bare metal servers, container clusters, and networking. It serves as a declarative system for orchestrating the deployment and lifecycle of self-hosted services, using Git as the source of truth to synchronize the desired state of the environment. The framework differentiates itself through a comprehensive automation suite that covers the entire hardware-to-service pipeline. It includes a PXE-based bare metal provisioner for network booting and operating system installation, alongside a lightweight container orchestration

Incus is a unified orchestration platform for managing system containers, OCI application containers, and virtual machines through a single control plane. It brings together cluster infrastructure management, secure multi-tenancy, software-defined networking, and pluggable storage backend orchestration into one cohesive system exposed via a full REST API and command-line interface. What distinguishes Incus is its ability to run multiple instance types side by side—full Linux system containers, OCI application containers, and QEMU virtual machines—all managed with consistent tooling. Networkin

PiVPN is an automated VPN deployer and server manager designed to establish secure gateways for remote network access. It provides a command-line tool for the installation and configuration of WireGuard and OpenVPN servers on Linux systems, with specific optimizations for single-board computers like the Raspberry Pi. The project distinguishes itself through a wrapper-based management interface that abstracts complex server commands into simplified operations. This includes automated handling of firewall rules, port forwarding, and package installation, as well as the ability to export client

ExternalDNS is a controller that automatically synchronizes Kubernetes resource states with external DNS providers. It monitors cluster resources such as services, ingresses, and gateway APIs to dynamically create and update DNS records, enabling automated service discovery and external traffic management. The project features a provider-agnostic interface that supports a wide array of cloud-managed vendors and on-premises providers, as well as an extension system for custom providers via webhooks and sidecars. It implements a reconciliation loop that uses resource annotations and custom reso

This project is a curated collection of deployment files and configurations for hosting a wide variety of open-source services on a home server. It primarily utilizes Docker and Docker Compose to automate the orchestration, lifecycle management, and deployment of containerized applications. The repository provides a comprehensive suite for self-hosted infrastructure, covering network management tools, media streaming, and home automation. It includes specialized configurations for securing internal services via reverse proxies, WireGuard VPN tunnels, and automated SSL/TLS certificate manageme

This project is a community-curated directory of open-source software designed for deployment in private server environments and home labs. It serves as a comprehensive resource for discovering independent, self-hosted alternatives to mainstream cloud services, enabling users to maintain full data ownership and control over their digital infrastructure. The directory is structured through a hierarchical taxonomy that organizes a vast collection of applications into logical categories, ranging from media management and data analytics to private communication and team productivity tools. It dis

mcp-context-forge is a Model Context Protocol federation gateway that unifies diverse AI tool servers and APIs into a single consistent interface for discovery and execution. It acts as a centralized proxy that aggregates multiple servers and APIs, allowing AI agents to access and invoke a unified set of tools, prompts, and resources. The project distinguishes itself through a multi-protocol translation bridge that converts communication between standard I/O, SSE, gRPC, and REST to enable interoperability between disparate tool servers. It includes a comprehensive LLM evaluation framework for

This project is an Android RPA framework designed for automating user interfaces and system tasks on rooted Android devices using Python and ADB. It provides a suite of tools for rooted device management, allowing for programmatic control of system settings, application lifecycles, and shell command execution via a remote API. The framework distinguishes itself through a combination of dynamic instrumentation and AI integration. It can inject scripts into running processes to hook Java interfaces and modifies application behavior in real time. Additionally, it supports large language model in

Databasus is a self-hosted backup platform that automates PostgreSQL backups, verifies their restorability, and stores them across multiple destinations while managing team access with role-based permissions. It combines on-the-fly AES-256-GCM encryption, cron-driven scheduling, job-queue-based verification, multi-destination storage, WAL streaming, throwaway container restore testing, and workspace-based role access control into a unified backup system. The platform distinguishes itself through automatic backup verification that restores each backup into a temporary database container for in

all-in-one is a containerized deployment system designed to install and manage a complete suite of productivity and collaboration services. It functions as a cloud suite deployer that orchestrates the installation of a self-hosted content platform, incorporating necessary dependencies via Docker or Kubernetes. The project distinguishes itself by providing a web-based dashboard for orchestrating, updating, and monitoring the lifecycle of service containers. It also serves as a local AI inference server, enabling the execution of generative text models, image diffusion, and speech processing on

Sovereign is a self-hosted cloud orchestrator and infrastructure-as-code toolkit designed to establish personal data sovereignty. It provides a suite of automation scripts to deploy a private cloud infrastructure consisting of open-source services for data storage, communication, and web hosting on private hardware. The project focuses on the independent management of digital assets through the deployment of private email servers, git hosting, and file synchronization systems. It distinguishes itself by automating the full stack of server administration, from initial Linux server automation t

This project is an Ansible role and configuration framework designed to automate the installation and provisioning of network attached storage and self-hosted services. It functions as a home server orchestration tool for deploying media servers, cloud storage, and home automation tools on private hardware. The system includes a dynamic DNS configuration suite to expose local network services to the internet using custom hostnames. It allows for the deployment of interconnected application stacks and preconfigured service suites that are coordinated to achieve specific operational goals. The

53AIHub is a centralized orchestration platform for deploying and managing AI agents and prompts across multiple large language model providers. It functions as a multi-model AI gateway and an operation portal for AI services, providing a unified interface to coordinate agents and prompts from various external platforms. The project distinguishes itself as a white-label AI portal designed for self-hosted infrastructure, allowing for full control over operational data on private servers or containers. It includes a comprehensive AI SaaS administration layer with a multi-tenant subscription eng

This project is a Buildroot-based Linux distribution and embedded home server operating system designed to host containerized home automation services. It serves as a dedicated platform that manages the hardware and software requirements of a local smart home hub. The system is built as an immutable operating system, utilizing a read-only root filesystem and image-based updates to ensure consistent versioning and prevent accidental changes. It employs container-based process isolation to decouple applications from the core operating system. The platform provides a supervised container manage

LuCI is a web-based graphical user interface and management framework for OpenWrt. It serves as an embedded Linux router dashboard that allows for the configuration of network devices and system operations through a web browser. The framework provides a visual system for managing firewall rules, DHCP, and wireless settings. It enables remote system administration by translating web requests into backend tasks and system changes. The system utilizes a remote procedure call daemon for backend execution and a unified configuration interface for state management. It employs a logic layer and tem

AzuraCast is a self-hosted web radio management suite and dashboard designed for internet radio broadcasting. It functions as an automated playback manager and broadcasting system, integrating an audio orchestrator for transcoding and cross-fading with a streaming server to distribute audio via mount points. The platform enables multi-tenant station management, allowing a single installation to host multiple independent radio entities. It distinguishes itself by combining an Auto-DJ broadcast system with the ability to manage live DJ accounts and coordinate real-time broadcasts. The system c

acme.sh is a shell-based certificate manager and ACME SSL certificate client. It automates the issuance, renewal, and installation of digital security certificates using a portable Unix shell script to remove dependencies on heavy runtime environments. The project specializes in automated domain ownership verification through a DNS challenge automator that integrates with provider APIs. It supports the generation of diverse certificate types, including wildcard certificates and issuance based on pre-existing certificate signing requests. The tool covers the full certificate lifecycle, includ

Certbot is a command-line client designed to automate the lifecycle of digital security certificates. By implementing the ACME protocol, it manages the communication between a local server and a certificate authority to verify domain ownership and issue transport layer security certificates without manual intervention. The tool distinguishes itself through a modular plugin architecture that allows it to interact directly with various web server configurations and DNS providers. This framework enables the software to perform automated domain validation, modify server settings, and configure vi

This project is a shell-based automation utility designed to synchronize domain name system records with a changing public internet address. It functions as a dynamic DNS updater, ensuring that a custom domain consistently points to the current network address of a home or office environment. The tool automates the process of detecting local network address changes by polling public web services and subsequently updating the corresponding records via the Cloudflare API. By utilizing environment variables for credential management and scheduling updates through system-level task runners, it ma

This project is a containerized dynamic DNS update client designed to automate the synchronization of domain records with changing public IP addresses. It functions as a multi-provider synchronization engine that monitors network connectivity and updates DNS records across various cloud platforms and custom services to ensure consistent domain resolution. The system distinguishes itself through a provider-based adapter pattern that abstracts diverse third-party APIs into a unified interface, allowing for consistent record management. It employs multi-source IP discovery to mitigate rate limit

Teleport is a zero-trust access platform designed to provide secure, identity-based connectivity to servers, databases, and Kubernetes clusters. It functions as a centralized gateway that replaces static credentials with short-lived, identity-bound cryptographic certificates, effectively eliminating the need for traditional VPNs and long-term secret exposure. The platform distinguishes itself by orchestrating access through a unified control plane that maps external identity provider claims to granular, role-based infrastructure permissions. It enforces security through mutual TLS gateways an

This project is a dynamic DNS client and automation service designed to maintain consistent connectivity for web services by synchronizing domain name records with changing public network addresses. It operates as a persistent background daemon, periodically polling for IP address changes and automatically updating records across multiple DNS providers. The application distinguishes itself through an embedded web-based dashboard that allows users to manage domain settings, monitor update logs, and configure provider credentials without manual file editing. It utilizes a provider-agnostic adap