{"data":[{"slug":"headscale","name":"Headscale","tagline":"BSD-3 self-hosted Tailscale control server","category":"devops","url":"https://headscale.net","github":"https://github.com/juanfont/headscale","pricing":"open-source","hook":"Headscale is the control plane you run when Tailscale clients are fine but Tailscale Inc coordination is not.","whatsGood":"BSD-3-Clause. Implements Tailscale control-server API. Official Tailscale clients talk to your coordination server. ACLs, tags, ephemeral nodes for CI. Small Go binary ops footprint.","theCatch":"Control server only — not a userspace WireGuard client replacement. Not associated with Tailscale Inc as a product. You operate DERP/coordination yourself; MagicDNS/feature parity lags Tailscale SaaS at the edges.","verdict":"BSD-3 Tailscale-compatible control plane. Self-host; clients stay Tailscale.","addedAt":"2026-09-04","featured":false,"domain":"DevOps","subSpecialty":"Networking","subcategory":"Networking","tags":["self-host","permissive","active"],"capabilities":["vpn","wireguard","self-host"],"surfaces":["Self-host"],"ecosystem":["Go","Multi-platform"],"licenseModel":"BSD-3-Clause","githubStars":44770,"starsPerWeek":136,"access":"free","archived":false,"repo":{"createdAt":"2020-06-21","pushedAt":"2026-10-19","license":"BSD-3-Clause","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/headscale","html":"/gems/headscale","markdown":"/gems/headscale.md"}},{"slug":"tailcat","name":"Tailcat","tagline":"BSD-3 WireGuard+DERP netcat without Tailscale control plane","category":"devops","url":"https://tailcat.dev","github":"https://github.com/tailscale/tailcat","pricing":"open-source","hook":"Tailcat is netcat over Tailscale's data plane — WireGuard + magicsock + DERP — with no Tailscale account or control plane.","whatsGood":"BSD-3-Clause. CLI and Go library. Userspace tunnels, SOCKS child mode, bring-your-own DERP. Out-of-band tokens instead of a tailnet.","theCatch":"CLI/API unstable — no stability promises. Public Tailscale DERP may be rate-limited or revoked; run your own derper for real bandwidth. Not Headscale control plane or full Tailscale VPN. Distinct from Headscale/Netbird.","verdict":"BSD-3 WireGuard netcat without Tailscale Inc coordination. Bring your own DERP.","addedAt":"2026-09-07","featured":false,"domain":"DevOps","subSpecialty":"Networking","subcategory":"Networking","tags":["self-host","permissive","active"],"capabilities":["wireguard","derp","netcat"],"surfaces":["Self-host"],"ecosystem":["Go","Multi-platform"],"licenseModel":"BSD-3-Clause","githubStars":8409,"starsPerWeek":82,"access":"free","archived":false,"repo":{"createdAt":"2024-10-29","pushedAt":"2026-10-07","license":"BSD-3-Clause","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/tailcat","html":"/gems/tailcat","markdown":"/gems/tailcat.md"}},{"slug":"matchbox","name":"Matchbox","tagline":"MIT/Apache-2.0 Rust/WASM P2P sockets for Bevy + GGRS","category":"rust","url":"https://github.com/johanhelsing/matchbox","github":"https://github.com/johanhelsing/matchbox","pricing":"open-source","hook":"Matchbox is UDP-like unreliable WebRTC P2P for Rust/WASM when Bevy + GGRS browser multiplayer needs a socket, not a JS rooms kit.","whatsGood":"MIT OR Apache-2.0. johanhelsing/matchbox: matchbox_socket (native + WASM, optional ggrs feature), matchbox_server full-mesh signaling, matchbox_signaling library, and bevy_matchbox for Bevy. Unreliable/reliable data channels with ordering/retransmit knobs — built for low-latency rollback netcode in the browser. Tutorial path with Bevy + GGRS is documented.","theCatch":"Vs PeerJS, Trystero, and Colyseus: Rust/WASM P2P socket + signaling crates — not a JS-first rooms kit, not serverless Nostr/MQTT discovery, not an authoritative game-room framework. You still run matchbox_server (or your own signaling) so peers can find each other; NAT/TURN still applies. Bevy version pins matter (bevy_matchbox tracks Bevy releases).","verdict":"MIT/Apache-2.0 Rust P2P for Bevy/GGRS. Free forever; you still host signaling.","addedAt":"2026-09-09","featured":false,"domain":"Rust","subSpecialty":"Networking","subcategory":"Networking","tags":["self-host","permissive","realtime"],"capabilities":["webrtc","p2p","wasm"],"surfaces":["Self-host"],"ecosystem":["Rust","WASM","Browser"],"licenseModel":"Apache-2.0","githubStars":1153,"starsPerWeek":4,"access":"free","archived":false,"repo":{"createdAt":"2021-09-01","pushedAt":"2026-06-02","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/matchbox","html":"/gems/matchbox","markdown":"/gems/matchbox.md"}},{"slug":"doggo","name":"doggo","tagline":"GPL-3.0 human DNS client — DoH/DoT/DoQ/DNSCrypt + web UI","category":"devops","url":"https://doggo.mrkaran.dev/","github":"https://github.com/mr-karan/doggo","pricing":"open-source","hook":"doggo is dig for humans when you need DoH/DoT/DoQ output you can actually read — plus a small web UI.","whatsGood":"GPL-3.0. mr-karan/doggo (Go). Modern DNS CLI with concise tables, JSON, and encrypted transports (DoH, DoT, DoQ, DNSCrypt). Inspired by ogham/dog; ships CLI + doggo.mrkaran.dev web UI and docs. Source github.com/mr-karan/doggo.","theCatch":"GPL-3.0 copyleft — fine for a CLI on your laptop; read the license before embedding into proprietary SaaS. Vs dig/nslookup (OS stock) and vs dog (Rust, quieter upstream): doggo is the maintained Go dig-with-DoH lane, not a recursive resolver and not dig dialect-complete. You still pick the upstream resolver.","verdict":"GPL-3.0 DNS CLI. Free forever queries; the Catch is copyleft, not a free DNS product seat.","addedAt":"2026-09-12","featured":false,"domain":"DevOps","subSpecialty":"Infrastructure","subcategory":"Networking","tags":["web-ui","self-host","copyleft","active"],"capabilities":[],"surfaces":["Self-host"],"ecosystem":["Multi-platform"],"licenseModel":"GPL-3.0","githubStars":4521,"starsPerWeek":15,"access":"free","archived":false,"repo":{"createdAt":"2020-12-09","pushedAt":"2026-10-12","license":"GPL-3.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/doggo","html":"/gems/doggo","markdown":"/gems/doggo.md"}},{"slug":"croc","name":"croc","tagline":"MIT secure peer file send — relay + PAKE","category":"devops","url":"https://getcroc.com","github":"https://github.com/schollz/croc","pricing":"open-source","hook":"croc is “send this folder to that laptop” when the other side is a person, not an S3 bucket.","whatsGood":"MIT. schollz/croc. CLI (and getcroc.com browser) that pairs two machines with a short code, derives a key via PAKE, and transfers end-to-end — public relay or `croc relay` you host. Resume, multi-file, cross-platform. Source github.com/schollz/croc.","theCatch":"Vs rclone (*rsync for 70+ cloud remotes*): croc is *peer send*, not cloud sync/mount and not a backup vault. Default path uses a public relay (you can self-host). Code phrase is the trust; treat it like a one-time password, not a permanent share link.","verdict":"MIT peer file send. Free forever; rclone the remotes, croc the person in the other room.","addedAt":"2026-09-14","featured":false,"domain":"DevOps","subSpecialty":"Networking","subcategory":"Networking","tags":["cli","self-host","permissive","active"],"capabilities":["p2p","transfer","cli"],"surfaces":["CLI","Self-host"],"ecosystem":["Go","Multi-platform"],"licenseModel":"OSS/MIT","githubStars":40635,"starsPerWeek":86,"access":"free","archived":false,"repo":{"createdAt":"2017-10-17","pushedAt":"2026-10-17","license":"MIT","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/croc","html":"/gems/croc","markdown":"/gems/croc.md"}},{"slug":"submarine","name":"Submarine","tagline":"MIT Rust/Tauri SSH & SFTP client — desktop + Android","category":"devops","url":"https://github.com/SinaXhpm/Submarine","github":"https://github.com/SinaXhpm/Submarine","pricing":"open-source","hook":"Submarine is a modern MIT SSH/SFTP client (Rust + Tauri) for Windows, macOS, Linux, and Android — terminal, remote edit, port forwards, folder mirror, and encrypted sync in one native window.","whatsGood":"MIT (SinaXhpm/Submarine). Free via GitHub Releases. Focused remote-access toolkit without SaaS login: SFTP, port forwarding, folder mirror, encrypted sync. Cross-platform including Android. ★374 on GitHub 2026-09-28.","theCatch":"Vs Navop: Navop is the wider DB/RDP/AI ops suite; Submarine stays on SSH/SFTP done well. Vs Termius-class paid clients: no team vault cloud here — keys and sync are local/self-managed. Mid-★ (~374) kept as clean OSS remote-access fill; confirm Android/desktop release maturity for your workflow.","verdict":"MIT Tauri SSH/SFTP when you want a focused native client — not Navop’s full ops suite; mid-★ devops fill.","addedAt":"2026-09-28","featured":false,"domain":"DevOps","subSpecialty":"Infrastructure","subcategory":"Networking","tags":["desktop-app","self-host","permissive","security","active","young-repo"],"capabilities":[],"surfaces":["Self-host","Hosted"],"ecosystem":["Multi-platform"],"licenseModel":"OSS/MIT","githubStars":451,"starsPerWeek":22,"access":"free","archived":false,"repo":{"createdAt":"2026-05-27","pushedAt":"2026-10-18","license":"MIT","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/submarine","html":"/gems/submarine","markdown":"/gems/submarine.md"}},{"slug":"tailscale","name":"Tailscale","tagline":"BSD-3-Clause WireGuard mesh VPN client","category":"devops","url":"https://tailscale.com","github":"https://github.com/tailscale/tailscale","pricing":"open-source","hook":"Tailscale connects your laptops, servers and phones into one private WireGuard network that works through NAT and firewalls, with identity-based access rules instead of opening ports.","whatsGood":"BSD-3-Clause plus a patent grant (tailscale/tailscale), release v1.104.1. This repo is the open-source client and daemon for Linux, macOS, Windows and more, including Tailscale SSH, subnet routers and exit nodes. Setup is a login and a command per machine. ★~37.6k.","theCatch":"By default every node connects to Tailscale’s hosted coordination server, a proprietary service with its own plans and limits. To run everything yourself you pair the client with headscale, the open-source coordination server, and lose some hosted features.","verdict":"The easiest way to put your machines on one private network — self-host the control side with headscale if that matters.","addedAt":"2026-10-16","featured":false,"domain":"AI Agents","subSpecialty":"Networking","subcategory":"Networking","tags":["self-host","permissive","active"],"capabilities":["vpn","wireguard"],"surfaces":["Self-host"],"ecosystem":["Go"],"licenseModel":"BSD-3-Clause","githubStars":37728,"starsPerWeek":108,"access":"free","archived":false,"repo":{"createdAt":"2020-01-31","pushedAt":"2026-10-19","license":"BSD-3-Clause","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/tailscale","html":"/gems/tailscale","markdown":"/gems/tailscale.md"}},{"slug":"iroh","name":"iroh","tagline":"Rust library that connects devices by public key over QUIC","category":"rust","url":"https://www.iroh.computer","github":"https://github.com/n0-computer/iroh","pricing":"open-source","hook":"iroh lets your app dial another device by its public key instead of an IP address: it hole-punches a direct QUIC connection when it can and falls back to a relay when it can't, so peer-to-peer sync, file transfer or streaming works across NATs without you running networking infrastructure.","whatsGood":"MIT OR Apache-2.0 (n0-computer/iroh), stable 1.x line with v1.3.0 released 2026-09-28. You get authenticated encryption, multiple streams with priorities and datagrams from QUIC. Ready-made protocols sit on top: iroh-blobs (BLAKE3 content-addressed transfer from kilobytes to terabytes), iroh-gossip (pub-sub overlays light enough for phones) and iroh-docs (an eventually consistent key-value store). The relay server and the DNS/Pkarr lookup server are in the same repo, so you can host the whole stack yourself. cargo add iroh to start. ★~12.7k.","theCatch":"Rust first: other languages go through the separate iroh-ffi bindings, which trail the core (iroh-ffi v1.1.0, July 2026). The free public relays run by n0 are rate-limited, shared by everyone and come with no uptime guarantee — the project itself says they are for development and testing. For production you either run your own relay or pay for n0's hosted relays (Pro from $19/month, dedicated relays from $199/month per region). It is a connection library, not a VPN: if you just want your machines on one private network, Tailscale or NetBird is the simpler tool.","verdict":"The building block for local-first or P2P features in a Rust app — plan your own relay before you ship.","addedAt":"2026-10-17","featured":false,"domain":"Rust","subSpecialty":"Networking","subcategory":"Networking","tags":["sdk","self-host","permissive","active"],"capabilities":["p2p","quic","hole-punching"],"surfaces":["Self-host"],"ecosystem":["Rust"],"licenseModel":"Apache-2.0","githubStars":12778,"starsPerWeek":53,"access":"free","archived":false,"repo":{"createdAt":"2022-03-14","pushedAt":"2026-10-17","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/iroh","html":"/gems/iroh","markdown":"/gems/iroh.md"}},{"slug":"nginx-ui","name":"Nginx UI","tagline":"AGPL-3.0 web UI for managing Nginx configs, certs and logs","category":"devops","url":"https://nginxui.com","github":"https://github.com/0xJacky/nginx-ui","pricing":"open-source","hook":"Nginx UI is a self-hosted web dashboard for an existing Nginx install: edit site configs, issue and renew Let's Encrypt certificates, read logs and watch server load from a browser, with every change tested and Nginx reloaded for you.","whatsGood":"AGPL-3.0 (0xJacky/nginx-ui), release v2.9.0 (2026-10-17), active since 2021. A single Go binary (Vue frontend) or a Docker image. It backs up configs automatically with diff and restore, mirrors changes across a cluster of nodes, includes a web terminal, and exposes an MCP interface so agents can manage Nginx config and service control. There is a public demo at demo.nginxui.com. ★~11.6k.","theCatch":"It is a control panel with root-level power over your web server: never expose it to the internet without strong auth, and put it behind a VPN or allowlist. The MCP interface hands an agent the same power, so scope it carefully. AGPL-3.0 matters if you modify it and offer it to others over a network. Much of the community and docs traffic is in Chinese.","verdict":"A handy Nginx admin panel for a small fleet — lock it down before you turn on the MCP side.","addedAt":"2026-10-18","featured":false,"domain":"DevOps","subSpecialty":"Infrastructure","subcategory":"Networking","tags":["web-ui","self-host","copyleft","security","observability","active"],"capabilities":["browser"],"surfaces":["Self-host"],"ecosystem":["Multi-platform"],"licenseModel":"AGPL-3.0","githubStars":11644,"starsPerWeek":39,"access":"free","archived":false,"repo":{"createdAt":"2021-02-19","pushedAt":"2026-10-19","license":"AGPL-3.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/nginx-ui","html":"/gems/nginx-ui","markdown":"/gems/nginx-ui.md"}},{"slug":"crowdsec","name":"CrowdSec","tagline":"MIT open-source IDS/IPS and WAF with a community blocklist","category":"devops","url":"https://docs.crowdsec.net","github":"https://github.com/crowdsecurity/crowdsec","pricing":"open-source","hook":"CrowdSec reads your logs and HTTP requests, detects attacks like brute force and scanning, and blocks bad IPs at your firewall, reverse proxy or CDN — a modern fail2ban with a shared reputation network.","whatsGood":"MIT (crowdsecurity/crowdsec), release v1.8.1 (2026-09-03). Detection and remediation are separate: parse logs on one machine, block on another via bouncers for nftables, nginx, Traefik, Cloudflare and more. Detection rules on the hub are MIT. The AppSec component is a WAF built on Coraza that loads SecLang rules and the OWASP Core Rule Set, and it can answer suspicious bots with a JavaScript proof-of-work challenge. ★~15.2k.","theCatch":"The community blocklist works by sharing signals: your instance reports attacking IPs to CrowdSec's network, so read the data policy. The web Console and premium blocklists are a commercial layer on top of the free engine. Tuning parsers and scenarios for custom apps takes real effort.","verdict":"The best free upgrade from fail2ban — especially behind a reverse proxy.","addedAt":"2026-10-18","featured":false,"domain":"DevOps","subSpecialty":"Infrastructure","subcategory":"Networking","tags":["api","self-host","permissive","observability","active"],"capabilities":[],"surfaces":["API","Self-host"],"ecosystem":["Multi-platform"],"licenseModel":"OSS/MIT","githubStars":15217,"starsPerWeek":45,"access":"free","archived":false,"repo":{"createdAt":"2020-05-15","pushedAt":"2026-10-18","license":"MIT","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/crowdsec","html":"/gems/crowdsec","markdown":"/gems/crowdsec.md"}},{"slug":"netbox","name":"NetBox","tagline":"Apache-2.0 source of truth for network and data-center infra","category":"devops","url":"https://netboxlabs.com/products/netbox/","github":"https://github.com/netbox-community/netbox","pricing":"open-source","hook":"NetBox is the open-source source of truth for network infrastructure: model racks, devices, cables, IP addresses, VLANs, circuits, power and VPNs, then feed that data to your automation through REST and GraphQL APIs.","whatsGood":"Apache-2.0 (netbox-community/netbox), release v4.7.3 (2026-10-13), developed since 2016. Successor to legacy IPAM and DCIM tools, with a deeply linked data model, custom fields, a plugin system and webhooks. It defines intended state and leaves pushing config to tools like Ansible or Nornir. A Django/Postgres app you can self-host. ★~21.7k.","theCatch":"It does not talk to your devices or discover anything on its own; you populate it by import, API or plugins, and keeping it accurate is a process problem. It needs Postgres and Redis. NetBox Labs sells NetBox Cloud and Enterprise; the Community edition stays free.","verdict":"The standard IPAM/DCIM for network automation — only as good as the data you keep in it.","addedAt":"2026-10-18","featured":false,"domain":"DevOps","subSpecialty":"Infrastructure","subcategory":"Networking","tags":["api","self-host","permissive","active"],"capabilities":["api"],"surfaces":["API","Self-host"],"ecosystem":["Multi-platform"],"licenseModel":"Apache-2.0","githubStars":21724,"starsPerWeek":39,"access":"free","archived":false,"repo":{"createdAt":"2016-02-29","pushedAt":"2026-10-19","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/netbox","html":"/gems/netbox","markdown":"/gems/netbox.md"}},{"slug":"vouch-proxy","name":"Vouch Proxy","tagline":"MIT SSO for Nginx via auth_request and OAuth/OIDC","category":"devops","url":"https://github.com/vouch/vouch-proxy","github":"https://github.com/vouch/vouch-proxy","pricing":"open-source","hook":"Vouch Proxy adds single sign-on to any site behind Nginx using the auth_request module: Nginx asks Vouch whether a request is logged in, and Vouch sends users through Google, GitHub, Okta, Keycloak or another OIDC provider.","whatsGood":"MIT (vouch/vouch-proxy), developed since 2017 in Go. One Vouch instance can protect all your sites at once, and the README says validation responses take under 1 ms when it runs next to Nginx. Supports Google, GitHub, Azure AD, Okta, Slack, ADFS, AWS Cognito, Gitea, Nextcloud, Pocket ID and most OIDC providers. ★~3.3k.","theCatch":"Nginx only (via auth_request); for Traefik or Caddy, other forward-auth tools fit better. It authenticates but offers only basic authorization by domain, user or team. Tagged releases are infrequent, so follow main or the Docker images.","verdict":"The simplest way to put SSO in front of internal Nginx sites.","addedAt":"2026-10-18","featured":false,"domain":"DevOps","subSpecialty":"Infrastructure","subcategory":"Networking","tags":["self-host","permissive","auth","active"],"capabilities":["auth"],"surfaces":["Self-host"],"ecosystem":["Multi-platform"],"licenseModel":"OSS/MIT","githubStars":3283,"starsPerWeek":7,"access":"free","archived":false,"repo":{"createdAt":"2017-07-21","pushedAt":"2026-09-27","license":"MIT","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/vouch-proxy","html":"/gems/vouch-proxy","markdown":"/gems/vouch-proxy.md"}},{"slug":"netbird","name":"NetBird","tagline":"WireGuard mesh ZTNA; Cloud free 5 users/100 machines, self-host AGPL plane","category":"devops","url":"https://netbird.io","github":"https://github.com/netbirdio/netbird","pricing":"freemium","hook":"NetBird is the full WireGuard mesh control plane you can self-host when Headscale is Tailscale-client-only coordination.","whatsGood":"Clients BSD-3; management/signal/relay AGPLv3. P2P WireGuard mesh, SSO/MFA, access policies, routes, private DNS. Cloud Free: 5 users, 100 machines. Self-host Community unlimited for core stack.","theCatch":"Vs Headscale/Tailscale: own clients+plane. Cloud Team from about 6 EUR/user; self-host HA/SCIM/device-approval need Commercial Starter or Enterprise. Dual license on control plane.","verdict":"WireGuard ZTNA. Cloud free 5/100; self-host AGPL core; HA extras paid.","addedAt":"2026-09-04","featured":false,"domain":"DevOps","subSpecialty":"Networking","subcategory":"Networking","tags":["self-host","free-tier","license-unclear","active"],"capabilities":["vpn","wireguard","ztna"],"surfaces":["Self-host","Hosted"],"ecosystem":["Go","Multi-platform"],"licenseModel":"Freemium","githubStars":30060,"starsPerWeek":104,"access":"free-tier","archived":false,"repo":{"createdAt":"2021-04-14","pushedAt":"2026-10-18","license":"NOASSERTION","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/netbird","html":"/gems/netbird","markdown":"/gems/netbird.md"}}],"meta":{"total":13,"count":13,"offset":0,"limit":null,"sort":"curated","sorts":["curated","catalog","new","stars","trending","name"],"filters":{"subcategory":"networking"},"next":null,"categories":["agents","nextjs","python","shopify","databases","devops","design","observability","rust","payments","comms","notifications","libraries"],"tags":["mcp","cli","tui","api","sdk","desktop-app","web-ui","editor-plugin","self-host","local-first","free-tier","paid-only","paid-led","permissive","copyleft","source-available","license-unclear","coding-agents","local-llm","rag","memory","evals","browser-automation","scraping","sandbox","skills","voice","security","auth","payments","realtime","postgres","vector","kubernetes","containers","observability","testing","workflows","graphics-3d","git","active","stale","archived","young-repo","fast-stars"]}}