Open-source alternatives to Algo

wireguard-ui is a web-based management interface and configuration generator for WireGuard VPN servers. It provides an authenticated administrative dashboard that allows users to manage VPN tunnels and peer connections through a graphical interface instead of manually editing configuration files. The project automates the creation of cryptographic key pairs and produces connection files and QR codes for distributing network settings to clients. It includes tools for tracking client metadata, such as names and email addresses, to identify individual users associated with specific connection se

SkyPilot is a multi-cloud AI orchestrator and distributed task scheduler designed to launch and manage AI workloads across various cloud providers, Kubernetes, and Slurm clusters. It functions as an infrastructure-as-code framework that uses declarative files to define resource requirements and setup commands for consistent execution across different environments. The project differentiates itself through automated cost optimization, selecting the most affordable GPU or TPU hardware and managing spot instances to reduce expenses. It also provides a remote development environment that bridges

wireguard-install is an automated setup tool and guided shell script for deploying and configuring WireGuard VPN servers on various Linux distributions. It functions as a Linux VPN server automator that handles the installation of network tunnel software and the establishment of security configurations on host systems. The project includes a command line interface for managing client access, allowing for the addition and removal of authorized VPN users and the generation of client configurations. It also provides a utility to uninstall the network tunnel and remove all associated system confi

This project is an infrastructure as code tool designed to automate the lifecycle management of Amazon Web Services resources. It functions as a cloud resource provisioner that enables users to define, version, and deploy infrastructure components through declarative configuration files. The system operates by reconciling the current state of a cloud environment against a desired configuration, calculating the necessary delta operations to achieve convergence. It utilizes a directed acyclic graph to resolve resource dependencies and determine the optimal execution order for changes, ensuring

Innernet is a WireGuard VPN mesh orchestrator and control plane that automates the deployment of encrypted tunnels between distributed peers. It functions as a virtual private network that coordinates endpoint discovery and distributes network configurations from a centralized server to establish a private overlay network. The system differentiates itself through a structured peer management lifecycle, using single-use invitation files for secure onboarding and cryptographic key exchange. It provides granular network segmentation by organizing peers into named CIDR blocks, allowing administra

Pulumi is an infrastructure-as-code framework that enables the definition, deployment, and management of cloud resources using general-purpose programming languages. It functions as a cloud resource orchestrator that coordinates the lifecycle of heterogeneous infrastructure by executing code to construct dependency graphs and reconciling the desired state against actual cloud environments. The platform distinguishes itself through a language-host runtime bridge that allows developers to use standard programming languages to define infrastructure, rather than relying solely on domain-specific

Firezone is a zero trust network access platform that uses WireGuard to provide identity-based connectivity to internal network resources. It functions as a virtual private network that synchronizes authentication and user groups via OpenID Connect providers. The system implements a group-based access control engine to enforce least privilege by restricting network resources to specific user groups. It utilizes holepunching and relay protocols for NAT traversal to establish encrypted tunnels through firewalls without requiring inbound ports. The platform includes a control plane for managing

Wirehole is a containerized network stack that integrates a WireGuard VPN server with recursive DNS resolution and sinkhole-based advertisement filtering. It bundles these interdependent services into a single managed environment using a compose-based deployment. The system enables network-wide ad blocking and tracker filtering by intercepting DNS queries via a sinkhole. It implements recursive DNS resolution to resolve domain names independently of external upstream providers and provides a web-based interface for managing VPN client peers and keys. Additional capabilities include split-tun

Boto3 is the AWS SDK for Python, providing a programmatic interface for managing and automating AWS cloud infrastructure and services. It serves as a cloud management API client and resource manager for provisioning, configuring, and scaling virtual servers, databases, and storage. The library enables the implementation of infrastructure-as-code through declarative templates and scripts, allowing for the deployment of identical resource stacks across multiple accounts and geographic regions. It also provides a framework for coordinating distributed workflows, serverless functions, and contain

Spinnaker is a multi-cloud continuous delivery platform designed to automate software releases and deployment pipelines across various public cloud providers and Kubernetes clusters. It functions as a cloud deployment orchestrator and infrastructure delivery tool, coordinating the promotion of software artifacts through multiple environments using visual workflows and directed acyclic graphs. The platform distinguishes itself with a dedicated canary analysis engine that compares performance metrics between new and stable software versions to automate release decisions. It utilizes cloud-agnos

Streisand is an orchestration system for deploying multi-protocol tunneling services and traffic obfuscation tools designed to circumvent regional network restrictions. It functions as a deployment utility and manager for various VPN and proxy services on remote cloud servers. The system distinguishes itself through a network obfuscation toolkit that wraps traffic in layers to evade deep packet inspection and bandwidth throttling. It automates the setup of multiple protocols, including WireGuard, OpenVPN, Shadowsocks, OpenConnect, OpenSSH, and Tor bridges. The project also includes utilities

This project is a shell-based orchestration tool designed to automate the deployment and administration of WireGuard virtual private network servers on Linux hosts. It functions as a system-level networking utility that handles the installation of kernel modules, the configuration of secure tunnel interfaces, and the management of network routing rules to enable encrypted remote access. The tool provides an interactive command-line interface that simplifies the lifecycle management of network peers. It allows administrators to dynamically add or remove client access profiles, assign custom DN

Salt is an infrastructure configuration management tool and orchestration framework designed for large-scale system administration. It functions as a remote execution engine that enables administrators to manage, provision, and enforce declarative states across distributed fleets of servers from a central control point. By utilizing a high-performance message bus, the platform allows for the simultaneous execution of administrative tasks and the maintenance of consistent software configurations across thousands of nodes. The system distinguishes itself through a flexible architecture that sup

OpenVPN is a cross-platform networking solution that establishes secure virtual private network connections by wrapping data traffic within encrypted tunnels. It functions as a server-side application that authenticates remote endpoints and routes encrypted traffic to provide access to private network resources across untrusted public networks. The software utilizes standard cryptographic protocols to perform mutual authentication and key exchange over a dedicated control channel. It verifies the identity of remote systems through certificate-based authentication, ensuring that only trusted e

GOAD is an Ansible-based automation tool and infrastructure orchestrator used to deploy pre-configured networks of vulnerable Windows virtual machines. It serves as a security training environment for practicing Active Directory penetration testing, privilege escalation, and lateral movement across various cloud platforms and local virtualization hypervisors. The project distinguishes itself through a multi-provider infrastructure model and a system of infrastructure recipes that simulate intentional security misconfigurations. It supports the deployment of varied attack scenarios, including

Hiddify is a cross-platform proxy client designed to manage secure network connections and traffic routing across desktop and mobile operating systems. It functions as a unified proxy manager, providing a centralized interface to configure and control various network proxy protocols for encrypted and private internet access. The application distinguishes itself by integrating local loopback interception, which configures the operating system network stack to route traffic through a local port for granular filtering. It also serves as a self-hosted infrastructure tool, enabling users to automa

A rule-based proxy for macOS

This project is a curated collection of deployment files and configurations for hosting a wide variety of open-source services on a home server. It primarily utilizes Docker and Docker Compose to automate the orchestration, lifecycle management, and deployment of containerized applications. The repository provides a comprehensive suite for self-hosted infrastructure, covering network management tools, media streaming, and home automation. It includes specialized configurations for securing internal services via reverse proxies, WireGuard VPN tunnels, and automated SSL/TLS certificate manageme

Otto is a hybrid cloud orchestration platform designed to provision infrastructure and deploy application workloads across diverse cloud environments using infrastructure as code. It functions as an infrastructure as code provisioner that automates the deployment of consistent resources through policy-driven workflows. The project includes a hybrid cloud service mesh for managing service discovery and secure communication between applications, as well as an identity-based access controller for managing secrets and enforcing granular access controls. It also features an infrastructure knowledg

wgcf is a network account manager and profile generator used to register service accounts and create configuration files for Cloudflare WARP. It enables the generation of standard WireGuard profiles that allow clients to connect to these network services. The tool includes mechanisms for service account registration and the binding of subscription licenses to activate premium network features. It manages the persistence of account identities and subscription data locally to maintain connectivity. Additional capabilities include network connection verification and diagnostic tools for tracing

This project provides a system for configuring dual-stack connectivity, establishing local proxy ports, and managing policy-based traffic routing. It functions as a utility to add IPv4 and IPv6 network exits to servers and a tool for importing and parsing WireGuard profiles to generate compatible network configurations. The software automates the installation and management of the Cloudflare WARP client across different operating systems. It enables the deployment of secure network tunnels and the creation of local SOCKS5 proxy ports to route specific application traffic without altering glob

Outline Apps is a suite of software components for establishing private proxy networks, consisting of cross-platform proxy clients, server administration interfaces, and identity-based access control systems. It enables the routing of device traffic through secure VPN or Shadowsocks server connections using unique access keys. The project provides tools for deploying and configuring VPN servers on cloud providers or Linux infrastructure. It includes a management interface for administering these servers and a system for generating access keys to authorize devices and enforce individual bandwi

VPNOn is a deep link VPN client and connection manager that enables the establishment of secure network tunnels and the opening of specific web addresses via custom URL schemes. It functions as a configuration importer and a system tray utility for managing secure connections. The project differentiates itself through automated configuration setup, using custom URL schemes to import server credentials and serialized network settings from external sources. It further automates connectivity by triggering a sequence that establishes a network tunnel before launching a browser to a target address

This project is a reference library and collection of example code patterns for deploying cloud infrastructure using the AWS CDK. It provides a set of sample projects that demonstrate how to define compute, storage, and networking resources using general purpose programming languages. The library includes reference implementations for various architectural patterns, including serverless backends with GraphQL and WebSocket APIs, container orchestration with load balancers and auto-scaling, and global static website hosting via content delivery networks. It also provides designs for isolated ne

This project is a Terraform Kubernetes provisioner and K3s cluster deployer designed to automate the installation and configuration of lightweight container orchestration on Hetzner Cloud infrastructure. It functions as a Hetzner Cloud infrastructure module, using declarative configuration to manage the full lifecycle of virtual machines, private networks, and load balancers. The orchestrator focuses on high availability by deploying redundant control planes and worker nodes across multiple physical data centers to ensure service continuity. It incorporates a cloud network security manager to

Octelium is a zero-trust network access platform and identity-aware proxy designed to secure private HTTP, SSH, and SQL resources. It functions as a secure gateway that validates human and workload identities using OIDC, SAML, and FIDO2 passkeys before granting access to internal applications and SaaS APIs. The system is distinguished by its secretless access broker, which injects credentials—such as API keys, passwords, and AWS Sigv4 signatures—at the gateway level so users can access databases and cloud resources without managing secrets. It further specializes in AI gateway administration,

This project is a toolset for automated VPN installation, proxy server management, and server-side network throughput optimization. It provides a Shadowsocks proxy server manager used to deploy and configure proxy servers on virtual private servers. The system utilizes automated deployment scripts to handle the installation of encryption methods, ports, and passwords on remote servers. It includes a VPS network optimizer that activates BBR congestion control to reduce latency and increase throughput for high-bandwidth streaming. The software covers remote proxy configuration and client confi