From 87be4ab5eb48977b2cbceb7ed706bbe86455f745 Mon Sep 17 00:00:00 2001 From: lglucas Date: Sat, 8 Aug 2026 14:12:27 -0300 Subject: [PATCH 01/14] fix(skills): frontmatter nas 6 skills core + auditoria das 26 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Seis skills não tinham frontmatter YAML nenhum, então a descrição que o Claude via era o próprio título H1 ("Product Brief Skill"). Eram justamente as seis que dirigem o WIZARD: project-genesis, research-waves, business-plan-impact-review, product-brief, prototype-lab e sprint-roadmap. As vinte periféricas do pack vibe-coder v0.3.0 já tinham frontmatter completo — as mais antigas e centrais eram as invisíveis. Pior caso: cinco arquivos vivos mandam invocar business-plan-impact-review pelo nome, e a skill não conseguia se descrever. Outras dez tinham frontmatter mas zero frase-gatilho. Descrição que diz o que a skill faz não é a mesma coisa que dizer quando acioná-la. frontmatter: 20/26 -> 26/26 gatilhos: 10/26 -> 26/26 Também corrigido: - Três pares sobrepostos agora se referenciam nos dois sentidos (secrets-discipline/secrets-scan, cost-watchdog/usage-monitor, first-100-users/grow-sustainably). A assimetria era sempre na mesma direção: a skill nova conhecia a antiga, nunca o contrário. - release-check virou tabela de delegação em vez de checklist manual, apontando verify-build-works, secrets-scan e privacy-audit. Fecha item aberto desde 2026-05-01. - docs/skill-system.md listava design-prototype e security-review, que não existem. Substituído pelo inventário real. Proveniência GitHub verificada, sem mudança necessária: 23 das 26 são autorais deste repo; as 3 com upstream já linkam registry packs que carregam as URLs. Lacunas registradas e não corrigidas: não existe skill de technical-plan (stage 4.2 roda só com prosa do WIZARD), e templates/project/CLAUDE.md anuncia /release-check, que não existe. Co-Authored-By: Claude Opus 5 (1M context) --- .../business-plan-impact-review/SKILL.md | 5 + .claude/skills/cost-watchdog/SKILL.md | 2 +- .claude/skills/decision-log/SKILL.md | 2 +- .claude/skills/feature-scaffold/SKILL.md | 2 +- .claude/skills/first-100-users/SKILL.md | 2 +- .claude/skills/os-self-test/SKILL.md | 2 +- .claude/skills/privacy-audit/SKILL.md | 2 +- .claude/skills/product-brief/SKILL.md | 5 + .claude/skills/project-genesis/SKILL.md | 5 + .claude/skills/prototype-lab/SKILL.md | 5 + .claude/skills/release-check/SKILL.md | 24 ++- .claude/skills/research-waves/SKILL.md | 5 + .claude/skills/secrets-discipline/SKILL.md | 2 +- .claude/skills/secrets-scan/SKILL.md | 2 +- .claude/skills/sprint-management/SKILL.md | 2 +- .claude/skills/sprint-roadmap/SKILL.md | 5 + .claude/skills/verify-build-works/SKILL.md | 2 +- CHANGELOG.md | 52 ++++++- docs/skill-audit-2026-08-08.md | 147 ++++++++++++++++++ docs/skill-system.md | 85 ++++++++-- session-log/2026-08-08-v0.5.0-skills-audit.md | 63 ++++++++ session-log/INDEX.md | 1 + 22 files changed, 393 insertions(+), 29 deletions(-) create mode 100644 docs/skill-audit-2026-08-08.md create mode 100644 session-log/2026-08-08-v0.5.0-skills-audit.md diff --git a/.claude/skills/business-plan-impact-review/SKILL.md b/.claude/skills/business-plan-impact-review/SKILL.md index 10aa34d..94b0580 100644 --- a/.claude/skills/business-plan-impact-review/SKILL.md +++ b/.claude/skills/business-plan-impact-review/SKILL.md @@ -1,3 +1,8 @@ +--- +name: business-plan-impact-review +description: Check every Business Plan change for downstream impact before accepting it — price moves projections, ARPU, LTV and positioning; persona moves GTM, UX and MVP scope; stack moves costs, roadmap and risks. Runs at WIZARD stage 2.8 when turning BP v0.0.1 into v0.0.2, and any time the BP is edited after approval. Use when the user says "mudei o preço", "troquei a persona", "cortei o escopo", "e se eu cobrar por assento?", or when `grow-sustainably` / `multi-ai-review` flag a pricing or packaging change. +--- + # Business Plan Impact Review Skill Use when revising BP v0.0.1 into v0.0.2 after user feedback. diff --git a/.claude/skills/cost-watchdog/SKILL.md b/.claude/skills/cost-watchdog/SKILL.md index aa7be73..9e47a72 100644 --- a/.claude/skills/cost-watchdog/SKILL.md +++ b/.claude/skills/cost-watchdog/SKILL.md @@ -1,6 +1,6 @@ --- name: cost-watchdog -description: Flag potentially expensive technical choices BEFORE they are committed. Watch for AI model selection, hosting tier upgrades, third-party services with metered pricing, and DB patterns that explode with scale. +description: Flag potentially expensive technical choices BEFORE they are committed — AI model selection, hosting tier upgrades, third-party services with metered pricing, and DB patterns that explode with scale. Preventive counterpart to `usage-monitor`, which tracks real spend after launch. Triggers when the user says "posso usar o Opus pra isso?", "qual plano eu contrato?", "isso vai ficar caro?", "quanto custa rodar isso?", or whenever a paid tier or metered API is about to enter the stack. --- # Cost Watchdog diff --git a/.claude/skills/decision-log/SKILL.md b/.claude/skills/decision-log/SKILL.md index 6718882..ed018d7 100644 --- a/.claude/skills/decision-log/SKILL.md +++ b/.claude/skills/decision-log/SKILL.md @@ -1,6 +1,6 @@ --- name: decision-log -description: Create session logs or ADRs to preserve why important decisions were made. +description: Record WHY a decision was made — including the alternatives rejected — as a session-log entry or an ADR. Use after any decision touching architecture, product scope, pricing, compliance, security, or release strategy, when `multi-ai-review` reconciles a disagreement, and when the user says "anota isso", "registra essa decisão", "por que a gente escolheu isso mesmo?", "não lembro por que fizemos assim". --- # Decision Log diff --git a/.claude/skills/feature-scaffold/SKILL.md b/.claude/skills/feature-scaffold/SKILL.md index a823ee3..9b96d2e 100644 --- a/.claude/skills/feature-scaffold/SKILL.md +++ b/.claude/skills/feature-scaffold/SKILL.md @@ -1,6 +1,6 @@ --- name: feature-scaffold -description: Create a feature-based folder structure and initial implementation plan. +description: Create a feature-based folder structure (components, actions, api, db, hooks, schemas, tests) plus an initial implementation plan, following `.claude/rules/feature-based-architecture.md`. Use when starting a new product feature during a coding sprint, and when the user says "vamos criar a tela de X", "quero adicionar tal funcionalidade", "onde eu coloco esse arquivo?", "como organizo isso?". --- # Feature Scaffold diff --git a/.claude/skills/first-100-users/SKILL.md b/.claude/skills/first-100-users/SKILL.md index e94a3ec..4074301 100644 --- a/.claude/skills/first-100-users/SKILL.md +++ b/.claude/skills/first-100-users/SKILL.md @@ -1,6 +1,6 @@ --- name: first-100-users -description: Get the first 100 real users for a vibe-coder SaaS without spending on ads. Hand-curated outreach, founder communities, niche-specific channels, retention check-ins. Activated after launch when the user asks "como pego os primeiros usuários", "ninguém tá usando", or after `launch-agent` Track A. +description: Get the first 100 real users for a vibe-coder SaaS without spending on ads. Hand-curated outreach, founder communities, niche-specific channels, retention check-ins. Activated after launch when the user asks "como pego os primeiros usuários", "ninguém tá usando", "como divulgo isso?", or after `launch-agent` Track A. Hand off to `grow-sustainably` once the project passes ~100 active users — this skill is conversation-driven and does not scale past that. --- # First 100 Users diff --git a/.claude/skills/os-self-test/SKILL.md b/.claude/skills/os-self-test/SKILL.md index 6cdb485..d5094c5 100644 --- a/.claude/skills/os-self-test/SKILL.md +++ b/.claude/skills/os-self-test/SKILL.md @@ -1,6 +1,6 @@ --- name: os-self-test -description: Verify the AI Dev Operating System is in a coherent state inside a project. Detects missing canonical files, broken cross-references, version drift, gitignore gaps, stale paths after a migration, and orphaned artifacts. Run after major edits to the OS or before opening a new sprint. +description: Verify the AI Dev Operating System is in a coherent state inside a project. Detects missing canonical files, broken cross-references, version drift, gitignore gaps, stale paths after a migration, and orphaned artifacts. Run after major edits to the OS, after renaming or moving canonical files, before opening a new sprint, before a release, and when the user says "tá tudo certo aqui?", "quebrou alguma coisa na estrutura?", "faz um check geral", "os links estão funcionando?". --- # OS Self-Test diff --git a/.claude/skills/privacy-audit/SKILL.md b/.claude/skills/privacy-audit/SKILL.md index 3026e00..ddbacf2 100644 --- a/.claude/skills/privacy-audit/SKILL.md +++ b/.claude/skills/privacy-audit/SKILL.md @@ -1,6 +1,6 @@ --- name: privacy-audit -description: Review features that touch personal data, sensitive data, auth, logs, exports, or deletion flows. +description: Review any feature that collects, stores, processes, exports, or displays personal data — answering the nine questions in `.claude/rules/privacy-audit.md` (what data, why, where, who can access, how controlled, retention, logs, deletion/export, policy impact). Mandatory before merging personal-data changes. Triggers on auth, user profiles, exports, analytics, logging, and when the user says "vou guardar o CPF", "preciso pedir o e-mail", "e a LGPD?", "posso salvar isso do usuário?". --- # Privacy Audit diff --git a/.claude/skills/product-brief/SKILL.md b/.claude/skills/product-brief/SKILL.md index 0b0bdfb..eb1894a 100644 --- a/.claude/skills/product-brief/SKILL.md +++ b/.claude/skills/product-brief/SKILL.md @@ -1,3 +1,8 @@ +--- +name: product-brief +description: Write docs/product/PRODUCT-BRIEF.md by reverse-engineering the approved prototype — every screen, the flow as actually clicked, and the gaps the prototype implied but never showed (empty states, errors, permissions, offline). Runs at WIZARD stage 4.1, after BP v0.0.2 and after a prototype direction is approved in Phase 3. Use when the user asks "o que exatamente a gente vai construir?", "quais telas o MVP tem?", "o que fica de fora?". +--- + # Product Brief Skill Runs at **Phase 4.1** of `WIZARD.md`. diff --git a/.claude/skills/project-genesis/SKILL.md b/.claude/skills/project-genesis/SKILL.md index 2d7c2d7..2b7ccae 100644 --- a/.claude/skills/project-genesis/SKILL.md +++ b/.claude/skills/project-genesis/SKILL.md @@ -1,3 +1,8 @@ +--- +name: project-genesis +description: Drive the full 5-phase Project Genesis Wizard, from raw idea to first coding sprint. Use when starting a new project from the AI Dev Operating System, when the user runs /project-start, or when they say "vamos começar um projeto novo", "tenho uma ideia de SaaS", "quero criar um app", "por onde eu começo?". Enforces the prototype-before-spec ordering (Phase 3 before Phase 4) and refuses to write code before Phase 5. +--- + # Project Genesis Skill Use this skill when starting a new project from the AI Dev Operating System. diff --git a/.claude/skills/prototype-lab/SKILL.md b/.claude/skills/prototype-lab/SKILL.md index 8c10677..ecc660b 100644 --- a/.claude/skills/prototype-lab/SKILL.md +++ b/.claude/skills/prototype-lab/SKILL.md @@ -1,3 +1,8 @@ +--- +name: prototype-lab +description: Build three genuinely distinct HTML/CSS/JS prototype directions — brand, color, typography, UI, UX — from BP v0.0.2 and the research, then extract the approved one into docs/product/DESIGN-DIRECTION.md. Runs at WIZARD Phase 3, BEFORE the Product Brief and Technical Plan. Use when the user says "quero ver como vai ficar", "me mostra umas ideias de layout", "qual vai ser a cara do produto?", "que cores a gente usa?", or runs /prototype-lab. +--- + # Prototype Lab Skill Create three distinct HTML/CSS/JS prototype directions using the same mock data. diff --git a/.claude/skills/release-check/SKILL.md b/.claude/skills/release-check/SKILL.md index f8f9360..c545368 100644 --- a/.claude/skills/release-check/SKILL.md +++ b/.claude/skills/release-check/SKILL.md @@ -1,19 +1,27 @@ --- name: release-check -description: Pre-release gate for tests, docs, changelog, privacy, security, and sprint closure. +description: Pre-release gate covering tests, build, docs, changelog, privacy, security, and sprint closure. Delegates to `verify-build-works`, `secrets-scan`, and `privacy-audit` rather than re-checking by hand. Run before tagging a release, before closing a sprint, before a first deploy, and when the user says "tá pronto pra lançar?", "posso subir isso?", "fecha a versão", "dá pra publicar?". --- # Release Check ## Required checks -- Tests pass. -- Lint/build pass. -- Changelog updated. -- Sprint doc updated. -- Session logs or ADRs created for important decisions. -- Privacy/security review complete when applicable. -- Coordinator review complete. +Do not re-implement checks that already have a skill. Delegate, then record the verdict. + +| Check | Delegate to | Blocking? | +|---|---|---| +| Tests pass | project test runner | yes | +| Build + dev server + main flow load | [`verify-build-works`](../verify-build-works/SKILL.md) | yes | +| No leaked secrets or credentials | [`secrets-scan`](../secrets-scan/SKILL.md) | yes | +| Personal-data changes reviewed | [`privacy-audit`](../privacy-audit/SKILL.md) | yes, when applicable | +| Changelog updated | — | yes | +| Sprint doc updated | [`sprint-management`](../sprint-management/SKILL.md) | yes | +| Session logs or ADRs for important decisions | [`decision-log`](../decision-log/SKILL.md) | warning | +| OS structure still coherent | [`os-self-test`](../os-self-test/SKILL.md) | warning | +| Coordinator review complete | `coordinator-agent` | yes | + +For a hard-to-reverse release decision (first public launch, pricing change shipping with the release, irreversible migration), run [`multi-ai-review`](../multi-ai-review/SKILL.md) before issuing a verdict. ## Output diff --git a/.claude/skills/research-waves/SKILL.md b/.claude/skills/research-waves/SKILL.md index 1b29e18..c887091 100644 --- a/.claude/skills/research-waves/SKILL.md +++ b/.claude/skills/research-waves/SKILL.md @@ -1,3 +1,8 @@ +--- +name: research-waves +description: Run the 3-wave research and validation process — Wave 1 competitor and market research, Wave 2 red team (devil's advocate, business/finance, technical/security), Wave 3 coordinator consolidation and BP writing. Runs at WIZARD stages 2.4–2.6, only after the user approves the plan. Use when the user asks "quem são meus concorrentes?", "esse mercado existe mesmo?", "isso tem furo?", "alguém já faz isso?", or runs /research-waves. Never fabricates market data. +--- + # Research Waves Skill Use for the 3-wave research and validation process. diff --git a/.claude/skills/secrets-discipline/SKILL.md b/.claude/skills/secrets-discipline/SKILL.md index be9b679..769acc3 100644 --- a/.claude/skills/secrets-discipline/SKILL.md +++ b/.claude/skills/secrets-discipline/SKILL.md @@ -1,6 +1,6 @@ --- name: secrets-discipline -description: Enforce safe handling of API keys, tokens, passwords, and any other secret in the project. Run when adding integrations, before commits, or when the user pastes a value that looks like a credential. +description: Enforce safe handling of API keys, tokens, passwords, and credentials — env files, `.gitignore` coverage, `.env.example` upkeep, rotation after exposure. This is the PREVENTIVE workflow; `secrets-scan` is the detection pass that finds what already leaked. Run when adding an integration, before commits, before a first deploy, and when the user pastes something that looks like a credential or says "essa é minha chave da OpenAI", "onde eu coloco esse token?", "posso commitar o .env?". --- # Secrets Discipline diff --git a/.claude/skills/secrets-scan/SKILL.md b/.claude/skills/secrets-scan/SKILL.md index aa21ad2..90f9a78 100644 --- a/.claude/skills/secrets-scan/SKILL.md +++ b/.claude/skills/secrets-scan/SKILL.md @@ -1,6 +1,6 @@ --- name: secrets-scan -description: Scan project changes for secrets, credentials, unsafe env handling, and accidental private data leaks. +description: Scan project changes for leaked secrets, credentials, unsafe env handling, and accidental private data. This is the DETECTION pass over what is already in the tree; `secrets-discipline` is the preventive workflow that stops it happening. Run before every commit, before every release (invoked by `release-check`), and when the user says "vazou alguma chave aí?", "isso tá seguro pra subir?", "esqueci alguma senha no código?". --- # Secrets Scan diff --git a/.claude/skills/sprint-management/SKILL.md b/.claude/skills/sprint-management/SKILL.md index fbd5445..ad0180a 100644 --- a/.claude/skills/sprint-management/SKILL.md +++ b/.claude/skills/sprint-management/SKILL.md @@ -1,6 +1,6 @@ --- name: sprint-management -description: Manage sprint lifecycle: open sprint, maintain sprint branch/docs, close sprint, update changelog, and prepare tags. +description: Manage the sprint lifecycle — open a sprint, maintain the sprint branch and docs, close it, update the changelog, and prepare tags. Powers /sprint-start, /sprint-plan and /sprint-close. Use when the user says "vamos começar a sprint", "fecha a sprint", "o que tá nessa sprint?", "terminei essa etapa", "qual o próximo ciclo?". --- # Sprint Management diff --git a/.claude/skills/sprint-roadmap/SKILL.md b/.claude/skills/sprint-roadmap/SKILL.md index cdc4bcc..bc43900 100644 --- a/.claude/skills/sprint-roadmap/SKILL.md +++ b/.claude/skills/sprint-roadmap/SKILL.md @@ -1,3 +1,8 @@ +--- +name: sprint-roadmap +description: Create a 14–20 sprint roadmap in docs/SPRINTS.md plus individual sprint files, starting with Sprint -1 (consolidating the approved prototype into a design system). Runs at WIZARD stage 4.4, after BP v0.0.2, the approved prototype direction, the Product Brief, and the Technical Plan all exist. Use when the user asks "qual a ordem das coisas?", "quanto tempo isso leva?", "o que eu faço primeiro?", or runs /sprint-plan. +--- + # Sprint Roadmap Skill Runs at **Phase 4.4** of `WIZARD.md` — last step before coding. diff --git a/.claude/skills/verify-build-works/SKILL.md b/.claude/skills/verify-build-works/SKILL.md index f94c62a..8a9d70c 100644 --- a/.claude/skills/verify-build-works/SKILL.md +++ b/.claude/skills/verify-build-works/SKILL.md @@ -1,6 +1,6 @@ --- name: verify-build-works -description: Smoke-test that the project still builds, the dev server starts, and the main user flow loads after a change. Run after every non-trivial edit, after a rollback, before a commit, and before pushing to remote. +description: Smoke-test that the project still builds, the dev server starts, and the main user flow loads after a change. Run after every non-trivial edit, after a rollback (`rollback-safe`), after a fix from `bug-triage-agent`, before a commit, before pushing, and as part of `release-check`. Also when the user says "ainda tá funcionando?", "roda aí pra ver", "testa se não quebrou", "tá de pé?". --- # Verify Build Works diff --git a/CHANGELOG.md b/CHANGELOG.md index 5b86b20..76c526c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,11 +10,59 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), > v0.5.0 is being delivered in four independent PRs. This section accumulates until the last one lands, then gets cut as a release. > -> - [x] **PR 1** — WIZARD restructured into 5 phases, prototype before spec *(this entry)* +> - [x] **PR 1** — WIZARD restructured into 5 phases, prototype before spec > - [ ] **PR 2** — Pitch artifact + "BP/Pitch online?" decision -> - [ ] **PR 3** — Skill frontmatter fix + audit +> - [x] **PR 3** — Skill frontmatter fix + audit > - [ ] **PR 4** — awesome-selfhosted catalog + managed-vs-self-hosted question +### Fixed — six core wizard skills were invisible to auto-invocation + +A `SKILL.md` advertises itself through the `description` field in its YAML frontmatter. Six skills had **no frontmatter at all**, so their entire advertised description was their own H1 title — "Product Brief Skill", "Research Waves Skill", and so on. + +They were precisely the six that drive the wizard: `project-genesis`, `research-waves`, `business-plan-impact-review`, `product-brief`, `prototype-lab`, `sprint-roadmap`. The twenty peripheral skills from the v0.3.0 vibe-coder pack all had proper frontmatter. **The oldest and most load-bearing skills were the least discoverable.** + +Worst case: five live files instruct Claude to invoke `business-plan-impact-review` by name, while the skill itself could not describe when it applied. + +### Changed — every skill description now states trigger conditions + +Ten further skills had frontmatter but zero trigger phrases: `cost-watchdog`, `decision-log`, `feature-scaffold`, `os-self-test`, `privacy-audit`, `release-check`, `secrets-discipline`, `secrets-scan`, `sprint-management`, `verify-build-works`. + +A description saying "Review features that touch personal data" is accurate and useless. What makes `privacy-audit` fire is `"vou guardar o CPF"` / `"e a LGPD?"`. All 26 descriptions now name conditions, not just behavior. + +| Metric | Before | After | +|---|---|---| +| Skills with frontmatter | 20 / 26 | **26 / 26** | +| Skills with trigger phrases | 10 / 26 | **26 / 26** | + +### Fixed — three overlapping skill pairs now cross-link both ways + +The asymmetry always ran the same direction — the newer skill knew about the older, never the reverse. + +- `secrets-discipline` ↔ `secrets-scan` — preventive workflow vs. detection pass. Neither said so; the distinction lived only in `docs/registry/packs/gitleaks.md`. +- `cost-watchdog` ↔ `usage-monitor` — preventive vs. post-launch, despite a v0.3.0 session log claiming they already cross-linked. +- `first-100-users` ↔ `grow-sustainably` — `grow-sustainably` referenced its predecessor in 7 places; `first-100-users` referenced its successor in **zero**, so founders reaching 100 users were never routed forward. + +### Changed — `release-check` delegates instead of duplicating + +Its checklist said "Lint/build pass" and "Privacy/security review complete" while `verify-build-works`, `secrets-scan`, and `privacy-audit` sat unreferenced. It is now a delegation table naming the responsible skill per check, with blocking vs. warning severity and a `multi-ai-review` escalation for hard-to-reverse releases. Closes an open item from `session-log/2026-05-01-v0.4.3-quick-wins.md:75`. + +### Added + +- `docs/skill-audit-2026-08-08.md` — full audit of all 26 skills, with the verification script. + +### Changed — `docs/skill-system.md` rewritten + +Its example table listed `design-prototype` and `security-review`, **neither of which exists**. Replaced with the real inventory of 26 grouped by job, plus a mandatory-frontmatter section explaining why `description` must carry trigger conditions. + +### Known gaps, recorded not fixed + +- **No `technical-plan` skill.** `product-brief` drives stage 4.1 and `sprint-roadmap` drives 4.4; stage 4.2 has only `WIZARD.md` prose. +- `templates/project/CLAUDE.md:62` advertises `/release-check`, which does not exist in `.claude/commands/`. + +### Note on GitHub provenance + +Checked, and **no change needed**. 23 of 26 skills are original to this repo. The three with declared upstream inspiration (`multi-ai-review`, `processize`, `grow-sustainably`) already link to registry packs carrying the URLs — the chain is `skill → registry pack → upstream URL`, which keeps license and review status in one place. A per-skill `source:` field was considered and declined as duplication. + ### Changed — WIZARD is now 5 phases, and the prototype comes before the spec **Breaking for anyone referencing stages by number.** The four competing numberings (`README.md` 15 steps, `WIZARD.md` overview 17 items, `WIZARD.md` stage headings `0`–`14`, `docs/wizard/` files `01`–`08`) were unified into one: diff --git a/docs/skill-audit-2026-08-08.md b/docs/skill-audit-2026-08-08.md new file mode 100644 index 0000000..49e219b --- /dev/null +++ b/docs/skill-audit-2026-08-08.md @@ -0,0 +1,147 @@ +# Skill audit — 2026-08-08 + +Full review of all 26 skills in `.claude/skills/`, answering three questions: + +1. Can Claude actually find each skill when it is needed? +2. Do any two skills overlap without saying so? +3. Where does each skill come from, and is that attribution reachable? + +Companion to [`skill-system.md`](skill-system.md), which explains what a skill *is*. This document records what the skills *were*, as of this date. + +--- + +## Finding 1 — Six skills were invisible to auto-invocation + +`SKILL.md` files declare themselves through YAML frontmatter. The `description` field is what Claude reads to decide whether a skill applies. With no frontmatter, the harness falls back to the H1 heading. + +Six skills had no frontmatter at all. Their entire advertised description was their own title: + +| Skill | Description Claude saw before | Body length | +|---|---|---| +| `business-plan-impact-review` | "Business Plan Impact Review Skill" | 7 lines | +| `product-brief` | "Product Brief Skill" | 24 lines | +| `project-genesis` | "Project Genesis Skill" | 21 lines | +| `prototype-lab` | "Prototype Lab Skill" | 22 lines | +| `research-waves` | "Research Waves Skill" | 7 lines | +| `sprint-roadmap` | "Sprint Roadmap Skill" | 17 lines | + +**These are the six core wizard skills.** Every phase of the Project Genesis Wizard is driven by one of them. The twenty peripheral skills — added later in the v0.3.0+ vibe-coder pack — all had proper frontmatter with Portuguese trigger phrases. + +The oldest and most important skills were the invisible ones. + +### Worst case: `business-plan-impact-review` + +Five live files instruct Claude to invoke it by name — `grow-sustainably/SKILL.md:100,161`, `multi-ai-review/SKILL.md:19,145`, `commands/multi-ai-review.md:49`, `commands/grow-sustainably.md:25,44`, `README.md:221`. Other skills were routing work to a skill that could not describe itself. + +**Fixed.** All 26 now carry `name` and `description`. + +--- + +## Finding 2 — Ten skills had no trigger phrases + +A description that states what a skill *does* is not the same as one that states when to *reach for it*. The user of this OS is a Brazilian vibe coder who types in Portuguese; a skill with no Portuguese trigger phrase effectively waits to be called by name. + +Ten of the twenty frontmattered skills had zero quoted trigger phrases: + +`cost-watchdog`, `decision-log`, `feature-scaffold`, `os-self-test`, `privacy-audit`, `release-check`, `secrets-discipline`, `secrets-scan`, `sprint-management`, `verify-build-works` + +Six of those ten are the v0.2.0-era originals, recognizable by body length: `secrets-scan` (14 lines), `decision-log` (17), `release-check` (25), `privacy-audit` (28), `feature-scaffold` (30), `sprint-management` (33). The vibe-coder pack skills run 60–162 lines with rich triggers. **Two generations of skill authorship, never reconciled.** + +### Evidence this had a real cost + +`os-self-test` exists to validate OS coherence. Three separate session logs record that it *was not run* when it should have been: + +- `session-log/2026-04-30-registry-framework-v0.4.0.md:77` +- `session-log/2026-05-09-registry-additions.md:74` +- `session-log/2026-08-08-v0.5.0-wizard-5-phases.md:103` + +A verification skill nobody remembers to invoke is a verification skill that does not exist. + +**Fixed.** All 26 descriptions now carry trigger phrases. 26/26 verified. + +--- + +## Finding 3 — Overlapping pairs, documented one-way or not at all + +| Pair | Relationship | Was it stated? | +|---|---|---| +| `secrets-discipline` ↔ `secrets-scan` | preventive workflow vs. detection pass | **Neither said so.** The distinction existed only in `docs/registry/packs/gitleaks.md:49` — an external pack file. | +| `cost-watchdog` ↔ `usage-monitor` | preventive vs. post-launch tracking | **One-way.** `usage-monitor` linked back; `cost-watchdog` did not — despite `session-log/2026-04-28-vibe-coder-pack-v0.3.0.md:15` claiming they "cross-link to each other". | +| `first-100-users` ↔ `grow-sustainably` | 0→100 vs. 100→1000 | **One-way, badly.** `grow-sustainably` referenced its predecessor in 7 places; `first-100-users` referenced its successor in **zero**. A founder who reached 100 users was never routed forward. | + +**Fixed.** All three pairs now state the relationship from both sides. + +--- + +## Finding 4 — `release-check` did not delegate + +`release-check` listed "Lint/build pass" and "Privacy/security review complete when applicable" as manual checklist items, while `verify-build-works`, `secrets-scan`, and `privacy-audit` existed to do exactly those things — unreferenced. + +An open item from `session-log/2026-05-01-v0.4.3-quick-wins.md:75` — *"Optionally cross-link `/multi-ai-review` from existing release-gate skills"* — had also never been actioned. + +**Fixed.** The checklist is now a delegation table naming the responsible skill per check, with blocking vs. warning severity, plus a `multi-ai-review` escalation for hard-to-reverse releases. + +--- + +## Finding 5 — GitHub provenance is present, via the registry + +The question was whether skills carry references to their upstream GitHub repos. + +**23 of 26 skills are original to this repository** and have no upstream to credit. Three have declared inspiration, and all three already link to a registry pack that carries the URL: + +| Skill | Links to | Which contains | +|---|---|---| +| `multi-ai-review` | `docs/registry/packs/gstack.md` | `https://github.com/garrytan/gstack` | +| `processize` | `docs/registry/packs/slavingia-skills.md` | `https://github.com/slavingia/skills` | +| `grow-sustainably` | both of the above | both URLs | + +**This is working as designed and needs no change.** The pattern is `skill → registry pack → upstream URL`, which keeps license and review status in one place rather than duplicating URLs across skill files. Repo-wide attribution additionally lives in `ATTRIBUTIONS.md`, `UPSTREAM-SOURCES.md`, and `docs/origin-map.md`. + +A per-skill `source:` frontmatter field was considered and **declined** — it would duplicate the registry with no added reachability. + +--- + +## Coverage gaps found but NOT fixed + +These are real findings that were out of scope for this pass. Recorded so they are not rediscovered later. + +### There is no `technical-plan` skill + +Every other Phase 4 artifact has a driving skill: + +| Artifact | Skill | +|---|---| +| `PRODUCT-BRIEF.md` | `product-brief` ✅ | +| `SPRINTS.md` | `sprint-roadmap` ✅ | +| `TECHNICAL-PLAN.md` | **none** ❌ | + +This mirrors a gap that existed in `docs/wizard/` until v0.5.0 PR 1, which had files for the Product Brief and sprint planning but none for the Technical Plan. The Technical Plan is currently produced by `WIZARD.md` stage 4.2 prose alone. + +### `templates/project/CLAUDE.md:62` advertises a command that does not exist + +It lists `/release-check` in its command table. `.claude/commands/` contains eleven commands; `release-check.md` is not among them. Either the command should be created or the template row removed. + +### `docs/skill-system.md` example table is stale + +Lines 14–22 list eight illustrative skills, including `design-prototype` and `security-review` — **neither exists** in `.claude/skills/`. The table predates the current inventory. + +--- + +## Final state + +| Metric | Before | After | +|---|---|---| +| Skills with frontmatter | 20 / 26 | **26 / 26** | +| Skills with trigger phrases | 10 / 26 | **26 / 26** | +| Overlapping pairs documented both ways | 0 / 3 | **3 / 3** | +| `release-check` delegating to sibling skills | no | **yes** | + +Verification command: + +```bash +for f in .claude/skills/*/SKILL.md; do + d=$(awk '/^---$/{c++; next} c==1 && /^description:/{print}' "$f") + q=$(( $(echo "$d" | grep -o '"' | wc -l) / 2 )) + [ "$q" -eq 0 ] && echo "no trigger: $(basename $(dirname $f))" +done +``` diff --git a/docs/skill-system.md b/docs/skill-system.md index 39902ec..206bf49 100644 --- a/docs/skill-system.md +++ b/docs/skill-system.md @@ -8,18 +8,85 @@ A skill tells the agent how to execute a workflow. --- -## Examples +## The 26 skills, by job + +Current inventory. For the full audit of how discoverable each one is, see [`skill-audit-2026-08-08.md`](skill-audit-2026-08-08.md). + +**Wizard core** — one per phase of `WIZARD.md`: + +| Skill | Stage | Purpose | +|---|---|---| +| `project-genesis` | all | Drive the full 5-phase wizard | +| `research-waves` | 2.4–2.6 | Market, competitor, red team, consolidation | +| `business-plan-impact-review` | 2.8 | Check BP changes for downstream impact | +| `prototype-lab` | 3.2 | Three visual directions, then design tokens | +| `product-brief` | 4.1 | Reverse-engineer the brief from the prototype | +| `sprint-roadmap` | 4.4 | 14–20 sprint roadmap | +| `registry-pick` | 3.1 + 4.3 | Recommend external packs (design pass, stack pass) | + +> There is no `technical-plan` skill. Stage 4.2 is currently driven by `WIZARD.md` prose alone — see the audit's coverage-gap section. + +**Build and ship:** + +| Skill | Purpose | +|---|---| +| `feature-scaffold` | Create a feature-based folder structure | +| `sprint-management` | Open, track, and close sprints | +| `verify-build-works` | Smoke-test build, dev server, main flow | +| `rollback-safe` | Undo the last AI change without losing work | +| `deploy-vercel-supabase` | First production deploy | +| `release-check` | Pre-release gate, delegating to the skills below | + +**Safety and compliance:** + +| Skill | Purpose | +|---|---| +| `secrets-discipline` | Preventive — safe credential handling | +| `secrets-scan` | Detection — find what already leaked | +| `privacy-audit` | Personal-data review against the nine questions | +| `multi-ai-review` | Second opinion on hard-to-reverse decisions | + +**Money and growth:** + +| Skill | Purpose | +|---|---| +| `cost-watchdog` | Preventive — flag expensive choices before they ship | +| `usage-monitor` | Reactive — track real spend after launch | +| `first-100-users` | 0 → 100 users, no ads | +| `grow-sustainably` | 100 → 1000 without burning out | + +**Working with a vibe coder:** | Skill | Purpose | |---|---| -| sprint-management | Open, track, and close sprints | -| feature-scaffold | Create a new feature structure | -| privacy-audit | Review data processing and privacy implications | -| secrets-scan | Check for leaked secrets | -| release-check | Validate a release before tagging | -| decision-log | Create a session log for major decisions | -| design-prototype | Guide AI-generated UI using design systems | -| security-review | Run a structured security review | +| `daily-standup` | 4-bullet "where we left off" briefing | +| `plain-portuguese-explainer` | Translate jargon into actionable Portuguese | +| `decision-log` | Record why a decision was made | +| `processize` | Codify a manually-validated workflow | +| `os-self-test` | Verify the OS is internally coherent | + +## Paired skills + +Three pairs cover the same territory from opposite ends. Each states the relationship in its own description, so invoking one surfaces the other: + +| Preventive / early | Reactive / late | +|---|---| +| `secrets-discipline` | `secrets-scan` | +| `cost-watchdog` | `usage-monitor` | +| `first-100-users` | `grow-sustainably` | + +## Frontmatter is mandatory + +Every `SKILL.md` must open with YAML frontmatter: + +```yaml +--- +name: skill-name +description: What it does, when to reach for it, and the Portuguese phrases that should trigger it. +--- +``` + +Without `description`, the harness falls back to the H1 heading — which means the skill is effectively invisible unless called by name. The `description` is the only thing Claude reads when deciding whether a skill applies, so it must contain **trigger conditions**, not just a summary of behavior. --- diff --git a/session-log/2026-08-08-v0.5.0-skills-audit.md b/session-log/2026-08-08-v0.5.0-skills-audit.md new file mode 100644 index 0000000..8224254 --- /dev/null +++ b/session-log/2026-08-08-v0.5.0-skills-audit.md @@ -0,0 +1,63 @@ +# 2026-08-08 — v0.5.0 PR 3: skill frontmatter fixed, all 26 audited + +Full findings live in [`docs/skill-audit-2026-08-08.md`](../docs/skill-audit-2026-08-08.md). This entry records the reasoning and the choices that were *not* obvious. + +## What prompted it + +The user asked whether the skills "estão bem inseridas para serem chamadas quando forem necessárias" — i.e. whether Claude can actually find them. That is a question about the `description` field, not about skill content. + +## What was true before + +Two defects, both invisible from inside the repo: + +1. **Six skills had no YAML frontmatter.** Their advertised description was their own H1 title. They were the six core wizard skills — `project-genesis`, `research-waves`, `business-plan-impact-review`, `product-brief`, `prototype-lab`, `sprint-roadmap`. +2. **Ten more had frontmatter but no trigger phrases.** They described what they do, never when to reach for them. + +So 16 of 26 skills were, to varying degrees, waiting to be called by name. + +## Why the split was exactly where it was + +Not random. Body length predicts it: + +| Generation | Bodies | Frontmatter | Triggers | +|---|---|---|---| +| v0.2.0 originals | 7–33 lines | often absent | none | +| v0.3.0+ vibe-coder pack | 58–162 lines | always present | rich, in Portuguese | + +The vibe-coder pack was written with auto-invocation in mind. The originals predate that concern and were never retrofitted. **The oldest and most load-bearing skills were the least discoverable.** + +## Decisions worth preserving + +1. **Trigger phrases are the point, not prose quality.** A description saying "Review features that touch personal data" is accurate and useless. What makes `privacy-audit` fire is `"vou guardar o CPF"`, `"e a LGPD?"`. Every description now names conditions, not just behavior. Enforced going forward by a new mandatory-frontmatter section in `docs/skill-system.md`. + +2. **Rejected the `source:` frontmatter field.** The user was offered it and declined, and the audit confirms the instinct was right: the three skills with upstream inspiration (`multi-ai-review`, `processize`, `grow-sustainably`) already link to registry packs that carry the GitHub URLs. The chain `skill → registry pack → upstream URL` keeps license and review status in one place. A `source:` field would duplicate it and immediately drift. + + **Answer to "as skills têm as referências dos respectivos githubs?"** — yes, for the three that have an upstream. The other 23 are original to this repo and have nothing to credit. + +3. **Fixed `release-check` by delegation, not by rewriting.** It listed "Lint/build pass" and "Privacy/security review complete" as manual items while `verify-build-works`, `secrets-scan`, and `privacy-audit` sat unreferenced. Converting the checklist into a delegation table with named owners and blocking/warning severity was better than expanding the checklist — it makes the gate composable and closes an open item from `session-log/2026-05-01-v0.4.3-quick-wins.md:75` that had sat for three months. + +4. **Three overlapping pairs now cross-link both ways.** The asymmetry was consistently in the same direction: the newer skill knew about the older one, never the reverse. `grow-sustainably` referenced `first-100-users` in 7 places; `first-100-users` referenced its successor in zero. A founder who hit 100 users was never routed forward. + +5. **`secrets-discipline` vs `secrets-scan` was documented only in an external file.** The preventive/detection distinction existed solely in `docs/registry/packs/gitleaks.md:49` — a pack one-pager. Neither skill said it. Now both do. + +## Evidence the defect had a real cost + +`os-self-test` exists to catch exactly the kind of drift this PR fixed. Three session logs record it *not being run* when it would have helped: `2026-04-30:77`, `2026-05-09:74`, and PR 1 of today at `:103`. It had no trigger phrase, so nothing surfaced it. Self-referential proof of the problem. + +## Verification performed + +- `frontmatter: 26/26`, `triggers: 26/26` via the script recorded at the end of the audit doc. +- All relative `.md` links across the repo resolve — zero broken. +- No `name:` key was altered, so every existing reference to a skill by slug remains valid. + +## Coverage gaps found and deliberately NOT fixed + +Building these is new work, not an update to existing skills, so they were left out of a PR scoped to "fix the 6, audit the 20": + +1. **No `technical-plan` skill.** `product-brief` drives stage 4.1 and `sprint-roadmap` drives 4.4, but stage 4.2 has only `WIZARD.md` prose. This mirrors the `docs/wizard/` gap that PR 1 closed — the Technical Plan keeps being the artifact nobody gives a home to. +2. **`templates/project/CLAUDE.md:62` advertises `/release-check`**, which does not exist in `.claude/commands/` (11 commands, not among them). +3. **`docs/skill-system.md` listed two non-existent skills** (`design-prototype`, `security-review`). Fixed here as a side effect, since the file was being edited anyway. + +## Open question + +Gaps 1 and 2 point at the same thing: the Technical Plan and the release gate are the two workflows with the weakest tooling. Worth deciding whether `technical-plan` becomes a skill in v0.5.1 or the Technical Plan stays prose-driven on purpose. diff --git a/session-log/INDEX.md b/session-log/INDEX.md index 54f1e5c..fa65380 100644 --- a/session-log/INDEX.md +++ b/session-log/INDEX.md @@ -6,6 +6,7 @@ Each entry captures the reasoning behind a material decision: what was true befo | Date | Topic | File | |---|---|---| +| 2026-08-08 | v0.5.0 PR 3 — skill audit: 6 core wizard skills had no frontmatter (invisible to auto-invocation), 10 more had no trigger phrases; 3 overlapping pairs cross-linked; `release-check` converted to a delegation table | [`2026-08-08-v0.5.0-skills-audit.md`](2026-08-08-v0.5.0-skills-audit.md) | | 2026-08-08 | v0.5.0 PR 1 — WIZARD restructured into 5 phases (1:1 with commit tags), Prototype Lab moved before Product Brief/Technical Plan, fractional stages eliminated, `registry-pick` split into design + stack passes | [`2026-08-08-v0.5.0-wizard-5-phases.md`](2026-08-08-v0.5.0-wizard-5-phases.md) | | 2026-05-09 | Registry additions — 14 new packs cataloged, 3 refreshed (Phase 2 cadence) | [`2026-05-09-registry-additions.md`](2026-05-09-registry-additions.md) | | 2026-05-04 | v0.4.5 course vertical — workshop em 3 aulas (Experience Learning Perestroika) + 2 sistemas planejados + easter egg `[STAGE:X]` | [`2026-05-04-v0.4.5-course-vertical.md`](2026-05-04-v0.4.5-course-vertical.md) | From 659d96b51a93451cc160cd512078a6d5d97a8fe7 Mon Sep 17 00:00:00 2001 From: lglucas Date: Sat, 8 Aug 2026 14:26:43 -0300 Subject: [PATCH 02/14] =?UTF-8?q?feat(wizard):=20est=C3=A1gio=202.9=20?= =?UTF-8?q?=E2=80=94=20artefato=20Pitch=20e=20a=20pergunta=20do=20BP=20onl?= =?UTF-8?q?ine?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit O OS não tinha artefato de Pitch nenhum. docs/business/ produzia só o BUSINESS-PLAN.md, e a palavra "pitch" aparecia apenas em registry packs descrevendo caso de uso de outras ferramentas. Colocar "BP e Pitch online" exigia inventar o Pitch primeiro. O novo estágio 2.9, no fim da Fase 2, faz duas coisas: 1. Escreve docs/business/PITCH.md — dez seções derivadas do BP v0.0.2. O pitch DERIVA e nunca ACRESCENTA: toda afirmação precisa já existir no BP. Se cabe no pitch mas falta no BP, o BP é que está incompleto. 2. Pergunta se BP e Pitch devem ficar online dentro do produto — como SUGESTÃO, não default, com três opções. "Nada online por enquanto" é resposta completa e encerra o estágio. Inserir o 2.9 renumerou ZERO estágios — primeiro teste da estrutura de fases entregue no PR 1, um commit depois. Gate de redação obrigatório antes de publicar qualquer coisa. Nunca vão ao ar sem aprovação explícita: projeções financeiras, unit economics, preço não anunciado, status de captação, registro interno de riscos, termos com fornecedores, teardown de concorrente e personas rastreáveis a entrevistado real. Três têm consequência além de vergonha: - Persona de entrevista real é dado pessoal (LGPD). Consentir em ser entrevistado não é consentir em ser publicado. - Teardown de concorrente convida retaliação jurídica e de imprensa. - Número publicado vira compromisso, cobrado depois em diligência. Também: - .claude/skills/pitch/SKILL.md — 27ª skill, pra que o estágio seja auto-invocável (a auditoria do PR 3 apontou estágio sem skill como defeito). - .claude/rules/privacy-audit.md ganha seção tratando publicação como forma de processamento, incluindo analytics na página pública, que reabre as nove perguntas. - Consequências roteadas pras fases donas: rotas no Product Brief (4.1), público-vs-gated e robots.txt no Technical Plan (4.2), analytics no privacy-audit, página como ativo de first-100-users/launch-agent. fix: a lista de artefatos do CLAUDE.md não tinha sido aplicada no PR 1 — o edit bateu no gate e a retentativa reaplicou outro edit. Corrigida aqui, com todos os artefatos na ordem de produção e sua fase. Co-Authored-By: Claude Opus 5 (1M context) --- .claude/rules/documentation-layers.md | 1 + .claude/rules/privacy-audit.md | 12 ++ .claude/skills/pitch/SKILL.md | 110 ++++++++++++++++++ CHANGELOG.md | 42 ++++++- CLAUDE.md | 16 ++- README.md | 2 + WIZARD.md | 83 +++++++++++++ docs/documentation-layers.md | 1 + docs/skill-system.md | 3 +- docs/wizard/phase-2-ideacao.md | 40 ++++++- .../2026-08-08-v0.5.0-pitch-publication.md | 80 +++++++++++++ session-log/INDEX.md | 1 + templates/business/PITCH.template.md | 97 +++++++++++++++ 13 files changed, 478 insertions(+), 10 deletions(-) create mode 100644 .claude/skills/pitch/SKILL.md create mode 100644 session-log/2026-08-08-v0.5.0-pitch-publication.md create mode 100644 templates/business/PITCH.template.md diff --git a/.claude/rules/documentation-layers.md b/.claude/rules/documentation-layers.md index 4514c1b..550168f 100644 --- a/.claude/rules/documentation-layers.md +++ b/.claude/rules/documentation-layers.md @@ -3,6 +3,7 @@ Each document has one responsibility: - `BUSINESS-PLAN.md`: business narrative. +- `PITCH.md`: the business narrative compressed to ten sections, derived from the BP — plus the record of what was approved for public publication. Never adds a claim the BP does not make. - `DESIGN-DIRECTION.md`: the approved prototype direction — tokens, screens, flow. Written in Phase 3, read by Phase 4. - `PRODUCT-BRIEF.md`: operational product understanding, reverse-engineered from the prototype. - `TECHNICAL-PLAN.md`: architecture, stack, security, tests. diff --git a/.claude/rules/privacy-audit.md b/.claude/rules/privacy-audit.md index c98415a..6782ae3 100644 --- a/.claude/rules/privacy-audit.md +++ b/.claude/rules/privacy-audit.md @@ -13,3 +13,15 @@ Any feature that collects, stores, processes, exports, or displays personal data 9. Does this change require documentation, policy, or consent updates? Do not merge personal-data changes without a privacy review. + +## Publishing documents counts as processing + +WIZARD stage 2.9 lets a project put its Business Plan and Pitch on a public URL. That is a personal-data decision, not only an editorial one. Before anything is published, answer: + +1. **Are any personas traceable to a real person?** "Marina, 34, gerente de clínica em Porto Alegre" is personal data when Marina is someone you actually interviewed. Generalize, or get documented consent. +2. **Did the interviewees agree to be described publicly?** Consent to be interviewed is not consent to be published. +3. **Does the team section expose more than those people agreed to?** Names, photos, and roles are personal data too. +4. **Will the page have analytics?** Visitor tracking on a public page is personal-data collection and re-triggers all nine questions above. +5. **Can it be unpublished?** Not in practice — search engines, archives, and screenshots outlive the page. Treat publication as permanent. + +The full redaction gate lives in `.claude/skills/pitch/SKILL.md` and the `PITCH.md` template. diff --git a/.claude/skills/pitch/SKILL.md b/.claude/skills/pitch/SKILL.md new file mode 100644 index 0000000..9eb1a8d --- /dev/null +++ b/.claude/skills/pitch/SKILL.md @@ -0,0 +1,110 @@ +--- +name: pitch +description: Derive a 10-section pitch from BP v0.0.2 into docs/business/PITCH.md, then ask the founder whether the BP and Pitch should live online inside the product (/pitch, /investors) — running a redaction gate over what must never go public. Runs at WIZARD stage 2.9. Use when the user says "preciso de um pitch", "vou apresentar pra investidor", "quero pôr o BP no site", "dá pra deixar isso público?", "como resumo tudo isso em 10 slides?". +--- + +# Pitch + +Two jobs, in order: compress the Business Plan into something a person will sit through, then decide — explicitly — whether it goes on the public internet. + +Runs at **WIZARD stage 2.9**, after BP v0.0.2 is accepted and before Phase 3. + +--- + +## Job 1 — Write the pitch + +Source: `docs/business/BUSINESS-PLAN.md` v0.0.2. Template: `templates/business/PITCH.template.md`. Output: `docs/business/PITCH.md`. + +**The pitch derives from the BP. It never adds to it.** + +If a claim belongs in the pitch but is not in the BP, that is a signal the BP is incomplete — go back and fix the BP, then re-derive. A pitch that says something the BP does not is how founders end up contradicting their own diligence materials. + +Ten sections maximum. If it does not fit, the problem is the argument, not the format. + +--- + +## Job 2 — Ask the publication question + +**This is a suggestion, not a default.** Most founders never consider putting the BP online. The skill's job is to put the option on the table with honest trade-offs and then accept whatever the user decides. "Not now" is a complete, valid answer. + +Present all three options: + +| Option | What it means | +|---|---| +| **(a) Tudo público** | BP + Pitch on a public URL, indexed | +| **(b) Público enxuto + completo gated** | Trimmed public page; full version behind login or a secret link | +| **(c) Nada online por enquanto** | Decide again after launch | + +State both sides. Do not sell it. + +**In favor:** a link beats a PDF attachment; builds authority; lets an investor, partner, or large customer qualify themselves without a meeting; kills the problem of a stale version circulating. + +**Against:** competitors read everything, including what you consider an advantage; published numbers become expectations you get held to; it requires maintenance, and a stale public BP is worse than none; several sections cannot go out at all. + +--- + +## The redaction gate + +Mandatory when the answer is (a) or (b). Publishing a Business Plan means publishing whatever is inside it. + +| Usually safe | Do NOT publish without explicit, considered approval | +|---|---| +| Problem and solution narrative | Financial projections, burn, runway | +| Positioning and differentiation | Unit economics — CAC, LTV, margins | +| Market context with **public** sources | Pricing not yet announced | +| Personas, generalized | Personas traceable to a real interviewee | +| Directional roadmap | Dated delivery commitments | +| Team and mission | Fundraising status, valuation, cap table | +| Metrics you will stand behind | Internal risk register | +| — | Supplier and partner terms | +| — | Competitor teardown naming specific weaknesses | + +Three rows carry consequences beyond embarrassment: + +1. **Personas from real interviews are personal data.** "Marina, 34, gerente de clínica em Porto Alegre" is an LGPD problem when Marina is someone you actually interviewed. Invoke [`privacy-audit`](../privacy-audit/SKILL.md) before publishing any persona or team entry. +2. **Competitor teardowns invite legal and PR retaliation.** "We are the one that does X" is positioning. "Their onboarding is broken" is a liability. +3. **Published numbers become commitments.** A projection on a public page gets quoted back during diligence, months later, when it is no longer true. + +Get row-by-row sign-off. Record it in the redaction table inside `PITCH.md` — Phase 4 builds the page from that table. + +--- + +## Route the downstream consequences + +If the answer is (a) or (b), this stops being a document decision and becomes product surface. Record it so later phases pick it up: + +| Consequence | Lands in | When | +|---|---|---| +| Routes (`/pitch`, `/investors`), navigation placement | Product Brief | stage 4.1 | +| Public vs. gated, auth model, `robots.txt`, SEO, PDF export | Technical Plan | stage 4.2 | +| Analytics on who views the page — **personal data** | [`privacy-audit`](../privacy-audit/SKILL.md) | before shipping | +| The page as acquisition and credibility asset | [`first-100-users`](../first-100-users/SKILL.md), `launch-agent` | post-launch | +| Who maintains it and how often | `PITCH.md` maintenance owner field | now | + +The last row is the one that gets skipped. An unowned public BP goes stale in a quarter. If nobody owns it, the honest answer is (c). + +--- + +## Outputs + +```txt +docs/business/PITCH.md +session-log/-pitch-and-publication-decision.md +``` + +The session-log entry must record **which option was chosen and why** — including a "not now", which is the answer most likely to be revisited later. + +--- + +## Re-run when + +- The BP changes materially — the pitch is derived, so it drifts. [`business-plan-impact-review`](../business-plan-impact-review/SKILL.md) should flag this. +- The founder's audience changes (accelerator application, then investors, then enterprise buyers). +- A previously-deferred publication decision comes back up, typically around launch. + +## Related + +- Source document: `docs/business/BUSINESS-PLAN.md` +- Template: `templates/business/PITCH.template.md` +- Gate before publishing: [`privacy-audit`](../privacy-audit/SKILL.md) +- Hard-to-reverse call? [`multi-ai-review`](../multi-ai-review/SKILL.md) — publishing is very hard to un-publish. diff --git a/CHANGELOG.md b/CHANGELOG.md index 76c526c..833a150 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,10 +11,50 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), > v0.5.0 is being delivered in four independent PRs. This section accumulates until the last one lands, then gets cut as a release. > > - [x] **PR 1** — WIZARD restructured into 5 phases, prototype before spec -> - [ ] **PR 2** — Pitch artifact + "BP/Pitch online?" decision +> - [x] **PR 2** — Pitch artifact + "BP/Pitch online?" decision > - [x] **PR 3** — Skill frontmatter fix + audit > - [ ] **PR 4** — awesome-selfhosted catalog + managed-vs-self-hosted question +### Added — Pitch artifact and the publication question (stage 2.9) + +**The OS had no Pitch artifact at all.** `docs/business/` produced only `BUSINESS-PLAN.md`; the word "pitch" appeared solely in registry packs describing other tools' use cases. So "put the BP and Pitch online" required inventing the Pitch first. + +New **stage 2.9** at the end of Phase 2 does two things: + +1. **Writes `docs/business/PITCH.md`** — ten sections derived from BP v0.0.2. The pitch *derives* and never *adds*: every claim must already exist in the BP. If it belongs in the pitch but is missing from the BP, the BP is incomplete. This prevents a founder from contradicting their own diligence materials. +2. **Asks whether the BP and Pitch should live online** inside the product (`/pitch`, `/investors`) — as a **suggestion, not a default**, with three options: fully public, trimmed public plus gated full version, or nothing for now. **"Nada online por enquanto" is a complete answer** that closes the stage. + +Inserting stage 2.9 **renumbered zero other stages** — the first test of PR 1's phase structure, one commit later. + +- `templates/business/PITCH.template.md` — ten sections plus the redaction gate. +- `.claude/skills/pitch/SKILL.md` — 27th skill, so the stage is auto-invocable (PR 3's audit flagged stages without skills as a defect). + +### Added — mandatory redaction gate before anything is published + +Publishing a Business Plan means publishing whatever is inside it. The gate splits the document and requires row-by-row sign-off. + +Never published without explicit, considered approval: financial projections, unit economics (CAC, LTV, margins), unannounced pricing, fundraising status and valuation, the internal risk register, supplier and partner terms, competitor teardowns naming specific weaknesses, and personas traceable to a real interviewee. + +Three carry consequences beyond embarrassment: + +- **Personas from real interviews are personal data** — LGPD applies. Consent to be interviewed is not consent to be published. +- **Competitor teardowns invite legal and PR retaliation** — positioning is safe, naming a competitor's weakness is not. +- **Published numbers become commitments** quoted back during diligence. + +The template also requires naming a **maintenance owner**. A stale public BP is worse than no public BP; if nobody owns it, the honest answer is "not now". + +### Changed — publication is now a privacy question + +`.claude/rules/privacy-audit.md` gained a section treating publication as a form of processing: traceable personas, interviewee consent, team exposure, **analytics on the public page (which re-triggers all nine questions)**, and the fact that publication is effectively irreversible — archives and screenshots outlive the page. + +### Changed — the decision routes into later phases + +Choosing public or gated creates product surface, not just a document. Routes and navigation land in the Product Brief (4.1); public-vs-gated, auth model, `robots.txt`, SEO and PDF export land in the Technical Plan (4.2); view analytics go through `privacy-audit`; the page becomes a `first-100-users` / `launch-agent` asset. + +### Fixed — `CLAUDE.md` artifact list, missed in PR 1 + +PR 1's edit to the "Required generated artifacts" list never applied — the edit hit a tool gate and the retry re-applied a different edit. The list kept the old ordering with no `DESIGN-DIRECTION.md`. Corrected here; now lists all artifacts in production order with their phase. + ### Fixed — six core wizard skills were invisible to auto-invocation A `SKILL.md` advertises itself through the `description` field in its YAML frontmatter. Six skills had **no frontmatter at all**, so their entire advertised description was their own H1 title — "Product Brief Skill", "Research Waves Skill", and so on. diff --git a/CLAUDE.md b/CLAUDE.md index 3333312..bface45 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -23,16 +23,20 @@ The purpose of this repo is to provide a day-zero operating system for AI-assist ## Required generated artifacts for a new project +Listed in the order the wizard produces them: + ```txt -docs/product/PRODUCT-BRIEF.md -docs/business/BUSINESS-PLAN.md -docs/technical/TECHNICAL-PLAN.md -docs/SPRINTS.md +knowledge-base/README.md (Phase 2) +docs/business/BUSINESS-PLAN.md (Phase 2) +docs/business/PITCH.md (Phase 2) +prototype-lab/README.md (Phase 3) +docs/product/DESIGN-DIRECTION.md (Phase 3) +docs/product/PRODUCT-BRIEF.md (Phase 4) +docs/technical/TECHNICAL-PLAN.md (Phase 4) +docs/SPRINTS.md (Phase 4) CHANGELOG.md session-log/INDEX.md session-log/YYYY-MM-DD-project-genesis.md -knowledge-base/README.md -prototype-lab/README.md ``` --- diff --git a/README.md b/README.md index da9149c..8b1a6fc 100644 --- a/README.md +++ b/README.md @@ -177,6 +177,7 @@ Behind the scenes, Claude is instructed to create and maintain: ```txt docs/business/BUSINESS-PLAN.md +docs/business/PITCH.md prototype-lab/ docs/product/DESIGN-DIRECTION.md docs/product/PRODUCT-BRIEF.md @@ -234,6 +235,7 @@ Important skills include: | `START-HERE.md` | First file Claude reads. | | `WIZARD.md` | Full Project Genesis Wizard flow. | | `docs/business/BUSINESS-PLAN.md` | Business/investor/hackathon document. | +| `docs/business/PITCH.md` | The BP in ten sections, plus the record of what may go public. | | `docs/product/DESIGN-DIRECTION.md` | The approved prototype direction: tokens, screens, flow. Bridge from Phase 3 to Phase 4. | | `docs/product/PRODUCT-BRIEF.md` | Operational product understanding, reverse-engineered from the prototype. | | `docs/technical/TECHNICAL-PLAN.md` | Stack, architecture, data, security, test plan. | diff --git a/WIZARD.md b/WIZARD.md index 9585d63..2df8d16 100644 --- a/WIZARD.md +++ b/WIZARD.md @@ -303,6 +303,89 @@ BP version becomes `v0.0.2`. --- +## 2.9 — Pitch, and the publication question + +Two outputs: a pitch derived from the BP, and an explicit decision about whether either document lives on the public internet. + +### Write the pitch + +```txt +docs/business/PITCH.md +``` + +Ten slides or fewer, derived from BP v0.0.2 — not written from scratch. The BP is the argument; the pitch is the argument compressed to what someone will actually sit through. If a claim is not in the BP, it does not belong in the pitch. + +### Ask the publication question + +Claude must raise this as a **suggestion, not a default**. Many founders never consider it; the wizard's job is to put the option on the table with its real trade-offs, then accept whatever the user decides. + +```txt +Uma opção que vale considerar: colocar o Business Plan e o Pitch online, dentro do próprio site/plataforma — por exemplo em /pitch ou /investors. + +Vantagens: +- Vira ativo de captação: você manda um link em vez de anexar PDF. +- Constrói autoridade e confiança ("build in public"). +- Investidor, parceiro ou cliente grande consegue se qualificar sozinho. +- Some o problema de versão desatualizada circulando por aí. + +Custos reais: +- Concorrente lê tudo, inclusive o que você acha que é vantagem. +- Números publicados viram expectativa — e cobrança depois. +- Exige manutenção: BP público desatualizado é pior que nenhum. +- Parte do conteúdo NÃO pode ir ao ar (ver gate abaixo). + +Você quer: +(a) tudo público, +(b) uma versão pública enxuta + versão completa atrás de login/link secreto, +(c) nada online por enquanto — decide depois do lançamento? +``` + +Whatever the user answers, record the decision and the reasoning in `session-log/`. "Not now" is a valid, complete answer and closes the stage. + +### Redaction gate — mandatory if the answer is (a) or (b) + +Publishing a Business Plan means publishing whatever is in it. Before anything goes to a public URL, Claude must run the following split and get explicit user sign-off on it. + +| Usually safe to publish | Do NOT publish without explicit, considered approval | +|---|---| +| Problem and solution narrative | Financial projections, burn, runway | +| Positioning and differentiation | Unit economics — CAC, LTV, margins | +| Market context with **public** sources | Pricing not yet announced (planned increases, discount policy) | +| Personas, generalized | Personas traceable to a real interviewee | +| Directional roadmap | Dated delivery commitments | +| Team and mission | Fundraising status, valuation, cap table | +| Metrics you are willing to be held to | The internal risk register | +| — | Supplier and partner terms | +| — | Competitor teardown naming specific weaknesses | + +Three of these carry consequences beyond embarrassment: + +- **Personas from real interviews are personal data.** Publishing "Marina, 34, gerente de clínica em Porto Alegre" when Marina is a real person you interviewed is an LGPD problem, not a style problem. Invoke `privacy-audit` before publishing any persona. +- **Competitor teardowns invite legal and PR retaliation.** Positioning ("we are the one that does X") is safe; "Competitor Y's onboarding is broken and their support is worse" is not. +- **Published numbers become commitments.** A projection on a public page will be quoted back during diligence. + +### Route the downstream consequences + +If the answer is (a) or (b), this is not just a document decision — it creates product surface. Record it so the later phases pick it up: + +| Consequence | Lands in | +|---|---| +| Routes (`/pitch`, `/investors`), navigation, whether it appears in the main nav | Product Brief (stage 4.1) | +| Public vs. gated, auth model for the gated version, SEO/`robots.txt`, PDF export | Technical Plan (stage 4.2) | +| Analytics on who views the page — **this is personal data** | `privacy-audit` | +| The page as an acquisition and credibility asset | `first-100-users`, `launch-agent` | + +### Required outputs + +```txt +docs/business/PITCH.md +session-log/-pitch-and-publication-decision.md +``` + +If the answer was (a) or (b), also record the approved public/private split inside `PITCH.md` so Phase 4 knows what it is building a page for. + +--- + # PHASE 3 — PROTÓTIPO **Goal:** the product becomes visible. Brand, color, typography, UI, and UX are decided by looking at three real options, not by describing them. diff --git a/docs/documentation-layers.md b/docs/documentation-layers.md index d08394d..26be336 100644 --- a/docs/documentation-layers.md +++ b/docs/documentation-layers.md @@ -9,6 +9,7 @@ Each document type has a job. Avoid mixing them. | Skills | How should a recurring workflow be executed? | `.claude/skills/**/SKILL.md` | | Commands | How does the user trigger a workflow? | `.claude/commands/*.md` | | Business plan | Is this worth building, and for whom? | `docs/business/BUSINESS-PLAN.md` | +| Pitch | The same argument in ten sections — and what of it may go public | `docs/business/PITCH.md` | | Design direction | What did the approved prototype actually decide? | `docs/product/DESIGN-DIRECTION.md` | | Product brief | What is the product, operationally? | `docs/product/PRODUCT-BRIEF.md` | | Technical plan | How is it built, and what are the risks? | `docs/technical/TECHNICAL-PLAN.md` | diff --git a/docs/skill-system.md b/docs/skill-system.md index 206bf49..e686fe0 100644 --- a/docs/skill-system.md +++ b/docs/skill-system.md @@ -8,7 +8,7 @@ A skill tells the agent how to execute a workflow. --- -## The 26 skills, by job +## The 27 skills, by job Current inventory. For the full audit of how discoverable each one is, see [`skill-audit-2026-08-08.md`](skill-audit-2026-08-08.md). @@ -19,6 +19,7 @@ Current inventory. For the full audit of how discoverable each one is, see [`ski | `project-genesis` | all | Drive the full 5-phase wizard | | `research-waves` | 2.4–2.6 | Market, competitor, red team, consolidation | | `business-plan-impact-review` | 2.8 | Check BP changes for downstream impact | +| `pitch` | 2.9 | Derive the pitch; decide if BP/Pitch go public | | `prototype-lab` | 3.2 | Three visual directions, then design tokens | | `product-brief` | 4.1 | Reverse-engineer the brief from the prototype | | `sprint-roadmap` | 4.4 | 14–20 sprint roadmap | diff --git a/docs/wizard/phase-2-ideacao.md b/docs/wizard/phase-2-ideacao.md index 0927339..9cbf377 100644 --- a/docs/wizard/phase-2-ideacao.md +++ b/docs/wizard/phase-2-ideacao.md @@ -1,7 +1,7 @@ # Phase 2 — Ideação **Commit tag:** `[STAGE:IDEACAO]` -**Canonical source:** [`WIZARD.md`](../../WIZARD.md) stages 2.1–2.8 +**Canonical source:** [`WIZARD.md`](../../WIZARD.md) stages 2.1–2.9 --- @@ -53,4 +53,40 @@ Claude applies the corrections, then runs a second pass checking every change fo `BP v0.0.2` becomes the contract that Phase 3 builds against. -**Before leaving this phase**, confirm the BP explicitly states four things: personas, positioning, MVP scope, and the primary user flow. Phase 3 has no Product Brief to lean on — these four are its only specification. +**Before leaving stage 2.8**, confirm the BP explicitly states four things: personas, positioning, MVP scope, and the primary user flow. Phase 3 has no Product Brief to lean on — these four are its only specification. + +--- + +## 2.9 — Pitch, and the publication question + +Two outputs: `docs/business/PITCH.md` derived from the BP, and an explicit decision about whether either document goes on the public internet. + +### The pitch derives, it never adds + +Ten sections maximum, every claim already present in BP v0.0.2. If something belongs in the pitch but is missing from the BP, the BP is incomplete — fix it there and re-derive. A pitch that says something the BP does not is how a founder ends up contradicting their own diligence materials. + +### The publication question is a suggestion, not a default + +Most founders never consider putting the BP online. The wizard's job is to put the option on the table with honest trade-offs and then accept the answer. **"Nada online por enquanto" is a complete answer** and closes the stage. + +Three options are offered: everything public, a trimmed public page with the full version gated, or nothing for now. + +The case for it: a link beats a PDF attachment, it builds authority, and it lets an investor or large customer qualify themselves without a meeting. The case against: competitors read everything, published numbers become expectations you get held to, and a stale public BP is worse than no public BP. + +### The redaction gate + +Mandatory if the answer is public or gated. Publishing a Business Plan means publishing whatever is inside it — and several sections should never leave the building: financial projections, unit economics, fundraising status, the internal risk register, supplier terms. + +Three carry consequences beyond embarrassment: + +- **Personas from real interviews are personal data.** LGPD applies. Run `privacy-audit` before publishing any persona. +- **Competitor teardowns invite retaliation.** Positioning is safe; naming a competitor's specific weakness is not. +- **Published numbers become commitments** that get quoted back during diligence. + +### It becomes product surface + +If the answer is public or gated, this is no longer a document decision. Routes and navigation land in the Product Brief (4.1); public-vs-gated, auth, `robots.txt` and PDF export land in the Technical Plan (4.2); view analytics are personal data and go through `privacy-audit`; the page becomes a `first-100-users` and `launch-agent` asset. + +**Someone must own updating it.** If nobody does, the honest answer is "not now". + +Driven by the [`pitch`](../../.claude/skills/pitch/SKILL.md) skill. diff --git a/session-log/2026-08-08-v0.5.0-pitch-publication.md b/session-log/2026-08-08-v0.5.0-pitch-publication.md new file mode 100644 index 0000000..ffb5de7 --- /dev/null +++ b/session-log/2026-08-08-v0.5.0-pitch-publication.md @@ -0,0 +1,80 @@ +# 2026-08-08 — v0.5.0 PR 2: Pitch artifact + the "BP online?" question + +## What the user asked for + +> "queremos que seja colocado a ideia de que BP e Pitch fiquem online, dentro do site/plataforma, isso como uma forma de sugestão a ser questionada ao projetista" + +Two words carry the whole design: **sugestão** and **questionada**. Not a default, not a recommendation the wizard pushes — an option put on the table with honest trade-offs, where "no" is a complete answer. + +## What was true before + +**There was no Pitch artifact anywhere in the OS.** `docs/business/` contained only `README.md`; the wizard produced `BUSINESS-PLAN.md` and nothing else. The word "pitch" appeared exclusively in registry pack files describing *other* tools' use cases ("Pitch decks, BP appendices"). Nothing in the wizard produced one. + +So "put the BP and Pitch online" required inventing the Pitch first. This turned out to be two changes, not one. + +## What changed + +1. **Stage 2.9** appended to Phase 2 of `WIZARD.md` — writes the pitch, then asks the publication question. +2. **`templates/business/PITCH.template.md`** — ten sections plus a redaction gate. +3. **`.claude/skills/pitch/SKILL.md`** — the 27th skill. +4. **Privacy rule extended** — `.claude/rules/privacy-audit.md` gained a section on publication as a form of processing. +5. **`PITCH.md` added to the documentation-layers canon** in four places. + +## Decisions worth preserving + +### 1. The insertion cost nothing — which was the point + +Adding stage `2.9` renumbered **zero** other stages. Under the old flat scheme this would have become another fractional stage or a cascade renumber of everything downstream. PR 1's phase structure was justified partly on this argument; PR 2 is the first test of it, one commit later. + +### 2. Built a skill, not just a stage + +PR 3's audit criticized `technical-plan` for having a wizard stage but no skill — a stage without a skill cannot be auto-invoked. Creating stage 2.9 without a skill would have reproduced the exact defect I had reported one PR earlier. So `pitch` exists as the 27th skill, with trigger phrases. + +### 3. The pitch derives; it never adds + +Hard rule in both the skill and the template: every claim in `PITCH.md` must already exist in BP v0.0.2. If something belongs in the pitch but is missing from the BP, the BP is incomplete — fix it there and re-derive. + +The failure mode this prevents is specific: a founder writes a punchier claim into the pitch, presents it, and then contradicts their own diligence materials when the investor reads the BP. + +### 4. The redaction gate is the substance, not the question + +Asking "want to publish?" is the easy half. The half that matters is *what must not go out*. Without a gate, a founder publishes a BP containing revenue projections, CAC, margins, and fundraising status — because those are simply chapters in the document. + +Three rows carry consequences beyond embarrassment: + +- **Personas from real interviews are personal data.** "Marina, 34, gerente de clínica em Porto Alegre" is an LGPD matter when Marina is a real interviewee. Consent to be interviewed is not consent to be published. +- **Competitor teardowns invite legal and PR retaliation.** Positioning is safe; naming a competitor's specific weakness is not. +- **Published numbers become commitments** quoted back during diligence months later. + +Plus one that is easy to miss: **publication is effectively irreversible**. Search engines, archives, and screenshots outlive the page. The rule now says to treat it as permanent. + +### 5. Analytics on the public page re-triggers the whole privacy audit + +Visitor tracking on `/pitch` is personal-data collection. It is not a footnote to the publication decision — it re-opens all nine questions in `.claude/rules/privacy-audit.md`. + +### 6. Publishing is product surface, not a document decision + +If the answer is public or gated, it creates routes, navigation, an auth model, `robots.txt` decisions, and a GTM asset. Those consequences are explicitly routed to the phases that own them — Product Brief (4.1), Technical Plan (4.2), `privacy-audit`, `first-100-users` / `launch-agent`. Without that routing the decision would evaporate between Phase 2 and Phase 4. + +### 7. The maintenance-owner field exists because "not now" is often the right answer + +A public BP nobody updates goes stale in a quarter, and a stale public BP is worse than none. The template requires naming who updates it and how often. If nobody owns it, the honest answer is (c) — and the skill says so. + +## Bug found and fixed here, carried over from PR 1 + +`CLAUDE.md`'s "Required generated artifacts" list was **never actually updated in PR 1**. The edit hit a tool gate, and on retry I re-applied the wrong edit — the golden-rules line, producing the duplication I later noticed and fixed — while the artifacts list silently kept the old order with no `DESIGN-DIRECTION.md`. + +Corrected here, since PR 2 is stacked on PR 1 and reaches `main` after it. If PR 1 is merged alone, `main` will carry the stale list until PR 3 and PR 2 land. + +**Lesson:** when a batched edit partially fails, re-verify each intended change independently rather than trusting the retry. + +## Verification performed + +- Skills: 27 total, `frontmatter: 27/27`, `triggers: 27/27`. +- All relative `.md` links across the repo resolve — zero broken. +- Stage numbering: no existing stage renumbered by the insertion. + +## Open questions + +- **Should there be a `/pitch` slash command?** `product-brief` and `sprint-roadmap` have none either, so leaving it out is consistent — but PR 3's audit already flagged `templates/project/CLAUDE.md` advertising a `/release-check` that does not exist. The command layer needs its own pass. +- **The public-BP page has no reference implementation.** When a project answers (a) or (b), Phase 4 builds it from scratch. A `stack-packs/` example might be worth adding once one project has done it for real — per the `processize` principle, do it manually until it works, then codify. diff --git a/session-log/INDEX.md b/session-log/INDEX.md index fa65380..3ad5dd9 100644 --- a/session-log/INDEX.md +++ b/session-log/INDEX.md @@ -6,6 +6,7 @@ Each entry captures the reasoning behind a material decision: what was true befo | Date | Topic | File | |---|---|---| +| 2026-08-08 | v0.5.0 PR 2 — Pitch artifact created (none existed) at new stage 2.9, plus the "BP/Pitch online?" question with a mandatory redaction gate; publication added to the privacy rule as a form of processing | [`2026-08-08-v0.5.0-pitch-publication.md`](2026-08-08-v0.5.0-pitch-publication.md) | | 2026-08-08 | v0.5.0 PR 3 — skill audit: 6 core wizard skills had no frontmatter (invisible to auto-invocation), 10 more had no trigger phrases; 3 overlapping pairs cross-linked; `release-check` converted to a delegation table | [`2026-08-08-v0.5.0-skills-audit.md`](2026-08-08-v0.5.0-skills-audit.md) | | 2026-08-08 | v0.5.0 PR 1 — WIZARD restructured into 5 phases (1:1 with commit tags), Prototype Lab moved before Product Brief/Technical Plan, fractional stages eliminated, `registry-pick` split into design + stack passes | [`2026-08-08-v0.5.0-wizard-5-phases.md`](2026-08-08-v0.5.0-wizard-5-phases.md) | | 2026-05-09 | Registry additions — 14 new packs cataloged, 3 refreshed (Phase 2 cadence) | [`2026-05-09-registry-additions.md`](2026-05-09-registry-additions.md) | diff --git a/templates/business/PITCH.template.md b/templates/business/PITCH.template.md new file mode 100644 index 0000000..d47f521 --- /dev/null +++ b/templates/business/PITCH.template.md @@ -0,0 +1,97 @@ +# PITCH.md + +> Produced at WIZARD stage 2.9, derived from `BUSINESS-PLAN.md` v0.0.2. +> Every claim here must already exist in the BP. If it is not in the BP, it does not belong in the pitch — go fix the BP first. +> Replace every `<...>` placeholder. Delete this block when done. + +- **Project:** `` +- **Derived from BP version:** `v0.0.2` +- **Last updated:** `` +- **Audience:** `` +- **Publication status:** `` — see the redaction gate at the end + +--- + +## 1. One line + +`` + +## 2. The problem + +`` + +## 3. Why now + +`` + +## 4. The solution + +`` + +## 5. How it works + +`` + +1. `<...>` +2. `<...>` +3. `<...>` + +## 6. Who it is for + +`` + +## 7. Market + +`` + +| Metric | Value | Source | +|---|---|---| +| `` | `<...>` | `` | + +## 8. Why us + +`` + +## 9. Business model + +`` + +## 10. Where we are / what we need + +`` + +--- + +## Redaction gate + +Fill this in **only** if the pitch or the BP is going to a public URL. It is the record of what was approved for publication, and Phase 4 builds the page from it. + +| Section | Público | Gated (login / secret link) | Não publicar | Reason | +|---|:---:|:---:|:---:|---| +| One line | | | | | +| Problem | | | | | +| Why now | | | | | +| Solution | | | | | +| How it works | | | | | +| Personas | | | | `` | +| Market + sources | | | | `` | +| Why us | | | | `` | +| Business model | | | | `` | +| Traction / metrics | | | | `` | +| Financial projections | | | | usually **não publicar** | +| Unit economics (CAC, LTV, margin) | | | | usually **não publicar** | +| Fundraising status / valuation | | | | usually **não publicar** | +| Risk register | | | | usually **não publicar** | +| Team | | | | `` | + +**Sign-off** + +- [ ] The user read this table and approved it explicitly, row by row. +- [ ] `privacy-audit` ran on every persona and team entry going public. +- [ ] No competitor is named alongside a specific weakness. +- [ ] Every published number is one the project is willing to be quoted on. +- [ ] The decision and its reasoning are recorded in `session-log/`. + +**Maintenance owner:** `` + +> A stale public BP is worse than no public BP. If nobody owns the update, choose *não publicar*. From 3498f7edfa6a483e255582e24a6ec14f2f02f599 Mon Sep 17 00:00:00 2001 From: lglucas Date: Sat, 8 Aug 2026 17:47:58 -0300 Subject: [PATCH 03/14] feat(selfhosted): espelha awesome-selfhosted e pergunta gerenciado-vs-self-hosted no 4.2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Importa a lista awesome-selfhosted (1.346 projetos) em três camadas e acrescenta ao Technical Plan a pergunta sobre plataformas gerenciadas versus self-hosted. docs/selfhosted/shortlist-saas.md ~20 categorias que um SaaS de fato substitui, curada à mão docs/selfhosted/INDEX.md + catalog/ as 1.346 entradas, 95 tags upstream colapsadas em 12 macro-categorias docs/selfhosted/README.md carve-out de licença e trade-off scripts/sync-selfhosted.js regenerador; nunca sobrescreve os dois arquivos curados docs/registry/packs/awesome-selfhosted.md one-pager pra descoberta Licença: o OS é MIT, estes dados NÃO são. São CC-BY-SA 3.0 Unported, share-alike, com autores creditados upstream. Atribuição carimbada em todo arquivo gerado; fronteira documentada no README do diretório, no ATTRIBUTIONS e no UPSTREAM-SOURCES. A seção 7 do UPSTREAM-SOURCES manda evitar vendoring e preferir link. A entrada nova declara a exceção e dá quatro razões: licença inequívoca, link não serve ao estágio 4.2, a cópia é gerada e não bifurcada, e está isolada num diretório só. O estágio 4.2 apresenta três opções (gerenciado, self-hosted, híbrido) com os dois lados, e traz instrução explícita de NÃO empurrar self-hosted. "Gerenciado em tudo" costuma ser a resposta certa pra quem está sozinho: self-hosted troca custo de fornecedor por custo de tempo e operação — backup, uptime, patch e ser quem acorda às 3h. Achado negativo, medido: nove tags upstream estão órfãs (o arquivo de tag existe, zero projetos a referenciam) — Backup, Federated Identity, Identity Management, Monitoring, CI/CD, FaaS, Static Site Generators, VPN e Distributed Filesystems. Keycloak, MinIO, Supabase, Uptime Kuma, Coolify, WireGuard, restic, Hugo e Jenkins estão ausentes do dataset. É justamente auth, observabilidade, CI/CD, backup e PaaS. A shortlist marca isso numa tabela de lacunas em vez de omitir. Licenças medidas nas 1.346 entradas: MIT 360, AGPL-3.0 302, GPL-3.0 224, Apache-2.0 143, BSD 51, Proprietary 70 — cerca de 39% copyleft. Seis entradas da shortlist não são permissivas e levam aviso na própria linha. Dois bugs corrigidos durante o trabalho: o mapa de categorias usava slugs de nome de arquivo (hífen duplo) contra nomes de exibição (hífen simples), jogando 203 entradas em "Outros"; e as seções agrupavam por tags[0], enterrando entradas cuja tag relevante não era a primeira. Co-Authored-By: Claude Opus 5 (1M context) --- ATTRIBUTIONS.md | 1 + CHANGELOG.md | 36 +- UPSTREAM-SOURCES.md | 24 ++ WIZARD.md | 33 ++ docs/registry/INDEX.md | 3 +- docs/registry/packs/awesome-selfhosted.md | 69 ++++ docs/selfhosted/INDEX.md | 47 +++ docs/selfhosted/README.md | 98 ++++++ docs/selfhosted/catalog/arquivos-backup.md | 134 ++++++++ docs/selfhosted/catalog/automacao-ia.md | 69 ++++ docs/selfhosted/catalog/comunicacao.md | 275 +++++++++++++++ docs/selfhosted/catalog/conteudo.md | 115 +++++++ docs/selfhosted/catalog/desenvolvimento.md | 171 +++++++++ docs/selfhosted/catalog/infraestrutura.md | 154 +++++++++ docs/selfhosted/catalog/midia.md | 214 ++++++++++++ docs/selfhosted/catalog/negocio.md | 233 +++++++++++++ docs/selfhosted/catalog/observabilidade.md | 71 ++++ docs/selfhosted/catalog/outros.md | 136 ++++++++ docs/selfhosted/catalog/produtividade.md | 325 ++++++++++++++++++ .../catalog/seguranca-identidade.md | 25 ++ docs/selfhosted/shortlist-saas.md | 230 +++++++++++++ scripts/sync-selfhosted.js | 264 ++++++++++++++ .../2026-08-08-v0.5.0-selfhosted-catalog.md | 90 +++++ session-log/INDEX.md | 1 + 24 files changed, 2816 insertions(+), 2 deletions(-) create mode 100644 docs/registry/packs/awesome-selfhosted.md create mode 100644 docs/selfhosted/INDEX.md create mode 100644 docs/selfhosted/README.md create mode 100644 docs/selfhosted/catalog/arquivos-backup.md create mode 100644 docs/selfhosted/catalog/automacao-ia.md create mode 100644 docs/selfhosted/catalog/comunicacao.md create mode 100644 docs/selfhosted/catalog/conteudo.md create mode 100644 docs/selfhosted/catalog/desenvolvimento.md create mode 100644 docs/selfhosted/catalog/infraestrutura.md create mode 100644 docs/selfhosted/catalog/midia.md create mode 100644 docs/selfhosted/catalog/negocio.md create mode 100644 docs/selfhosted/catalog/observabilidade.md create mode 100644 docs/selfhosted/catalog/outros.md create mode 100644 docs/selfhosted/catalog/produtividade.md create mode 100644 docs/selfhosted/catalog/seguranca-identidade.md create mode 100644 docs/selfhosted/shortlist-saas.md create mode 100644 scripts/sync-selfhosted.js create mode 100644 session-log/2026-08-08-v0.5.0-selfhosted-catalog.md diff --git a/ATTRIBUTIONS.md b/ATTRIBUTIONS.md index df13558..28baff0 100644 --- a/ATTRIBUTIONS.md +++ b/ATTRIBUTIONS.md @@ -40,6 +40,7 @@ For repos that can be **installed on top of a project** running this OS (curated Key references include: +- awesome-selfhosted — https://github.com/awesome-selfhosted/awesome-selfhosted *(list data licensed **CC-BY-SA 3.0 Unported**; mirrored at [`docs/selfhosted/`](docs/selfhosted/README.md) under that licence rather than MIT — see the carve-out there)* - Anthropic Skills — https://github.com/anthropics/skills - everything-claude-code — https://github.com/affaan-m/everything-claude-code - UI UX Pro Max Skill — https://github.com/nextlevelbuilder/ui-ux-pro-max-skill diff --git a/CHANGELOG.md b/CHANGELOG.md index 833a150..24b55f5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,7 +13,41 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), > - [x] **PR 1** — WIZARD restructured into 5 phases, prototype before spec > - [x] **PR 2** — Pitch artifact + "BP/Pitch online?" decision > - [x] **PR 3** — Skill frontmatter fix + audit -> - [ ] **PR 4** — awesome-selfhosted catalog + managed-vs-self-hosted question +> - [x] **PR 4** — awesome-selfhosted catalog + managed-vs-self-hosted question + +### Added — self-hosted catalogue (1.346 projects) and the stage 4.2 question + +`docs/selfhosted/` mirrors [awesome-selfhosted](https://github.com/awesome-selfhosted/awesome-selfhosted) so the WIZARD can offer concrete self-hosted alternatives without a network call. + +| Layer | What | Generated? | +|---|---|---| +| `shortlist-saas.md` | ~20 categories a SaaS founder actually replaces, framed as "you pay for X → alternative Y" | ✋ hand-curated | +| `INDEX.md` + `catalog/` | all 1.346 entries; 95 upstream tags collapsed into 12 macro-categories | 🤖 generated | +| `README.md` | licence carve-out, regeneration, honest trade-off table | ✋ hand-curated | +| `scripts/sync-selfhosted.js` | regenerator; never overwrites the two hand-curated files | — | +| `docs/registry/packs/awesome-selfhosted.md` | one-pager, so it is discoverable from the registry | ✋ | + +**New question at WIZARD stage 4.2**, before the stack is locked: managed platforms, self-hosted, or hybrid? Presented as a question with both sides, not a recommendation. The stage carries an explicit instruction *not* to push self-hosting — "managed for everything" is frequently right for a solo non-developer, and self-hosting trades vendor cost for time and operations: backup, uptime, patching, and being the person who wakes up at 3am. + +### Added — CC-BY-SA 3.0 carve-out + +The OS is MIT. **The data in `docs/selfhosted/` is not** — it is CC-BY-SA 3.0 Unported, share-alike, with authors credited upstream. Attribution is stamped on every generated file, and the boundary is documented in `docs/selfhosted/README.md`, `ATTRIBUTIONS.md` and `UPSTREAM-SOURCES.md`. + +`UPSTREAM-SOURCES.md` section 7 says to avoid vendoring and prefer linking. The new entry states this is a deliberate exception and gives four reasons it clears the bar: unambiguous licence, linking cannot serve stage 4.2, the copy is generated rather than forked, and it is quarantined to one directory. Future vendoring should clear the same four. + +### Documented — what the catalogue does NOT cover + +Measured, not assumed. **Nine upstream tags are orphaned** — the tag file exists and zero projects reference it: Backup, Federated Identity & Authentication, Identity Management, Monitoring & Status Pages, CI/CD, FaaS & Serverless, Static Site Generators, VPN, Distributed Filesystems. + +Verified absent from the dataset: Keycloak, Authentik, MinIO, Supabase, Uptime Kuma, Coolify, Woodpecker, Jenkins, WireGuard, restic, Borg, Hugo, Jekyll, Cal.com, Meilisearch. + +That is auth, observability, CI/CD, backup, PaaS, static sites and VPN — the first things a SaaS founder looks for. It follows from the upstream scope (self-hosted *network services and web applications*). The shortlist marks these as gaps in a dedicated table rather than omitting them silently. + +### Documented — licence traps, per entry + +Across the 1.346 entries: MIT 360, **AGPL-3.0 302**, **GPL-3.0 224**, Apache-2.0 143, BSD 51, **⊘ Proprietary 70** — roughly **39% copyleft**. + +Six entries in the curated shortlist are not permissive and carry a ⚠️ on their own row: Sentry Self-Hosted, Directus and Outline (BUSL-1.1), Chatwoot and Budibase (⊘ Proprietary), n8n (Apache-2.0 + Commons-Clause). The AGPL note is stated precisely: running unmodified triggers nothing; the obligation begins on modify-and-serve. ### Added — Pitch artifact and the publication question (stage 2.9) diff --git a/UPSTREAM-SOURCES.md b/UPSTREAM-SOURCES.md index 58c1e4f..17301d9 100644 --- a/UPSTREAM-SOURCES.md +++ b/UPSTREAM-SOURCES.md @@ -109,6 +109,30 @@ Product-specific business content, market research, pricing, partners, competito --- +### awesome-selfhosted + +- URL: https://github.com/awesome-selfhosted/awesome-selfhosted +- Data repo: https://github.com/awesome-selfhosted/awesome-selfhosted-data +- Classification: `source` — **content was directly copied**, not merely referenced. +- License: **CC-BY-SA 3.0 Unported** (share-alike). Authors listed in the upstream `AUTHORS` file. +- Role: catalogue of self-hostable software, offered as an alternative to managed SaaS. +- Local mapping: + - `docs/selfhosted/` — the mirror (1.346 entries, 12 categories) + - `scripts/sync-selfhosted.js` — regenerator + - `docs/registry/packs/awesome-selfhosted.md` — one-pager + - `WIZARD.md` stage 4.2 — where the managed-vs-self-hosted question is asked + +**This is a deliberate exception to policy items 4 and 5 in section 7 below**, which say to avoid vendoring and to prefer linking over duplicating. The exception is justified because: + +1. **Licence and attribution are unambiguous** — CC-BY-SA 3.0, authors file upstream, attribution header stamped on every generated file. That satisfies item 4. +2. **Linking would not do the job.** The WIZARD asks the managed-vs-self-hosted question at stage 4.2 and has to offer concrete alternatives in the same breath. A link makes the answer depend on the network, and on the founder leaving the conversation to browse 1.346 entries. +3. **The copy is generated, not hand-edited.** `sync-selfhosted.js` regenerates it from upstream, so it can be refreshed rather than drifting into a fork. +4. **It is quarantined.** The mirror lives in one directory with its own licence carve-out, so CC-BY-SA never leaks into the MIT-licensed parts of the OS. + +Anything vendored in future should clear the same four bars. + +--- + ## 4. Security and hardening references ### CIS Hardening Guide diff --git a/WIZARD.md b/WIZARD.md index 2df8d16..9709eee 100644 --- a/WIZARD.md +++ b/WIZARD.md @@ -509,6 +509,39 @@ The data model must be derived from the entities visible in the prototype's mock No alpha/beta stack should be recommended unless explicitly accepted. +### Managed vs. self-hosted — ask, do not assume + +Before locking the stack, Claude must put the self-hosted option on the table explicitly. Most vibe coders default to managed platforms because nobody ever showed them the alternative — and some are paying monthly for services they could run themselves for the price of one small server. + +This is a **question**, not a recommendation. Present both sides and accept the answer. + +```txt +Antes de fechar a stack: cada serviço externo que a gente escolher aqui é uma +assinatura mensal e um pedaço dos teus dados na mão de outra empresa. + +Existe o caminho self-hosted — você roda o software no teu próprio servidor. + +(a) Gerenciado em tudo — Vercel, Supabase, Auth0, Sentry Cloud e afins. + Rápido de subir, você paga e não pensa mais nisso. +(b) Self-hosted no que der — mais controle dos dados e custo previsível, + mas você vira o responsável por backup, uptime e patch de segurança. +(c) Híbrido — gerenciado no que é crítico e barato, self-hosted no que é caro + por uso ou sensível em dados. + +Qual faz sentido pro teu momento? +``` + +**Consult [`docs/selfhosted/shortlist-saas.md`](docs/selfhosted/shortlist-saas.md)** for concrete alternatives per category, with licences. The full catalogue of 1.346 projects lives in [`docs/selfhosted/`](docs/selfhosted/README.md). + +Rules for this conversation: + +- **State the real cost of self-hosting.** It trades vendor cost for time and operations: backup, uptime, security patching, and being the person who wakes up when it breaks. A solo founder in Sprint 1 hosting eight services is doing SRE, not product. +- **Do not push (b).** The maintainer of this OS prefers self-hosted, and that stance is recorded in `ETHOS.md` — explicitly as a stance, not a rule. "Managed for everything" is frequently the right answer for a solo non-developer. +- **Flag the gaps honestly.** The catalogue has nothing for auth/SSO, uptime monitoring, CI/CD, backup, PaaS, static site generators or VPN. If the project needs those self-hosted, say so and look elsewhere. +- **Flag copyleft and source-available licences.** Roughly 39% of the catalogue is AGPL or GPL, and several popular options are BUSL-1.1, Commons-Clause, or outright proprietary. If the project will resell or embed the component, this stops being a detail — route it to `legal-compliance-agent`. +- **Run `cost-watchdog`** to compare the projected cost of both paths before closing. +- **Record the decision and its reasoning** in the Technical Plan and in `session-log/`. A founder who chose managed in year 1 will want to know why when the invoice grows in year 2. + --- ## 4.3 — Stack pack pick diff --git a/docs/registry/INDEX.md b/docs/registry/INDEX.md index faaa9f9..fe5e4d2 100644 --- a/docs/registry/INDEX.md +++ b/docs/registry/INDEX.md @@ -6,7 +6,7 @@ For how the registry works, see [`README.md`](README.md). For per-pack detail, click the slug in the first column. For non-installable websites and live tools, see the **External resources** section below. -Last index update: 2026-05-09 (registry-additions-2026-05-09 — 14 new packs added, 3 refreshed) +Last index update: 2026-08-08 (v0.5.0 PR 4 — `awesome-selfhosted` added; its 1.346-entry catalogue is vendored at [`docs/selfhosted/`](../selfhosted/README.md) under CC-BY-SA 3.0) --- @@ -24,6 +24,7 @@ Last index update: 2026-05-09 (registry-additions-2026-05-09 — 14 new packs ad | [`auto-research-claw`](packs/auto-research-claw.md) | AutoResearchClaw | `ai` `research` `agents` | active | MIT | 2026-05-09 | | [`autohedge`](packs/autohedge.md) | AutoHedge | `experimental` `fintech` `agents` | experimental | MIT | 2026-04-30 | | [`awesome-design-md`](packs/awesome-design-md.md) | VoltAgent awesome-design-md | `design` | active | check upstream | 2026-04-30 | +| [`awesome-selfhosted`](packs/awesome-selfhosted.md) | awesome-selfhosted ⭐ | `infra` `tooling` `reference` | active | CC-BY-SA 3.0 | 2026-08-08 | | [`bark`](packs/bark.md) | Bark (Suno) | `ai` `audio` | active | MIT | 2026-04-30 | | [`boringco`](packs/boringco.md) | Boring Co (origin) | `origin` | archived | private | 2026-04-30 | | [`cis-hardening-guide`](packs/cis-hardening-guide.md) | CIS Hardening Guide | `security` `infra` | active | check upstream | 2026-04-30 | diff --git a/docs/registry/packs/awesome-selfhosted.md b/docs/registry/packs/awesome-selfhosted.md new file mode 100644 index 0000000..5e9ba19 --- /dev/null +++ b/docs/registry/packs/awesome-selfhosted.md @@ -0,0 +1,69 @@ +# awesome-selfhosted + +- **URL:** https://github.com/awesome-selfhosted/awesome-selfhosted +- **Data repo:** https://github.com/awesome-selfhosted/awesome-selfhosted-data +- **Website:** https://awesome-selfhosted.net +- **License:** CC-BY-SA 3.0 Unported (the list data — confirm upstream) +- **Status:** active +- **Last reviewed:** 2026-08-08 +- **Tags:** #infra #tooling #reference + +## What it is + +A community-maintained catalogue of **1.346 open-source projects you can host yourself** instead of subscribing to a third-party SaaS, organized under 95 functional tags. The human-readable list is generated from `awesome-selfhosted-data`, where each project is one YAML file carrying name, description, licence, platforms, tags, stars, and release activity. + +Automated workflows upstream check for dead links and unmaintained projects, so the data decays more slowly than a typical awesome-list. + +## When to install + +You do not install this one — **it is already vendored** into this OS at [`docs/selfhosted/`](../../selfhosted/README.md), because the WIZARD needs it available offline at stage 4.2. + +Go to the upstream when: + +- The local shortlist does not cover your category and you want the current state rather than our snapshot. +- You want to check whether a project was removed for being unmaintained or insecure. +- You want to contribute a project back. + +## When NOT to install + +- Never as a dependency. It is a catalogue, not code. +- Do not copy tables out of it into an MIT-licensed project without carrying the CC-BY-SA attribution — see the licence note below. + +## How to use + +```bash +# Refresh the local mirror in this repo: +node scripts/sync-selfhosted.js + +# Or browse the local copy: +# docs/selfhosted/shortlist-saas.md ← start here +# docs/selfhosted/INDEX.md ← all 12 categories +``` + +## Fit signals + +- The Technical Plan (stage 4.2) is choosing between managed platforms and self-hosting. +- The project has data-residency or LGPD constraints that make a third-party SaaS awkward. +- Projected third-party subscription cost is material relative to the project's budget. +- The founder already operates a server, so the marginal cost of one more service is low. + +## Conflicts and overlaps + +- **Not the same thing as `docs/registry/`.** This registry answers "what do I install *inside* my project"; the self-hosted catalogue answers "what do I run *instead of* paying a SaaS". +- Pairs with `cost-watchdog` (compares projected cost of both paths) and `privacy-audit` (data residency). + +## Local mapping + +- `docs/selfhosted/README.md` — licence carve-out, how the mirror works +- `docs/selfhosted/shortlist-saas.md` — curated per SaaS category +- `docs/selfhosted/INDEX.md` + `docs/selfhosted/catalog/` — generated, 1.346 entries +- `scripts/sync-selfhosted.js` — regenerator +- `WIZARD.md` stage 4.2 — where the managed-vs-self-hosted question is asked + +## Notes + +⚠️ **Licence is share-alike.** The list data is CC-BY-SA 3.0, not MIT like the rest of this OS. Redistributing it — modified or not — requires keeping the same licence and the attribution. That is why the mirror lives in its own directory with an explicit carve-out. + +⚠️ **Coverage is uneven exactly where a SaaS founder looks first.** Nine tags are orphaned upstream (the tag file exists, no project references it): Backup, Federated Identity & Authentication, Identity Management, Monitoring & Status Pages, CI/CD, FaaS & Serverless, Static Site Generators, VPN, Distributed Filesystems. Keycloak, MinIO, Supabase, Uptime Kuma, Coolify, WireGuard, restic, Hugo and Jenkins are all absent. This follows from the upstream scope — self-hosted *network services and web applications*, not build tools, CLIs or protocol implementations. + +⚠️ **Not everything listed is open source.** Upstream maintains a non-free licence list (`BUSL-1.1`, `SSPL-1.0`, `Elastic-2.0`, `Commons-Clause`, `FSL-1.1-MIT`, `CC-BY-NC-*`, `⊘ Proprietary`) and tags entries accordingly — 70 entries are proprietary. Around 39% of the catalogue is AGPL or GPL. diff --git a/docs/selfhosted/INDEX.md b/docs/selfhosted/INDEX.md new file mode 100644 index 0000000..eec93d7 --- /dev/null +++ b/docs/selfhosted/INDEX.md @@ -0,0 +1,47 @@ +# Catálogo self-hosted — índice + +Espelho navegável do **awesome-selfhosted**: **1346 projetos** de código aberto que você pode hospedar por conta própria, agrupados em 12 categorias. + +Para escolher o que usar num projeto novo, comece pela [**shortlist SaaS**](shortlist-saas.md) — as categorias que um fundador de SaaS de fato substitui. Este índice é o acervo completo, para quando a shortlist não cobre o caso. + +> **Fonte:** [awesome-selfhosted/awesome-selfhosted-data](https://github.com/awesome-selfhosted/awesome-selfhosted-data) · **Licença:** [CC-BY-SA 3.0 Unported](https://creativecommons.org/licenses/by-sa/3.0/) · **Autores:** [AUTHORS](https://github.com/awesome-selfhosted/awesome-selfhosted-data/blob/master/AUTHORS) upstream. +> Arquivo **gerado** por `scripts/sync-selfhosted.js`. Não edite à mão — as edições se perdem na próxima sincronização. + +--- + +## Categorias + +| Categoria | Projetos | O que tem dentro | +|---|---:|---| +| [Comunicação](catalog/comunicacao.md) | 197 | Email, chat, fórum, videoconferência, XMPP, IRC, SIP, newsletters, feed readers. | +| [Arquivos e backup](catalog/arquivos-backup.md) | 91 | Sincronização, object storage, gerenciadores de arquivo, P2P, backup, arquivamento digital. | +| [Mídia](catalog/midia.md) | 161 | Streaming de áudio e vídeo, galerias de foto, gestão de biblioteca, videovigilância, jogos. | +| [Produtividade e conhecimento](catalog/produtividade.md) | 227 | Notas, wikis, gestão documental, suítes de escritório, tarefas, bookmarks, calendário, dashboards. | +| [Negócio e operações](catalog/negocio.md) | 160 | CRM, e-commerce, ERP, estoque, RH, finanças, ticketing, agendamento, eventos. | +| [Desenvolvimento](catalog/desenvolvimento.md) | 118 | CI/CD, API management, IDEs, testes, low-code, serverless, feature flags, geradores estáticos, bancos de dados. | +| [Infraestrutura e rede](catalog/infraestrutura.md) | 106 | DNS, proxy, VPN, servidores web, acesso remoto, IoT, painéis de self-hosting. | +| [Segurança e identidade](catalog/seguranca-identidade.md) | 7 | Gerenciadores de senha, SSO, identidade federada, gestão de identidade. | +| [Observabilidade e busca](catalog/observabilidade.md) | 48 | Monitoramento, status pages, analytics, motores de busca. | +| [Conteúdo e publicação](catalog/conteudo.md) | 82 | CMS, blogs, encurtadores de URL, plataformas de curso. | +| [Automação e IA](catalog/automacao-ia.md) | 46 | Automação de fluxos e IA generativa auto-hospedada. | +| [Outros](catalog/outros.md) | 103 | Mapas e GPS, saúde, genealogia, e o balde "Miscellaneous" do upstream. | + +**Total: 1346 projetos.** + +--- + +## Como regenerar + +```bash +node scripts/sync-selfhosted.js +``` + +O script clona o upstream, lê os arquivos YAML e reescreve `INDEX.md` e `catalog/`. O `README.md` e a `shortlist-saas.md` são curados à mão e **não** são sobrescritos. + +--- + +## Legenda + +- **⭐** — estrelas no GitHub quando disponíveis. Sinal de tração, não de qualidade. +- **⚠️** — o upstream marcou o projeto como arquivado. Não adote sem verificar. +- **Licença** — copyleft (AGPL, GPL) impõe obrigações se você distribuir modificações. Ver a nota de licenças no [README](README.md). diff --git a/docs/selfhosted/README.md b/docs/selfhosted/README.md new file mode 100644 index 0000000..2d66698 --- /dev/null +++ b/docs/selfhosted/README.md @@ -0,0 +1,98 @@ +# Catálogo self-hosted + +Espelho local do **[awesome-selfhosted](https://github.com/awesome-selfhosted/awesome-selfhosted)** — 1.346 projetos de código aberto que você pode hospedar por conta própria em vez de assinar um SaaS de terceiros. + +| Arquivo | O que é | Gerado? | +|---|---|---| +| [`shortlist-saas.md`](shortlist-saas.md) | **Comece por aqui.** As categorias que um fundador de SaaS de fato substitui, curadas à mão. | ✋ manual | +| [`INDEX.md`](INDEX.md) | Índice das 12 categorias com contagem. | 🤖 gerado | +| [`catalog/`](catalog) | O acervo completo, 1.346 projetos em 12 arquivos. | 🤖 gerado | + +Upstream, para aprofundar: **** · dados em **** · site em ****. + +--- + +## Licença — leia antes de copiar daqui + +O AI Dev Operating System é MIT. **Este diretório não é.** + +> Os dados em `INDEX.md` e `catalog/` derivam do awesome-selfhosted-data, licenciado sob **[Creative Commons Attribution-ShareAlike 3.0 Unported](https://creativecommons.org/licenses/by-sa/3.0/)** (CC-BY-SA 3.0). A lista de autores está em [AUTHORS](https://github.com/awesome-selfhosted/awesome-selfhosted-data/blob/master/AUTHORS) no upstream. +> +> Share-alike significa que **qualquer redistribuição destes dados, modificada ou não, precisa manter a mesma licença e a atribuição**. Se você copiar tabelas daqui para o seu projeto, o CC-BY-SA acompanha. O resto do OS continua MIT — a fronteira é este diretório. + +O carve-out é deliberado, e é o motivo de o catálogo viver em `docs/selfhosted/` em vez de misturado ao `docs/registry/`. + +--- + +## Como isto se relaciona com o `docs/registry/` + +Duas coisas diferentes, fáceis de confundir: + +| | `docs/registry/` | `docs/selfhosted/` | +|---|---|---| +| **Pergunta que responde** | "que repo eu instalo **dentro** do meu projeto?" | "que software eu hospedo **em vez de** assinar um SaaS?" | +| **Conteúdo** | 71 packs curados à mão, um one-pager cada | 1.346 entradas geradas de fonte externa | +| **Licença** | MIT (o catálogo; cada pack tem a sua) | CC-BY-SA 3.0 | +| **Quando roda no WIZARD** | estágios 3.1 e 4.3 | estágio 4.2 | + +--- + +## Regenerar + +```bash +node scripts/sync-selfhosted.js +``` + +Clona o upstream, lê os YAML e reescreve `INDEX.md` e `catalog/`. **Não sobrescreve** este README nem a `shortlist-saas.md`. + +Para usar um clone que você já tem localmente: + +```bash +node scripts/sync-selfhosted.js /caminho/para/awesome-selfhosted-data +``` + +Vale rodar a cada poucos meses. O upstream tem verificação automática de link morto e de projeto abandonado; **nossa cópia não tem** — ela é fiel à data em que foi gerada, e nada mais. + +--- + +## O que este catálogo NÃO cobre + +Verificado no snapshot atual, e relevante justamente porque é onde um fundador de SaaS olha primeiro. Nestas 9 categorias **o arquivo de tag existe upstream mas nenhum software a referencia**: + +`Backup` · `Federated Identity & Authentication` · `Identity Management` · `Monitoring & Status Pages` · `Software Development - CI/CD` · `Software Development - FaaS & Serverless` · `Static Site Generators` · `VPN` · `File Transfer - Distributed Filesystems` + +E projetos conhecidos dessas áreas estão ausentes do dataset: Keycloak, Authentik, MinIO, Supabase, Uptime Kuma, Coolify, WireGuard, restic, Borg, Hugo, Jekyll, Jenkins, Cal.com. + +Isso é coerente com o escopo declarado do upstream — **serviços de rede e aplicações web** auto-hospedados. Ferramentas de build, CLIs de backup e implementações de protocolo caem fora do escopo, e os arquivos de tag vazios são resíduo de um escopo anterior. + +**Consequência prática:** para auth, observabilidade, CI/CD, backup e PaaS, este catálogo não vai te ajudar. Procure no `docs/registry/` ou fora. A [`shortlist-saas.md`](shortlist-saas.md) marca essas lacunas explicitamente em vez de fingir que não existem. + +--- + +## Licenças dentro do catálogo + +Medido no snapshot atual das 1.346 entradas: + +| Licença | Entradas | Atenção | +|---|---:|---| +| MIT | 360 | permissiva | +| **AGPL-3.0** | **302** | ⚠️ copyleft de rede | +| **GPL-3.0** | **224** | ⚠️ copyleft | +| Apache-2.0 | 143 | permissiva | +| BSD (variantes) | 51 | permissiva | +| **⊘ Proprietary** | **70** | ⚠️ não é código aberto | + +Cerca de **39% do catálogo é copyleft**. Duas armadilhas concretas: + +1. **AGPL-3.0 alcança uso em rede.** Se você modificar um componente AGPL e oferecer o serviço pela internet, precisa disponibilizar o código modificado aos usuários. Rodar sem modificar é livre; modificar e servir, não. +2. **Nem tudo aqui é código aberto.** O upstream mantém uma lista de licenças não-livres (`BUSL-1.1`, `SSPL-1.0`, `Elastic-2.0`, `Commons-Clause`, `FSL-1.1-MIT`, `CC-BY-NC-*`, `⊘ Proprietary`) e marca as entradas correspondentes. 70 são proprietárias. + +**Confirme a licença no upstream do projeto antes de adotar.** A coluna aqui é ponto de partida, não parecer jurídico. + +--- + +## Por que isto existe no OS + +O WIZARD, no estágio 4.2 (Technical Plan), pergunta ao projetista se ele quer plataformas gerenciadas, self-hosted, ou híbrido. A pergunta só é honesta se houver uma resposta concreta do lado self-hosted — daí o catálogo ser local e offline, e não um link. + +A postura do mantenedor está no [`ETHOS.md`](../../ETHOS.md): preferência por self-hosted, por independência de infraestrutura, controle dos dados e custo. **Isso é postura, não regra.** O estágio 4.2 apresenta o trade-off dos dois lados e aceita a decisão do projetista — inclusive "gerenciado em tudo", que costuma ser a resposta certa para quem está sozinho no Sprint 1. diff --git a/docs/selfhosted/catalog/arquivos-backup.md b/docs/selfhosted/catalog/arquivos-backup.md new file mode 100644 index 0000000..d535007 --- /dev/null +++ b/docs/selfhosted/catalog/arquivos-backup.md @@ -0,0 +1,134 @@ +# Self-hosted — Arquivos e backup + +Sincronização, object storage, gerenciadores de arquivo, P2P, backup, arquivamento digital. + +**91 projetos** nesta categoria. + +> **Fonte:** [awesome-selfhosted/awesome-selfhosted-data](https://github.com/awesome-selfhosted/awesome-selfhosted-data) · **Licença:** [CC-BY-SA 3.0 Unported](https://creativecommons.org/licenses/by-sa/3.0/) · **Autores:** [AUTHORS](https://github.com/awesome-selfhosted/awesome-selfhosted-data/blob/master/AUTHORS) upstream. +> Arquivo **gerado** por `scripts/sync-selfhosted.js`. Não edite à mão — as edições se perdem na próxima sincronização. + +[← Voltar ao índice](../INDEX.md) · [Shortlist SaaS](../shortlist-saas.md) + +--- + +## Archiving and Digital Preservation (DP) + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [ArchiveBox](https://archivebox.io/) | Create HTML & screenshot archives of sites from your bookmarks, browsing history, RSS feeds, or other sources (alternative to Wayback Machine). | MIT | Python, Docker | 28.1k | +| [ArchivesSpace](https://archivesspace.org/) | Archives information management application for managing and providing Web access to archives, manuscripts and digital objects. | ECL-2.0 | Ruby | 0.4k | +| [Bichon](https://github.com/rustmailer/bichon) | Email archiving server that syncs from IMAP accounts, indexes emails for full-text search, and provides a REST API. No external database required, includes WebUI with multi-account support. | AGPL-3.0 | Rust, Docker | 1.9k | +| [bitmagnet](https://bitmagnet.io) | BitTorrent indexer, DHT crawler, content classifier and torrent search engine with web UI, GraphQL API and Servarr stack integration. | MIT | Go, Docker | 4.3k | +| [CKAN](https://ckan.org) | Make open data websites. | AGPL-3.0 | Python | 5.1k | +| [Collective Access - Providence](https://collectiveaccess.org/) | Highly configurable Web-based framework for management, description, and discovery of digital and physical collections supporting a variety of metadata standards, data types, and media formats. | GPL-3.0 | PHP | 0.4k | +| [Eonvelope](https://dacid99.gitlab.io/eonvelope) | Email archiving software that allows you to preserve your emails for an indefinite long period of time. | AGPL-3.0 | K8S, Docker | 0.0k | +| [Ganymede](https://github.com/Zibbp/ganymede) | Twitch VOD and live stream archiving platform. Includes a rendered chat for each archive. | GPL-3.0 | Docker | 1.0k | +| [mail-archiver](https://github.com/s1t5/mail-archiver) | Web application for archiving, searching, and exporting emails from multiple accounts (IMAP, M365 or Import). Featuring folder sync, attachment support, mailbox migration and a dashboard. | GPL-3.0 | Docker | 2.0k | +| [Omeka S](https://omeka.org/s/) | Next-generation web publishing platform for institutions interested in connecting digital cultural heritage collections with other resources online. | GPL-3.0 | Nodejs | 0.5k | +| [Open Archiver](https://openarchiver.com/) | Email archiving solution with full-text search and eDiscovery search features. | AGPL-3.0 | Docker | 2.2k | +| [Piler](https://www.mailpiler.org/) | Feature-rich email archiving solution. | GPL-3.0 | C, Docker, deb | 0.3k | +| [Wallabag](https://www.wallabag.org) | Wallabag, formerly Poche, is a web application allowing you to save articles to read them later with improved readability. | MIT | PHP | 12.9k | +| [Wayback](https://github.com/wabarc/wayback) | A self-hosted toolkit for archiving webpages to the Internet Archive, archive.today, IPFS, and local file systems. | GPL-3.0 | Go | 2.2k | + +## File Transfer & Synchronization + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [bewCloud](https://bewcloud.com) | File sharing + sync, notes, and photos (alternative to Nextcloud and ownCloud's RSS reader). | AGPL-3.0 | Docker | 1.2k | +| [Cloudreve](https://cloudreve.org/) | File management and sharing system, supports multiple storage providers. | GPL-3.0 | Docker, Go | 28.5k | +| [FileRun](https://filerun.com/) | Complete solution for your files with integration with Google and Office. | ⊘ Proprietary | PHP | — | +| [Git Annex](https://git-annex.branchable.com/) | File synchronization between computers, servers, external drives. | GPL-3.0 | Haskell | — | +| [Kinto](https://kinto.readthedocs.org) | Minimalist JSON storage service with synchronisation and sharing abilities. | Apache-2.0 | Python | 4.4k | +| [Nextcloud](https://nextcloud.com/) | Access and share your files, calendars, contacts, mail and [more](https://apps.nextcloud.com/) from any device, on your terms. | AGPL-3.0 | PHP, deb | 36.4k | +| [OpenCloud](https://docs.opencloud.eu/) | File Sharing and Collaboration Platform. | Apache-2.0 | Docker, Go, Nodejs | 5.8k | +| [OpenSSH SFTP server](https://www.openssh.com/) | Secure File Transfer Program. | BSD-2-Clause | C, deb | — | +| [ownCloud](https://owncloud.org/) | All-in-one solution for saving, synchronizing, viewing, editing and sharing files, calendars, address books and more. | AGPL-3.0 | PHP, Docker, deb | 8.8k | +| [Peergos](https://peergos.org) | Secure and private space online where you can store, share and view your photos, videos, music and documents. Also includes a calendar, news feed, task lists, chat and email client. | AGPL-3.0 | Java | 2.4k | +| [Puter](https://puter.com/) | Web-based operating system designed to be feature-rich, exceptionally fast, and highly extensible. | AGPL-3.0 | Nodejs, Docker | 43.0k | +| [Pydio](https://pydio.com/) | Turn any web server into a powerful file management system and an alternative to mainstream cloud storage providers. | AGPL-3.0 | Go | 2.2k | +| [Resilio Sync](https://www.resilio.com/) | Proprietary peer-to-peer file synchronisation tool. | ⊘ Proprietary | Unknown | — | +| [Samba](https://www.samba.org/) | Samba is the standard Windows interoperability suite of programs for Linux and Unix. It provides secure, stable and fast file and print services for all clients using the SMB/CIFS protocol. | GPL-3.0 | C | — | +| [Seafile](https://www.seafile.com/en/home/) | File hosting and sharing solution primary for teams and organizations. | GPL-2.0, GPL-3.0, AGPL-3.0, Apache-2.0 | C | 15.1k | +| [Sync-in](https://sync-in.com) | File storage, syncing, sharing, and collaboration with real-time editing, permission management, and desktop/CLI clients. | AGPL-3.0 | Nodejs, Docker | 1.6k | +| [Syncthing](https://syncthing.net/) | Syncthing is an open source peer-to-peer file synchronisation tool. | MPL-2.0 | Go, Docker, deb | 87.4k | +| [Unison](https://www.cis.upenn.edu/~bcpierce/unison/) | Unison is a file-synchronization tool for OSX, Unix, and Windows. | GPL-3.0 | deb, OCaml | 5.4k | +| [Yetishare](https://yetishare.com) | Powerful file hosting script with support for Amazon S3, Wasabi, Backblaze, local, direct and SFTP storage. | ⊘ Proprietary | PHP | — | + +## File Transfer - Object Storage & File Servers + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [GarageHQ](https://garagehq.deuxfleurs.fr/) | Geo-distributed, S3‑compatible storage service that can fulfill many needs. | AGPL-3.0 | Docker, Rust | — | +| [Harbor](https://goharbor.io/) | Cloud native image registry that stores, signs, and scans content. | Apache-2.0 | Docker, K8S | 29.1k | +| [SeaweedFS](https://github.com/seaweedfs/seaweedfs) | SeaweedFS is an open source distributed file system supporting WebDAV, S3 API, FUSE mount, HDFS, etc, optimized for lots of small files, and easy to add capacity. | Apache-2.0 | Go | 33.9k | +| [sftpgo Community Edition](https://github.com/drakkan/sftpgo) | Flexible, fully featured and highly configurable SFTP server with optional FTP/S and WebDAV support. | AGPL-3.0, ⊘ Proprietary | Go, deb, Docker | 12.4k | +| [Zenko CloudServer](https://www.zenko.io/cloudserver) | Zenko CloudServer, an open-source implementation of a server handling the Amazon S3 protocol. | Apache-2.0 | Docker, Nodejs | 1.9k | +| [ZOT OCI Registry](https://zotregistry.dev) | A production-ready vendor-neutral OCI-native container image registry. | Apache-2.0 | Go, Docker | 2.6k | + +## File Transfer - Peer-to-peer Filesharing + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [bittorrent-tracker](https://webtorrent.io/) | Simple, robust, BitTorrent tracker (client and server) implementation. | MIT | Nodejs | 1.9k | +| [Deluge](https://deluge-torrent.org/) | Lightweight, cross-platform BitTorrent client. | GPL-3.0 | Python, deb | — | +| [PrivyDrop](https://www.privydrop.app) | Simple and user-friendly, breakpoint-resumable peer-to-peer text, image, and file transfer tool based on WebRTC. | MIT | Docker, Nodejs | 0.1k | +| [qBittorrent](https://www.qbittorrent.org/) | Free cross-platform bittorrent client with a feature rich Web UI for remote access. | GPL-2.0 | C++ | 39.3k | +| [slskd](https://github.com/slskd/slskd) | A modern client-server application for the Soulseek file sharing network. | AGPL-3.0 | Docker, C# | 3.7k | +| [Transmission](https://transmissionbt.com/) | Fast, easy, free Bittorrent client. | GPL-3.0 | C++, deb | 15.0k | +| [Webtor](https://github.com/webtor-io/self-hosted) | Web-based torrent client with instant audio/video streaming. | MIT | Docker | 0.7k | + +## File Transfer - Single-click & Drag-n-drop Upload + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [015](https://send.fudaoyuan.icu) | A temporary file sharing platform. Focused on providing one-time, temporary file and text upload, processing, and sharing services. | AGPL-3.0 | Docker | 0.4k | +| [Chibisafe](https://chibisafe.app) | File uploader service that aims to to be easy to use and set up. It accepts files, photos, documents, anything you imagine and gives you back a shareable link for you to send to others. | MIT | Docker, Nodejs | 2.7k | +| [Digirecord](https://ladigitale.dev/digirecord/) | Record and share audio files (documentation in French). | AGPL-3.0 | Nodejs, PHP | — | +| [elixire](https://gitlab.com/elixire/elixire) | Simple yet advanced screenshot uploading and link shortening service. | AGPL-3.0 | Python | 0.0k | +| [Files Sharing](https://github.com/axeloz/filesharing) | File sharing application based on unique and temporary links. | GPL-3.0 | PHP, Docker | 0.3k | +| [Flare](https://github.com/FlintSH/Flare) | A nonbloated, modern, and highly configurable file/screenshot vault server with support for ShareX, Flameshot, and Spectacle. Offers OCR search and more. | MIT | Docker, Nodejs | 0.1k | +| [Gokapi](https://github.com/Forceu/gokapi) | Lightweight server to share files, which expire after a set amount of downloads or days. Similar to the discontinued Firefox Send, with the difference that only the admin is allowed to upload files. | GPL-3.0 | Go, Docker | 2.8k | +| [goploader](https://depado.github.io/goploader/) | Easy file sharing with server-side encryption, curl/httpie/wget compliant. | MIT | Go | 0.3k | +| [GoSƐ](https://codeberg.org/stv0g/gose) | Modern file-uploader focusing on scalability and simplicity. It only depends on a S3 storage backend and hence scales horizontally without the need for additional databases or caches. | Apache-2.0 | Go, Docker | — | +| [Jirafeau](https://gitlab.com/jirafeau/Jirafeau) | One-click-fileshare project. Select your file, upload, and share a link. That's it. | AGPL-3.0 | PHP, Docker | 0.0k | +| [OnionShare](https://github.com/onionshare/onionshare) | Securely and anonymously share a file of any size. | GPL-3.0 | Python, deb | 7.1k | +| [PicoShare](https://github.com/mtlynch/picoshare) | Minimalist, easy-to-host service for sharing images and other files. | AGPL-3.0 | Go, Docker | 3.0k | +| [Picsur](https://github.com/CaramelFur/Picsur) | Simple imaging hosting platform that allows you to easily host, edit, and share images. | AGPL-3.0 | Docker | 1.2k | +| [PictShare](https://www.pictshare.net/) | Multi lingual image hosting service with a simple resizing and upload API. | Apache-2.0 | PHP, Docker | 0.9k | +| [Pingvin Share X](https://github.com/smp46/pingvin-share-x) | File sharing platform with support for logins, reverse shares, share expiry, S3 Buckets, advanced authentication, ClamAV for security scans and more (fork of Pingvin Share). | BSD-2-Clause | Docker, Nodejs | 0.3k | +| [Plik](https://github.com/root-gg/plik) | Scalable and friendly temporary file upload system. | MIT | Go, Docker | 1.8k | +| [ProjectSend](https://www.projectsend.org/) | Upload files and assign them to specific clients you create. Give access to those files to your clients. | GPL-2.0 | PHP | 2.0k | +| [PsiTransfer](https://github.com/psi-4ward/psitransfer) | Simple file sharing solution with robust up-/download-resume and password protection. | BSD-2-Clause | Nodejs | 1.9k | +| [QuickShare](https://ihexxa.github.io/quickshare.site/) | Quick and simple file sharing between different devices. | LGPL-3.0 | Docker, Go | 0.6k | +| [Safebucket](https://docs.safebucket.io/) | File sharing platform with pluggable infrastructure, where uploads and downloads go directly between clients and S3-compatible storage. | Apache-2.0 | Go, Docker | 0.8k | +| [sE2EEnd](https://github.com/sE2EEnd/sE2EEnd) | End-to-end encrypted file sharing with password protection, download limits, and auto-expiration, integrated with Keycloak for authentication. | AGPL-3.0 | Docker | 0.0k | +| [Sharry](https://github.com/eikek/sharry) | Share files easily over the internet between authenticated and anonymous users (both ways) with resumable up- and downloads. | GPL-3.0 | Scala, Java, deb, Docker | 1.3k | +| [Shifter](https://github.com/TobySuch/Shifter) | A simple, self-hosted file-sharing web app, powered by Django. | MIT | Docker | 0.0k | +| [Slink](https://docs.slinkapp.io/) | Image sharing platform designed to give users complete control over their media sharing experience. | AGPL-3.0 | Docker | 1.6k | +| [snowshare](https://github.com/TuroYT/snowshare) | File and link sharing platform with URL shortening, code snippet sharing, and file uploads, featuring customizable expiration, privacy settings, and QR codes. | CC0-1.0 | Nodejs, Docker | 0.1k | +| [transfer.sh](https://github.com/dutchcoders/transfer.sh) | Easy file sharing from the command line. | MIT | Go | 15.9k | +| [Uguu](https://github.com/nokonoko/uguu) | Stores files and deletes after X amount of time. | MIT | PHP | 1.2k | +| [XBackBone](https://xbackbone.app/) | A simple, fast and lightweight file manager with instant sharing tools integration, like ShareX (a free and open-source screenshot utility for Windows). | AGPL-3.0 | PHP, Docker | 1.2k | +| [Zipline](https://github.com/diced/zipline) | A lightweight, fast and reliable file sharing server that is commonly used with ShareX, offering a react-based Web UI and fast API. | MIT | Docker, Nodejs | 3.3k | + +## File Transfer - Web-based File Managers + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Apaxy](https://oupala.github.io/apaxy/) | Theme built to enhance the experience of browsing web directories, using the mod_autoindex Apache module and some CSS to override the default style of a directory listing. | GPL-3.0 | Javascript | 1.9k | +| [ClyoCloud](https://clyo.cloud/) | A personal, self-hosted cloud storage and media management application built for privacy, efficiency, and aesthetics. | AGPL-3.0 | Nodejs | — | +| [copyparty](https://github.com/9001/copyparty) | Portable file server with accelerated resumable uploads, deduplication, WebDAV, FTP, zeroconf, media indexer, video thumbnails, audio transcoding, and write-only folders, in a single file with no mandatory dependencies. | MIT | Python | 46.1k | +| [Directory Lister](https://www.directorylister.com/) | Simple PHP based directory lister that lists a directory and all its sub-directories and allows you to navigate there within. | MIT | PHP, Docker | 2.5k | +| [filebrowser](https://filebrowser.org/) | Web File Browser with a Material Design web interface. | Apache-2.0 | Go | 35.8k | +| [FileGator](https://filegator.io/) | FileGator is a powerful multi-user file manager with a single page front-end. | MIT | PHP, Docker | 3.0k | +| [FileRise](https://github.com/error311/FileRise) | Web file manager with uploads, tagging, share links, gallery/table views, and an in-browser editor. | MIT | Docker, PHP | 1.0k | +| [Filestash](https://www.filestash.app/) | Web file manager that lets you manage your data anywhere it is located: FTP, SFTP, WebDAV, Git, S3, Minio, Dropbox, or Google Drive. | AGPL-3.0 | Docker | 14.5k | +| [IFM](https://github.com/misterunknown/ifm) | Single script file manager. | MIT | PHP | 0.4k | +| [mikochi](https://github.com/zer0tonin/Mikochi) | Browse remote folders, upload files, delete, rename, download and stream files to VLC/mpv. | MIT | Go, Docker, K8S | 0.4k | +| [miniserve](https://github.com/svenstaro/miniserve) | CLI tool to serve files and dirs over HTTP. | MIT | Rust | 7.8k | +| [ResourceSpace](https://www.resourcespace.com) | Simple, fast, and free way to organise your digital assets. | BSD-4-Clause | PHP | — | +| [slcl](https://gitea.privatedns.org/xavi/slcl) | Simple and lightweight web cloud storage. | AGPL-3.0 | C | — | +| [Surfer](https://git.cloudron.io/cloudron/surfer) | Simple static file server with webui to manage files. | MIT | Nodejs | — | +| [TagSpaces](https://www.tagspaces.org/) | TagSpaces is an offline, cross-platform file manager and organiser that also can function as a note taking app. The WebDAV version of the application can be installed on top of a WebDAV servers such as Nextcloud or ownCloud. | AGPL-3.0 | Nodejs | 5.2k | +| [Tiny File Manager](https://tinyfilemanager.github.io) | Web based File Manager in PHP, simple, fast and small file manager with a single file. | GPL-3.0 | PHP | 6.0k | + diff --git a/docs/selfhosted/catalog/automacao-ia.md b/docs/selfhosted/catalog/automacao-ia.md new file mode 100644 index 0000000..6ce38bc --- /dev/null +++ b/docs/selfhosted/catalog/automacao-ia.md @@ -0,0 +1,69 @@ +# Self-hosted — Automação e IA + +Automação de fluxos e IA generativa auto-hospedada. + +**46 projetos** nesta categoria. + +> **Fonte:** [awesome-selfhosted/awesome-selfhosted-data](https://github.com/awesome-selfhosted/awesome-selfhosted-data) · **Licença:** [CC-BY-SA 3.0 Unported](https://creativecommons.org/licenses/by-sa/3.0/) · **Autores:** [AUTHORS](https://github.com/awesome-selfhosted/awesome-selfhosted-data/blob/master/AUTHORS) upstream. +> Arquivo **gerado** por `scripts/sync-selfhosted.js`. Não edite à mão — as edições se perdem na próxima sincronização. + +[← Voltar ao índice](../INDEX.md) · [Shortlist SaaS](../shortlist-saas.md) + +--- + +## Automation + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Activepieces](https://www.activepieces.com) | No-code business automation tool like Zapier or Tray. For example, you can send a Slack notification for each new Trello card. | MIT | Docker | 23.6k | +| [Apache Airflow](https://airflow.apache.org/) | Platform to programmatically author, schedule, and monitor workflows. | Apache-2.0 | Python, Docker | 46.4k | +| [Automatisch](https://automatisch.io) | Business automation tool that lets you connect different services like Twitter, Slack, and more to automate your business processes (alternative to Zapier). | AGPL-3.0 | Docker | 13.9k | +| [BookBounty](https://github.com/TheWicklowWolf/BookBounty) | Retrieve missing Readarr books from Library Genesis. | MPL-2.0 | Docker | 0.3k | +| [changedetection.io](https://changedetection.io/) | Stay up-to-date with web-site content changes. | Apache-2.0 | Python, Docker | 33.0k | +| [ChiefOnboarding](https://chiefonboarding.com) | Employee onboarding platform that allows you to provision user accounts and create sequences with todo items, resources, text/email/Slack messages, and more! Available as a web portal and Slack bot. | AGPL-3.0 | Docker | 0.9k | +| [Cronicle](https://cronicle.net/) | Simple, distributed task scheduler and runner with a web based UI. | MIT | Nodejs | 5.8k | +| [Cronmaster](https://github.com/fccview/cronmaster) | Cronjob management UI with human readable syntax, live logging and log history for your cronjobs. | AGPL-3.0 | Docker | 1.3k | +| [Ctfreak](https://ctfreak.com) | IT task scheduler with mobile-friendly web UI to schedule concurrent, remote and chained execution of Bash / Powershell / SQL scripts, Webhooks, and more. | ⊘ Proprietary | Unknown | — | +| [CxReports](https://www.cx-reports.com) | Reporting and PDF document generation with a user-friendly WYSIWYG template editor, API, automated email delivery, and robust security features. | ⊘ Proprietary | Docker | — | +| [Dagu](https://docs.dagu.cloud/) | Powerful Cron alternative with a Web UI. It allows you to define dependencies between commands as a Directed Acyclic Graph (DAG) in a declarative YAML format. | GPL-3.0 | Go, Docker | 3.7k | +| [Discount Bandit](https://discount-bandit.cybrarist.com/) | Track pricing, stock status of products across multiple stores such as Amazon, Ebay, Walmart, etc. | GPL-3.0 | PHP, Docker | 0.7k | +| [Dittofeed](https://www.dittofeed.com) | Omni-channel customer engagement and messaging automation platform (alternative to Braze, Customer.io, Iterable). | MIT | Docker | 2.9k | +| [feedmixer](https://github.com/cristoper/feedmixer) | Micro web service which takes a list of feed URLs and returns a new feed consisting of the most recent n entries from each given feed (returns Atom, RSS, or JSON). | WTFPL | Python | 0.2k | +| [flowctl](https://flowctl.net) | Self-service workflow execution platform with approvals, remote execution and scheduling. | Apache-2.0 | Go, Docker | 0.3k | +| [Fredy](https://fredy.orange-coding.net/) | Searches for new apartments, houses, and flats in Germany on platforms like ImmoScout24, Immowelt, and others, and instantly delivers the results to you via Slack, Telegram, and more. | Apache-2.0 | Nodejs, Docker | 1.4k | +| [gocron](https://github.com/flohoss/gocron) | Task scheduler that allows users to specify recurring jobs via a simple YAML configuration file. | MIT | Docker | 0.5k | +| [HandBrake Web](https://github.com/TheNickOfTime/handbrake-web) | Use one or more instances of HandBrake video transcoder on a headless device via a web interface. | AGPL-3.0 | Docker | 0.8k | +| [Healthchecks](https://healthchecks.io/) | Listen for pings and sends alerts when pings are late. | BSD-3-Clause | Python, Docker | 10.2k | +| [HomeButler](https://homebutler.dev) | Homelab management tool for monitoring hosts, Docker services, Wake-on-LAN, inventory, and remote operations, with a web dashboard and MCP integrations. | MIT | Docker, Go | 0.2k | +| [Huginn](https://github.com/huginn/huginn) | Build agents that monitor and act on your behalf. | MIT | Ruby | 49.8k | +| [Kestra](https://kestra.io) | Event-driven, language-agnostic platform to create, schedule, and monitor workflows. In code. Coordinate data pipelines and tasks such as ETL and ELT. | Apache-2.0 | Docker | 27.6k | +| [Kibitzr](https://kibitzr.github.io) | Lightweight personal web assistant with powerful integrations. | MIT | Python | 0.7k | +| [LazyLibrarian](https://gitlab.com/LazyLibrarian/LazyLibrarian) | Follow authors and grab metadata for all your digital reading needs. It uses a combination of Goodreads, Librarything and optionally GoogleBooks as sources for author info and book info. | GPL-3.0 | Python | 0.4k | +| [Leon](https://getleon.ai) | Personal assistant who can live on your server. | MIT | Nodejs | 17.4k | +| [Matchering](https://github.com/sergree/matchering) | Automated music mastering (alternative to LANDR, eMastered and MajorDecibel). | GPL-3.0 | Docker | 2.6k | +| [Mylar3](https://mylarcomics.com/) | Automated Comic Book (cbr/cbz) downloader program for use with NZB and torrents. | GPL-3.0 | Python, Docker | 1.5k | +| [n8n](https://n8n.io/) | Free node based Workflow Automation Tool. Easily automate tasks across different services. | Apache-2.0, Commons-Clause | Nodejs | 199.7k | +| [OliveTin](https://www.olivetin.app/) | Web interface for running Linux shell commands. | AGPL-3.0 | Go | 3.7k | +| [pyLoad](https://pyload.net/) | Lightweight, customizable and remotely manageable downloader for 1-click-hosting sites like rapidshare.com or uploaded.to. | AGPL-3.0 | Python | 3.8k | +| [StackStorm](https://stackstorm.com) | StackStorm (aka _IFTTT for Ops_) is event-driven automation for auto-remediation, security responses, troubleshooting, deployments, and more. Includes rules engine, workflow, 160 integration packs with 6000+ actions and ChatOps. | Apache-2.0 | Python | 6.5k | +| [µTask](https://github.com/ovh/utask) | Automation engine that models and executes business processes declared in yaml. | BSD-3-Clause | Go, Docker | 1.4k | + +## Generative Artificial Intelligence (GenAI) + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Agenta](https://agenta.ai/) | LLMOps platform for prompt management, LLM evaluation, and observability. Build, evaluate, and monitor production-grade LLM applications with collaborative prompt engineering. | MIT | Docker | 4.4k | +| [AnythingLLM](https://anythingllm.com/) | All-in-one desktop & Docker AI application with built-in RAG, AI agents, No-code agent builder, MCP compatibility, and more. | MIT | Nodejs, Docker | 64.5k | +| [GoModel](https://gomodel.enterpilot.io/) | AI gateway written in Go with a unified OpenAI-compatible API for multiple LLM providers, USD cost tracking, budgets, usage analytics, guardrails, caching, and an admin dashboard. | MIT | Go, Docker | 1.0k | +| [Khoj](https://khoj.dev/) | Your AI second brain. Get answers from the web or your docs. Build custom agents, schedule automations, do deep research. Turn any online or local LLM into your personal, autonomous AI. | AGPL-3.0 | Python, Docker | 36.4k | +| [LibreChat](https://www.librechat.ai) | Enhanced ChatGPT-compatible AI chat interface supporting multiple AI providers, with multi-user auth, message search, and plugin support. | MIT | Nodejs, Docker | 41.8k | +| [LLM Harbor](https://github.com/av/harbor) | Containerized LLM toolkit. Run LLM backends, APIs, frontends, and additional services via a concise CLI. | Apache-2.0 | Docker, Shell | 3.2k | +| [LLMKube](https://llmkube.com) | Kubernetes operator for self-hosted LLM inference with pluggable runtimes (llama.cpp, vLLM, TGI, Ollama, vllm-swift), multi-GPU sharding, NVIDIA CUDA + Apple Silicon Metal support, and OpenAI-compatible API. | Apache-2.0 | Go, Docker, K8S | 0.2k | +| [LobeHub](https://www.lobehub.com) | Modern design AI chat framework supporting multiple AI providers, one click install MCP Marketplace and Artifacts / Thinking. | ⊘ Proprietary | Nodejs, Docker | 81.4k | +| [Local Deep Research](https://github.com/LearningCircuit/local-deep-research) | AI-powered deep research tool with multi-source search (arXiv, PubMed, web), PDF text extraction, and encrypted local storage. | MIT | Docker, Python | 8.9k | +| [LocalAI](https://localai.io/) | Run your AI models locally and generate images and audio (alternative to OpenAI and Claude). | MIT | Docker, K8S | 48.3k | +| [Ollama](https://ollama.com/) | Get up and running with Llama 3.3, DeepSeek-R1, Phi-4, Gemma 3, and other large language models. | MIT | Docker, Python | 178.0k | +| [Onyx Community Edition](https://onyx.app) | Chat UI that works with any LLM. It comes loaded with advanced features like agents, web search, RAG, MCP, deep research, Connectors to 40+ knowledge sources, and more. | MIT | Docker, K8S | 31.5k | +| [Open-WebUI](https://openwebui.com) | User-friendly AI Interface, supports Ollama, OpenAI API. | BSD-3-Clause | Docker, Python | 148.2k | +| [Vane](https://github.com/ItzCrazyKns/Vane) | AI-powered search engine (alternative to Perplexity AI). | MIT | Docker | 36.0k | + diff --git a/docs/selfhosted/catalog/comunicacao.md b/docs/selfhosted/catalog/comunicacao.md new file mode 100644 index 0000000..ec65fe1 --- /dev/null +++ b/docs/selfhosted/catalog/comunicacao.md @@ -0,0 +1,275 @@ +# Self-hosted — Comunicação + +Email, chat, fórum, videoconferência, XMPP, IRC, SIP, newsletters, feed readers. + +**197 projetos** nesta categoria. + +> **Fonte:** [awesome-selfhosted/awesome-selfhosted-data](https://github.com/awesome-selfhosted/awesome-selfhosted-data) · **Licença:** [CC-BY-SA 3.0 Unported](https://creativecommons.org/licenses/by-sa/3.0/) · **Autores:** [AUTHORS](https://github.com/awesome-selfhosted/awesome-selfhosted-data/blob/master/AUTHORS) upstream. +> Arquivo **gerado** por `scripts/sync-selfhosted.js`. Não edite à mão — as edições se perdem na próxima sincronização. + +[← Voltar ao índice](../INDEX.md) · [Shortlist SaaS](../shortlist-saas.md) + +--- + +## Communication - Custom Communication Systems + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [AnyCable](https://anycable.io/) | Realtime server for reliable two-way communication over WebSockets, Server-sent events, etc. | MIT | Go, Docker | 2.4k | +| [Apprise](https://github.com/caronc/apprise) | Apprise allows you to send a notification to almost all of the most popular notification services available to us today such as: Telegram, Discord, Slack, Amazon SNS, Gotify, etc. | MIT | Python, Docker, deb | 17.0k | +| [Centrifugo](https://centrifugal.dev/) | Language-agnostic real-time messaging (Websocket or SockJS) server. | MIT | Go, Docker, K8S | 10.6k | +| [Chatwoot](https://www.chatwoot.com) | Customer communication platform (alternative to Intercom and Zendesk). | ⊘ Proprietary | Ruby, Docker, K8S | 35.6k | +| [Chitchatter](https://chitchatter.im/) | Peer-to-peer chat app that is serverless, decentralized, and ephemeral. | GPL-2.0 | Nodejs | 2.3k | +| [Conduit](https://conduit.rs/) | A simple, fast, and reliable chat server powered by Matrix. | Apache-2.0 | Rust | 0.9k | +| [Continuwuity](https://continuwuity.org/) | Community-driven Matrix homeserver, the continuation of conduwuit focusing on user experience and new features (fork of Conduit). | Apache-2.0 | Rust, Docker, K8S, deb | — | +| [Databag](https://github.com/balzack/databag) | Federated, end-to-end encrypted messaging service for the web, iOS, and Android, supporting text, photos, video, and WebRTC video and audio calls. | Apache-2.0 | Docker | 1.5k | +| [Element](https://element.io) | Fully-featured Matrix client for Web, iOS & Android. | Apache-2.0 | Nodejs | 13.4k | +| [GlobaLeaks](https://www.globaleaks.org/) | Whistleblowing software enabling anyone to easily set up and maintain a secure reporting platform. | AGPL-3.0 | Python, deb, Docker | 1.5k | +| [GNUnet](https://gnunet.org/) | Software framework for decentralized, peer-to-peer networking. | GPL-3.0 | C | — | +| [Gotify](https://gotify.net/) | Notification server with Android and CLI clients (alternative to PushBullet). | MIT | Go, Docker | 15.7k | +| [Groupboard](https://www.groupboard.com/products/) | Online whiteboard, audio/video conferencing, screen sharing, shared code editing and optional session recording/playback. | ⊘ Proprietary | Unknown | — | +| [Hyphanet](https://hyphanet.org/) | Anonymously share files, browse and publish _freesites_ (web sites accessible only through Hyphanet) and chat on forums. | GPL-2.0 | Java | 1.2k | +| [Jami](https://jami.net/) | Universal communication platform which preserves the user's privacy and freedoms. | GPL-3.0 | C++ | — | +| [Live Helper Chat](https://livehelperchat.com/) | Live Support chat for your website. | Apache-2.0 | PHP | 2.2k | +| [Mattermost](https://mattermost.com/) | Platform for secure collaboration across the entire software development lifecycle, can be integrated with Gitlab (alternative to Slack). | ⊘ Proprietary | Go, Docker, K8S | 38.7k | +| [Mumble](https://wiki.mumble.info/wiki/Main_Page) | Low-latency, high quality voice/text chat software. | BSD-3-Clause | C++, deb | 8.2k | +| [Notifo](https://github.com/notifo-io/notifo) | Multichannel notification server with support for Email, Mobile Push, Web Push, SMS, messaging and a javascript plugin. | MIT | C# | 0.9k | +| [Novu](https://novu.co/) | Notification infrastructure for developers. | MIT | Docker, Nodejs | 39.5k | +| [ntfy](https://ntfy.sh/) | Push notifications to phone or desktop using HTTP PUT/POST, with Android app, CLI and web app, similar to Pushover and Gotify. | Apache-2.0, GPL-2.0 | Go, Docker, K8S | 33.2k | +| [One Time Secret](https://docs.onetimesecret.com) | Share sensitive information securely with self-destructing links that are only viewable once. | MIT | Docker, Ruby, Nodejs | 2.9k | +| [OTS](https://ots.fyi/) | One-Time-Secret sharing platform with a symmetric 256bit AES encryption in the browser. | Apache-2.0 | Go | 0.8k | +| [PrivMX WebMail](https://privmx.com) | Alternative private mail system - web-based, end-to-end encrypted by design, self-hosted, decentralized, uses independent PKI. Easy to install and administrate, freeware, open-source. | ⊘ Proprietary | PHP | — | +| [PushBits](https://github.com/pushbits/server) | Notification server for relaying push notifications via Matrix, similar to PushBullet and Gotify. | ISC | Go | 0.4k | +| [RetroShare](https://retroshare.cc) | Secured and decentralized communication system. Offers decentralized chat, forums, messaging, file transfer. | GPL-2.0 | C++ | 2.0k | +| [Rocket.Chat](https://rocket.chat/) | Communications platform that puts data protection first (alternative to Gitter.im and Slack). | MIT | Nodejs, Docker, K8S | 45.9k | +| [SAMA](https://samacloud.io) | Next-Gen self-hosted chat server and clients. | GPL-3.0 | Nodejs, Docker | 0.2k | +| [Screego](https://screego.net) | Screego is a simple tool to quickly share your screen to one or multiple people via web browser. | GPL-3.0 | Docker, Go | 10.5k | +| [Shhh](https://github.com/smallwat3r/shhh) | Keep secrets out of emails or chat logs, share them using secure links with passphrase and expiration dates. | MIT | Python | 0.4k | +| [SimpleX Chat](https://github.com/simplex-chat/simplex-chat) | The most private and secure chat and applications platform - now with double ratchet E2E encryption. | AGPL-3.0 | Haskell | 19.2k | +| [Spectrum 2](https://spectrum.im/) | Spectrum 2 is an open source instant messaging transport. It allows users to chat together even when they are using different IM networks. | GPL-3.0 | C++ | 0.4k | +| [Stoat](https://stoat.chat/) | Stoat is a user-first chat platform built with modern web technologies. | AGPL-3.0, MIT | Rust | 2.6k | +| [Synapse](https://element-hq.github.io/synapse/latest/index.html) | Server for [Matrix](https://matrix.org/), an open standard for decentralized persistent communication. | Apache-2.0 | Python, deb | 4.5k | +| [Tiledesk](https://tiledesk.com) | All-in-one customer engagement platform from lead-gen to post-sales, from WhatsApp to your website. With omni-channel live agents and AI-powered chatbots (alternative to Intercom, Zendesk, Tawk.to and Tidio). | MIT | Docker, K8S | 0.3k | +| [Tinode](https://github.com/tinode) | Instant messaging platform. Backend in Go. Clients: Swift iOS, Java Android, JS webapp, scriptable command line; chatbots. | GPL-3.0 | Go | 13.5k | +| [Tox](https://tox.chat/) | Distributed, secure messenger with audio and video chat capabilities. | GPL-3.0 | C | 2.7k | +| [Tuwunel](https://tuwunel.chat) | High-performance and feature-rich chat server for Matrix, and the successor to conduwuit (fork of Conduit). | Apache-2.0 | deb, Docker, Nix, Rust | 2.4k | +| [Typebot](https://typebot.io) | Conversational app builder (alternative to Typeform and Landbot). | AGPL-3.0 | Docker | 10.2k | +| [Virola Messenger](https://virola.io/) | Instant messaging and collaboration tool with private and group chat rooms, continuous voice and video meetings, files sharing, issue tracking with integrated task board (alternative to Slack). | ⊘ Proprietary | C++ | — | +| [WBO](https://github.com/lovasoa/whitebophir) | Web Whiteboard to collaborate in real-time on schemas, drawings, and notes. | AGPL-3.0 | Nodejs, Docker | 2.6k | +| [WorkAdventure](https://workadventu.re) | Virtual office / virtual conference application presented as a 16-bit RPG video game. | AGPL-3.0, Commons-Clause | Docker | 5.7k | +| [Zulip](https://zulip.org) | Zulip is a powerful, open source group chat application. | Apache-2.0 | Python | 25.6k | + +## Communication - Email - Complete Solutions + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [AnonAddy](https://anonaddy.com) | Email forwarding service for creating aliases. | MIT | PHP, Docker | 4.8k | +| [b1gMail](https://www.b1gmail.eu) | Complete email solution that runs on any webspace with PHP and MariaDB. It supports POP3 catchall mailboxes and can also integrate with Postfix or b1gMailServer if you're running your own server. | GPL-2.0 | PHP | — | +| [DebOps](https://docs.debops.org/) | Your Debian-based data center in a box. A set of general-purpose Ansible roles that can be used to manage Debian or Ubuntu hosts. | GPL-3.0 | Ansible, Python | 1.4k | +| [docker-mailserver](https://docker-mailserver.github.io/docker-mailserver/edge/) | Production-ready fullstack but simple mail server (SMTP, IMAP, LDAP, Antispam, Antivirus, etc.) running inside a container. Only configuration files, no SQL database. | MIT | Docker | 18.7k | +| [Dovel](https://dovel.email) | SMTP server that sends and receives emails according to a simple configuration file, with an optional web interface that you can use to browse your emails. | LGPL-3.0 | Go | — | +| [Forward Email](https://forwardemail.net) | Privacy-focused encrypted email for everyone. All-in-one alternative to Gmail + Mailchimp + Sendgrid. | BUSL-1.1, MPL-2.0 | Nodejs, Docker | 1.7k | +| [Inboxen](https://inboxen.org) | Lets you have an infinite number of unique inboxes. | GPL-3.0 | Python | — | +| [iRedMail](https://www.iredmail.org/) | Full-featured mail server solution based on Postfix and Dovecot. | GPL-3.0 | Shell | 1.8k | +| [Maddy Mail Server](https://maddy.email/) | All-in-one mail server that implements SMTP (both MTA and MX) and IMAP. Replaces Postfix, Dovecot, OpenDKIM, OpenSPF, OpenDMARC with single daemon. | GPL-3.0 | Go | 6.1k | +| [Mail-in-a-Box](https://mailinabox.email/) | Turns any Ubuntu server into a fully functional mail server with one command. | CC0-1.0 | Shell | 15.4k | +| [Mailcow](https://mailcow.email/) | Mail server suite based on Dovecot, Postfix and other open source software, that provides a modern Web UI for administration. | GPL-3.0 | Docker, PHP | 13.2k | +| [Mailu](https://mailu.io/) | Simple yet full-featured mail server as a set of Docker images. | MIT | Docker, Python | 7.4k | +| [Modoboa](https://modoboa.org/en/) | Mail hosting and management platform including a modern and simplified web user interface. | ISC | Python | 3.5k | +| [Mox](https://www.xmox.nl/) | Complete e-mail solution with IMAP4, SMTP, SPF, DKIM, DMARC, MTA-STS, DANE and DNSSEC, reputation-based and content-based junk filtering, Internationalization (IDNA), automatic TLS with ACME and Let's Encrypt, account autoconfiguration, and webmail. | MIT | Go | 5.8k | +| [Postal](https://docs.postalserver.io/) | Complete and fully featured mail server for use by websites & web servers. | MIT | Docker, Ruby | 16.7k | +| [Simple NixOS Mailserver](https://gitlab.com/simple-nixos-mailserver/nixos-mailserver) | Complete mailserver solution leveraging the Nix Ecosystem. | GPL-3.0 | Nix | 0.3k | +| [SimpleLogin](https://simplelogin.io) | Open source email alias solution to protect your email address. Comes with browser extensions and mobile apps. | MIT | Docker, Python | 6.9k | +| [Stalwart Mail Server](https://stalw.art) | All-in-one mail server with JMAP, IMAP4, and SMTP support and a wide range of modern features. | AGPL-3.0 | Rust, Docker | 14.1k | +| [wildduck](https://wildduck.email/) | Scalable no-SPOF IMAP/POP3 mail server. | EUPL-1.2 | Nodejs, Docker | 2.1k | + +## Communication - Email - Mail Delivery Agents + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Cyrus IMAP](https://www.cyrusimap.org/) | Email (IMAP/POP3), contacts and calendar server. | BSD-3-Clause-Attribution | C | 0.6k | +| [DavMail](https://davmail.sourceforge.net/) | POP/IMAP/SMTP/Caldav/Carddav/LDAP exchange gateway allowing users to use any mail/calendar client with an Exchange server, even from the internet or behind a firewall through Outlook Web Access. | GPL-2.0 | Java | 0.8k | +| [Dovecot](https://www.dovecot.org/) | IMAP and POP3 server written primarily with security in mind. | MIT, LGPL-2.1 | C, deb | 1.2k | + +## Communication - Email - Mail Transfer Agents + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [chasquid](https://blitiri.com.ar/p/chasquid/) | SMTP (email) server with a focus on simplicity, security, and ease of operation. | Apache-2.0 | Go | — | +| [Courier MTA](https://www.courier-mta.org/) | Fast, scalable, enterprise mail/groupware server providing ESMTP, IMAP, POP3, webmail, mailing list, basic web-based calendaring and scheduling services. | GPL-3.0 | C, deb | — | +| [DragonFly](https://github.com/corecode/dma) | A small MTA for home and office use. Works on Linux and FreeBSD. | BSD-3-Clause | C | 0.3k | +| [EmailRelay](https://emailrelay.sourceforge.net/) | A small and easy to configure SMTP and POP3 server for Windows and Linux. | GPL-3.0 | C++ | — | +| [Exim](https://www.exim.org/) | Message transfer agent (MTA) developed at the University of Cambridge. | GPL-3.0 | C, deb | — | +| [Haraka](https://haraka.github.io/) | Fast, highly extensible, and event driven SMTP server. | MIT | Nodejs | 5.6k | +| [OpenSMTPD](https://opensmtpd.org/) | Secure SMTP server implementation from the OpenBSD project. | ISC | C, deb | 0.6k | +| [OpenTrashmail](https://github.com/HaschekSolutions/opentrashmail) | Complete trashmail solution that exposes an SMTP server and has a web interface to manage received emails. Works with multiple and wildcard domains and is fully file based (no database needed). Includes RSS feeds and JSON API. | Apache-2.0 | Python, PHP, Docker | 0.9k | +| [Postfix](http://www.postfix.org/) | Fast, easy to administer, and secure Sendmail replacement. | IPL-1.0 | C, deb | — | +| [Sendmail](https://www.proofpoint.com/us/products/email-protection/open-source-email-solution) | Message transfer agent (MTA). | Sendmail | C, deb | — | + +## Communication - Email - Mailing Lists and Newsletters + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [HyperKitty](https://wiki.list.org/HyperKitty) | Access GNU Mailman v3 archives. | GPL-3.0 | Python | 0.2k | +| [Keila](https://www.keila.io) | Reliable and easy-to-use newsletter tool (alternative to Mailchimp and Sendinblue). | AGPL-3.0 | Docker | 2.2k | +| [Listmonk](https://listmonk.app/) | High performance, self-hosted newsletter and mailing list manager with a modern dashboard. | AGPL-3.0 | Go, Docker | 22.7k | +| [Mailman](https://www.list.org/) | Manage electronic mail discussion and e-newsletter lists. | GPL-3.0 | Python | — | +| [Mautic](https://www.mautic.org/) | Marketing automation software (email, social and more). | GPL-3.0 | PHP | 10.3k | +| [mlmmj](https://mlmmj.org/) | Mailing list management made joyful. | MIT | C | — | +| [phpList](https://www.phplist.org) | Newsletter and email marketing with advanced management of subscribers, bounces, and plugins. | AGPL-3.0 | PHP | 0.9k | +| [Postorius](https://docs.mailman3.org/projects/postorius/en/latest/) | Web user interface to access GNU Mailman. | GPL-3.0 | Python | 0.1k | +| [Schleuder](https://schleuder.nadir.org/) | GPG-enabled mailing list manager with resending-capabilities. | GPL-3.0 | Ruby | — | +| [Sendy](https://sendy.co) | Self-hosted email newsletter application that lets you send bulk emails via Amazon Simple Email Service (SES) or other SMTP services. | ⊘ Proprietary | PHP | — | +| [Sympa](https://www.sympa.community/) | Mailing list manager. | GPL-2.0 | Perl | 0.3k | + +## Communication - Email - Webmail Clients + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Cypht](https://cypht.org) | Feed reader for your email accounts. | LGPL-2.1 | PHP | 1.7k | +| [Roundcube](https://roundcube.net) | Browser-based IMAP client with an application-like user interface. | GPL-3.0 | PHP, deb | 7.1k | +| [SnappyMail](https://snappymail.eu/) | Simple, modern, lightweight & fast web-based email client (fork of RainLoop). | AGPL-3.0 | PHP | 1.7k | +| [SquirrelMail](https://squirrelmail.org) | Another browser-based IMAP client. | GPL-2.0 | PHP | — | + +## Communication - IRC + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Ergo](https://ergo.chat/) | Modern IRCv3 server written in Go, combining the features of an ircd, a services framework, and a bouncer. | MIT | Go, Docker | 3.3k | +| [Glowing Bear](https://github.com/glowing-bear/glowing-bear) | A web frontend for WeeChat. | GPL-3.0 | Nodejs | 1.0k | +| [InspIRCd](https://www.inspircd.org/) | Modular IRC server written in C++ for Linux, BSD, Windows, and macOS. | GPL-2.0 | C++, Docker | 1.3k | +| [Kiwi IRC](https://kiwiirc.com/) | Responsive web IRC client with theming support. | Apache-2.0 | Nodejs | 1.0k | +| [ngircd](https://ngircd.barton.de/) | Portable and lightweight Internet Relay Chat server for small or private networks. | GPL-2.0 | C, deb | 0.6k | +| [Quassel IRC](https://quassel-irc.org/) | Distributed IRC client, meaning that one (or multiple) client(s) can attach to and detach from a central core. | GPL-2.0 | C++ | 0.8k | +| [Robust IRC](https://robustirc.net/) | IRC without netsplits. Distributed IRC server, based on RobustSession protocol. | BSD-3-Clause | Go | 0.2k | +| [The Lounge](https://thelounge.chat/) | Self-hosted web IRC client. | MIT | Nodejs, Docker | 6.3k | +| [UnrealIRCd](https://www.unrealircd.org/) | Modular, advanced and highly configurable IRC server written in C for Linux, BSD, Windows, and macOS. | GPL-2.0 | C | 0.5k | +| [Weechat](https://weechat.org/) | Fast, light and extensible chat client. | GPL-3.0 | C, Docker, deb | 3.4k | +| [ZNC](https://wiki.znc.in/ZNC) | Advanced IRC bouncer. | Apache-2.0 | C++, deb | 2.1k | + +## Communication - SIP + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [3CX](https://www.3cx.com/pbx/) | Full-featured PABX system, with call queues, built-in web conferencing, live chat and social media messaging all on one system. | ⊘ Proprietary | Unknown | — | +| [Asterisk](https://www.asterisk.org/) | Easy to use but advanced IP PBX system, VoIP gateway and conference server. | GPL-2.0 | C, deb | 3.4k | +| [Flexisip](https://www.linphone.org/en/flexisip-sip-server/) | Complete, modular and scalable SIP server, includes a push gateway, to deliver SIP incoming calls or text messages on mobile device platforms where push notifications are required to receive information when the app is not active in the foreground. | AGPL-3.0 | C, Docker | 0.2k | +| [Freepbx](https://www.freepbx.org) | Web-based open source GUI that controls and manages Asterisk. | GPL-2.0 | PHP | — | +| [FreeSWITCH](https://freeswitch.org/) | Scalable open source cross-platform telephony platform. | MPL-2.0 | C | 5.1k | +| [FusionPBX](https://www.fusionpbx.com/) | Web interface for multi-platform voice switch called FreeSWITCH. | MPL-1.1 | PHP | 1.0k | +| [Kamailio](https://www.kamailio.org/w/) | Modular SIP server (registrar/proxy/router/etc). | GPL-2.0 | C, deb | 2.9k | +| [openSIPS](https://opensips.org/) | SIP proxy/server for voice, video, IM, presence and any other SIP extensions. | GPL-2.0 | C | 1.5k | +| [Routr](https://routr.io) | Lightweight SIP proxy, location server, and registrar for a reliable and scalable SIP infrastructure. | MIT | Docker, K8S | 1.7k | +| [SIP3](https://sip3.io/) | VoIP troubleshooting and monitoring platform. | Apache-2.0 | Java | — | +| [SIPCAPTURE Homer](https://www.sipcapture.org/) | Troubleshooting and monitoring VoIP calls. | AGPL-3.0 | Nodejs, Go, Docker | 2.0k | +| [Wazo](https://wazo-platform.org/) | Full-featured IPBX solution built atop Asterisk with integrated Web administration interface and REST-ful API. | GPL-3.0 | Python | — | +| [Yeti-Switch](https://yeti-switch.org/) | Transit class4 softswitch(SBC) with integrated billing and routing engine and REST API. | GPL-2.0 | C++, Ruby | — | + +## Communication - Social Networks and Forums + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Akkoma](https://akkoma.social/) | Federated microblogging server with Mastodon, GNU social, and ActivityPub compatibility. | AGPL-3.0 | Elixir, Docker | — | +| [Answer](https://answer.apache.org) | Knowledge-based community software. You can use it to quickly build your Q&A community for product technical support, customer support, user communication, and more. | Apache-2.0 | Docker, Go | 15.6k | +| [Artalk](https://artalk.js.org/) | Comment system built in Golang, providing a lightweight and highly customizable solution for adding comments to your website. | MIT | Go, Docker | 2.3k | +| [AsmBB](https://board.asm32.info) | Fast, SQLite-powered forum engine written in ASM. | EUPL-1.2 | Assembly | — | +| [BuddyPress](https://buddypress.org/about/) | Powerful plugin that takes your WordPress.org powered site beyond the blog with social-network features like user profiles, activity streams, user groups, and more. | GPL-2.0 | PHP | 0.3k | +| [Coral](https://coralproject.net/) | A better commenting experience from Vox Media. | Apache-2.0 | Docker, Nodejs | 2.0k | +| [diaspora*](https://diasporafoundation.org/) | Distributed social networking server. | AGPL-3.0 | Ruby | 13.7k | +| [Discourse](https://www.discourse.org/) | Advanced forum / community solution based on Ruby and JS. | GPL-2.0 | Docker | 47.6k | +| [Elgg](https://elgg.org/) | Powerful open source social networking engine. | GPL-2.0 | PHP | 1.7k | +| [Enigma 1/2 BBS](https://nuskooler.github.io/enigma-bbs/) | Enigma 1/2 is a modern, multi-platform BBS engine with unlimited "callers" and legacy DOS door game support. | BSD-2-Clause | Shell, Docker, Nodejs | 0.7k | +| [Flarum](https://flarum.org) | Delightfully simple forums. Flarum is the next-generation forum software that makes online discussion fun again. | MIT | PHP | 16.4k | +| [Friendica](https://friendi.ca/) | Social Communication Server. | AGPL-3.0 | PHP | 1.7k | +| [GoToSocial](https://docs.gotosocial.org/en/latest/) | ActivityPub federated social network server implementing the Mastodon client API. | AGPL-3.0 | Docker, Go | — | +| [Habitat](https://gethabitat.org/) | A Platform for Local Communities. | AGPL-3.0 | Docker | 0.1k | +| [Hatsu](https://hatsu.cli.rs/) | Bridge that interacts with Fediverse on behalf of your static site. | AGPL-3.0 | Docker, Rust | 0.3k | +| [Hubzilla](https://hubzilla.org) | Decentralized identity, privacy, publishing, sharing, cloud storage, and communications/social platform. | MIT | PHP | — | +| [HumHub](https://www.humhub.org/) | Flexible kit for private social networks. | AGPL-3.0 | PHP | 6.7k | +| [Iceshrimp.NET](https://iceshrimp.net) | Federated microblogging server that communicates over ActivityPub. | EUPL-1.2 | .NET, C#, Docker | — | +| [Isso](https://isso-comments.de/) | Lightweight commenting server written in Python and Javascript. It aims to be a drop-in replacement for Disqus. | MIT | Python, Docker | 5.3k | +| [Lemmy](https://join-lemmy.org/) | Link aggregator for the fediverse (alternative to Reddit). | AGPL-3.0 | Docker, Rust | 14.5k | +| [Loomio](https://www.loomio.org/) | Collaborative decision-making tool that makes it easy for anyone to participate in decisions which affect them. | AGPL-3.0 | Docker | 2.6k | +| [Mastodon](https://joinmastodon.org/) | Federated microblogging server. | AGPL-3.0 | Ruby | 50.2k | +| [Misago](https://misago-project.org/) | Fully featured modern forum application that is fast, scalable and responsive. | GPL-2.0 | Docker | 2.8k | +| [Misskey](https://misskey.io/) | Decentralized app-like microblogging server/SNS for the Fediverse, using the ActivityPub protocol like GNU social and Mastodon. | AGPL-3.0 | Nodejs, Docker | 11.3k | +| [Movim](https://movim.eu/) | Modern, federated social network based on XMPP, with a fully featured group-chat, subscriptions and microblogging. | AGPL-3.0 | PHP, Docker | 2.0k | +| [MyBB](https://mybb.com/) | Free, extensible forum software package. | LGPL-3.0 | PHP | 1.2k | +| [NodeBB](https://nodebb.org/) | Forum software built for the modern web. | GPL-3.0 | Nodejs, Docker | 15.2k | +| [OSSN](https://www.opensource-socialnetwork.org/) | Social networking software that allows you to make a social networking website and helps your members build social relationships, with people who share similar professional or personal interests. | CAL-1.0 | PHP | 1.2k | +| [phpBB](https://www.phpbb.com/) | Flat-forum bulletin board software solution that can be used to stay in touch with a group of people or can power your entire website. | GPL-2.0 | PHP | 2.1k | +| [PieFed](https://join.piefed.social) | A link aggregator / reddit clone for the fediverse (alternative to Reddit). | AGPL-3.0 | Python, Docker | — | +| [PixelFed](https://pixelfed.social) | Ethical photo sharing platform, powered by ActivityPub federation (alternative to Instagram). | AGPL-3.0 | PHP | 7.1k | +| [Pleroma](https://pleroma.social) | Federated microblogging server, Mastodon, GNU social, & ActivityPub compatible. | AGPL-3.0 | Elixir | — | +| [qpixel](https://codidact.com/) | Q&A-based community knowledge-sharing software. | AGPL-3.0 | Ruby | 0.4k | +| [Redlib](https://github.com/redlib-org/redlib) | An alternative private front-end to Reddit, with its origins in Libreddit. | AGPL-3.0 | Rust | 3.6k | +| [remark42](https://remark42.com/) | Lightweight and simple comment engine, which doesn't spy on users. It can be embedded into blogs, articles or any other place where readers add comments. | MIT | Docker, Go | 5.6k | +| [Scoold](https://scoold.com) | Stack Overflow in a JAR. An enterprise-ready Q&A platform with full-text search, SAML, LDAP integration and social login support. | Apache-2.0 | Java, Docker, K8S | 0.9k | +| [Simple Machines Forum](https://www.simplemachines.org/) | Free, professional grade software package that allows you to set up your own online community within minutes. | BSD-3-Clause | PHP | 0.7k | +| [Socialhome](https://socialhome.network) | Federated and decentralized profile builder and social network engine. | AGPL-3.0 | Docker, Python | 0.4k | +| [Talkyard](https://www.talkyard.io/) | Create a community, where your users can suggest ideas and get questions answered. And have friendly open-ended discussions and chat (Slack/StackOverflow/Discourse/Reddit/Disqus hybrid). | AGPL-3.0 | Docker, Scala | 1.8k | +| [yarn.social](https://yarn.social) | Self-Hosted, Twitter™-like Decentralised micro-logging platform. No ads, no tracking, your content, your data. | MIT | Go | — | + +## Communication - Video Conferencing + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [BigBlueButton](https://bigbluebutton.org/) | Supports real-time sharing of audio, video, slides (with whiteboard controls), chat, and the screen. Instructors can engage remote students with polling, emojis, and breakout rooms. | LGPL-3.0 | Java | 9.2k | +| [Galene](https://galene.org/) | Video conferencing server that is easy to deploy and that requires moderate server resources. | MIT | Go | 1.4k | +| [Janus](https://janus.conf.meetecho.com/) | General-purpose, lightweight, minimalist WebRTC Server. | GPL-3.0 | C | 9.1k | +| [Jitsi Meet](https://jitsi.org/Projects/JitsiMeet) | WebRTC application that uses Jitsi Videobridge to provide high quality, scalable video conferences. | Apache-2.0 | Nodejs, Docker, deb | 29.7k | +| [Jitsi Video Bridge](https://jitsi.org/Projects/JitsiVideobridge) | WebRTC compatible Selective Forwarding Unit (SFU) that allows for multiuser video communication. | Apache-2.0 | Java, deb | 3.1k | +| [MiroTalk C2C](https://c2c.mirotalk.com) | Real-time cam-2-cam video calls & screen sharing, end-to-end encrypted, to embed in any website with a simple iframe. | AGPL-3.0 | Nodejs, Docker | 0.5k | +| [MiroTalk P2P](https://p2p.mirotalk.com) | Simple, secure, fast real-time video conferences up to 4k and 60fps, compatible with all browsers and platforms. | AGPL-3.0 | Nodejs, Docker | 4.7k | +| [MiroTalk SFU](https://sfu.mirotalk.com) | Simple, secure, scalable real-time video conferences up to 4k, compatible with all browsers and platforms. | AGPL-3.0 | Nodejs, Docker | 3.1k | +| [plugNmeet](https://www.plugnmeet.org/) | Scalable and high performance web conferencing system. | MIT | Docker, Go | 0.5k | +| [TrueConf](https://trueconf.com/products/tcsf/trueconf-server-free.html) | Platform for your corporate communications, based on the advanced architecture, with support for UltraHD video conferencing, built-in messenger with personal and group chats, and a free version for up to 1,000 users. | ⊘ Proprietary | Docker, deb | — | + +## Communication - XMPP - Servers + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [ejabberd](https://www.ejabberd.im/) | XMPP instant messaging server. | GPL-2.0 | Erlang, Docker | 6.7k | +| [MongooseIM](https://www.erlang-solutions.com/products/mongooseim.html) | Mobile messaging platform with a focus on performance and scalability. | GPL-2.0 | Erlang, Docker, K8S | 1.7k | +| [Openfire](https://www.igniterealtime.org/projects/openfire/) | Real time collaboration (RTC) server. | Apache-2.0 | Java | 3.1k | +| [Prosody IM](https://prosody.im/) | Feature-rich and easy to configure XMPP server. | MIT | Lua | — | +| [Snikket](https://snikket.org/) | All-in-one Dockerized easy XMPP solution, including web admin and clients. | Apache-2.0 | Docker | 0.4k | +| [Tigase](https://tigase.net/xmpp-server) | XMPP server implementation in Java. | GPL-3.0 | Java | 0.4k | + +## Communication - XMPP - Web Clients + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Converse.js](https://conversejs.org/) | XMPP chat client in your browser. | MPL-2.0 | Javascript | 3.3k | +| [Libervia](https://repos.goffi.org/libervia-web) | Web frontend from Salut à Toi. | AGPL-3.0 | Python | — | +| [Salut à Toi](https://www.salut-a-toi.org/) | Multipurpose, multi frontend, libre and decentralized communication tool. | AGPL-3.0 | Python | — | + +## Feed Readers + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Bubo Reader](https://github.com/georgemandis/bubo-rss) | Irrationally minimal RSS feed reader. | MIT | Nodejs | 0.2k | +| [CommaFeed](https://www.commafeed.com/) | Google Reader inspired self-hosted RSS reader. | Apache-2.0 | Java, Docker | 3.6k | +| [Feeds Fun](https://feeds.fun/) | News reader with tags, scoring, and AI. | BSD-3-Clause | Python | 0.4k | +| [FreshRSS](https://freshrss.org/) | Self-hostable RSS feed aggregator. | AGPL-3.0 | PHP, Docker | 15.7k | +| [Fusion](https://github.com/0x2E/fusion) | Lightweight RSS aggregator and reader. | MIT | Go, Docker | 2.1k | +| [Goeland](https://github.com/slurdge/goeland) | Turns any RSS/Atom feed into a beautiful email digest. | MIT | Go, Docker | 0.2k | +| [JARR](https://1pxsolidblack.pl/jarr-en.html) | JARR (Just Another RSS Reader) is a web-based news aggregator and reader (fork of Newspipe). | AGPL-3.0 | Docker, Python | 0.1k | +| [Kriss Feed](https://github.com/tontof/kriss_feed) | Simple and smart (or stupid) feed reader. | CC0-1.0 | PHP | 0.3k | +| [Leed](https://github.com/LeedRSS/Leed) | Leed (for Light Feed) is a Free and minimalist RSS aggregator. | AGPL-3.0 | PHP | 0.2k | +| [Miniflux](https://miniflux.app/) | Minimalist news reader. | Apache-2.0 | Go, deb, Docker | 9.6k | +| [NewsBlur](https://www.newsblur.com/) | Personal news reader that brings people together to talk about the world. A new sound of an old instrument. | MIT | Python | 7.6k | +| [Newspipe](https://git.sr.ht/~cedric/newspipe) | Web news reader. | AGPL-3.0 | Python | — | +| [reader](https://github.com/lemon24/reader) | Feed reader web app and library (so you can use it to build your own), with only standard library and pure-Python dependencies. | BSD-3-Clause | Python | 0.5k | +| [Readflow](https://readflow.app) | Lightweight news reader with modern interface and features: full-text search, automatic categorization, archiving, offline support, notifications. | AGPL-3.0 | Go, Docker | 0.5k | +| [RSS Monster](https://github.com/pietheinstrengholt/rssmonster) | Easy to use web-based RSS aggregator and reader compatible with the Fever API (alternative to Google Reader). | MIT | PHP | 0.5k | +| [RSS-Bridge](https://github.com/RSS-Bridge/rss-bridge) | Generate RSS/ATOM feeds for websites which don't have one. | Unlicense | PHP, Docker | 9.2k | +| [RSS2EMail](https://github.com/rss2email/rss2email) | Fetches RSS/Atom-feeds and pushes new content to any email-receiver, supports OPML. | GPL-2.0 | Python, deb | 0.5k | +| [RSSHub](https://docs.rsshub.app) | Easy to use, and extensible RSS feed aggregator capable of generating RSS feeds from pretty much everything ranging from social media to university departments. | MIT | Nodejs, Docker | 45.6k | +| [Selfoss](https://selfoss.aditu.de/) | New multipurpose rss reader, live stream, mashup, aggregation web application. | GPL-3.0 | PHP | 2.5k | +| [Stringer](https://github.com/stringer-rss/stringer) | Work-in-progress self-hosted, anti-social RSS reader. | MIT | Ruby | 4.1k | +| [Tiny Tiny RSS](https://tt-rss.org) | Web-based news feed (RSS/Atom) reader and aggregator. | GPL-3.0 | Docker, PHP | 0.8k | +| [TinyFeed](https://feed.lovergne.dev/) | Generate a static HTML page from a collection of feeds with a simple CLI. | MIT | Go, Docker | 0.4k | +| [Upvote RSS](https://www.upvote-rss.com/) | Generate rich RSS feeds from Reddit, Hacker News, Lemmy, Mbin, and more. | MIT | Docker, PHP | 0.5k | +| [Yarr](https://github.com/nkanaev/yarr) | Yarr (yet another rss reader) is a web-based feed aggregator which can be used both as a desktop application and a personal self-hosted server. | MIT | Go | 3.9k | + diff --git a/docs/selfhosted/catalog/conteudo.md b/docs/selfhosted/catalog/conteudo.md new file mode 100644 index 0000000..3125893 --- /dev/null +++ b/docs/selfhosted/catalog/conteudo.md @@ -0,0 +1,115 @@ +# Self-hosted — Conteúdo e publicação + +CMS, blogs, encurtadores de URL, plataformas de curso. + +**82 projetos** nesta categoria. + +> **Fonte:** [awesome-selfhosted/awesome-selfhosted-data](https://github.com/awesome-selfhosted/awesome-selfhosted-data) · **Licença:** [CC-BY-SA 3.0 Unported](https://creativecommons.org/licenses/by-sa/3.0/) · **Autores:** [AUTHORS](https://github.com/awesome-selfhosted/awesome-selfhosted-data/blob/master/AUTHORS) upstream. +> Arquivo **gerado** por `scripts/sync-selfhosted.js`. Não edite à mão — as edições se perdem na próxima sincronização. + +[← Voltar ao índice](../INDEX.md) · [Shortlist SaaS](../shortlist-saas.md) + +--- + +## Blogging Platforms + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Antville](https://antville.org) | Free, open source project aimed at the development of a high performance, feature rich weblog hosting software. | Apache-2.0 | Javascript | 0.1k | +| [Castopod](https://castopod.org) | Podcast management hosting platform that includes the latest podcast 2.0 standards, an automated Fediverse feed, analytics, an embeddable player, and more. | AGPL-3.0 | PHP, Docker | — | +| [Chyrp Lite](https://chyrplite.net) | Extra-awesome, extra-lightweight blog engine. | BSD-3-Clause | PHP | 0.5k | +| [Dotclear](https://git.dotclear.org/dev/dotclear) | Take control over your blog. | GPL-2.0 | PHP | — | +| [Ech0](https://echo.soopy.cn/) | Lightweight federated publishing platform focused on personal idea sharing (documentation in Chinese). | AGPL-3.0 | Docker, K8S | 2.0k | +| [FlatPress](https://flatpress.org/) | A lightweight, easy-to-set-up flat-file blogging engine. | GPL-2.0 | PHP | 0.2k | +| [fx](https://github.com/rikhuijzer/fx) | Micro-blog tool offering built-in syntax highlighting, mobile publishing and more (alternative to Twitter, Bluesky). | MIT | Docker | 0.3k | +| [Ghost](https://ghost.org/) | Just a blogging platform. | MIT | Nodejs | 54.7k | +| [Haven](https://havenweb.org/) | Private blogging system with markdown editing and built in RSS reader. | MIT | Ruby | 0.8k | +| [HTMLy](https://www.htmly.com/) | Databaseless PHP blogging platform. A flat-file CMS that allows you to create a fast, secure, and powerful website or blog in seconds. | GPL-2.0 | PHP | 1.4k | +| [Known](https://withknown.com/) | Collaborative social publishing platform. | Apache-2.0 | PHP | 1.1k | +| [Mataroa](https://mataroa.blog/) | Naked blogging platform for minimalists. | MIT | Python | 0.4k | +| [PluXml](https://pluxml.org) | XML-based blog/CMS platform. | GPL-3.0 | PHP | 0.2k | +| [Serendipity](https://docs.s9y.org/) | Serendipity (s9y) is a highly extensible and customizable PHP blog engine using Smarty templating. | BSD-3-Clause | PHP | 0.2k | +| [WriteFreely](https://writefreely.org) | Writing software for starting a minimalist, federated blog — or an entire community. | AGPL-3.0 | Go | 5.2k | + +## Content Management Systems (CMS) + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Alfresco Community Edition](https://www.alfresco.com/products/community/download) | The open source Enterprise Content Management software that handles any type of content, allowing users to easily share and collaborate on content. | LGPL-3.0 | Java | 0.2k | +| [Apostrophe](https://apostrophecms.com/) | CMS with a focus on extensible in-context editing tools. | MIT | Nodejs | 4.6k | +| [Automad](https://automad.org/) | Flat-file content management system and template engine. | MIT | PHP, Docker | 0.9k | +| [Backdrop CMS](https://backdropcms.org/) | Comprehensive CMS for small to medium sized businesses and non-profits. | GPL-2.0 | PHP | 1.0k | +| [Bludit](https://www.bludit.com/) | Build a site or blog in seconds. Bludit uses flat-files (text files in JSON format) to store posts and pages. | MIT | PHP | 1.5k | +| [Bolt CMS](https://boltcms.io/) | Content Management Tool, which strives to be as simple and straightforward as possible. | MIT | PHP | 0.6k | +| [CMS Made Simple](https://www.cmsmadesimple.org/) | Faster and easier management of website contents, scalable for small businesses to large corporations. | GPL-2.0 | PHP | — | +| [Cockpit](https://getcockpit.com) | Simple content platform to manage any structured content. | MIT | PHP | 0.7k | +| [Concrete 5 CMS](https://www.concretecms.com) | Open source content management system. | MIT | PHP | 0.8k | +| [Contao](https://contao.org/) | Powerful CMS that allows you to create professional websites and scalable web applications. | LGPL-3.0 | PHP | 0.4k | +| [CouchCMS](https://www.couchcms.com/) | CMS for designers. | CPAL-1.0 | PHP | 0.4k | +| [CraftCMS](https://craftcms.com/) | Content-first CMS that aims to make life enjoyable for developers and content managers alike. | ⊘ Proprietary | PHP | 3.6k | +| [Drupal](https://www.drupal.org/) | Advanced open source content management platform. | GPL-2.0 | PHP | — | +| [eLabFTW](https://www.elabftw.net) | Online lab notebook for research labs. Store experiments, use a database to find reagents or protocols, use trusted timestamping to legally timestamp an experiment, export as pdf or zip archive, share with collaborators…. | AGPL-3.0 | PHP | 1.4k | +| [Expressa](https://github.com/thomas4019/expressa) | Content Management System for powering database driven websites using JSON schemas. Provides permission management and automatic REST APIs. | MIT | Nodejs | 0.5k | +| [Joomla!](https://www.joomla.org/) | Advanced Content Management System (CMS). | GPL-2.0 | PHP | 5.1k | +| [KeystoneJS](https://keystonejs.com/) | CMS and web application platform. | MIT | Nodejs | 9.9k | +| [Kirby](https://getkirby.com/) | File-based CMS. Easy to setup. Easy to use. Flexible as hell. | ⊘ Proprietary | PHP | 1.5k | +| [Localess](https://localess.org/home) | Powerful translation management and content management system. Manage and translate your website or app content into multiple languages, using AI to translate faster. | MIT | Docker | 0.1k | +| [MODX](https://modx.com/) | Advanced content management and publishing platform. The current version is called 'Revolution'. | GPL-2.0 | PHP | 1.4k | +| [Neos](https://www.neos.io) | Neos or TYPO3 Neos (for version 1) is a modern, open source CMS. | GPL-3.0 | PHP | — | +| [Noosfero](https://gitlab.com/noosfero/noosfero) | Platform for social and solidarity economy networks with blog, e-Portfolios, CMS, RSS, thematic discussion, events agenda and collective intelligence for solidarity economy in the same system. | AGPL-3.0 | Ruby | 0.1k | +| [october](https://octobercms.com/) | CMS platform based on the Laravel PHP Framework. | ⊘ Proprietary | PHP | 11.1k | +| [Omeka](https://omeka.org) | Create complex narratives and share rich collections, adhering to Dublin Core standards with Omeka on your server, designed for scholars, museums, libraries, archives, and enthusiasts. | GPL-3.0 | PHP | 0.5k | +| [Payload CMS](https://payloadcms.com/) | Developer-first headless CMS and application framework. | MIT | Nodejs | 44.0k | +| [Pimcore](http://www.pimcore.com/) | Multi-channel experience and engagement management platform. | GPL-3.0 | PHP, Docker | 3.8k | +| [Plone](https://plone.org/) | Powerful open-source CMS system. | ZPL-2.0 | Python, Docker | — | +| [Publify](https://publify.github.io/) | Simple but full featured web publishing software. | MIT | Ruby | 1.9k | +| [REDAXO](https://www.redaxo.org) | Simple, flexible and useful content management system (documentation in German). | MIT | PHP, Docker | 0.4k | +| [SilverStripe](https://www.silverstripe.org) | Easy to use CMS with powerful MVC framework underlying. | BSD-3-Clause | PHP | — | +| [SPIP](https://www.spip.net/fr) | Publication system for the Internet aimed at collaborative work, multilingual environments, and simplicity of use for web authors. | GPL-3.0 | PHP | — | +| [Squidex](https://squidex.io) | Headless CMS, based on MongoDB, CQRS and Event Sourcing. | MIT | .NET | 2.5k | +| [Strapi](https://strapi.io/) | The most advanced open-source Content Management Framework (headless-CMS) to build powerful API with no effort. | MIT | Nodejs | 72.8k | +| [Superdesk](https://superdesk.org/) | End-to-end news creation, production, curation, distribution, and publishing platform. | AGPL-3.0 | Docker, Python, PHP | 0.7k | +| [Textpattern](https://textpattern.com/) | Flexible, elegant and easy-to-use CMS. | GPL-2.0 | PHP | 0.9k | +| [Typemill](https://typemill.net/) | Author-friendly flat-file-cms with a visual markdown editor based on vue.js. | MIT | PHP | 0.6k | +| [TYPO3](https://typo3.org/) | Powerful and advanced CMS with a large community. | GPL-2.0 | PHP | 1.2k | +| [Umbraco](https://umbraco.com/) | The friendly CMS. Free and open source with an amazing community. | MIT | .NET | 5.2k | +| [Vvveb CMS](https://www.vvveb.com) | Powerful and easy to use CMS to build websites, blogs or e-commerce stores. | AGPL-3.0 | PHP, Docker | 1.2k | +| [Wagtail](https://wagtail.io/) | Django content management system focused on flexibility and user experience. | BSD-3-Clause | Python | 20.4k | +| [WinterCMS](https://wintercms.com/) | Speedy and secure content management system built on the Laravel PHP framework. | MIT | PHP | 1.5k | +| [WonderCMS](https://www.wondercms.com) | WonderCMS is the smallest flat file CMS since 2008. | MIT | PHP | 0.7k | +| [WordPress](https://wordpress.org/) | World's most-used blogging and CMS engine. | GPL-2.0 | PHP | 21.3k | + +## Learning and Courses + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Canvas LMS](https://www.instructure.com/canvas/) | Learning management system (LMS) that is revolutionizing the way we educate. | AGPL-3.0 | Ruby | 6.8k | +| [Chamilo LMS](https://chamilo.org/) | Create a virtual campus for the provision of online or semi-online training. | GPL-3.0 | PHP | 1.0k | +| [Digiscreen](https://ladigitale.dev/digiscreen/) | Interactive whiteboard/wallpaper for the classroom, in person or remotely (documentation in French). | AGPL-3.0 | Nodejs, PHP | — | +| [Digitools](https://ladigitale.dev/digitools) | A set of simple tools to accompany the animation of courses in person or remotely. (documentation in French). | AGPL-3.0 | PHP | — | +| [edX](https://www.edx.org/) | The Open edX platform is open-source code that powers edX.org. | AGPL-3.0 | Python | — | +| [Gibbon](https://gibbonedu.org/) | Flexible school management platform designed to make life better for teachers, students, parents and leaders. | GPL-3.0 | PHP | 0.6k | +| [Helium](https://www.heliumedu.com) | Color-coded student planner for classes, homework, grades, and notes with smart notifications and multi-device sync. | MIT | Python, Docker | 0.0k | +| [ILIAS](https://www.ilias.de) | Learning management system that can cope with anything you throw at it. | GPL-3.0 | PHP | 0.5k | +| [INGInious](https://inginious.org/?lang=en) | Intelligent grader that allows secured and automated testing of code made by students. | AGPL-3.0 | Python, Docker | 0.2k | +| [Moodle](https://moodle.org/) | Learning and courses platform with one of the largest open source communities worldwide. | GPL-3.0 | PHP | — | +| [Open eClass](https://www.openeclass.org/) | Open eClass is an advanced e-learning solution that can enhance the teaching and learning process. | GPL-2.0 | PHP | 0.2k | +| [OpenOLAT](https://www.openolat.com/?lang=en) | Learning management system for teaching, education, assessment and communication. | Apache-2.0 | Java | 0.4k | +| [QST](https://qstonline.org) | Online assessment software. From a quick quiz on your phone to large scale, high stakes, proctored desktop testing, easy, secure and economical. | GPL-2.0 | Perl | — | +| [RELATE](https://documen.tician.de/relate/) | Courseware package that includes features such as: flexible rules, statistics, multi-course support, class calendar. | MIT | Python | 0.4k | +| [RosarioSIS](https://www.rosariosis.org/) | Student Information System for school management. Features students demographics, grades, scheduling, attendance, student billing, discipline & food service modules. | GPL-2.0 | PHP | 0.1k | + +## URL Shorteners + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [bit](https://github.com/sjdonado/bit) | Fast, lightweight, resource-efficient, compiled URL shortener. | MIT | Docker, Crystal | 0.1k | +| [Chhoto URL](https://chhoto.link) | Simple, lightning-fast URL shortener with no bloat (fork of simply-shorten). | MIT | Rust, Docker | 0.9k | +| [clink](https://git.crueter.xyz/crueter/clink) | A super-minimal link shortening service written in pure C, focusing on small executable size, portability, and ease of configuration. | AGPL-3.0 | C | — | +| [Flink](https://gitlab.com/rtraceio/web/flink) | Create QR Codes, embeddable link previews for your website and crawls/scrapes metadata. | MIT | Docker | — | +| [Kutt](https://kutt.to) | Modern URL shortener with support for custom domains and custom URLs. | MIT | Nodejs, Docker | 11.0k | +| [rs-short](https://git.42l.fr/42l/rs-short) | Lightweight link shortener written in Rust, with features such as caching, spambot protection and phishing detection. | MPL-2.0 | Rust | — | +| [Shlink](https://shlink.io) | URL shortener with REST API and command line interface. Includes official progressive web application and docker images. | MIT | PHP, Docker | 5.2k | +| [Simple-URL-Shortener](https://github.com/azlux/Simple-URL-Shortener) | KISS URL shortener, public or private (with account). Minimalist and lightweight. No dependencies. | MIT | PHP | 0.1k | +| [YOURLS](https://yourls.org/) | YOURLS is a set of PHP scripts that will allow you to run Your Own URL Shortener. Features include password protection, URL customization, bookmarklets, statistics, API, plugins, jsonp. | MIT | PHP | 12.1k | + diff --git a/docs/selfhosted/catalog/desenvolvimento.md b/docs/selfhosted/catalog/desenvolvimento.md new file mode 100644 index 0000000..374415d --- /dev/null +++ b/docs/selfhosted/catalog/desenvolvimento.md @@ -0,0 +1,171 @@ +# Self-hosted — Desenvolvimento + +CI/CD, API management, IDEs, testes, low-code, serverless, feature flags, geradores estáticos, bancos de dados. + +**118 projetos** nesta categoria. + +> **Fonte:** [awesome-selfhosted/awesome-selfhosted-data](https://github.com/awesome-selfhosted/awesome-selfhosted-data) · **Licença:** [CC-BY-SA 3.0 Unported](https://creativecommons.org/licenses/by-sa/3.0/) · **Autores:** [AUTHORS](https://github.com/awesome-selfhosted/awesome-selfhosted-data/blob/master/AUTHORS) upstream. +> Arquivo **gerado** por `scripts/sync-selfhosted.js`. Não edite à mão — as edições se perdem na próxima sincronização. + +[← Voltar ao índice](../INDEX.md) · [Shortlist SaaS](../shortlist-saas.md) + +--- + +## Database Management + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Adminer](https://www.adminer.org/) | Database management in a single PHP file. Available for MySQL, MariaDB, PostgreSQL, SQLite, MS SQL, Oracle, Elasticsearch, MongoDB and others. | Apache-2.0, GPL-2.0 | PHP | 7.5k | +| [Azimutt](https://azimutt.app) | Visual database exploration made for real world databases (big and messy). Explore your database schema as well as data, document them, extend them and even get analysis and guidelines. | MIT | Elixir, Nodejs, Docker | 2.2k | +| [Baserow](https://baserow.io/) | Create your own database without technical experience (alternative to Airtable). | MIT | Docker | 2.3k | +| [Bytebase](https://www.bytebase.com/) | Safe database schema change and version control for DevOps teams, supports MySQL, PostgreSQL, TiDB, ClickHouse, and Snowflake. | MIT | Docker, K8S, Go | 14.4k | +| [Chartbrew](https://chartbrew.com) | Connect directly to databases and APIs and use the data to create beautiful charts. | MIT | Nodejs, Docker | 4.0k | +| [ChartDB](https://chartdb.io/) | Database diagrams editor that allows you to visualize and design your DB with a single query. | AGPL-3.0 | Nodejs, Docker | 22.7k | +| [CloudBeaver](https://dbeaver.com/) | Manage databases, supports PostgreSQL, MySQL, SQLite and more. A web/hosted version of DBeaver. | Apache-2.0 | Docker | 5.1k | +| [Cluster Control](https://severalnines.com/clustercontrol/) | Setup many databases in few clicks with monitoring, load balancing and more. | ⊘ Proprietary | deb, Ansible, Shell, Docker | — | +| [d9](https://d9.webcapsule.io) | Turn SQL databases into secure APIs through an intuitive admin interface. Data platform and headless CMS (fork of Directus). | GPL-3.0 | Nodejs | 0.1k | +| [Databunker](https://databunker.org/) | Network-based, self-hosted, GDPR compliant, secure database for personal data or PII. | MIT | Docker | 1.5k | +| [Datasette](https://datasette.io/) | Explore and publish data with easy import and export and database management. | Apache-2.0 | Python, Docker | 11.4k | +| [Directus](https://directus.io/) | An Instant App & API for your SQL Database. Directus wraps your new or existing SQL database with a realtime GraphQL+REST API for developers, and an intuitive admin app for non-technical users. | BUSL-1.1 | Nodejs, Docker | 37.2k | +| [Evidence](https://evidence.dev) | Code-based BI tool. Write reports using SQL and markdown and they render as a website. | MIT | Nodejs | 6.8k | +| [LibreDB Studio](https://libredb.org) | Browser-based SQL IDE for PostgreSQL, MySQL, Oracle, SQL Server, SQLite, MongoDB and Redis, with an optional AI assistant that writes SQL from natural language (alternative to DataGrip, DBeaver). | MIT | Docker, K8S | 0.1k | +| [Limbas](https://www.limbas.com/en/) | Database framework for creating database-driven business applications. As a graphical database frontend, it enables the efficient processing of data stocks and the flexible development of comfortable database applications. | GPL-2.0 | PHP | 0.1k | +| [Mathesar](https://mathesar.org/) | Intuitive UI to manage data collaboratively, for users of all technical skill levels. Built on Postgres – connect an existing DB or set up a new one. | GPL-3.0 | Docker, Python | 5.1k | +| [MindsDB](https://mindsdb.com/) | AI layer for existing databases that allows you to effortlessly develop, train and deploy state-of-the-art machine learning models using standard queries. | Elastic-2.0 | Docker, Python | 39.5k | +| [NocoDB](https://www.nocodb.com/) | No-code platform that turns any database into a smart spreadsheet (alternative to Airtable and Smartsheet). | SUL-1.0 | Nodejs, Docker | 64.4k | +| [StackRender](https://stackrender.io/) | Database schema design and SQL migration generator supporting PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, and Oracle. | AGPL-3.0 | Nodejs, Docker | — | + +## Software Development - API Management + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Aastro](https://starwalkn.github.io/aastro-docs) | Extensible API Gateway written in Go. | Apache-2.0 | Go, Docker | 0.0k | +| [Composio](https://composio.dev/) | Integration platform for AI agents & LLMs with support for 250+ apps and custom tools. | Elastic-2.0 | Python | 29.6k | +| [DreamFactory](https://www.dreamfactory.com/) | Turns any SQL/NoSQL/Structured data into Restful API. | Apache-2.0 | PHP, Docker, K8S | 1.8k | +| [form.io](https://form.io) | A REST API building platform that utilizes a drag & drop form builder, and is application framework agnostic. Contains open source and enterprise version. | MIT | Nodejs, Docker | — | +| [Fusio](https://www.fusio-project.org/) | Open-source API management platform which helps to build and manage REST APIs. | AGPL-3.0 | PHP, Docker | 2.1k | +| [Graphweaver](https://graphweaver.com/) | Turn multiple data sources into a single GraphQL API. | MIT | Nodejs | 0.6k | +| [Hasura](https://hasura.io) | Fast, instant realtime GraphQL APIs on Postgres with fine grained access control, also trigger webhooks on database events. | Apache-2.0 | Haskell, Docker, K8S | 32.1k | +| [Hook0](https://www.hook0.com) | Webhooks-as-a-service (WaaS) that makes it easy for online products to provide webhooks. Dispatch up to 3,000 events/month with 7 days of history retention for free. | SSPL-1.0 | Rust, Nodejs, Docker | 0.0k | +| [Hoppscotch Community Edition](https://hoppscotch.io) | Fast and beautiful API request builder. | MIT | Nodejs, Docker | 80.0k | +| [Kong](https://konghq.com/kong/) | Microservice API Gateway and Platform. | Apache-2.0 | Lua, Docker, K8S, deb | 43.9k | +| [Lura](https://luraproject.org/) | High-performance API Gateway. | Apache-2.0 | Go | 6.8k | +| [Opik](https://www.comet.com/site/products/opik/) | Evaluate, test, and ship LLM applications with a suite of observability tools to calibrate language model outputs across your dev and production lifecycle. | Apache-2.0 | Docker, Python | 21.2k | +| [Para](https://paraio.org) | Flexible and modular backend framework/server for object persistence, API development and authentication. | Apache-2.0 | Java, Docker | 0.6k | +| [Svix](https://svix.com) | Open-source webhooks as a service that makes it super easy for API providers to send webhooks. | MIT | Docker, Rust | 3.3k | +| [Tyk](https://tyk.io) | Fast and scalable open source API Gateway. Out of the box, Tyk offers an API Management Platform with an API Gateway, API Analytics, Developer Portal and API Management Dashboard. | MPL-2.0 | Go, Docker, K8S | 10.8k | + +## Software Development - Feature Toggle + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Featbit](https://www.featbit.co/) | Enterprise-grade feature flag platform that you can self-host. | MIT | Docker, K8S | 1.9k | +| [Flagsmith](https://flagsmith.com) | Dashboard, API and SDKs for adding Feature Flags to your applications (alternative to LaunchDarkly). | BSD-3-Clause | Docker, K8S | 6.5k | +| [Flipt](https://flipt.io) | Feature flag solution with support for multiple data backends (alternative to LaunchDarkly). | GPL-3.0 | Docker, K8S, Go | 4.9k | +| [GO Feature Flag](https://gofeatureflag.org) | Simple, complete, and lightweight feature flag solution (alternative to LaunchDarkly). | MIT | Go | 2.1k | + +## Software Development - IDE & Tools + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Atheos](https://www.atheos.io) | Web-based IDE framework with a small footprint and minimal requirements, continued from Codiad. | MIT | PHP, Docker | 0.7k | +| [code-server](https://github.com/coder/code-server) | VS Code in the browser, hosted on a remote server. | MIT | Nodejs, Docker | 78.7k | +| [Coder](https://coder.com/) | Remote development machines on your own infrastructure. | AGPL-3.0 | Go, Docker, K8S, deb | 14.1k | +| [Eclipse Che](https://www.eclipse.org/che/) | Open source workspace server and cloud IDE. | EPL-1.0 | Docker, Java | 7.2k | +| [Judge0 CE](https://judge0.com) | API to compile and run source code. | GPL-3.0 | Docker | 4.4k | +| [JupyterLab](https://jupyterlab.readthedocs.io/en/stable/) | Web-based environment for interactive and reproducible computing. | BSD-3-Clause | Python, Docker | 15.2k | +| [Langfuse](https://langfuse.com) | LLM engineering platform for model tracing, prompt management, and application evaluation. Langfuse helps teams collaboratively debug, analyze, and iterate on their LLM applications such as chatbots or AI agents. | MIT | Docker | 32.7k | +| [LiveCodes](https://livecodes.io/docs/features/self-hosting) | Feature-rich client-side code playground for React, Vue, Svelte, Solid, Typescript, Python, Go, Ruby, PHP and 90+ other languages. | MIT | Nodejs | 1.5k | +| [Lowdefy](https://www.lowdefy.com/) | Build internal tools, BI dashboards, admin panels, CRUD apps and workflows in minutes using YAML / JSON on an self-hosted, open-source platform. Connect to your data sources, host via Serverless, Netlify or Docker. | Apache-2.0 | Nodejs, Docker | 3.0k | +| [RapidForge](https://rapidforge.io/) | Lightweight platform for building webhooks, scheduled tasks and pages. Implement your logic with Bash or Lua. | Apache-2.0 | Go, Nodejs | 0.0k | +| [RepoFlow](https://www.repoflow.io) | Simplify package management for npm, PyPI, Docker, Go, Helm, and more. Try it for free with 10GB storage, 10GB bandwidth, 100 packages, and unlimited users in the cloud, or self-hosted for personal use only. | ⊘ Proprietary | Nodejs, Docker | — | +| [RStudio Server](https://www.rstudio.com/products/rstudio/#Server) | Web browser based IDE for R. | AGPL-3.0 | Java, C++ | 5.0k | + +## Software Development - Localization + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Accent](https://www.accent.reviews/) | Developer-oriented translation tool. | BSD-3-Clause | Elixir, Docker | 1.5k | +| [Tolgee](https://tolgee.io) | Developer & translator friendly web-based localization platform enabling users to translate directly in the app they develop. | Apache-2.0 | Docker, Java | 4.1k | +| [Traduora](https://traduora.co) | Translation management platform for teams. | AGPL-3.0 | Docker, K8S, Nodejs | 2.1k | +| [Weblate](https://weblate.org) | Web-based translation tool with tight version control integration. | GPL-3.0 | Python, Docker, K8S | 6.0k | + +## Software Development - Low Code + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Appsmith](https://www.appsmith.com/) | Build admin panels, CRUD apps and workflows. Build everything you need, 10x faster. | Apache-2.0 | Java, Docker, K8S | 40.6k | +| [Appwrite](https://appwrite.io) | End to end backend server for web, native, and mobile developers 🚀. | BSD-3-Clause | Docker | 56.8k | +| [Budibase](https://www.budibase.com) | Build and automate internal tools, admin panels, dashboards, CRUD apps, and more, in minutes (alternative to Outsystems, Retool, Mendix, Appian). | ⊘ Proprietary | Nodejs, Docker, K8S | 28.2k | +| [Dify.ai](https://dify.ai) | Build, test and deploy LLM applications. | Apache-2.0, Commons-Clause | Docker | 151.7k | +| [Halo](https://www.halo.run) | A powerful and easy-to-use website building tool (documentation in Chinese). | GPL-3.0 | Java, Docker | 39.5k | +| [Manifest](https://manifest.build) | Complete backend that fits into 1 YAML file. | MIT | Nodejs | 7.4k | +| [PocketBase](https://pocketbase.io/) | Backend for your next SaaS and Mobile app in one file. | MIT | Go, Docker | 60.5k | +| [Saltcorn](https://saltcorn.com/) | No-code database application builder for web and mobile applications. One platform for user interface, data backend, durable workflows, email, PDF generation, and AI applications. | MIT | Docker, Nodejs | 2.0k | +| [SQLPage](https://sql-page.com) | SQL-only dynamic website builder. | MIT | Rust, Docker | 2.5k | +| [ToolJet](https://tooljet.io/) | Low-code framework to build & deploy internal tools with minimal engineering effort (alternative to Retool and Mendix). | GPL-3.0 | Nodejs, Docker, K8S | 38.3k | +| [TrailBase](https://trailbase.io/) | Open, sub-millisecond, single-executable FireBase alternative with type-safe REST & realtime APIs, built-in JS/TS runtime, auth & admin UI. | OSL-3.0 | Rust, Docker | 5.5k | +| [UI Bakery](https://uibakery.io) | Build internal tools, customer portals, and CRUD apps quickly. Configure scheduled jobs and webhooks. Create structure and manage data through a GUI. | ⊘ Proprietary | Docker, K8S | 0.3k | + +## Software Development - Project Management + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [92five](https://92fiveapp.com/) | Self-hosted project management application. | ⊘ Proprietary | PHP | — | +| [Active Collab](https://activecollab.com/) | Project management. | ⊘ Proprietary | PHP | — | +| [BitBucket Server](https://www.atlassian.com/software/bitbucket/enterprise/data-center) | Enterprise-level Git solution (alternative to GitLab). | ⊘ Proprietary | Java | — | +| [Buddy Enterprise](https://buddy.works/) | Git and Continuous Integration/Delivery Platform. | ⊘ Proprietary | Nodejs, Java | — | +| [Cgit](https://git.zx2c4.com/cgit/about/) | Fast lightweight web interface for git repositories. | GPL-2.0 | C | — | +| [Crucible](https://www.atlassian.com/software/crucible) | Peer code review application. | ⊘ Proprietary | Java | — | +| [eigenfocus](https://eigenfocus.com/) | Project Management, Planning and Time Tracking app. From solo projects to multi-member teams, Eigenfocus adapts to your workflow. | ⊘ Proprietary | Docker | 0.9k | +| [Forgejo](https://forgejo.org) | A lightweight software forge focused on scaling, federation, and privacy (fork of Gitea). | MIT | Docker, Go | — | +| [Fossil](https://www.fossil-scm.org/index.html/doc/trunk/www/index.wiki) | Distributed version control system featuring wiki and bug tracker. | BSD-2-Clause-FreeBSD | C | — | +| [Gerrit](https://www.gerritcodereview.com/) | Code review and project management tool for Git-based projects. | Apache-2.0 | Java, Docker | 1.2k | +| [gitbucket](https://gitbucket.github.io/) | Git platform powered with easy installation, high extensibility & GitHub API compatibility (alternative to GitHub). | Apache-2.0 | Scala, Java | 9.4k | +| [Gitea](https://gitea.com) | Git with a cup of tea! Painless self-hosted all-in-one software development service, including Git hosting, code review, team collaboration, package registry and CI/CD. | MIT | Go, Docker, K8S | 57.3k | +| [GitLab](https://about.gitlab.com) | Self Hosted Git repository management, code reviews, issue tracking, activity feeds and wikis. | MIT | Ruby, deb, Docker, K8S | 7.2k | +| [Gogs](https://gogs.io/) | Painless self-hosted Git Service written in Go. | MIT | Go | 47.7k | +| [Huly](https://huly.io) | All-in-one project management platform (alternative to Linear, Jira, Slack, Notion, Motion). | EPL-2.0 | Docker, K8S, Nodejs | 27.3k | +| [Ideon](https://www.theideon.com) | Project workspace built around an infinite canvas; embed GitHub, GitLab, Gitea, and Forgejo repositories alongside notes, links, and tasks, with real-time collaboration. | AGPL-3.0 | Docker | 0.5k | +| [Kanban Tool](https://kanbantool.com/kanban-tool-on-site) | Advanced Kanban boards with time tracking. | ⊘ Proprietary | Ruby | — | +| [Kaneo](https://kaneo.app/) | Project management platform focused on simplicity and efficiency. | MIT | K8S, Docker | 7.6k | +| [Kantree](https://kantree.io) | Work management and collaboration. | ⊘ Proprietary | Python | — | +| [Leantime](https://leantime.io) | Lean project management system for small teams and startups helping to manage projects from ideation through delivery. | AGPL-3.0 | PHP, Docker | 11.3k | +| [Mindwendel](https://www.mindwendel.com/) | Brainstorm and upvote ideas and thoughts within your team. | AGPL-3.0 | Docker, Elixir | 0.1k | +| [minimal-git-server](https://github.com/mcarbonne/minimal-git-server) | Lightweight git server with a basic CLI to manage repositories, supporting multiple accounts and running in a container. | MIT | Docker | 0.0k | +| [Octobox](https://octobox.io/) | Take back control of your GitHub Notifications. | AGPL-3.0 | Ruby, Docker | 4.5k | +| [OneDev](https://onedev.io/) | All-In-One DevOps Platform. With Git Management, Issue Tracking, and CI/CD. Simple yet Powerful. | MIT | Java, Docker, K8S | — | +| [OpenProject](https://www.openproject.org) | Manage your projects, tasks and goals. Collaborate via work packages and link them to your pull requests on Github. | GPL-3.0 | Ruby, deb, Docker | 15.8k | +| [Pagure](https://pagure.io/pagure) | Lightweight, powerful, and flexible git-centric forge with features laying the foundation for federated and decentralized development. | GPL-2.0 | Docker, Python, deb | — | +| [Phorge](https://we.phorge.it/) | Community-driven platform for collaborating, managing, organizing and reviewing software development projects. | Apache-2.0 | PHP | — | +| [Plane](https://plane.so) | Track issues, epics, and product roadmaps in the simplest way possible (alternative to JIRA, Linear and Height). | AGPL-3.0 | Docker | 55.7k | +| [ProjeQtOr](https://www.projeqtor.org/) | Complete, mature, multi-user project management system with extensive functionality for all phases of a project. | AGPL-3.0 | PHP | — | +| [Redmine](https://www.redmine.org/) | Flexible project management web application. | GPL-2.0 | Ruby | — | +| [Review Board](https://www.reviewboard.org/) | Extensible and friendly code review tool for projects and companies of all sizes. | MIT | Python, Docker | 1.7k | +| [RhodeCode](https://rhodecode.com/) | Unify and simplify repository management for Git, Subversion, and Mercurial. | AGPL-3.0 | Python | — | +| [Rukovoditel](https://www.rukovoditel.net/) | Configurable open source project management, web-based application. | GPL-2.0 | PHP | — | +| [SCM Manager](https://www.scm-manager.org/) | The easiest way to share and manage your Git, Mercurial and Subversion repositories over http. | BSD-3-Clause | Java, deb, Docker, K8S | 0.2k | +| [ShipShipShip](https://shipshipship.io) | Changelog and roadmap platform that bridges project management and customer communication. | Apache-2.0 | Docker | 0.3k | +| [Smederee](https://smeder.ee) | A frugal platform which is dedicated to help people build great software together leveraging the power of the Darcs version control system. | AGPL-3.0 | Scala | — | +| [Solo](https://www.getsoloapp.com/) | Free project management app created for freelancers. Create contacts, manage tasks, upload files, track project progress, and keep notes. | ⊘ Proprietary | PHP | — | +| [Sourcehut](https://sourcehut.org/) | A full web git interface with no javascript. | GPL-2.0 | Go | — | +| [Taiga](https://www.taiga.io/) | Agile Project Management Tool based on the Kanban and Scrum methods. | MPL-2.0 | Docker, Python, Nodejs | — | +| [Titra](https://titra.io/) | Time-tracking solution for freelancers and small teams. | GPL-3.0 | Javascript, Docker | 0.5k | +| [Trac](https://trac.edgewall.org/) | Trac is an enhanced wiki and issue tracking system for software development projects. | BSD-3-Clause | Python, deb | — | +| [Traq](https://traq.io/) | Project management and issue tracking system written in PHP. | GPL-3.0 | PHP, Nodejs | 0.2k | +| [Tuleap](https://www.tuleap.org/) | Tuleap is a libre suite to plan, track, code and collaborate on software projects. | GPL-2.0 | PHP | — | +| [UVDesk](https://www.uvdesk.com/) | UVDesk community is a service oriented, event driven extensible opensource helpdesk system that can be used by your organization to provide efficient support to your clients effortlessly whichever way you imagine. | MIT | PHP | 19.5k | +| [ZenTao](https://www.zentao.pm/) | An agile(scrum) project management system/tool. | AGPL-3.0 | PHP | 1.7k | + +## Software Development - Testing + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Bamboo](https://www.atlassian.com/software/bamboo) | Continuous integration server. | ⊘ Proprietary | Java | — | +| [Bencher](https://bencher.dev/) | Suite of continuous benchmarking tools designed to catch performance regressions in CI. | MIT, Apache-2.0 | Rust | 0.9k | +| [BrowserStack Automate TurboScale](https://www.browserstack.com/automate-turboscale) | Scalable browser automation grid on your cloud (AWS, GCP and Azure) supporting Selenium and Playwright. | ⊘ Proprietary | Docker | — | +| [Moon](https://aerokube.com/moon/) | Efficient Selenium protocol implementation running everything in Kubernetes or Openshift. | ⊘ Proprietary | Go | — | +| [Request Inbox](https://request-inbox.com/) | Collect and inspect HTTP requests for testing and debugging. Create and manage inboxes, capture detailed request data, configure custom responses. | Apache-2.0 | Docker | 0.0k | +| [Sentry Self-Hosted](https://github.com/getsentry/self-hosted) | Powerful error tracking platform with wide language support and a robust API. | BUSL-1.1 | Python | 44.5k | +| [WebHook Tester](https://github.com/tarampampam/webhook-tester) | Powerful tool for testing WebHooks and more. | MIT | Docker, Go, deb, K8S | 0.5k | + diff --git a/docs/selfhosted/catalog/infraestrutura.md b/docs/selfhosted/catalog/infraestrutura.md new file mode 100644 index 0000000..3eb4a6e --- /dev/null +++ b/docs/selfhosted/catalog/infraestrutura.md @@ -0,0 +1,154 @@ +# Self-hosted — Infraestrutura e rede + +DNS, proxy, VPN, servidores web, acesso remoto, IoT, painéis de self-hosting. + +**106 projetos** nesta categoria. + +> **Fonte:** [awesome-selfhosted/awesome-selfhosted-data](https://github.com/awesome-selfhosted/awesome-selfhosted-data) · **Licença:** [CC-BY-SA 3.0 Unported](https://creativecommons.org/licenses/by-sa/3.0/) · **Autores:** [AUTHORS](https://github.com/awesome-selfhosted/awesome-selfhosted-data/blob/master/AUTHORS) upstream. +> Arquivo **gerado** por `scripts/sync-selfhosted.js`. Não edite à mão — as edições se perdem na próxima sincronização. + +[← Voltar ao índice](../INDEX.md) · [Shortlist SaaS](../shortlist-saas.md) + +--- + +## DNS + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [AdGuard Home](https://adguard.com/en/adguard-home/overview.html) | User-friendly ads & trackers blocking DNS server. | GPL-3.0 | Docker | 36.0k | +| [blocky](https://0xerr0r.github.io/blocky/latest/) | Fast and lightweight DNS proxy as ad-blocker for local network with many features (alternative to Pi-hole). | Apache-2.0 | Go, Docker | 6.8k | +| [Maza ad blocking](https://maza-ad-blocking.andros.dev/) | Local ad blocker. Like Pi-hole but local and using your operating system. | Apache-2.0 | Shell | 1.9k | +| [Numa](https://numa.rs/) | Ad-blocking DNS resolver with DNSSEC-validating recursive resolution, DoH/DoT/Oblivious DoH, ephemeral overrides, and local service domains, in a single Rust binary (alternative to Pi-hole, AdGuard Home, NextDNS). | MIT | Rust, Docker, Nix | 1.4k | +| [Pi-hole](https://pi-hole.net/) | Blackhole for Internet advertisements with a GUI for management and monitoring. | EUPL-1.2 | Shell, PHP, Docker | 60.2k | +| [Technitium DNS Server](https://technitium.com/dns/) | Authoritative/recursive DNS server with ad blocking functionality. | GPL-3.0 | Docker, C# | 9.4k | + +## Internet of Things (IoT) + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Domoticz](https://www.domoticz.com/) | Home Automation System that lets you monitor and configure various devices like: Lights, Switches, various sensors/meters like Temperature, Rain, Wind, UV, Electra, Gas, Water and much more. | GPL-3.0 | C, C++, Docker, Shell | 3.8k | +| [EMQX](https://www.emqx.io/) | Scalable MQTT broker. Connect 100M+ IoT devices in one single cluster, move and process real-time IoT data with 1M msg/s throughput at 1ms latency. | Apache-2.0 | Docker, Erlang | 16.6k | +| [evcc](https://evcc.io/) | Extensible Electric Vehicle Charge Controller and home energy management system. | MIT | deb, Docker, Go | 7.1k | +| [FHEM](https://fhem.de/fhem.html) | Automate common tasks in the household like switching lamps and heating. It can also be used to log events like temperature or power consumption. You can control it via web or smartphone frontends, telnet or TCP/IP directly. | GPL-3.0 | Perl | — | +| [FlowForge](https://flowforge.com/) | Deploy Node-RED applications in a reliable, scalable and secure manner. The FlowForge platform provides DevOps capabilities for Node-RED development teams. | Apache-2.0 | Nodejs, Docker, K8S | 0.4k | +| [FMD Server](https://fmd-foss.org) | A server to communicate with the FMD (Find My Device) Android app, to locate and control your devices. | GPL-3.0 | Docker, Go | 0.2k | +| [Gladys](https://gladysassistant.com/) | Privacy-first home assistant. | Apache-2.0 | Nodejs, Docker | 3.1k | +| [Home Assistant](https://home-assistant.io/) | Home automation platform. | Apache-2.0 | Python, Docker | 89.8k | +| [ioBroker](https://www.iobroker.net/) | Integration platform for the Internet of Things, focused on building automation, smart metering, ambient assisted living, process automation, visualization and data logging. | MIT | Nodejs | 1.4k | +| [LHA](https://github.com/javalikescript/lha) | Light Home Automation application that is fully extensible using Blockly, HTML or Lua. It includes extensions such as ConBee, Philips Hue or Z-Wave JS. | MIT | Lua | 0.0k | +| [Node RED](https://nodered.org/) | Browser-based flow editor that helps you wiring hardware devices, APIs and online services to create IoT solutions. | Apache-2.0 | Nodejs, Docker | 23.5k | +| [Onloc](https://onloc.app) | Track and share your location in real time. Control and lock stolen or lost phones. | AGPL-3.0 | Docker | 0.0k | +| [openHAB](https://www.openhab.org) | Vendor and technology agnostic open source software for home automation. | EPL-2.0 | Java | 1.1k | +| [OpenRemote](https://openremote.io) | IoT Asset management, Flow Rules and WHEN-THEN rules, Data visualization, Edge Gateway. | AGPL-3.0 | Java | 1.8k | +| [polluSensWeb](https://wespeakenglish.github.io/polluSensWeb/) | Web-based serial interface and charting tool for visualizing and logging data from UART pollution sensors (PM2.5, VOC, etc). Features live data acquisition, dynamic charts, CSV export, and webhook integration. | MIT | Javascript | 0.0k | +| [SIP Irrigation Control](https://dan-in-ca.github.io/SIP/) | Open source software for sprinkler/irrigation control. | GPL-3.0 | Python | 0.4k | +| [SOLECTRUS](https://solectrus.de) | Photovoltaic dashboard that displays energy production and consumption with cost and savings calculations. | AGPL-3.0 | Docker | 0.2k | +| [Tasmota](https://tasmota.com) | Open source firmware for ESP devices. Total local control with quick setup and updates. Control using MQTT, Web UI, HTTP or serial. Automate using timers, rules or scripts. Integration with home automation solutions. | GPL-3.0 | C, C++ | 24.7k | +| [Thingsboard](https://thingsboard.io/) | Open-source IoT Platform - Device management, data collection, processing and visualization. | Apache-2.0 | Java, Docker, K8S | 22.2k | +| [WebThings Gateway](https://webthings.io/gateway/) | WebThings is an open source implementation of the Web of Things, including the WebThings Gateway and the WebThings Framework. | MPL-2.0 | Nodejs | 2.6k | + +## Network Utilities + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [beelzebub](https://beelzebub-honeypot.com/) | Honeypot framework designed to provide a highly secure environment for detecting and analyzing cyber attacks. | MIT | Docker, K8S, Go | 2.1k | +| [Canary Tokens](https://canarytokens.org) | Generates lightweight, embedded honeypot triggers called canary tokens for detecting unauthorized access. | BSD-3-Clause | Docker, Python | 3.0k | +| [MyIP](https://ipcheck.ing) | All in one IP Toolbox. Easy to check what's your IPs, IP geolocation, check for DNS leaks, examine WebRTC connections, speed test, ping test, MTR test, check website availability and more. | MIT | Nodejs, Docker | 11.5k | +| [MySpeed](https://myspeed.dev/) | Speed test analysis software that shows your internet speed for up to 30 days. | MIT | Docker, Nodejs | 3.0k | +| [NetAlertX](https://netalertx.com/) | Network intruder and presence detector. Scans for devices connected to your network and alerts you if new and unknown devices are found. | GPL-3.0 | Docker | 6.9k | +| [PlugNPiN](https://deepspace2.github.io/PlugNPiN) | Automatically scrapes containers with specific labels and creates local DNS/CNAME entries in Pi-Hole/AdGuard Home and proxy hosts in Nginx Proxy Manager. | GPL-3.0 | Docker | 0.1k | +| [Speed Test by OpenSpeedTest™](https://openspeedtest.com/) | Free & Open-Source HTML5 Network Performance Estimation Tool. | MIT | Docker | 3.7k | +| [Speedtest Tracker](https://docs.speedtest-tracker.dev/) | Monitor the performance and uptime of your internet connection. | MIT | Docker, K8S | 5.9k | +| [Upsnap](https://github.com/seriousm4x/UpSnap) | A simple Wake on LAN (WOL) dashboard app. Wake up devices on your network and see current status. | MIT | Go, Docker | 6.1k | +| [Wakupator](https://github.com/Gibus21250/Wakupator) | Wake On LAN Machine Manager based on network traffic. | MIT | C | 0.2k | +| [WatchYourLAN](https://github.com/aceberg/WatchYourLAN) | Lightweight network IP scanner with notifications, history, export to Grafana. | MIT | Docker, Go, deb | 7.2k | +| [whois](https://github.com/KincaidYang/whois) | WHOIS/RDAP query API for domains, IP addresses, CIDR prefixes and ASNs, with unified JSON output, caching, API key authentication, batch queries and MCP support for AI assistants. | MIT | Go, Docker | 0.1k | + +## Proxy + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [g3proxy](https://g3-project.readthedocs.io/projects/g3proxy/en/latest/) | Forward proxy server supporting proxy chaining, protocol inspection, MITM Interception, ICAP adaptation and transparent proxy. | Apache-2.0 | Rust, deb | — | +| [GitProxy](https://git-proxy.finos.org/) | Proxy for Git that applies rules and workflows to all outgoing git push operations and ensures they are compliant. It supports both HTTP/HTTPS and SSH protocols with security scanning and validation. | Apache-2.0 | Nodejs, Docker | 0.2k | +| [imgproxy](https://imgproxy.net/) | Fast and secure standalone server for resizing and converting remote images. | MIT | Go, Docker, K8S | 11.0k | +| [iodine](https://code.kryo.se/iodine/) | IPv4 over DNS tunnel solution, enabling you to start up a socks5 proxy listener. | ISC | C, deb | 7.9k | +| [Outline Server](https://getoutline.org/) | A proxy server that runs a Shadowsocks instance for each access key and a REST API to manage the access keys. | Apache-2.0 | Docker, Nodejs | 6.2k | +| [Privoxy](https://www.privoxy.org) | Non-caching web proxy with advanced filtering capabilities for enhancing privacy, modifying web page data and HTTP headers, controlling access, and removing ads and other obnoxious Internet junk. | GPL-2.0 | C, deb | — | +| [sish](https://github.com/antoniomika/sish) | HTTP(S)/WS(S)/TCP tunnels to localhost using only SSH (serveo/ngrok alternative). | MIT | Go, Docker | 4.7k | +| [socks5-proxy-server](https://github.com/nskondratev/socks5-proxy-server) | SOCKS5 proxy server with built-in authentication and Telegram-bot for user management and user statistics on data spent (handy when you pay per GB of data). It is dockerised and simple to install. | Apache-2.0 | Docker | 0.1k | +| [Squid](http://www.squid-cache.org/) | Caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages. | GPL-2.0 | C, deb | — | +| [Tinyproxy](https://tinyproxy.github.io/) | Light-weight HTTP/HTTPS proxy daemon. | GPL-2.0 | C, deb | 6.0k | + +## Remote Access + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Cardea](https://github.com/hectorm/cardea) | SSH bastion server with access control, session recording, and optional TPM-backed key protection. | EUPL-1.2 | Go, Docker | 0.0k | +| [Engity's Bifröst](https://bifroest.engity.org/) | Highly customizable SSH server with several ways to authorize a user and options where and how to execute a user's session. | Apache-2.0 | Go, Docker | 0.1k | +| [Firezone](https://www.firezone.dev/) | Secure remote access gateway that supports the WireGuard protocol. It offers a Web GUI, 1-line install script, multi-factor auth (MFA), and SSO. | Apache-2.0 | Elixir, Docker | 9.0k | +| [Guacamole](https://guacamole.apache.org) | Clientless remote desktop gateway supporting standard protocols like VNC and RDP. | Apache-2.0 | Java, C | 3.9k | +| [MeshCentral](https://meshcentral.com/) | Run your own web server to remotely manage and control computers on a local network or anywhere on the internet. | Apache-2.0 | Nodejs | 7.0k | +| [ShellHub](https://www.shellhub.io) | Modern SSH server for remotely accessing linux devices via command line (using any SSH client) or web-based user interface (alternative to sshd). | Apache-2.0 | Docker | 2.1k | +| [SparkView](https://www.beyondssl.com/en/products/sparkview/) | Browser-based remote access solution. No VPN client; just deploy the software in the DMZ. Access VMs, desktops, servers, and apps anytime, anywhere, without complex and costly client rollouts or user management. | ⊘ Proprietary | Java | — | +| [Sshwifty](https://github.com/nirui/sshwifty) | Sshwifty is a SSH and Telnet connector made for the Web. | AGPL-3.0 | Go, Docker | 3.1k | +| [Termix](https://docs.termix.site/) | Clientless web-based server management platform with SSH terminal, tunneling, and file editing capabilities. | Apache-2.0 | Docker | 14.6k | +| [Warpgate](https://github.com/warp-tech/warpgate) | Fully transparent SSH, HTTPS, Kubernetes, MySQL and Postgres bastion/PAM that doesn't need additional client-side software. | Apache-2.0 | Rust, Docker | 7.5k | + +## Self-hosting Solutions + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Axigen](https://www.axigen.com/mail-server/free/) | Turnkey messaging solution for small & micro businesses, integration projects or test environments. | ⊘ Proprietary | Unknown | — | +| [CasaOS](https://casaos.zimaspace.com/) | Simple, easy-to-use, elegant Home Cloud system. | Apache-2.0 | Go, Docker | 37.0k | +| [Cloudron](https://www.cloudron.io/) | Open-core software allowing you to effortlessly self-host web apps on your server. | ⊘ Proprietary | Nodejs, Docker | — | +| [Cosmos](https://cosmos-cloud.io/) | Run server applications securely and with built-in privacy features. It acts as a secure gateway to your application, as well as a server manager. | Apache-2.0, Commons-Clause | Docker, Go | 6.1k | +| [DietPi](https://dietpi.com/) | Minimal Debian OS optimized for single-board computers, which allows you to easily install and manage several services for selfhosting at home. | GPL-2.0 | Shell | 6.2k | +| [DockSTARTer](https://dockstarter.com/) | DockSTARTer helps you get started with home server apps running in Docker. | MIT | Shell | 2.6k | +| [Dropserver](https://dropserver.org) | An application platform for your personal web services. | Apache-2.0 | Go, Deno | 0.1k | +| [Easypanel](https://easypanel.io) | Modern server control panel powered by Docker. | ⊘ Proprietary | Docker | — | +| [FreedomBox](https://freedombox.org/) | Community project to develop, design and promote personal servers running free software for private, personal, communications. | AGPL-3.0 | Python, deb | — | +| [HomelabOS](https://homelabos.com) | Offline privacy-centric data-center. Deploy over 100 services with a few commands. | MIT | Docker | 1.3k | +| [HomeServerHQ](https://www.homeserverhq.com/) | All-in-one home server infrastructure and installer. Have a fully configured email server, VPN, and public website(s) set up in less than an hour, even behind CGNAT. | GPL-3.0 | Shell | 0.1k | +| [LibreServer](https://libreserver.org/) | Home server configuration based on Debian. | AGPL-3.0 | Shell | 0.0k | +| [NextCloudPi](https://github.com/nextcloud/nextcloudpi) | Nextcloud preinstalled and preconfigured, with a text and web management interface and all the tools needed to self host private data. With installation images for Raspberry Pi, Odroid, Rock64, Docker, and a curl installer for Armbian/Debian. | GPL-2.0 | Shell, PHP | 2.9k | +| [Nirvati](https://nirvati.org) | Easily 1-click spin up popular self-hosted apps from a convenient web interface. | AGPL-3.0 | Rust, K8S | — | +| [OpenMediaVault](https://www.openmediavault.org/) | Network attached storage (NAS) solution based on Debian Linux. It contains services like SSH, (S)FTP, SMB/CIFS, DAAP media server, RSync, BitTorrent client and many more. | GPL-3.0 | PHP | 6.9k | +| [Poste.io](https://poste.io) | Full-featured solution for your Email server. Native implementation of last anti-SPAM methods, webmail and easy administration included. Free tier available. | ⊘ Proprietary | Unknown | — | +| [Sandstorm](https://sandstorm.io/) | Personal server for running self-hosted apps easily and securely. | Apache-2.0 | C++, Shell | 7.1k | +| [Self Host Blocks](https://github.com/ibizaman/selfhostblocks) | Modular server management based on NixOS modules and focused on best practices. | AGPL-3.0 | Nix | 0.5k | +| [StartOS](https://start9.com) | Browser-based, graphical Operating System (OS) that makes running a personal server as easy as running a personal computer. | MIT | Rust | 2.0k | +| [Syncloud](https://syncloud.org/) | Your own online file storage, social network or email server. | GPL-3.0 | Go, Shell | 0.4k | +| [Tipi](https://runtipi.io/) | Homeserver manager. One command setup, one click installs for your favorites self-hosted apps. | GPL-3.0 | Shell | 9.6k | +| [UBOS](https://ubos.net/) | Linux distro that runs on indie boxes (personal servers and IoT devices). Single-command installation and management of apps - Jenkins, Mediawiki, Owncloud, WordPress, etc., and other features. | GPL-3.0 | Perl | — | +| [Umbrel](https://umbrel.com/) | A beautiful personal server OS for self-hosting. Install on a Raspberry Pi 4 or Ubuntu/Debian. | ⊘ Proprietary | Nodejs, Docker | 11.7k | +| [Unraid](https://www.unraid.net) | Linux-based operating system designed to run on home media server setups. | ⊘ Proprietary | Unknown | — | +| [Websoft9](https://www.websoft9.com) | GitOps-driven, multi-application hosting for cloud servers and home servers, one-click deployment of 200+ open source apps. | LGPL-3.0 | Shell, Python | 2.1k | +| [WikiSuite](https://wikisuite.org) | The most comprehensive and integrated Free / Libre / Open Source enterprise software suite. | GPL-3.0, LGPL-2.1, Apache-2.0, MPL-2.0, MPL-1.1, MIT, AGPL-3.0 | Shell, Perl, deb | — | +| [xsrv](https://xsrv.readthedocs.io/) | Install and manage self-hosted services/applications, on your own server(s). | GPL-3.0 | Ansible, Shell | 0.4k | +| [YunoHost](https://yunohost.org/) | Server operating system aiming to make self-hosting accessible to everyone. | AGPL-3.0 | Python, Shell | — | + +## Web Servers + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Algernon](https://algernon.roboticoverlords.org/) | Small self-contained pure-Go web server with Lua, Markdown, HTTP/2, QUIC, Redis and PostgreSQL support. | BSD-3-Clause | Go, Docker | 3.0k | +| [Apache HTTP Server](https://httpd.apache.org/) | Secure, efficient and extensible server that provides HTTP services in sync with the current HTTP standards. | Apache-2.0 | C, deb, Docker | — | +| [BunkerWeb](https://www.bunkerweb.io) | Next-gen Web Application Firewall (WAF) that will protect your web services. | AGPL-3.0 | deb, Docker, K8S, Python | 10.8k | +| [Caddy](https://caddyserver.com/) | Powerful, enterprise-ready, open source web server with automatic HTTPS. | Apache-2.0 | Go, deb, Docker | 74.7k | +| [Ferron](https://ferron.sh/) | Fast, memory-safe web server written in Rust. | MIT | Rust, Docker, deb | 2.1k | +| [go-doxy](https://github.com/yusing/godoxy) | Lightweight, simple, and performant reverse proxy with WebUI, Docker integration, automatic shutdown/startup for container based on traffic. | MIT | Docker, Go | 3.8k | +| [godoxy](https://docs.godoxy.dev/) | High-performance reverse proxy and container orchestrator for self-hosters. | MIT | Docker, Go | — | +| [HAProxy](https://www.haproxy.org/) | Very fast and reliable reverse-proxy offering high availability, load balancing, and proxying for TCP and HTTP-based applications. | GPL-2.0 | C, deb, Docker | — | +| [Lighttpd](https://www.lighttpd.net/) | Secure, fast, compliant, and very flexible web server that has been optimized for high-performance environments. | BSD-3-Clause | C, deb, Docker | — | +| [NGINX](https://nginx.org/en/) | HTTP and reverse proxy server, mail proxy server, and generic TCP/UDP proxy server. | BSD-2-Clause | C, deb, Docker | 31.4k | +| [Nginx Proxy Manager](https://nginxproxymanager.com/) | Docker container for managing Nginx proxy hosts with a simple, powerful interface. | MIT | Docker | 33.8k | +| [Pangolin](https://digpangolin.com/) | Identity-aware tunneled reverse proxy with dashboard UI, access control, and WireGuard-based tunnels (alternative to Cloudflare Tunnel, Tailscale). | AGPL-3.0 | Docker | 22.1k | +| [Pomerium](https://www.pomerium.io) | Identity-aware reverse proxy, successor to now obsolete oauth_proxy. It inserts an OAuth step before proxying your request to the backend, so that you can safely expose your self-hosted websites to public Internet. | Apache-2.0 | Go, Docker | 4.9k | +| [SafeLine](https://waf.chaitin.com/) | Web application firewall / reverse proxy to protect your web apps from attacks and exploits. | GPL-3.0 | Docker | 22.3k | +| [Static Web Server](https://static-web-server.net/) | Cross-platform, high-performance, and asynchronous web server for static file serving. | Apache-2.0, MIT | Rust, Docker | 2.3k | +| [SWAG (Secure Web Application Gateway)](https://github.com/linuxserver/docker-swag) | Nginx webserver and reverse proxy with PHP support, built-in Certbot (Let's Encrypt) client and fail2ban integration. | GPL-3.0 | Docker | 3.7k | +| [Traefik](https://traefik.io/) | HTTP reverse proxy and load balancer that makes deploying microservices easy. | MIT | Go, Docker | 64.3k | +| [UUSEC WAF](https://waf.uusec.com/) | Industry-leading high-performance, AI and semantic technology web application firewall and API security gateway (fork of nginx). | GPL-3.0 | C, Lua, Docker | 1.7k | +| [Vinyl Cache](https://vinyl-cache.org/) | Web application accelerator/caching HTTP reverse proxy (formerly Varnish). | BSD-2-Clause | Go, deb, Docker | — | +| [Zoraxy](https://zoraxy.aroz.org/) | General purpose HTTP reverse proxy and forwarding tool. | AGPL-3.0 | Go, Docker | 5.4k | + diff --git a/docs/selfhosted/catalog/midia.md b/docs/selfhosted/catalog/midia.md new file mode 100644 index 0000000..8e332fb --- /dev/null +++ b/docs/selfhosted/catalog/midia.md @@ -0,0 +1,214 @@ +# Self-hosted — Mídia + +Streaming de áudio e vídeo, galerias de foto, gestão de biblioteca, videovigilância, jogos. + +**161 projetos** nesta categoria. + +> **Fonte:** [awesome-selfhosted/awesome-selfhosted-data](https://github.com/awesome-selfhosted/awesome-selfhosted-data) · **Licença:** [CC-BY-SA 3.0 Unported](https://creativecommons.org/licenses/by-sa/3.0/) · **Autores:** [AUTHORS](https://github.com/awesome-selfhosted/awesome-selfhosted-data/blob/master/AUTHORS) upstream. +> Arquivo **gerado** por `scripts/sync-selfhosted.js`. Não edite à mão — as edições se perdem na próxima sincronização. + +[← Voltar ao índice](../INDEX.md) · [Shortlist SaaS](../shortlist-saas.md) + +--- + +## Games + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [0 A.D.](https://play0ad.com/) | Cross-platform real-time strategy game of ancient warfare. | MIT, GPL-2.0, Zlib | C++, C, deb | — | +| [A Dark Room](https://github.com/doublespeakgames/adarkroom) | Minimalist text adventure game for your browser. | MPL-2.0 | Javascript | 8.2k | +| [Cubiks-2048](https://github.com/Kshitij-Banerjee/Cubiks-2048) | Clone of 2048 game in 3D. | CC-BY-NC-4.0 | Javascript | 0.0k | +| [DDraceNetwork](https://ddnet.org/) | Cooperative platformer version of DDRace, a Teeworlds modification featuring unique cooperative gameplay. | Zlib | C++ | 0.8k | +| [Digibuzzer](https://digibuzzer.app/) | Create a virtual game room around a connected buzzer (documentation in French). | AGPL-3.0 | Nodejs | — | +| [Hypersomnia](https://github.com/TeamHypersomnia/Hypersomnia) | Competitive top-down shooter blending Counter-Strike with Hotline Miami. Runs on Linux, Windows, MacOS and the Web. | AGPL-3.0 | C++, Docker | 1.6k | +| [Lila](https://lichess.org/) | Ad-less chess server powering lichess.org, with official iOS and Android client apps. | AGPL-3.0 | Scala | 18.6k | +| [Luanti](https://www.luanti.org/) | Voxel game engine (formerly Minetest). Play one of our many games, mod a game to your liking, make your own game, or play on a multiplayer server. | LGPL-2.1, MIT, Zlib | C++, Lua, deb | 13.4k | +| [Mindustry](https://mindustrygame.github.io/) | Factorio-like tower defense game. Build production chains to gather more resources, and build complex facilities. | GPL-3.0 | Java | 28.5k | +| [MTA:SA](https://multitheftauto.com/) | Add network play functionality to Rockstar North's Grand Theft Auto game series, in which this functionality is not originally found. | GPL-3.0 | C++ | 1.8k | +| [OpenTTD](https://www.openttd.org/) | Transport tycoon simulation game. | GPL-2.0 | C++, Docker | 8.1k | +| [piqueserver](https://github.com/piqueserver/piqueserver) | Server for openspades, the first-person shooter in a destructible voxel world. | GPL-3.0 | Python, C++ | 0.2k | +| [Posio](https://github.com/abrenaut/posio) | Geography multiplayer game. | MIT | Python | 0.7k | +| [Razzia](https://github.com/Ralex91/Razzia) | Quiz game platform, designed for smaller self-hosted events (alternative to Kahoot!). | MIT | Nodejs, Docker | 1.0k | +| [Red Eclipse 2](https://www.redeclipse.net/) | Arena first-person shooter similar to Unreal Tournament. | Zlib, MIT, CC-BY-SA-4.0 | C, C++, deb | 0.5k | +| [Scribble.rs](https://github.com/scribble-rs/scribble.rs) | A web-based pictionary game. | BSD-3-Clause | Go, Docker | 0.7k | +| [Suroi](https://suroi.io/) | An open-source 2D battle royale game inspired by surviv.io. | GPL-3.0 | Nodejs | 0.5k | +| [The Battle for Wesnoth](https://github.com/wesnoth/wesnoth) | The Battle for Wesnoth is an Open Source, turn-based tactical strategy game with a high fantasy theme, featuring both singleplayer and online/hotseat multiplayer combat. | GPL-2.0 | C++, deb | 6.8k | +| [Veloren](https://veloren.net/) | Multiplayer RPG. Open-source game inspired by Cube World, Legend of Zelda, Dwarf Fortress and Minecraft. | GPL-3.0 | Rust | 2.4k | +| [Zero-K](https://zero-k.info/) | Open Source on Springrts engine. Zero-K is a traditional real time strategy game with a focus on player creativity through terrain manipulation, physics, and a large roster of unique units - all while being balanced to support competitive play. | GPL-2.0 | Lua | 0.8k | + +## Games - Administrative Utilities & Control Panels + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [auto-mcs](https://www.auto-mcs.com) | Cross-platform Minecraft server manager. | AGPL-3.0 | Python | 0.5k | +| [Calagopus](https://calagopus.com) | Modern game server management panel. Deploy, monitor, and manage Minecraft, Hytale, and other game servers with industry-leading performance. | MIT | Rust, Docker, deb | 0.5k | +| [Crafty Controller](https://craftycontrol.com/) | Minecraft launcher and manager that allows users to start and administer Minecraft servers from a user-friendly interface. | GPL-3.0 | Docker, Python | 0.2k | +| [Drop](https://droposs.org) | Game distribution platform, designed for distributing and sharing DRM-free games efficiently (alternative to Steam, GameVault). | AGPL-3.0 | Docker | 0.7k | +| [EasyWI](https://easy-wi.com) | Easy-Wi is a Web-interface that allows you to manage server daemons like gameservers. In addition it provides you with a CMS which includes a fully automated game- and voiceserver lending service. | GPL-3.0 | PHP, Shell | 0.2k | +| [GameAP](https://gameap.com/) | Game Administration Panel for managing game servers on Linux and Windows. | MIT | Go, Docker | 0.0k | +| [GameVault](https://gamevau.lt) | Organize, download, and play DRM-free games from your own server, complete with metadata enrichment and user-friendly interface. | CC-BY-NC-SA-4.0 | Nodejs, Docker | 0.3k | +| [Gameyfin](https://gameyfin.org) | Video game library manager with automatic scanning, web access, downloads, and plugin support. | AGPL-3.0 | Docker | 1.1k | +| [Gaseous Server](https://github.com/gaseous-project/gaseous-server) | Game ROM manager with a built-in web-based emulator using multiple sources to identify and provide metadata. | AGPL-3.0 | Docker, .NET | 0.9k | +| [Lancache](https://lancache.net) | LAN Party game caching made easy. | MIT | Docker, Shell | 0.9k | +| [LinuxGSM](https://linuxgsm.com/) | CLI tool for deployment and management of dedicated game servers on Linux: more than 120 games are supported. | MIT | Shell | 4.9k | +| [Minus Games](https://accessory.github.io/minus_games_user_guide) | Sync games and save files across multiple devices. | MIT | Rust | 0.0k | +| [Ownfoil](https://github.com/a1ex4/ownfoil) | Nintendo Switch library manager, with automated management tasks (file identification and organization, missing updates/DLC), serving your library to multiple supported clients on your Switch, with shop customization and multi user authentication. | AGPL-3.0 | Docker, Python | 0.9k | +| [Pelican Panel](https://pelican.dev/) | Web application for easy management of game servers, offering a user-friendly interface for deploying, configuring, and managing servers, server monitoring tools, and extensive customization options (fork of Pterodactyl). | AGPL-3.0 | PHP, Docker | 2.2k | +| [Pterodactyl](https://pterodactyl.io/) | Management panel for game servers, with an intuitive UI for end users. | MIT | PHP | 9.1k | +| [PufferPanel](https://www.pufferpanel.com/) | Game server management panel designed for both small networks and game server providers. | Apache-2.0 | Go | 1.7k | +| [Retrom](https://github.com/JMBeresford/retrom) | Private cloud game library distribution server + frontend/launcher. | GPL-3.0 | Docker, Rust | 2.0k | +| [RomM](https://romm.app/) | ROM manager for organizing, enriching, and playing retro games, with support for 400+ platforms. | AGPL-3.0 | Docker | 12.0k | +| [SourceBans++](https://sbpp.github.io/) | Admin, ban, and communication management system for games running on the Source engine. | CC-BY-SA-4.0 | PHP | 0.4k | +| [Sunshine](https://app.lizardbyte.dev/Sunshine/) | Remote game stream host for Moonlight with support up to 120 frames per second and 4K resolution. | GPL-3.0 | C++, deb, Docker | 40.0k | + +## Media Management + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [ChannelTube](https://github.com/TheWicklowWolf/ChannelTube) | Download video or audio from YouTube channels on a schedule via yt-dlp. | AGPL-3.0 | Docker | 0.3k | +| [Deleterr](https://github.com/rfsbraz/deleterr) | Automated media cleanup tool that removes watched and stale content from Plex, Sonarr, and Radarr based on configurable rules. | MIT | Docker | 0.3k | +| [Downtify](https://downtify.henriquesebastiao.com) | Download Spotify music with album art and metadata. | GPL-3.0 | Docker | 0.4k | +| [Lidarr](https://lidarr.audio/) | Music collection manager for Usenet and BitTorrent users. | GPL-3.0 | C#, Docker | 5.5k | +| [LidaTube](https://github.com/TheWicklowWolf/LidaTube) | Finding and fetch missing Lidarr albums via yt-dlp. | GPL-3.0 | Docker | 0.4k | +| [Lidify](https://github.com/TheWicklowWolf/Lidify) | Music discovery tool that provides recommendations based on selected Lidarr artists, using Spotify or LastFM. | MIT | Docker | 0.6k | +| [Medusa](https://github.com/pymedusa/Medusa) | Automatic Video library manager for TV Shows. It watches for new episodes of your favorite shows, and when they are posted it does its magic. | GPL-3.0 | Python | 2.0k | +| [MeTube](https://github.com/alexta69/metube) | Web GUI for youtube-dl, with playlist support. Allows downloading videos from dozens of websites. | AGPL-3.0 | Python, Nodejs, Docker | 14.4k | +| [MKVPriority](https://github.com/kennethsible/mkvpriority) | Selects preferred audio and subtitle tracks using configurable priority scores and sets the appropriate default and forced flags. | MIT | Python, Docker | 0.1k | +| [MyTube](https://github.com/franklioxygen/MyTube) | Downloader and player for yt-dlp-supported sites with channel subscriptions, cloud upload support, and local library organization. | MIT | Nodejs, Docker | 1.1k | +| [nefarious](https://lardbit.github.io/nefarious/) | Automate downloading Movies and TV Shows. | GPL-3.0 | Python | 1.3k | +| [Ombi](https://ombi.io/) | Content request system for Plex/Emby, connects to SickRage, CouchPotato, Sonarr, with a growing feature set. | GPL-2.0 | C#, deb | 4.1k | +| [Pinchflat](https://github.com/kieraneglin/pinchflat) | Download YouTube content built using yt-dlp. | AGPL-3.0 | Docker | 5.2k | +| [PodFetch](https://samtv12345.github.io/PodFetch) | Sleek and efficient podcast downloader. | Apache-2.0 | Docker, Rust | 0.5k | +| [Radarr](https://radarr.video/) | Automatically download movies via Usenet and BitTorrent (fork of Sonarr). | GPL-3.0 | C#, Docker | 14.1k | +| [Reaparr](https://www.reaparr.rocks/) | Cross-platform Plex media downloader that seamlessly adds media from other Plex servers to your own. | GPL-3.0 | Docker | 0.7k | +| [Seerr](https://github.com/seerr-team/seerr) | Manage requests for your media library, supports Plex, Jellyfin and Emby media servers (fork of Overseerr). | MIT | Docker, Nodejs | 12.2k | +| [Sonarr](https://sonarr.tv/) | Automatic TV Shows downloader and manager for Usenet and BitTorrent. It can grab, sort and rename new episodes and automatically upgrade the quality of files already downloaded when a better quality format becomes available. | GPL-3.0 | C#, Docker | 15.0k | +| [TrackWatch](https://trackwatch.emlopezr.com) | Automated music release tracker for Spotify with email notifications, discography generator, and ghost track cleaner (alternative to Release Radar). | MIT | Docker | 0.0k | +| [tubesync](https://github.com/meeb/tubesync) | Syncs YouTube channels and playlists to a locally hosted media server. | AGPL-3.0 | Docker, Python | 2.8k | +| [Watcharr](https://github.com/sbondCo/Watcharr) | Add and track all the shows and movies you are watching. Comes with user authentication, modern and clean UI and a very simple setup. | MIT | Docker | 1.5k | +| [ydl_api_ng](https://github.com/Totonyus/ydl_api_ng) | Simple youtube-dl REST API to launch downloads on a distant server. | GPL-3.0 | Python | 0.2k | +| [Youtarr](https://github.com/DialmasterOrg/Youtarr) | Download videos from YouTube channels on a schedule via yt-dlp, with a web UI to browse and selectively download videos. Integrates with Plex Media Server and generates NFO metadata for Jellyfin, Kodi, and Emby. | ISC | Docker | 1.5k | +| [youtube-dl-nas](https://hyeonsangjeon.github.io/youtube-dl-nas/) | Authenticated yt-dlp download queue for video, audio and subtitles, with history, mobile sharing and NAS file management (fork of youtube-dl-server). | MIT | Python, Docker | 0.2k | +| [YoutubeDL-Server](https://github.com/nbr23/youtube-dl-server) | Web and REST interface to Youtube-DL for downloading videos onto a server. | MIT | Python, Docker | 0.3k | +| [yt-dlp Web UI](https://github.com/marcopiovanello/yt-dlp-web-ui) | Web GUI for yt-dlp. | MPL-2.0 | Docker, Go, Nodejs | 2.5k | + +## Media Streaming - Audio Streaming + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Ampache](https://ampache.org/) | Web based audio/video streaming application. | AGPL-3.0 | PHP | 3.8k | +| [Audiobookshelf](https://www.audiobookshelf.org/) | Audiobook and podcast server. It streams all audio formats, keeps and syncs progress across devices. Comes with open-source apps for Android and iOS. | GPL-3.0 | Docker, deb, Nodejs | 13.9k | +| [Audioserve](https://github.com/izderadicka/audioserve) | Simple personal server to serve audio files from directories (audiobooks, music, podcasts...). Focused on simplicity and supports sync of play position between clients. | MIT | Rust | 0.9k | +| [AzuraCast](https://www.azuracast.com/) | Modern and accessible web radio management suite. | Apache-2.0 | Docker | 4.0k | +| [Beets](https://beets.io/) | Music library manager and MusicBrainz tagger (command-line and Web interface). | MIT | Python, deb | 15.5k | +| [Black Candy](https://github.com/blackcandy-org/blackcandy) | Music streaming server. | MIT | Docker, Ruby | 4.3k | +| [BotWave](https://botwave.dpip.lol) | FM broadcasting system with server-client architecture for managing multiple Raspberry Pi transmitters remotely. | GPL-3.0 | Python | 0.1k | +| [Funkwhale](https://dev.funkwhale.audio/funkwhale) | Modern, web-based, convivial, multi-user and free music server. | BSD-3-Clause | Python | — | +| [gonic](https://github.com/sentriz/gonic) | Lightweight music streaming server. Subsonic compatible. | GPL-3.0 | Go, Docker | 2.5k | +| [koel](https://koel.dev/) | Personal music streaming server that works. | MIT | PHP | 17.2k | +| [LibreTime](https://libretime.org) | Broadcast streaming radio on the web (fork of [Airtime](https://github.com/sourcefabric/Airtime)). | AGPL-3.0 | Docker, PHP | 0.9k | +| [LMS](https://github.com/epoupon/lms) | Access your self-hosted music using a web interface. | GPL-3.0 | Docker, deb, C++ | 1.7k | +| [Lyrion Music Server](https://lyrion.org/) | Server software which controls a wide range of Squeezebox/Slim Devices audio players and compatible hardware (formerly Logitech Media Server). | GPL-2.0 | deb, Docker, Perl | 1.8k | +| [moOde Audio](https://moodeaudio.org/) | Audiophile-quality music playback for the wonderful Raspberry Pi family of single board computers. | GPL-3.0 | PHP | 1.4k | +| [Mopidy](https://docs.mopidy.com/) | Extensible music server. Offers a superset of the mpd API, as well as integration with 3rd party services like Spotify, SoundCloud etc. | Apache-2.0 | Python, deb | 8.6k | +| [mpd](https://www.musicpd.org/) | Daemon to remotely play music, stream music, handle and organize playlists. Many clients available. | GPL-2.0 | C++ | 2.7k | +| [mStream](https://mstream.io/) | Music streaming server with GUI management tools. Runs on Mac, Windows, and Linux. | GPL-3.0 | Nodejs | 2.4k | +| [multi-scrobbler](https://foxxmd.github.io/multi-scrobbler) | Scrobble plays from multiple sources to multiple scrobbling services. | MIT | Nodejs, Docker | 1.2k | +| [musikcube](https://musikcube.com/) | Streaming audio server with Linux/macOS/Windows/Android clients. | BSD-3-Clause | C++, deb | 4.8k | +| [Navidrome Music Server](https://www.navidrome.org) | Modern Music Server and Streamer, compatible with Subsonic/Airsonic. | GPL-3.0 | Docker, Go | 22.7k | +| [Pinepods](https://www.pinepods.online/) | Podcast management system with multi-user support. Pinepods utilizes a central database so aspects like listen time and themes follow from device to device. | GPL-3.0 | Docker | 0.9k | +| [Polaris](https://github.com/agersant/polaris) | Music browsing and streaming application optimized for large music collections, ease of use and high performance. | MIT | Rust, Docker | 2.7k | +| [Snapcast](https://github.com/snapcast/snapcast) | Synchronous multiroom audio server. | GPL-3.0 | C++, deb | 7.8k | +| [Stretto](https://github.com/benkaiser/stretto) | Music player with Youtube/Soundcloud import and iTunes/Spotify discovery. | MIT | Nodejs | 0.6k | +| [Supysonic](https://github.com/spl0k/supysonic) | Python implementation of the Subsonic server API. | AGPL-3.0 | Python, deb | 0.3k | +| [SwingMusic](https://swingmusic.vercel.app/) | Swing Music is a beautiful, self-hosted music player and streaming server for your local audio files. Like a cooler Spotify ... but bring your own music. | MIT | Python, Docker | 2.0k | +| [Väinö](https://supponexus.com/products/vaino) | High-fidelity music server for Raspberry Pi with iOS and Android companion apps. | ⊘ Proprietary | Python | — | +| [vod2pod-rss](https://github.com/madiele/vod2pod-rss) | Convert YouTube and Twitch channels to podcasts, no storage required. Transcodes VoDs to MP3 192k on the fly, generates an RSS feed to use in podcast clients. | MIT | Docker | 0.4k | + +## Media Streaming - Multimedia Streaming + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [ClipBucket](https://clipbucket.fr/) | Start your own video sharing website (YouTube/Netflix Clone) in a matter of minutes. | AAL | Docker, PHP | 0.2k | +| [cmyflix](https://github.com/farfalleflickan/cmyflix) | Minimalist Plex/Jellyfin alternative to stream video. | AGPL-3.0 | C, deb | 0.2k | +| [Gerbera](https://gerbera.io/) | UPnP Media Server, which allows you to stream your digital media throughout your home network and listen to/watch it on a variety of UPnP compatible devices. | GPL-2.0 | Docker, deb, C++ | 1.4k | +| [Icecast 2](https://icecast.org) | Streaming audio/video server which can be used to create an Internet radio station or a privately running jukebox and many things in between. | GPL-2.0 | C | — | +| [Jellyfin](https://jellyfin.org) | Media server for audio, video, books, comics, and photos with a sleek interface and robust transcoding capabilities. Almost all modern platforms have clients, including Roku, Android TV, iOS, and Kodi. | GPL-2.0 | C#, deb, Docker | 55.5k | +| [Karaoke Eternal](https://www.karaoke-eternal.com) | Host awesome karaoke parties where everyone can easily find and queue songs from their phone's browser. The player is also fully browser-based with support for MP3+G, MP4 and WebGL visualizations. | ISC | Docker, Nodejs | 0.9k | +| [Kodi](https://kodi.tv/) | Multimedia/Entertainment center, formerly known as XBMC. Runs on Android, BSD, Linux, macOS, iOS and Windows. | GPL-2.0 | C++, deb | 21.1k | +| [Kyoo](https://github.com/zoriya/kyoo) | Innovative media browser designed for seamless streaming of anime, series and movies, offering advanced features like dynamic transcoding, auto watch history and intelligent metadata retrieval. | GPL-3.0 | Docker | 2.5k | +| [MediaMTX](https://mediamtx.org) | Ready-to-use, zero-dependency real-time media server and proxy to publish, read, record, playback and route video/audio streams over SRT, WebRTC, RTSP, RTMP, HLS, MPEG-TS, RTP. | MIT | Go, Docker | 19.7k | +| [Meelo](https://github.com/Arthi-chaud/Meelo) | Personal Music Server, designed for collectors and music maniacs. | GPL-3.0 | Docker | 1.2k | +| [MistServer](https://mistserver.org/) | Public domain streaming media server that works with any device and any format. | Unlicense | C++ | 0.5k | +| [NymphCast](http://nyanko.ws/nymphcast.php) | Turn your choice of Linux-capable hardware into an audio and video source for a television or powered speakers (alternative to Chromecast). | BSD-3-Clause | C++ | 2.6k | +| [Rygel](https://gnome.pages.gitlab.gnome.org/rygel/) | UPnP AV MediaServer that allows you to easily share audio, video, and pictures. Media player software may use Rygel to become a MediaRenderer that may be controlled remotely by a UPnP or DLNA Controller. | LGPL-2.1 | C | — | +| [Stash](https://stashapp.cc) | A web-based library organizer and player for your adult media stash, with auto-tagging and metadata scraping support. | AGPL-3.0 | Docker, Go | 12.8k | +| [üWave](https://u-wave.net/) | Self-hosted collaborative listening platform. Users take turns playing media—songs, talks, gameplay videos, or anything else—from a variety of media sources like YouTube and SoundCloud. | MIT | Nodejs | — | +| [µStreamer](https://github.com/pikvm/ustreamer) | Lightweight and very quick server to stream MJPEG video from any V4L2 device to the net. | GPL-3.0 | C, deb | 2.0k | + +## Media Streaming - Video Streaming + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Channels DVR Server](https://getchannels.com/dvr-server/) | Flexible server providing a whole home self hosted DVR experience for [Channels](https://getchannels.com). | ⊘ Proprietary | Unknown | — | +| [CyTube](https://github.com/calzoneman/sync) | Synchronize media, chat, and more for an arbitrary number of channels. | MIT | Nodejs | 1.6k | +| [Emby](https://emby.media/) | Home media server supporting both DLNA and DIAL (Chromecast) devices out-of-the-box. | ⊘ Proprietary | C# | — | +| [Invidious](https://github.com/iv-org/invidious) | Alternative YouTube front-end. | AGPL-3.0 | Docker, Crystal | 22.4k | +| [MediaCMS](https://mediacms.io) | Modern, fully featured open source video and media CMS, written in Python/Django/React, featuring a REST API. | AGPL-3.0 | Python, Docker | 5.0k | +| [OvenMediaEngine](https://github.com/OvenMediaLabs/OvenMediaEngine) | Streaming Server with Sub-Second Latency. | AGPL-3.0 | C++, Docker | 3.2k | +| [Owncast](https://owncast.online/) | Decentralized single-user live video streaming and chat server for running your own live streams similar in style to the large mainstream options. | MIT | Go | 11.4k | +| [PeerTube](https://joinpeertube.org/en/) | Decentralized video streaming platform using P2P (BitTorrent) directly in the web browser. | AGPL-3.0 | Nodejs | 15.2k | +| [Plex](https://www.plex.tv/) | Centralized home media playback system with a powerful central server. | ⊘ Proprietary | Unknown | — | +| [Rapidbay](https://github.com/hauxir/rapidbay/) | Videostreaming service/torrent client that allows searching and playing videos from torrents in the browser or from a Chromecast/AppleTV/Smart TV. | MIT | Python, Docker | 0.9k | +| [Restreamer](https://datarhei.github.io/restreamer/) | Access H.264 real-time video streaming on your website without a streaming provider. | Apache-2.0 | Nodejs, Docker | 5.1k | +| [SRS](https://ossrs.io/) | A simple, high efficiency and real-time video server, supports RTMP, WebRTC, HLS, HTTP-FLV and SRT. | MIT | Docker, C++ | 29.1k | +| [Subsonic](http://www.subsonic.org/pages/index.jsp) | Web-based media streamer and jukebox. | ⊘ Proprietary | Unknown | — | +| [SyncTube](https://github.com/RblSb/SyncTube) | Lightweight and very simple to setup CyTube alternative to watch videos with friends and chat. | MIT | Nodejs, Haxe | 0.4k | +| [Tiramisu](https://github.com/MrRobotoGit/tiramisu) | BitTorrent engine with a FUSE virtual filesystem that streams torrents live to Plex/Jellyfin without downloading (alternative to Real-Debrid). | GPL-2.0 | Go, Docker | 0.1k | +| [Tube](https://git.mills.io/prologic/tube) | Youtube-like (_without censorship and features you don't need!_) video sharing app written in Go which also supports automatic transcoding to MP4 H.265 AAC, multiple collections and RSS feed. | MIT | Go | — | +| [Tube Archivist](https://tubearchivist.com/) | Organize, search, and enjoy your YouTube collection. Subscribe, download, and track viewed content with metadata indexing and a user-friendly interface. | GPL-3.0 | Docker | 8.3k | +| [VideoLAN Client (VLC)](https://www.videolan.org/) | Cross-platform multimedia player client and server supporting most multimedia files as well as DVDs, Audio CDs, VCDs, and various streaming protocols. | GPL-2.0 | C, deb | — | + +## Photo Galleries + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Chevereto](https://chevereto.com/) | Ultimate image sharing software. Create your very own personal image hosting website in just minutes. | AGPL-3.0 | PHP, Docker | 1.0k | +| [ChronoFrame](https://chronoframe.bh8.ga/) | Personal gallery application with online photo management, supporting Live/Motion Photos, and explore map. | MIT | Nodejs, Docker | 1.9k | +| [Damselfly](https://damselfly.info) | Fast server-based photo management system for large collections of images. Includes face detection, face & object recognition, powerful search, and EXIF Keyword tagging. Runs on Linux, MacOS and Windows. | GPL-3.0 | Docker, C#, .NET | 1.8k | +| [Ente](https://ente.com/) | An end-to-end encrypted photo-sharing platform (alternative to Google Photos, Apple Photos). | AGPL-3.0 | Docker, Nodejs, Go | 28.2k | +| [HomeGallery](https://home-gallery.org) | Browse personal photos and videos featuring tagging, mobile-friendly, and AI powered image discovery. | MIT | Nodejs, Docker | 1.2k | +| [Immich](https://immich.app/) | Photo and video backup solution directly from your mobile phone (alternative to Google Photos). | AGPL-3.0 | Docker | 109.9k | +| [Immich Kiosk](https://github.com/damongolding/immich-kiosk) | Lightweight slideshow for running on kiosk devices and browsers that uses Immich as a data source. | GPL-3.0 | Docker, Go | 1.6k | +| [LibrePhotos](https://github.com/LibrePhotos/librephotos) | Photo management service with a slight focus on cool graphs (alternative to Google Photos). | MIT | Python, Docker | 8.0k | +| [Lychee](https://lycheeorg.github.io/) | Grid and album based photo-management-system. | MIT | PHP, Docker | 4.3k | +| [Mediagoblin](https://mediagoblin.org) | Media publishing platform that anyone can run (alternative to Flickr, YouTube, SoundCloud). | AGPL-3.0 | Python | — | +| [Memtly](https://docs.memtly.com/) | Event photo sharing platform and gallery with slideshow that allows guests to view and share memories via a QR code. | GPL-3.0 | C#, Docker | 0.2k | +| [Nextcloud Memories](https://memories.gallery/) | Fast, modern and advanced photo management suite. Runs as a Nextcloud app. | AGPL-3.0 | PHP | 3.8k | +| [Photofield](https://github.com/SmilyOrg/photofield) | Experimental fast photo viewer. | MIT | Docker, Go | 0.6k | +| [PhotoPrism](https://photoprism.org) | Personal photo management powered by Go and Google TensorFlow. Browse, organize, and share your personal photo collection, using the latest technologies to automatically tag and find pictures. | AGPL-3.0 | Go, Docker | 40.0k | +| [PhotoStructure](https://photostructure.com/) | All your family's photos and videos automatically organized into a fun and beautiful website. Runs via Docker, NodeJS, or native desktop installers. | ⊘ Proprietary | Nodejs | — | +| [Photoview](https://photoview.github.io/) | Simple and user-friendly photo gallery for personal servers. It is made for photographers and aims to provide an easy and fast way to navigate directories, with thousands of high resolution photos. | GPL-3.0 | Go, Docker | 6.5k | +| [PiGallery 2](https://bpatrik.github.io/pigallery2/) | Directory-first photo gallery website, with a rich UI, optimised for running on low resource servers. | MIT | Docker, Nodejs | 2.3k | +| [Piwigo](https://piwigo.org/) | Photo gallery software for the web, built by an active community of users and developers. | GPL-2.0 | PHP | 3.8k | +| [Reservo](https://reservo.co) | Scalable image hosting script with support for CDNs, paid account upgrades, advertising spots and drag & drop upload. | ⊘ Proprietary | PHP | — | +| [sigal](https://github.com/saimn/sigal) | Yet another simple static gallery generator. | MIT | Python | 0.9k | +| [Single File PHP Gallery](http://sye.dk/sfpg/) | Web gallery in one single PHP file. | ⊘ Proprietary | PHP | — | +| [SPIS](https://github.com/gbbirkisson/spis) | A simple, lightweight and fast media server with decent mobile support. | GPL-3.0 | Docker, Rust | 0.2k | +| [This week in past](https://github.com/RouHim/this-week-in-past) | Aggregates images taken this week, from previous years and presents them on a web page with a simple slideshow. | MIT | Docker, Rust | 0.1k | +| [Thumbor](http://thumbor.org/) | A smart imaging service and enables on-demand cropping, resizing, applying filters and optimizing images. | MIT | Python, Docker | 10.5k | +| [Zenphoto](https://www.zenphoto.org/) | Open-source gallery and CMS project. | GPL-2.0 | PHP | 0.3k | + +## Video Surveillance + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Bluecherry](https://www.bluecherrydvr.com/) | Closed-circuit television (CCTV) software application which supports IP and Analog cameras. | GPL-2.0 | PHP | 0.3k | +| [Frigate](https://frigate.video/) | Monitor your security cameras with locally processed AI. | MIT | Docker, Python, Nodejs | 34.9k | +| [motionEye](https://github.com/motioneye-project/motioneye) | Online interface for the software Motion, a video surveillance program with motion detection. | GPL-3.0 | Python, Docker | 4.7k | +| [Secluso](https://secluso.com) | Private DIY home security camera system for Raspberry Pi, with end-to-end encrypted remote access and mobile apps for live video, alerts, and recording playback. | GPL-3.0 | Rust | 1.7k | +| [SentryShot](https://codeberg.org/SentryShot/sentryshot) | Video surveillance management system. | GPL-2.0 | Docker, Rust | — | +| [Strix](https://github.com/eduard256/Strix) | Auto-discovers working stream URLs for IP cameras and generates ready-to-use Frigate and go2rtc configs. | MIT | Go, Docker | 0.8k | +| [Viseron](https://viseron.netlify.app/) | Self-hosted, local-only NVR and AI Computer Vision software. With features such as object detection, motion detection, face recognition and more, it gives you the power to keep an eye on your home, office or any other place you want to monitor. | MIT | Docker | 3.3k | +| [Zoneminder](https://www.zoneminder.com/) | Closed-circuit television (CCTV) software application which supports IP, USB and Analog cameras. | GPL-2.0 | PHP, deb | 5.9k | + diff --git a/docs/selfhosted/catalog/negocio.md b/docs/selfhosted/catalog/negocio.md new file mode 100644 index 0000000..527ae10 --- /dev/null +++ b/docs/selfhosted/catalog/negocio.md @@ -0,0 +1,233 @@ +# Self-hosted — Negócio e operações + +CRM, e-commerce, ERP, estoque, RH, finanças, ticketing, agendamento, eventos. + +**160 projetos** nesta categoria. + +> **Fonte:** [awesome-selfhosted/awesome-selfhosted-data](https://github.com/awesome-selfhosted/awesome-selfhosted-data) · **Licença:** [CC-BY-SA 3.0 Unported](https://creativecommons.org/licenses/by-sa/3.0/) · **Autores:** [AUTHORS](https://github.com/awesome-selfhosted/awesome-selfhosted-data/blob/master/AUTHORS) upstream. +> Arquivo **gerado** por `scripts/sync-selfhosted.js`. Não edite à mão — as edições se perdem na próxima sincronização. + +[← Voltar ao índice](../INDEX.md) · [Shortlist SaaS](../shortlist-saas.md) + +--- + +## Booking and Scheduling + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Alf.io](https://alf.io/) | Ticket reservation system. | GPL-3.0 | Java | 1.6k | +| [Cal.diy](https://cal.diy/) | Online appointment scheduling system. | MIT | Nodejs | 47.3k | +| [Easy!Appointments](https://easyappointments.org/) | Allows your customers to book appointments with you via the web. | GPL-3.0 | PHP | 4.3k | +| [Hi.Events](https://hi.events) | Event management and ticketing platform for conferences, concerts, and more. Offering customizable event pages and embeddable ticket widgets. | AGPL-3.0 | Docker | 4.0k | +| [LibreBooking](https://librebooking.readthedocs.io/) | Resource scheduling solution offering a flexible, mobile-friendly, and extensible interface for organizations to manage resource reservations. | GPL-3.0 | PHP, Docker | 0.8k | +| [QloApps](https://qloapps.com/) | Customizable and intuitive web-based hotel reservation system and a booking engine. | OSL-3.0 | PHP, Nodejs | 14.2k | +| [Rallly](https://rallly.co) | Create polls to vote on dates and times (alternative to Doodle). | AGPL-3.0 | Nodejs, Docker | 5.2k | +| [Seatsurfing](https://seatsurfing.app/) | Webbased app to book seats, desks and rooms for offices. | GPL-3.0 | Docker | 0.3k | + +## Community-Supported Agriculture (CSA) + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [ACP Admin](https://acp-admin.ch/) | CSA administration. Manage members, subscriptions, deliveries, drop-off locations, member participation, invoices and emails (documentation in French). | MIT | Ruby | 0.1k | +| [FoodCoopShop](https://www.foodcoopshop.com/) | User-friendly software for food-coops. | AGPL-3.0 | PHP, Docker | 0.1k | +| [Foodsoft](https://foodcoops.net/) | Manage a non-profit food coop (product catalog, ordering, accounting, job scheduling). | AGPL-3.0 | Docker, Ruby | 0.4k | +| [Hive-Pal](https://hivepal.app) | Mobile-first beekeeping management app for tracking hives, inspections, queen records, and equipment with streamlined data entry optimized for field use. | MIT | Nodejs, Docker | 0.0k | +| [juntagrico](https://juntagrico.org/) | Management platform for community gardens and vegetable cooperatives. | LGPL-3.0 | Python | 0.1k | +| [Open Food Network](https://www.openfoodnetwork.org/) | Online marketplace for local food. It enables a network of independent online food stores that connect farmers and food hubs with individuals and local businesses. | AGPL-3.0 | Ruby | 1.3k | +| [OpenOlitor](https://openolitor.org/) | Administration platform for Community Supported Agriculture groups. | AGPL-3.0 | Scala | 0.0k | +| [teikei](https://github.com/teikei/teikei) | A web application that maps out community-supported agriculture based on crowdsourced data. | AGPL-3.0 | Nodejs | 0.1k | + +## Conference Management + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [indico](https://getindico.io/) | Feature-rich event management system, made @ CERN, the place where the Web was born. | MIT | Python | 2.1k | +| [motion.tools (Antragsgrün)](https://motion.tools/) | Manage motions and amendments for (political) conventions. | AGPL-3.0 | PHP, Docker | 0.1k | +| [OpenSlides](https://openslides.com/) | Presentation and assembly system for managing and projecting agenda, motions and elections of an assembly. | MIT | Docker | 0.6k | +| [osem](https://osem.io/) | Event management tailored to free Software conferences. | MIT | Ruby, Docker | 0.9k | +| [pretalx](https://pretalx.org) | Web-based event management, including running a Call for Papers, reviewing submissions, and scheduling talks. Exports and imports for various related tools. | Apache-2.0 | Python | 0.9k | + +## Customer Relationship Management (CRM) + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Corteza](https://docs.cortezaproject.org) | CRM including a unified workspace, enterprise messaging and a low code environment for rapidly and securely delivering records-based management solutions. | Apache-2.0 | Go | 2.1k | +| [Django-CRM](https://DjangoCRM.github.io/info/) | Analytical CRM with tasks management, email marketing and many more. Django CRM is built for individual use, businesses of any size or freelancers and is designed to provide easy customization and quick development. | AGPL-3.0 | Python | 0.6k | +| [EspoCRM](https://www.espocrm.com/) | CRM with a frontend designed as a single page application, and a REST API. | AGPL-3.0 | PHP | 3.2k | +| [Krayin](https://krayincrm.com/) | CRM solution for SMEs and Enterprises for complete customer lifecycle management. | MIT | PHP | 23.6k | +| [Monica](https://monicahq.com/) | Personal relationship manager, and a new kind of CRM to organize interactions with your friends and family. | AGPL-3.0 | PHP, Docker | 25.0k | +| [SuiteCRM](https://suitecrm.com) | The award-winning, enterprise-class open source CRM. | AGPL-3.0 | PHP | 5.6k | +| [Twenty](https://twenty.com) | A modern CRM offering the flexibility of open source, advanced features, and a sleek design. | AGPL-3.0 | Docker | 54.5k | + +## E-commerce + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Aimeos](https://aimeos.org/) | E-commerce framework for building custom online shops, market places and complex B2B applications scaling to billions of items with Laravel. | LGPL-3.0, MIT | PHP | 5.4k | +| [Bagisto](https://bagisto.com/en/) | Leading Laravel open source e-commerce framework with multi-inventory sources, taxation, localization, dropshipping and more exciting features. | MIT | PHP | 28.0k | +| [CoreShop](https://www.coreshop.org) | E-commerce plugin for Pimcore. | GPL-3.0 | PHP | 0.3k | +| [Drupal Commerce](https://drupalcommerce.org) | Popular e-commerce module for Drupal CMS, with support for dozens of payment, shipping, and shopping related modules. | GPL-2.0 | PHP | — | +| [EverShop](https://evershop.io/) | E-commerce platform with essential commerce features. Modular architecture and fully customizable. | GPL-3.0 | Docker, Nodejs | 10.2k | +| [Magento Open Source](https://business.adobe.com/products/magento/magento-commerce.html) | Leading provider of open omnichannel innovation. | OSL-3.0 | PHP | 12.2k | +| [MedusaJs](https://medusajs.com/) | Headless commerce engine that enables developers to create amazing digital commerce experiences. | MIT | Nodejs | 35.6k | +| [Microweber](https://microweber.com/) | Drag and Drop CMS and online shop. | MIT | PHP | 3.4k | +| [myCart](https://github.com/shurco/mycart) | Shopping cart in 1 file (with support for payment by card or cryptocurrency). | MIT | Go, Docker | 0.4k | +| [Open Source POS](https://github.com/opensourcepos/opensourcepos) | Open Source Point of Sale is a web based point of sale system. | MIT | PHP | 4.3k | +| [OpenCart](https://www.opencart.com) | Shopping cart solution. | GPL-3.0 | PHP | 8.2k | +| [OXID eShop](https://oxidforge.org/en/) | OXID eShop is a flexible open source e-commerce software with a wide range of functionalities. | ⊘ Proprietary | PHP | 0.2k | +| [PrestaShop](https://www.prestashop.com/) | Fully scalable e-commerce solution. | OSL-3.0 | PHP | 9.2k | +| [Pretix](https://pretix.eu/) | Ticket sales platform for events. | AGPL-3.0 | Python, Docker | 2.5k | +| [s-cart](https://s-cart.org/) | E-commerce website for individuals and businesses, built on top of Laravel Framework. | MIT | PHP | 0.0k | +| [Saleor](https://saleor.io) | Django based open-sourced e-commerce storefront. | BSD-3-Clause | Docker, Python | 23.2k | +| [Sharetribe](https://www.sharetribe.com) | Open-source platform to create your own peer-to-peer marketplace, also available with SaaS model. | ⊘ Proprietary | Ruby | 2.4k | +| [Shopware Community Edition](https://www.shopware.com/en/community/community-edition/) | PHP based open source e-commerce software made in Germany. | MIT | PHP | 3.4k | +| [Solidus](https://solidus.io/) | A free, open-source ecommerce platform that gives you complete control over your store. | BSD-3-Clause | Ruby, Docker | 5.3k | +| [Spree Commerce](https://spreecommerce.org) | Spree is a complete, modular & API-driven open source e-commerce solution for Ruby on Rails. | BSD-3-Clause | Ruby | 15.6k | +| [Sylius](https://sylius.com) | Symfony2 powered open source full-stack platform for eCommerce. | MIT | PHP | 8.5k | +| [Thelia](https://thelia.net/) | Thelia is an open source and flexible e-commerce solution. | LGPL-3.0 | PHP | 0.9k | +| [Vendure](https://www.vendure.io) | A headless commerce framework. | MIT | Nodejs | 8.3k | +| [WooCommerce](https://woocommerce.com/) | WordPress based e-commerce solution. | GPL-3.0 | PHP | 10.4k | + +## Human Resources Management (HRM) + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [admidio](https://www.admidio.org/) | User management system for websites of organizations and groups. The system has a flexible role model so that it’s possible to reflect the structure and permissions of your organization. | GPL-2.0 | PHP, Docker | 0.5k | +| [Frappe HR](https://frappe.io/hr) | Complete HRMS solution with over 13 different modules right from employee management, onboarding, leaves, to payroll, taxation, and more. | GPL-3.0 | Docker, Python, Nodejs | 8.5k | +| [MintHCM](https://minthcm.org/) | Tool for Human Capital Management based on two popular, well-known business applications SugarCRM Community Edition and SuiteCRM. | AGPL-3.0 | PHP | 0.4k | + +## Inventory Management + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Cannery](https://cannery.app) | Firearm and ammunition tracker app. | AGPL-3.0 | Docker | — | +| [DVinyl](https://github.com/Kyonew/DVinyl) | Modern collection manager for physical media (vinyls, CDs, cassettes, books, movies, and video games). | MIT | Nodejs, Docker | — | +| [HomeBox (SysAdminsMedia)](https://homebox.software/) | Inventory and organization system built for the home user. | AGPL-3.0 | Docker, Go | 6.7k | +| [Inventaire](https://inventaire.io/welcome) | Collaborative resources mapper project, while yet only focused on exploring books mapping with wikidata and ISBNs. | AGPL-3.0 | Nodejs | — | +| [Inventree](https://docs.inventree.org/en/latest/) | Inventory management system which provides intuitive parts management and stock control. | MIT | Python | 7.4k | +| [Open QuarterMaster](https://openquartermaster.com/) | Powerful inventory management system, designed to be flexible and scalable. | GPL-3.0 | deb, Docker | 0.1k | +| [Part-DB](https://docs.part-db.de/) | Inventory management system for your electronic components. | AGPL-3.0 | Docker, PHP, Nodejs | 1.7k | +| [Shelf](https://www.shelf.nu) | Asset and equipment tracking software used by teams who value clarity. Shelf is an asset database and QR asset label generator that lets you create, manage and overview your assets across locations. Unlimited assets, free forever. | AGPL-3.0 | Nodejs | 2.8k | +| [Spoolman](https://github.com/Donkie/Spoolman) | Keep track of your inventory of 3D-printer filament spools. | MIT | Docker, Python | 2.7k | + +## Manufacturing + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [CNCjs](https://cnc.js.org/) | Web interface for CNC milling controllers running Grbl, Smoothieware, or TinyG. | MIT | Nodejs | 2.6k | +| [Fluidd](https://docs.fluidd.xyz/) | Lightweight & responsive user interface for Klipper, the 3D printer firmware. | GPL-3.0 | Docker, Nodejs | 1.8k | +| [LinuxCNC](https://www.linuxcnc.org/) | Linux based CNC machine controller. It can drive milling machines, lathes, 3D printers, laser cutters, plasma cutters, robot arms, hexapods, and more. | GPL-2.0, LGPL-3.0 | C, deb | 2.4k | +| [Mainsail](https://docs.mainsail.xyz/) | Modern and responsive user interface for the Klipper 3D printer firmware. Control and monitor your printer from everywhere, from any device. | GPL-3.0 | Docker, Python | 2.2k | +| [Manyfold](https://manyfold.app) | Digital asset manager for 3d print files; STL, OBJ, 3MF and more. | MIT | Docker | 2.1k | +| [Octoprint](https://octoprint.org/) | Snappy web interface for controlling consumer 3D printers. | AGPL-3.0 | Docker, Python | 9.1k | + +## Money, Budgeting & Management + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Actual](https://actualbudget.org) | Local-first personal finance tool based on zero-sum budgeting, supporting synchronization across devices, custom rules, manual transaction importing (from QIF, OFX, and QFX files), and optional automatic synchronization with many banks. | MIT | Nodejs, Docker | 28.0k | +| [Akaunting](https://akaunting.com/) | Accounting software designed for small businesses and freelancers. | BUSL-1.1 | PHP | 10.0k | +| [Assets](https://github.com/venil7/assets) | Personal net worth and investment tracker. | ⊘ Proprietary | Docker | 0.2k | +| [Bigcapital](https://bigcapital.app/) | Financial accounting and inventory management software for small to medium businesses. | AGPL-3.0 | Docker | 3.8k | +| [Bitcart](https://bitcart.ai) | Cryptocurrencies payment processor and development platform. | MIT | Docker, Python, Nodejs | 1.0k | +| [BTCPay Server](https://btcpayserver.org/) | Bitcoin and other cryptocurrencies payment processor. | MIT | C# | 7.7k | +| [Budget Board](https://budgetboard.net/) | Simple app for tracking monthly spending and working towards financial goals. | GPL-3.0 | Docker | 0.9k | +| [DePay](https://depay.com) | Accept Web3 Payments directly into your wallet. Peer-to-peer, free, self-hosted & open-source. | MIT | Nodejs | 0.1k | +| [Econumo](https://econumo.com) | Budgeting application for managing personal and family finances, supporting multiple currencies, joint accounts, and budgets. | MIT | Docker | 0.1k | +| [ExpenseOwl](https://github.com/tanq16/expenseowl) | Extremely simple expense tracker with a beautiful UI. | MIT | Go, Docker, K8S | 1.5k | +| [ezbookkeeping](https://ezbookkeeping.mayswind.net/) | A lightweight personal bookkeeping app hosted by yourself. | MIT | Go, Docker | 5.4k | +| [Family Accounting Tool](https://github.com/nymanjens/facto) | Web-based finance management tool for partners with partially shared expenses. | Apache-2.0 | Scala | 0.4k | +| [Fava](https://beancount.github.io/fava/) | Web frontend of Beancount, a text based double-entry accounting system. | MIT | Python | 2.5k | +| [Firefly III](https://firefly-iii.org/) | Firefly III is a modern financial manager. It helps you to keep track of your money and make budget forecasts. It supports credit cards, has an advanced rule engine and can import data from many banks. | AGPL-3.0 | PHP, Docker | 24.3k | +| [FOSSBilling](https://fossbilling.org/) | Hosting and billing automation. Integrates with WHM, CWP, cPanel and HestiaCP. Full API and easily extensible. | Apache-2.0 | PHP, Docker | 1.7k | +| [Galette](https://galette.eu/) | Membership management web application aimed towards non profit organizations. | GPL-3.0 | PHP | 0.1k | +| [Ghostfolio](https://ghostfol.io/) | Wealth management software to keep track of stocks, ETFs and cryptocurrencies. | AGPL-3.0 | Docker, Nodejs | 9.1k | +| [GRR](https://grr.devome.com/?lang=en) | Assets management and booking for small/medium companies. | GPL-2.0 | PHP | 0.1k | +| [HyperSwitch](https://hyperswitch.io/) | Payment switch to make payments fast, reliable and affordable. Connect with multiple payment processors and route traffic effortlessly, all with a single API integration. | Apache-2.0 | Docker, Rust | 43.4k | +| [IHateMoney](https://ihatemoney.org/) | Manage your shared expenses, easily. | BSD-3-Clause | Docker, Python | 1.4k | +| [Invoice Ninja](https://www.invoiceninja.org/) | Powerful tool to invoice clients online. | Elastic-2.0 | PHP, Docker, K8S | 10.0k | +| [InvoicePlane](https://www.invoiceplane.com/) | Manage quotes, invoices, payments and customers for your small business. | MIT | PHP | 3.1k | +| [InvoiceShelf](https://invoiceshelf.com/) | Track expenses, payments & create professional invoices & estimates (fork of Crater). | AGPL-3.0 | PHP, Docker | 1.8k | +| [Kill Bill](https://killbill.io/) | Subscription billing & payments platform. Have access to real-time analytics and financial reports. | Apache-2.0 | Java, Docker | 5.7k | +| [Kresus](https://kresus.org/) | Personal finance manager. | AGPL-3.0 | Nodejs, Docker | 0.3k | +| [Lago](https://www.getlago.com/) | Metering and usage-based billing. | AGPL-3.0 | Docker | 10.3k | +| [monetr](https://monetr.app/) | Budgeting application focused on planning for recurring expenses. | FSL-1.1-MIT | Docker, K8S | 0.7k | +| [Mybucks.online](https://mybucks.online) | Secure, browser-based, password-only self-custodial cryptocurrency wallet. | MIT | Nodejs | 0.0k | +| [MyFin Budget](https://myfinbudget.com) | Personal finances platform (web + REST API + Android) that'll help you budget, keep track of your income/spending and forecast your financial future. | GPL-3.0 | Nodejs, Docker | 0.3k | +| [OctoBot](https://www.octobot.cloud/) | Cryptocurrency trading bot. | GPL-3.0 | Python, Docker | 6.3k | +| [Ocular](https://simonwep.github.io/ocular/) | Simplistic and straightforward budgeting app to track your budget across months and years. | MIT | Docker | 0.6k | +| [OpenBudgeteer](https://github.com/TheAxelander/OpenBudgeteer) | Budgeting app based on the Bucket Budgeting Principle. | AGPL-3.0 | Docker, C# | 1.0k | +| [Pancake](https://www.pancakeapp.com/) | Online invoicing, project management, time tracking and proposal software. | ⊘ Proprietary | PHP | — | +| [Receipt Wrangler](https://receiptwrangler.io) | Easy-to-use receipt manager, powered by AI. Allows users to create receipts effortlessly and quickly, categorize and more. | AGPL-3.0 | Docker | 0.3k | +| [REI3](https://rei3.de/home_en/) | Manage tasks, time, assets and much more within your business. | MIT | Go | 0.6k | +| [SHKeeper](https://shkeeper.io/) | Cryptocurrency payment processor with the unique combination of gateway and merchant allowing you to accept payments in multiple cryptocurrencies without fees and intermediaries. | GPL-3.0 | Python | 0.6k | +| [SolidInvoice](https://solidinvoice.co) | Open source invoicing and quote application. | MIT | PHP | 0.9k | +| [Sure](https://github.com/we-promise/sure) | Personal finance application for everyone (fork of Maybe). | AGPL-3.0 | Docker | 9.3k | +| [VoucherVault](https://github.com/l4rm4nd/VoucherVault) | Store and manage vouchers, coupons, loyalty and gift cards digitally. Supports expiry notifications, transaction histories, file uploads and OIDC SSO. | GPL-3.0 | Docker | 0.5k | +| [Wallos](https://wallosapp.com) | Lightweight personal subscription tracker with statistics and optional notifications. | GPL-3.0 | PHP, Docker | 8.3k | +| [WYGIWYH](https://github.com/eitchtee/WYGIWYH) | Simple and powerful finance tracker. | AGPL-3.0 | Docker, Python | 0.9k | +| [YAFFA](https://www.yaffa.cc) | Personal finance web application, that can be used to keep track of your money, expenses, budgets, and investments. It also helps with long-term financial planning. | MIT | PHP | 0.1k | + +## Polls and Events + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Bitpoll](https://github.com/fsinfuhh/Bitpoll) | Conduct polls about dates, times or general questions. | GPL-3.0 | Docker, Python | 0.3k | +| [Bracket](https://docs.bracketapp.nl/) | Flexible tournament system to build a tournament setup, add teams, schedule matches, keep track of scores and present ranking live to the public. | AGPL-3.0 | Docker, Nodejs | 1.7k | +| [Christmas Community](https://github.com/Wingysam/Christmas-Community) | Create a simple place for your entire family to use to find gifts that people want, and to avoid double-gifting. | AGPL-3.0 | Docker, Nodejs | 0.4k | +| [Claper](https://claper.co/) | The ultimate tool to interact with your audience (alternative to Slido, AhaSlides and Mentimeter). | GPL-3.0 | Elixir, Docker | 0.8k | +| [ClearFlask](https://clearflask.com) | Community-feedback tool for managing incoming feedback and prioritizing a public roadmap (alternative to Canny, UserVoice, Upvoty). | AGPL-3.0 | Docker | 0.4k | +| [docassemble](https://docassemble.org/) | A free, open-source expert system for guided interviews and document assembly, based on Python, YAML, and Markdown. | MIT | Docker, Python | 1.0k | +| [EventSchedule](https://eventschedule.com/) | Share events, sell tickets, and bring communities together. | AAL | PHP, Docker | 0.1k | +| [Fider](https://fider.io) | Open platform to collect and prioritize feedback (alternative to UserVoice). | MIT | Docker | 4.5k | +| [Formbricks](https://formbricks.com) | Experience Management Suite built on the largest open source survey stack worldwide. Gracefully gather feedback at every step of the customer journey to know what your customers need. | AGPL-3.0 | Nodejs, Docker | 12.7k | +| [Framadate](https://framadate.org/abc/) | Online service for planning an appointment or make a decision quickly and easily: Make a poll, Define dates or subjects to choose, Send the poll link to your friends or colleagues, Discuss and make a decision. | CECILL-B | PHP | — | +| [Gancio](https://gancio.org/) | Local community event and agenda sharing. | AGPL-3.0 | Nodejs | — | +| [gathio](https://docs.gath.io/) | Self-destructing, shareable, no-registration event pages. | GPL-3.0 | Nodejs, Docker | 0.5k | +| [HeyForm](https://heyform.net) | Form builder that allows anyone to create engaging conversational forms for surveys, questionnaires, quizzes, and polls. | AGPL-3.0 | Docker | 8.9k | +| [hitobito](https://hitobito.com) | Manage complex group hierarchies with members, events and a lot more. | AGPL-3.0 | Ruby | 0.5k | +| [LimeSurvey](https://www.limesurvey.org) | Feature-rich web-based polling software. Supports extensive survey logic. | GPL-2.0 | PHP | 3.7k | +| [Meetable](https://events.indieweb.org) | Minimal events aggregator. | MIT | PHP | 0.2k | +| [Mobilizon](https://mobilizon.org) | Federated tool that helps you find, create and organise events and groups. | AGPL-3.0 | Elixir, Docker | — | +| [OpnForm](https://opnform.com) | Beautiful open-source form builder. | AGPL-3.0 | PHP, Nodejs, Docker | 3.5k | +| [Revel](https://www.letsrevel.io) | Community-focused event management and ticketing platform. | MIT | Python, Docker | 0.1k | + +## Resource Planning + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Dolibarr](https://www.dolibarr.org/) | Modern CRM software package to manage your company or foundation activity (contacts, suppliers, invoices, orders, stocks, agenda, accounting, ...). | GPL-3.0 | PHP, deb | 7.5k | +| [ERPNext](https://frappe.io/erpnext) | ERP system to help you run your business. | GPL-3.0 | Python, Docker | 37.8k | +| [farmOS](https://farmos.org/) | Web-based farm record keeping application. | GPL-2.0 | PHP, Docker | 1.3k | +| [grocy](https://grocy.info/) | ERP beyond your fridge. Groceries & household management solution for your home. | MIT | PHP, Docker | 9.4k | +| [LedgerSMB](https://ledgersmb.org/) | Integrated accounting and ERP system for small and midsize businesses, with double entry accounting, budgeting, invoicing, quotations, projects, orders and inventory management, shipping and more. | GPL-2.0 | Docker, Perl | 0.6k | +| [Odoo](https://www.odoo.com) | Free open source ERP system. | LGPL-3.0 | Python, deb, Docker | 53.6k | +| [OFBiz](https://ofbiz.apache.org/) | Enterprise Resource Planning system with a suite of business applications flexible enough to be used across any industry. | Apache-2.0 | Java | 1.1k | +| [Tryton](https://www.tryton.org/) | Free open source business solution. | GPL-3.0 | Python | — | + +## Ticketing + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [BugPin](https://bugpin.io) | Visual bug reporting and ticketing tool for web applications. | AGPL-3.0, MIT | Docker | — | +| [Bugsink](https://www.bugsink.com/) | Real-time error tracking for your applications with all the details in one place. Easy setup with clear instructions included. | ⊘ Proprietary | Python, Docker | 2.0k | +| [Bugzilla](https://www.bugzilla.org/) | General-purpose bugtracker and testing tool originally developed and used by the Mozilla project. | MPL-2.0 | Perl | 0.8k | +| [Deskpro](https://www.deskpro.com/) | On-Premise help desk software that includes email, chat, voice & help centre publishing. Full visible source code and API. | ⊘ Proprietary | Unknown | — | +| [EKSO](https://ekso.app) | Help desk ticketing and project/issue tracker. | ⊘ Proprietary | Docker | — | +| [Erxes](https://erxes.io/install/) | Marketing, sales, and customer service platform designed to help businesses attract more engaged customers. | AGPL-3.0, Commons-Clause | Docker, Nodejs | 4.1k | +| [Frappe Helpdesk](https://frappe.io/helpdesk) | Helpdesk software which helps you streamline your company's support, offers an easy setup, clean user interface, and automation tools to resolve customer queries efficiently. | AGPL-3.0 | Docker | 3.3k | +| [FreeScout](https://freescout.net/) | Email-based customer support application, help desk and shared mailbox (alternative to Zendesk and Help Scout). | AGPL-3.0 | PHP, Docker | 4.5k | +| [Full Help](https://www.fullhelp.com/en/) | Simple, easy to use help desk & knowledge base software. Custom branding, custom themes, restful API, communication channels, multi-company support, multi-language support, and much more! At least 1 new release per month. | ⊘ Proprietary | PHP | — | +| [GlitchTip](https://glitchtip.com) | Error tracking app to collect errors reported by your app. | MIT | Python, Docker, K8S | 0.2k | +| [ITFlow](https://itflow.org) | Client IT documentation, ticketing, invoicing and accounting for MSPs (Managed Service Providers). | GPL-3.0 | PHP | 1.0k | +| [JIRA](https://www.atlassian.com/software/jira) | Professional and extensible issue tracker. | ⊘ Proprietary | Java | — | +| [Jitbit Helpdesk](https://www.jitbit.com/helpdesk/) | Help desk software - simple but powerful. | ⊘ Proprietary | .NET | — | +| [Libredesk](https://libredesk.io/) | Modern omnichannel customer support desk. Live chat, email, and more in a single binary. | AGPL-3.0 | Docker, Go, Nodejs | 2.7k | +| [MantisBT](https://www.mantisbt.org/) | Bug tracker, fits best for software development. | GPL-2.0 | PHP | 1.8k | +| [OTOBO](https://otobo.io/en/) | Flexible web-based ticketing system used for customer service, help desk, IT service management. | GPL-3.0 | Perl, Docker | 0.3k | +| [Request Tracker](https://www.bestpractical.com/rt/) | Enterprise-grade issue tracking system. | GPL-2.0 | Perl | 1.1k | +| [Roundup Issue Tracker](https://www.roundup-tracker.org/) | Simple-to-use and -install issue tracking system with command-line, web, REST, XML-RPC, and e-mail interfaces. Designed with flexibility in mind - not just another bug tracker. | MIT, ZPL-2.0 | Python, Docker | — | +| [SupportPal](https://www.supportpal.com/) | Powerful help desk software - easy, fast and intuitive. | ⊘ Proprietary | PHP | — | +| [Telebugs](https://telebugs.com/) | Lightweight error tracker without a subscription (alternative to Sentry). | ⊘ Proprietary | Docker | — | +| [Zammad](https://zammad.org/) | Easy to use but powerful open-source support and ticketing system. | AGPL-3.0 | Ruby, deb | 5.8k | + diff --git a/docs/selfhosted/catalog/observabilidade.md b/docs/selfhosted/catalog/observabilidade.md new file mode 100644 index 0000000..938cc05 --- /dev/null +++ b/docs/selfhosted/catalog/observabilidade.md @@ -0,0 +1,71 @@ +# Self-hosted — Observabilidade e busca + +Monitoramento, status pages, analytics, motores de busca. + +**48 projetos** nesta categoria. + +> **Fonte:** [awesome-selfhosted/awesome-selfhosted-data](https://github.com/awesome-selfhosted/awesome-selfhosted-data) · **Licença:** [CC-BY-SA 3.0 Unported](https://creativecommons.org/licenses/by-sa/3.0/) · **Autores:** [AUTHORS](https://github.com/awesome-selfhosted/awesome-selfhosted-data/blob/master/AUTHORS) upstream. +> Arquivo **gerado** por `scripts/sync-selfhosted.js`. Não edite à mão — as edições se perdem na próxima sincronização. + +[← Voltar ao índice](../INDEX.md) · [Shortlist SaaS](../shortlist-saas.md) + +--- + +## Analytics + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [ANALOG](https://github.com/orangecoloured/analog) | A minimal analytics tool. Tracks events in a span of 10-30 days. | MIT | Nodejs, Docker | 0.0k | +| [Aptabase](https://aptabase.com/) | Privacy first and simple analytics for mobile and desktop apps. | AGPL-3.0 | Docker | 1.8k | +| [AWStats](http://www.awstats.org/) | Generate statistics from web, streaming, ftp or mail server logfiles. | GPL-3.0 | Perl | 0.4k | +| [Countly Community Edition](https://count.ly) | Real time mobile and web analytics, crash reporting and push notifications platform. | AGPL-3.0 | Nodejs, Docker | 5.9k | +| [d8a.tech](https://d8a.tech) | A data collection service that works with your existing Google Analytics setup to capture user activity and send it straight to your own private database. | MIT | Go, Docker | 0.0k | +| [Daily Stars Explorer](https://emanuelef.github.io/daily-stars-explorer) | Track GitHub repo trends with daily star insights to see growth and community interest over time. | MIT | Go, Nodejs, Docker | 0.4k | +| [Druid](https://druid.apache.org) | Distributed, column-oriented, real-time analytics data store. | Apache-2.0 | Java, Docker | 14.0k | +| [EDA](https://github.com/jortilles/EDA) | Web application for data analysis and visualization. | AGPL-3.0 | Nodejs, Docker | 0.2k | +| [GoAccess](http://goaccess.io/) | Real-time web log analyzer and interactive viewer that runs in a terminal. | GPL-2.0 | C | 20.8k | +| [GoatCounter](https://www.goatcounter.com) | Easy web statistics without tracking of personal data. | EUPL-1.2 | Go | 5.9k | +| [HitKeep](https://hitkeep.com/) | Privacy-first web analytics with goals, funnels, ecommerce tracking, and team management in a single binary with embedded DuckDB (alternative to Google Analytics, Plausible, Umami). | MIT | Go, Docker | 0.1k | +| [Litlyx](https://litlyx.com) | All-in-one Analytics Solution. Setup in 30 seconds. Display all your data on an AI-powered dashboard. Fully self-hostable and GDPR compliant. | Apache-2.0 | Docker | 1.7k | +| [Liwan](https://liwan.dev/) | Privacy-first web analytics. | Apache-2.0 | Rust, Docker | 0.2k | +| [Matomo](https://matomo.org/) | Web analytics that protects your data and your customers' privacy (alternative to Google Analytics). | GPL-3.0 | PHP | 21.7k | +| [Medama Analytics](https://oss.medama.io) | Privacy-first website analytics. Tiny, simple, and cookie-free. | Apache-2.0, MIT | Docker, Go | 0.6k | +| [Metabase](https://metabase.com/) | Easy way for everyone in your company to ask questions and learn from data. | AGPL-3.0 | Java, Docker | 48.6k | +| [Middleware](https://middlewarehq.com/) | Tool designed to help engineering leaders measure and analyze the effectiveness of their teams using the DORA metrics. | Apache-2.0 | Docker, Python, Nodejs | 1.6k | +| [Netron](https://netron.app/) | Visualizer for neural network and machine learning models. | MIT | Python, Nodejs | 33.3k | +| [Offen](https://www.offen.dev/) | Fair, lightweight and open web analytics tool. Gain insights while your users have full access to their data. | Apache-2.0 | Go, Docker | 1.0k | +| [Plausible Analytics](https://plausible.io/) | Simple, lightweight (< 1 KB) and privacy-friendly web analytics. | AGPL-3.0 | Elixir | 28.4k | +| [PostHog](https://posthog.com) | Product analytics, session recording, feature flagging and a/b testing that you can self-host (alternative to Mixpanel, Amplitude, Heap, HotJar, Optimizely). | MIT | Python | 37.5k | +| [Postiz](https://postiz.com) | Schedule posts, track the performance of your content, and manage all your social media accounts in one place (Alternative to Buffer, Hootsuite, Sprout Social). | AGPL-3.0 | Docker | 34.4k | +| [Prisme Analytics](https://www.prismeanalytics.com) | Privacy-focused and progressive analytics service based on Grafana. | AGPL-3.0, MIT | Docker | 0.1k | +| [Redash](http://redash.io) | Connect and query your data sources, build dashboards to visualize data and share them with your company. | BSD-2-Clause | Docker | 28.7k | +| [RudderStack](https://rudderstack.com/) | Collect, unify, transform, and store your customer data, and route it to a wide range of common, popular marketing, sales, and product tools (alternative to Segment). | Elastic-2.0 | Docker, K8S, Go, Nodejs | 4.5k | +| [Rybbit](https://rybbit.com/) | Web and products analytics that is easy to setup and more intuitive (alternative to Google Analytics). | AGPL-3.0 | Docker | 12.6k | +| [Shaper](https://taleshape.com/shaper/docs) | Build Data Dashboards all in SQL. Powered by DuckDB. | MPL-2.0 | Docker, Nodejs, Python, Go | 1.2k | +| [Socioboard](https://github.com/socioboard/Socioboard-5.0) | Social media management, analytics, and reporting platform supporting nine social media networks out-of-the-box. | GPL-3.0 | Nodejs | 1.5k | +| [Statistics for Strava](https://github.com/robiningelbrecht/statistics-for-strava) | Statistics dashboard generated from Strava data. | AGPL-3.0 | Docker | 0.0k | +| [Superset](http://superset.apache.org/) | Modern data exploration and visualization platform. | Apache-2.0 | Python | 74.2k | +| [Swetrix](https://swetrix.com/) | Ultimate, open-source web analytics to satisfy all your needs. | AGPL-3.0 | Docker | 0.1k | +| [Umami](https://umami.is/) | Simple, fast, privacy-focused alternative to Google Analytics. | MIT | Nodejs, Docker | 38.1k | +| [Vince](https://www.vinceanalytics.com/) | Web analytics and dashboard (alternative to Google Analytics). | AGPL-3.0 | Go, Docker, K8S, deb | 2.0k | + +## Search Engines + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Aleph](https://aleph.occrp.org/) | Tool for indexing large amounts of both documents (PDF, Word, HTML) and structured (CSV, XLS, SQL) data for easy browsing and search. It is built with investigative reporting as a primary use case. | MIT | Docker, K8S | 2.4k | +| [Apache Solr](https://lucene.apache.org/solr/) | Enterprise search platform featuring full-text search, hit highlighting, faceted search, real-time indexing, dynamic clustering, and rich document (e.g., Word, PDF) handling. | Apache-2.0 | Java, Docker, K8S | 1.6k | +| [ElasticSearch](https://www.elastic.co/elasticsearch/) | Distributed, RESTful search and analytics engine. | SSPL-1.0 | Java | 77.8k | +| [Fess](https://fess.codelibs.org/) | Powerful and easily deployable Enterprise Search Server. | Apache-2.0 | Java, Docker | 1.1k | +| [Hister](https://hister.org/) | Personal web search engine with automatic indexing of visited websites. Supports offline local result previews, local files, multi-user handling and optional semantic search. | AGPL-3.0 | Go, Docker | 1.8k | +| [Manticore Search](https://github.com/manticoresoftware/manticoresearch/) | Full-text search and data analytics, with fast response time for small, medium and big data (alternative to Elasticsearch). | GPL-3.0 | Docker, deb, C++, K8S | 11.9k | +| [MeiliSearch](https://www.meilisearch.com) | Ultra relevant, instant and typo-tolerant full-text search API. | MIT | Rust, Docker, deb | 58.9k | +| [Meme Search](https://github.com/neonwatty/meme-search) | AI-powered meme search engine. Automatically extracts descriptions from images using vision-language models, then indexes with vector embeddings for semantic and keyword search. | Apache-2.0 | Docker | 0.7k | +| [OpenSearch](https://opensearch.org) | Distributed and RESTful search engine. | Apache-2.0 | Java, Docker, K8S, deb | 13.5k | +| [SearXNG](https://docs.searxng.org/) | Internet metasearch engine which aggregates results from various search services and databases (Fork of Searx). | AGPL-3.0 | Python, Docker | 35.1k | +| [Sosse](https://sosse.readthedocs.io/en/stable/) | Selenium based search engine and crawler with offline archiving. | AGPL-3.0 | Python, Docker | 0.0k | +| [Typesense](https://typesense.org) | Blazing fast, typo-tolerant open source search engine optimized for developer happiness and ease of use. | GPL-3.0 | C++, Docker, K8S, deb | 26.4k | +| [Websurfx](https://github.com/neon-mmd/websurfx) | Aggregate results from other search engines (metasearch engine) without ads while keeping privacy and security in mind. It is extremely fast and provides a high level of customization (alternative to SearX). | AGPL-3.0 | Rust, Docker | 1.2k | +| [Yacy](https://yacy.net/en/index.html) | Peer based, decentralized search engine server. | GPL-2.0 | Java, Docker, K8S | 4.0k | +| [ZincSearch](https://zincsearch.com) | Search engine that requires minimal resources (alternative to Elasticsearch). | Apache-2.0 | Go, Docker, K8S | 17.9k | + diff --git a/docs/selfhosted/catalog/outros.md b/docs/selfhosted/catalog/outros.md new file mode 100644 index 0000000..144c063 --- /dev/null +++ b/docs/selfhosted/catalog/outros.md @@ -0,0 +1,136 @@ +# Self-hosted — Outros + +Mapas e GPS, saúde, genealogia, e o balde "Miscellaneous" do upstream. + +**103 projetos** nesta categoria. + +> **Fonte:** [awesome-selfhosted/awesome-selfhosted-data](https://github.com/awesome-selfhosted/awesome-selfhosted-data) · **Licença:** [CC-BY-SA 3.0 Unported](https://creativecommons.org/licenses/by-sa/3.0/) · **Autores:** [AUTHORS](https://github.com/awesome-selfhosted/awesome-selfhosted-data/blob/master/AUTHORS) upstream. +> Arquivo **gerado** por `scripts/sync-selfhosted.js`. Não edite à mão — as edições se perdem na próxima sincronização. + +[← Voltar ao índice](../INDEX.md) · [Shortlist SaaS](../shortlist-saas.md) + +--- + +## Genealogy + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Genea.app](https://www.genea.app/) | Genealogy tool designed with privacy in mind that anyone can use to author or edit their family tree. Data is stored in the GEDCOM format and all processing is done in the browser. | MIT | Javascript | 0.3k | +| [Genealogy](https://genealogy.kreaweb.be/) | Record family members and their relationships and build a family tree. | MIT | PHP | 0.4k | +| [GeneWeb](https://geneweb.tuxfamily.org/wiki/GeneWeb) | Genealogy software that can be used offline or as a Web service. | GPL-2.0 | OCaml | 0.4k | +| [Gramps Web](https://www.grampsweb.org/) | Web app for collaborative genealogy, based on and interoperable with Gramps, the open source genealogy desktop application. | AGPL-3.0 | Docker | 0.2k | +| [webtrees](https://www.webtrees.net) | Webtrees is the web's leading online collaborative genealogy application. | GPL-3.0 | PHP | 0.8k | + +## Health and Fitness + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Endurain](https://docs.endurain.com/) | Fitness tracking service designed to give users full control over their data and hosting environment. | AGPL-3.0 | Docker | — | +| [FitTrackee](https://docs.fittrackee.org/) | Simple workout/activity tracker. | AGPL-3.0 | Python, Docker | 1.1k | +| [Mere Medical](https://meremedical.co/) | Manage all of your medical records from Epic MyChart, Cerner, and OnPatient patient portals in one place. Privacy-focused, self-hosted, and offline-first. | GPL-3.0 | Docker, Nodejs | 0.3k | +| [OpenEMR](https://www.open-emr.org/) | Electronic health records and medical practice management solution. | GPL-3.0 | PHP, Docker | 5.4k | +| [wger](https://wger.de/) | Web-based personal workout, fitness and weight logger/tracker. It can also be used as a simple gym management utility and offers a full REST API as well. | AGPL-3.0 | Python, Docker | 6.6k | +| [Wingfit](https://wingfit.fr) | Minimalist fitness app to plan your workouts, track your personal records and leverage smartwatch data. | CC-BY-SA-4.0 | Python, Docker | 0.5k | + +## Maps and Global Positioning System (GPS) + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [AirTrail](https://airtrail.johan.ohly.dk) | Personal flight tracking system. | GPL-3.0 | Docker, Nodejs | 1.5k | +| [Bicimon](https://github.com/knrdl/bicimon) | Bike Speedometer as Progressive Web App. | MIT | Javascript | 0.1k | +| [Dawarich](https://dawarich.app/) | Visualize your location history, track your movements, and analyze your travel patterns with complete privacy and control (alternative to Google Timeline a.k.a. Google Location History). | AGPL-3.0 | Docker | 10.0k | +| [Geo2tz](https://github.com/noandrea/geo2tz) | Get the timezone from geo coordinates (lat, lon). | MIT | Go, Docker | 0.1k | +| [GraphHopper](https://graphhopper.com/) | Fast routing library and server using OpenStreetMap. | Apache-2.0 | Java | 6.6k | +| [MapTiler Server](https://www.maptiler.com/server/) | Host OpenStreetMap vector tiles, satellite imagery, own geodata and data from PostGIS database. | ⊘ Proprietary | Unknown | — | +| [NextGIS Web](https://nextgis.com/nextgis-web/) | Web GIS server for geospatial data management, web map publishing, and QGIS-centered collaborative workflows. | GPL-3.0 | Docker | 0.3k | +| [Nominatim](https://nominatim.org/) | Server application for geocoding (address -> coordinates) and reverse geocoding (coordinates -> address) on OpenStreetMap data. | GPL-2.0 | C | 4.4k | +| [Open Source Routing Machine (OSRM)](http://project-osrm.org/) | High performance routing engine designed to run on OpenStreetMap data and offering an HTTP API, C++ library interface, and Nodejs wrapper. | BSD-2-Clause | C++ | 8.0k | +| [OpenRouteService](https://openrouteservice.org/) | Route service with directions, isochrones, time-distance matrix, route optimization, etc. | GPL-3.0 | Docker, Java | 1.9k | +| [OpenStreetMap](https://www.openstreetmap.org/) | Collaborative project to create a free editable map of the world. | GPL-2.0 | Ruby | 2.8k | +| [OpenTripPlanner](https://www.opentripplanner.org/) | Multimodal trip planning software based on OpenStreetMap data and consuming published GTFS-formatted data to suggest routes using local public transit systems. | LGPL-3.0 | Java, Javascript | 2.7k | +| [OwnTracks Recorder](https://github.com/owntracks/recorder) | Store and access data published by [OwnTracks](https://owntracks.org/) location tracking apps. | GPL-2.0 | C, Lua, deb, Docker | 1.2k | +| [TileServer GL](https://tileserver.readthedocs.io/) | Vector and raster maps with GL styles. Server side rendering by Mapbox GL Native. Map tile server for Mapbox GL JS, Android, iOS, Leaflet, OpenLayers, GIS via WMTS, etc. | BSD-2-Clause | Nodejs, Docker | 2.9k | +| [Traccar](https://www.traccar.org/) | Java application to track GPS positions. Supports loads of tracking devices and protocols, has an Android and iOS App. Has a web interface to view your trips. | Apache-2.0 | Java | — | +| [wanderer](https://github.com/open-wanderer/wanderer) | Trail database where you can upload your recorded tracks or create new ones and add various metadata to build an easily searchable catalogue. | AGPL-3.0 | Docker, Go, Nodejs | 3.8k | + +## Miscellaneous + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [2FAuth](https://github.com/Bubka/2FAuth) | Manage your Two-Factor Authentication (2FA) accounts and generate their security codes. | AGPL-3.0 | PHP, Docker | 4.1k | +| [Anchr](https://anchr.io) | Toolbox for tiny tasks on the internet, including bookmark collections, URL shortening and (encrypted) image uploads. | GPL-3.0 | Nodejs | 0.4k | +| [Anubis](https://anubis.techaro.lol/) | Web AI firewall utility which protects upstream resources from scraper bots. | MIT | Docker, deb, Go | 21.2k | +| [asciinema](https://asciinema.org/) | Web app for hosting asciicasts. | Apache-2.0 | Elixir, Docker | 2.5k | +| [Baby Buddy](https://github.com/babybuddy/babybuddy) | Helps caregivers track baby sleep, feedings, diaper changes, and tummy time. | BSD-2-Clause | Python | 2.8k | +| [ClipCascade](https://github.com/Sathvik-Rao/ClipCascade) | Syncs your clipboard across multiple devices instantly, without any button press. Available on Windows, macOS, Linux, and Android, it provides seamless and secure clipboard sharing with end-to-end data encryption. | GPL-3.0 | Java, Docker | 1.9k | +| [Cloudlog](https://magicbug.co.uk/cloudlog/) | Log your amateur radio contacts anywhere. | MIT | PHP, Docker | 0.6k | +| [ConvertX](https://github.com/C4illin/ConvertX) | Online file converter which supports over a thousand different formats. | AGPL-3.0 | Docker | 18.4k | +| [CUPS](https://www.cups.org/) | The Common Unix Print System uses Internet Printing Protocol (IPP) to support printing to local and network printers. | GPL-2.0 | C | 1.7k | +| [CyberChef](https://github.com/gchq/CyberChef) | Perform all manner of operations within a web browser such as AES, DES and Blowfish encryption and decryption, creating hexdumps, calculating hashes, and much more. | Apache-2.0 | Javascript | 35.5k | +| [Digiboard](https://digiboard.app/) | Create collaborative whiteboards (documentation in French). | AGPL-3.0 | Nodejs | — | +| [Digicard](https://codeberg.org/ladigitale/digicard) | Create simple graphic compositions (documentation in French). | AGPL-3.0 | Nodejs | — | +| [Digicut](https://ladigitale.dev/digicut/) | Cut audio and video files using FFMPEG.wasm (documentation in French). | AGPL-3.0 | Nodejs | — | +| [Digiface](https://ladigitale.dev/digiface/) | Create avatars using the Avataaars library (documentation in French). | AGPL-3.0 | Nodejs | — | +| [Digiflashcards](https://ladigitale.dev/digiflashcards/) | An online application to create flashcards (documentation in French). | AGPL-3.0 | Nodejs, PHP | — | +| [Digimerge](https://ladigitale.dev/digimerge/) | Assemble audio and video files directly in your browser (documentation in French). | AGPL-3.0 | Nodejs | — | +| [Digiquiz](https://ladigitale.dev/digiquiz/) | An online application to publish content created with H5P (documentation in French). | AGPL-3.0 | Nodejs | — | +| [Digiread](https://ladigitale.dev/digiread/) | Clean up online pages and articles using Mozilla's Readability (documentation in French). | AGPL-3.0 | Nodejs, PHP | — | +| [Digisteps](https://ladigitale.dev/digisteps/) | A simple application for creating online educational paths (documentation in French). | AGPL-3.0 | Nodejs, PHP | — | +| [Digitranscode](https://ladigitale.dev/digitranscode) | Convert audio files and videos directly in the browser (documentation in French). | AGPL-3.0 | Nodejs | — | +| [Digiview](https://ladigitale.dev/digiview/) | View YouTube videos in a distraction-free interface (documentation in French). | AGPL-3.0 | Nodejs, PHP | — | +| [Digiwords](https://ladigitale.dev/digiwords/) | A simple online application for creating word clouds (documentation in French). | AGPL-3.0 | Nodejs, PHP | — | +| [DOCAT](https://github.com/docat-org/docat) | Host your docs. Simple. Versioned. Fancy. | MIT | Python, Docker | 0.9k | +| [Domain Locker](https://domain-locker.com) | Domain name portfolio management and tracker. | MIT | Deno, Docker | 1.5k | +| [DOMJudge](https://www.domjudge.org/) | System for running a programming contest, like the ICPC regional and world championship programming contests. | GPL-2.0, BSD-3-Clause, MIT | PHP | 0.9k | +| [ESMira](https://esmira.kl.ac.at) | Run longitudinal studies (ESM, AA, EMA) with data collection and communication with participants being completely anonymous. | AGPL-3.0 | PHP | 0.0k | +| [F-Droid](https://f-droid.org) | Server tools for maintaining an F-Droid repository system. | AGPL-3.0 | Python, Docker, deb | 0.4k | +| [Flyimg](https://flyimg.io) | Resize and crop images on the fly. Get optimised images with MozJPEG, WebP or PNG using ImageMagick, with an efficient caching system. | MIT | Docker | 1.2k | +| [Geeftlist](https://codeberg.org/nanawel/geeftlist) | Collaborative platform for managing, sharing and reserving gifts between friends and family. | GPL-3.0 | Docker | — | +| [google-webfonts-helper](https://github.com/majodev/google-webfonts-helper) | Hassle-Free Way to Self-Host Google Fonts. Get eot, ttf, svg, woff and woff2 files + CSS snippets. | MIT | Nodejs | 13.0k | +| [Habitica](https://habitica.com/) | Habit tracker app which treats your goals like a Role Playing Game. | GPL-3.0, CC-BY-SA-3.0 | Nodejs, Docker | 14.0k | +| [HortusFox](https://hortusfox.github.io) | Collaborative plant management and tracking system for plant enthusiasts. | MIT | PHP, Docker | 1.6k | +| [ImgCompress](https://imgcompress.karimzouine.com) | Image processing tool that runs entirely in Docker. Compress, convert, resize, batch-process images, and remove backgrounds using local AI without cloud dependencies. | GPL-3.0 | Docker | 0.3k | +| [Infisical Community Edition](https://infisical.com/) | Platform for secrets, certificates, and privileged access management. | MIT | Docker, K8S, deb | 28.6k | +| [iSponsorBlockTV](https://github.com/dmunozv04/iSponsorBlockTV) | Block and skip sponsors, while also muting and skipping ads on YouTube. | GPL-3.0 | Docker, Python | 6.0k | +| [IT-Tools by sharevb](https://github.com/sharevb/it-tools) | Collection of handy online tools for developers (fork of [it-tools](https://github.com/CorentinTh/it-tools)). | GPL-3.0 | Docker | 1.5k | +| [Jelu](https://bayang.github.io/jelu-web) | Read and to-read list book tracker. | MIT | Java, Docker | 0.7k | +| [jetlog](https://github.com/pbogre/jetlog) | Personal flight tracker and viewer. | GPL-2.0 | Docker | 0.3k | +| [Kasm Workspaces](https://kasmweb.com/) | Streaming containerized apps and desktops to end-users. Examples include Ubuntu in your browser, or simply single apps such as Chrome, OpenOffice, Gimp, Filezilla etc. | GPL-3.0 | Docker | — | +| [Keygen](https://keygen.sh/) | Software licensing and distribution API. | ⊘ Proprietary | Ruby | 1.5k | +| [Koillection](https://koillection.github.io/) | Koillection is a service allowing users to manage any kind of collections. | MIT | Docker, PHP | 1.3k | +| [LanguageTool](https://languagetool.org/) | Proofread more than 20 languages. It finds many errors that a simple spell checker cannot detect. | LGPL-2.1 | Java, Docker | 14.8k | +| [Libre Translate](https://libretranslate.com/) | Machine Translation API. | AGPL-3.0 | Docker, Python | 15.9k | +| [LubeLogger](https://lubelogger.com) | Web-based vehicle maintenance and fuel mileage tracker. | MIT | Docker, K8S, C# | 2.8k | +| [Mirumoji](https://svdc1.github.io/mirumoji/docs) | Japanese immersion toolkit providing clickable, tokenized subtitles with dictionary lookups and transcription generation. | MIT | Docker, Python | 0.0k | +| [mosparo](https://mosparo.io/) | The modern spam protection tool. It replaces other captcha methods with a simple and easy to use spam protection solution. | MIT | PHP | 0.3k | +| [Movary](https://github.com/leepeuker/movary) | Web app to track and rate your watched movies. | MIT | Docker, PHP | 0.8k | +| [Neko](https://neko.m1k1o.net) | Virtual browser that runs in docker and uses WebRTC. | Apache-2.0 | Docker, Go | 21.9k | +| [OmniTools](https://omnitools.app/) | Collection of powerful web-based tools for everyday tasks (coding, manipulating images/videos, PDFs or crunching numbers...). | MIT | Docker | 10.0k | +| [Open-Meteo](https://open-meteo.com/) | Weather API with open-data forecasts, historical and climate data from all major national weather services. | AGPL-3.0 | Docker | 6.0k | +| [OpenReader](https://openreader.richardr.dev/) | EPUB, PDF, DOCX, MD, and TXT file text to speech document reader. Read documents in realtime with high-quality TTS; or extract audiobooks. | MIT | Docker | 0.5k | +| [OpenZiti](https://openziti.io/) | Fully-featured, zero trust, full mesh overlay network. Includes a 2FA support out of the box, clients for all major desktop/mobile OS'es. | Apache-2.0 | Go | 4.3k | +| [Operational.co](https://operational.co) | Receive alerts in a live timeline from your product. | AGPL-3.0 | Nodejs, Docker | 0.5k | +| [penpot](https://penpot.app/) | Web-based design and prototyping platform meant for cross-domain teams. | MPL-2.0 | Docker | 58.2k | +| [POMjs](https://password.oppetmoln.se/) | Random password generator. | GPL-2.0 | Javascript | 0.0k | +| [Pønskelisten](https://github.com/aunefyren/poenskelisten) | Sharing wishlists and collaborating on gifts and presents. | GPL-3.0 | Docker, Go | 0.2k | +| [re:Director](https://re-director.github.io/) | Simple domain redirection management tool. | Apache-2.0 | Java, Docker | 0.0k | +| [Reactive Resume](https://rxresu.me/) | One-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source and free forever. | MIT | Docker, Nodejs | 40.1k | +| [RemoteUtilities](https://www.remoteutilities.com/) | Remote support software for LAN administration and remote support over the Internet. | ⊘ Proprietary | Unknown | — | +| [revealjs](https://revealjs.com) | Framework for easily creating beautiful presentations using HTML. | MIT | Javascript | 72.1k | +| [Revive Adserver](https://www.revive-adserver.com/) | Ad serving system. Formerly known as OpenX Adserver and phpAdsNew. | GPL-2.0 | PHP | 1.5k | +| [SANE Network Scanning](http://sane-project.org/) | Allow remote clients to access image acquisition devices (scanners) available on the local host. | GPL-2.0 | C | — | +| [ScreenConnect](https://www.screenconnect.com/) | Lightning-fast remote support and remote access to connect instantly and solve problems faster. | ⊘ Proprietary | Unknown | — | +| [string.is](https://string.is/) | An open-source, privacy-friendly online string toolkit for developers. | AGPL-3.0 | Nodejs | 0.3k | +| [Teleport](https://goteleport.com/) | Certificate authority and access plane for SSH, Kubernetes, web applications, and databases. | Apache-2.0 | Go, Docker, K8S | 20.8k | +| [TeslaMate](https://github.com/teslamate-org/teslamate) | A powerful data logger for Tesla vehicles. | MIT | Elixir, Docker | 8.8k | +| [Transmute](https://transmute.sh) | File converter for images, video, audio, json, excel and more. Supports over 2,000 conversions!. | MIT | Docker | 1.3k | +| [URL-to-PNG](https://github.com/jasonraimondi/url-to-png) | URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. | MIT | Nodejs, Docker | 0.3k | +| [Usertour](https://www.usertour.io/) | User onboarding platform allowing you to create in-app product tours, checklists, and surveys in minutes effortlessly. | AGPL-3.0 | Docker | 2.1k | +| [Warracker](https://warracker.com) | Warranty tracker that lets you monitor expiry dates, upload receipts/files, and get alerts before warranties expire. | AGPL-3.0 | Docker | 1.5k | +| [Wavelog](https://www.wavelog.org) | Webbased Logging Software for Radio Amateurs. Enhanced QSO logging, statistics and maps for your browser. | MIT | PHP, Docker | 0.5k | +| [WeeWX](https://weewx.com/) | Open source software for your weather station. | GPL-3.0 | Python, deb | 1.2k | +| [WeTTY](https://butlerx.github.io/wetty/#/) | Terminal in browser over http/https. | MIT | Docker, Nodejs | 5.4k | +| [Wishlist](https://github.com/cmintey/wishlist) | Wishlist application that you can share with your friends and family. | MIT | Docker, K8S | 0.6k | +| [Yamtrack](https://github.com/FuzzyGrim/Yamtrack) | Media tracker for movies, tv shows, anime, manga, video games and books. | AGPL-3.0 | Docker, Python | 3.3k | +| [Zero-TOTP](https://zero-totp.com) | Complete, reliable, secure and zero-trust webapp based on zero-knowledge encryption to store your TOTP codes. | GPL-3.0 | Docker | 0.0k | + diff --git a/docs/selfhosted/catalog/produtividade.md b/docs/selfhosted/catalog/produtividade.md new file mode 100644 index 0000000..4eebc1e --- /dev/null +++ b/docs/selfhosted/catalog/produtividade.md @@ -0,0 +1,325 @@ +# Self-hosted — Produtividade e conhecimento + +Notas, wikis, gestão documental, suítes de escritório, tarefas, bookmarks, calendário, dashboards. + +**227 projetos** nesta categoria. + +> **Fonte:** [awesome-selfhosted/awesome-selfhosted-data](https://github.com/awesome-selfhosted/awesome-selfhosted-data) · **Licença:** [CC-BY-SA 3.0 Unported](https://creativecommons.org/licenses/by-sa/3.0/) · **Autores:** [AUTHORS](https://github.com/awesome-selfhosted/awesome-selfhosted-data/blob/master/AUTHORS) upstream. +> Arquivo **gerado** por `scripts/sync-selfhosted.js`. Não edite à mão — as edições se perdem na próxima sincronização. + +[← Voltar ao índice](../INDEX.md) · [Shortlist SaaS](../shortlist-saas.md) + +--- + +## Bookmarks and Link Sharing + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [42links](https://42links.tuxproject.de) | Bookmarking server supporting multiple accounts. | BSD-3-Clause-No-Military-License | CommonLisp | — | +| [Betula](https://joinbetula.org) | Single-user federated bookmark manager with Fediverse support and archives. | AGPL-3.0 | Go | — | +| [Buku](https://github.com/jarun/Buku) | Powerful bookmark manager and a personal textual mini-web. | GPL-3.0 | Python, deb | 7.2k | +| [Digibunch](https://ladigitale.dev/digibunch/#/) | Create bunches of links to share with your learners or colleagues. | AGPL-3.0 | Nodejs, PHP | — | +| [Espial](https://github.com/jonschoning/espial) | An open-source, web-based bookmarking server. | AGPL-3.0 | Haskell | 0.9k | +| [Faved](https://faved.to/) | Handcrafted bookmark manager combining powerful tagging, instant search, and a clean, distraction-free interface. Built for large collections and advanced workflows, optimized for efficiency and ease-of-use. | MIT | Docker | 1.2k | +| [Firefox Account Server](https://mozilla-services.readthedocs.io/en/latest/howtos/run-fxa.html) | Host your own Firefox accounts server. | MPL-2.0 | Nodejs, Java | 0.7k | +| [Karakeep](https://karakeep.app/) | Bookmark-everything app with a touch of AI for the data hoarders out there. | AGPL-3.0 | Docker | 28.2k | +| [LinkAce](https://www.linkace.org/) | Bookmark archive with automatic backups to the Internet Archive, link monitoring, and a full REST API. Installation is done via Docker, or as a simple PHP application. | GPL-3.0 | Docker, PHP | 3.3k | +| [linkding](https://linkding.link/) | Minimal bookmark management with a fast and clean UI. Simple installation through Docker and can run on your Raspberry Pi. | MIT | Docker | 11.0k | +| [LinkWarden](https://linkwarden.app/) | Bookmark and archive manager to store your useful links. | MIT | Docker, Nodejs | 19.4k | +| [NeonLink](https://github.com/AlexSciFier/neonlink) | Bookmark service with unique design and simple installation with Docker. | MIT | Docker | 0.4k | +| [Readeck](https://readeck.org/en/) | Save the precious readable content of web pages you like and want to keep forever. See it as a bookmark manager and a read later tool. | AGPL-3.0 | Go, Docker | — | +| [Servas](https://github.com/beromir/Servas) | A self-hosted bookmark management tool. It allows organization with tags, groups, and a list specifically for later access. It supports multiple users with 2FA. Companion browser extensions are available for Firefox and Chrome. | GPL-3.0 | Docker, Nodejs, PHP | 0.8k | +| [Shaarli](https://github.com/shaarli/Shaarli) | Personal, minimalist, super-fast, no-database bookmarking and link sharing platform. | Zlib | PHP, deb | 3.9k | +| [Shiori](https://github.com/go-shiori/shiori) | Simple bookmark manager built with Go. | MIT | Go, Docker | 11.6k | +| [Slash](https://github.com/yourselfhosted/slash) | An open source, self-hosted bookmarks and link sharing platform. | GPL-3.0 | Docker | 3.2k | +| [SyncMarks](https://codeberg.org/Offerel/SyncMarks-Webapp) | Sync and manage your browser bookmarks from Edge, Firefox and Chromium. | AGPL-3.0 | PHP | — | + +## Calendar & Contacts + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Baïkal](https://sabre.io/baikal/) | Lightweight CalDAV and CardDAV server based on sabre/dav. | GPL-3.0 | PHP | 3.3k | +| [DAViCal](https://www.davical.org/) | Server for calendar sharing (CalDAV) that uses a PostgreSQL database as a data store. | GPL-2.0 | PHP, deb | 0.1k | +| [Davis](https://github.com/tchapi/davis) | A simple, dockerizable and fully translatable admin interface for sabre/dav based on Symfony 5 and Bootstrap 4, largely inspired by Baïkal. | MIT | PHP | 0.7k | +| [Keeper.sh](https://keeper.sh/) | Calendar syncing tool that pulls and pushes events between calendar sources and destinations via iCal/ICS or OAuth, with support for anonymized busy/free events. | AGPL-3.0 | Docker | 1.2k | +| [Manage My Damn Life](https://intri.in/manage-my-damn-life/) | Manage my Damn Life (MMDL) is a self-hosted front end for managing your CalDAV tasks and calendars. | GPL-3.0 | Nodejs, Docker | 0.6k | +| [Radicale](https://radicale.org/) | Simple calendar and contact server with extremely low administrative overhead. | GPL-3.0 | Python, deb | 4.9k | +| [SabreDAV](https://sabre.io/) | Open source CardDAV, CalDAV, and WebDAV framework and server. | MIT | PHP | 1.7k | +| [Xandikos](https://github.com/jelmer/xandikos) | Open source CardDAV and CalDAV server with minimal administrative overhead, backed by a Git repository. | GPL-3.0 | Python, deb | 0.6k | + +## Document Management + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [BentoPDF](https://bentopdf.com) | Powerful, privacy-first, client-side PDF toolkit that allows you to manipulate, edit, merge, and process PDF files directly in your browser. | AGPL-3.0 | Nodejs, Docker | 14.6k | +| [Docspell](https://docspell.org) | Auto-tagging document organizer and archive. | GPL-3.0 | Scala, Java, Docker | 2.3k | +| [Documenso](https://documenso.com) | Digital document signing platform (alternative to DocuSign). | AGPL-3.0 | Nodejs, Docker | 14.3k | +| [Docuseal](https://www.docuseal.co) | Create, fill, and sign digital documents (alternative to DocuSign). | AGPL-3.0 | Docker | 18.2k | +| [EveryDocs](https://github.com/jonashellmann/everydocs-core) | Simple Document Management System for private use with basic functionality to organize your documents digitally. | GPL-3.0 | Docker, Ruby | 0.4k | +| [Gotenberg](https://gotenberg.dev) | Developer-friendly API to interact with powerful tools like Chromium and LibreOffice for converting numerous document formats (HTML, Markdown, Word, Excel, etc.) into PDF files, and more. | MIT | Docker | 12.8k | +| [I, Librarian](https://i-librarian.net) | Organize PDF papers and office documents. It provides a lot of extra features for students and research groups both in industry and academia. | GPL-3.0 | PHP | 0.3k | +| [Mayan EDMS](https://www.mayan-edms.com) | Electronic document management system for your documents with preview generation, OCR, and automatic categorization among other features. | GPL-2.0 | Docker, K8S | 0.7k | +| [OpenSign](https://www.opensignlabs.com) | Document signing software (alternative to DocuSign). | AGPL-3.0 | Nodejs, Docker | 6.8k | +| [Paperless-ngx](https://docs.paperless-ngx.com/) | Scan, index, and archive all of your paper documents with an improved interface (fork of Paperless). | GPL-3.0 | Python, Docker | 44.1k | +| [Papermerge](https://papermerge.com) | Document management system focused on scanned documents (electronic archives). Features file browsing in similar way to dropbox/google drive. OCR, full text search, text overlay/selection. | Apache-2.0 | Docker, K8S | 0.5k | +| [Papra](https://papra.app) | Minimalist document storage, management and archiving platform designed to be simple to use and accessible to everyone. | AGPL-3.0 | Docker | 5.2k | +| [PdfDing](https://www.pdfding.com) | PDF manager, viewer and editor offering a seamless user experience on multiple devices. It's designed to be minimal, fast, and easy to set up using Docker. | AGPL-3.0 | Docker, K8S | 1.8k | +| [SeedDMS](https://www.seeddms.org) | Document Management System with workflows, access rights, fulltext search, and more. | GPL-2.0 | PHP | — | +| [Signature PDF](https://github.com/24eme/signaturepdf) | Sign and manipulate PDFs with collaboration, organization, compression and metadata editing. | AGPL-3.0 | PHP, deb, Docker | 0.8k | +| [SimpleDMS](https://simpledms.eu) | Easy-to-use, metadata-driven, open-source document management system (DMS) for small businesses that sorts documents almost by itself. | AGPL-3.0 | Docker | 0.2k | +| [Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF) | Local hosted web application that allows you to perform various operations on PDF files, such as merging, splitting, file conversions and OCR. | Apache-2.0 | Docker, Java | 89.1k | + +## Document Management - E-books + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Atsumeru](https://atsumeru.xyz) | Manga/comic/light novel media server with clients for Windows, Linux, macOS and Android. | MIT | Java, Docker | 0.2k | +| [Bindery](https://github.com/jarynclouatre/bindery) | Folder-watching converter for e-books and comics. EPUB to Kobo KEPUB via kepubify, CBZ/CBR/PDF via Kindle Comic Converter, with per-device profiles, ComicInfo.xml naming, chapter-to-volume bundling and a web UI. | MIT | Docker | 0.1k | +| [BookLogr](https://github.com/Mozzo1000/booklogr) | Manage your personal book library with ease. | Apache-2.0 | Docker | 0.6k | +| [Bookwyrm](https://joinbookwyrm.com/) | Social network for tracking your reading, talking about books, writing reviews, and discovering what to read next. | ⊘ Proprietary | Python | 2.8k | +| [Calibre](https://calibre-ebook.com/) | E-book library manager that can view, convert, and catalog e-books in most of the major e-book formats and provides a built-in Web server for remote clients. | GPL-3.0 | Python, deb | 25.6k | +| [Calibre Web](https://github.com/janeczku/calibre-web) | Browse, read and download eBooks using an existing Calibre database. | GPL-3.0 | Python | 17.8k | +| [Calibre Web Automated](https://github.com/crocodilestick/Calibre-Web-Automated) | All-in-one solution, combining the modern lightweight web UI from Calibre-Web with the robust, versatile feature set of Calibre (fork of Calibre Web). | GPL-3.0 | Docker | 6.1k | +| [Inkheart](https://gitlab.com/Nystik/inkheart) | Lightweight PDF library and reader. | Apache-2.0 | Docker | 0.0k | +| [Kapowarr](https://casvt.github.io/Kapowarr/) | Build and manage a comic book library. Download, rename, move and convert issues of the volume to your liking. | GPL-3.0 | Docker, Python | 1.0k | +| [Kavita](https://www.kavitareader.com/) | Cross-platform e-book/manga/comic/pdf server and web reader with user management, ratings and reviews, and metadata support. | GPL-3.0 | .NET, Docker | 11.4k | +| [kiwix-serve](https://github.com/kiwix/kiwix-tools) | HTTP daemon for serving wikis from ZIM files. | GPL-3.0 | C++ | 0.9k | +| [Komga](https://komga.org) | Media server for comics/mangas/BDs with API and OPDS support, a modern web interface for exploring your libraries, as well as a web reader. | MIT | Java, Docker | 6.5k | +| [MyMangaDB](https://github.com/FabianRolfMatthiasNoll/MyMangaDB) | Manga collection manager with automatic metadata, MyAnimeList import and detailed collection statistics. | GPL-3.0 | Docker | 0.0k | +| [Stump](https://www.stumpapp.dev) | A fast, free and open source comics, manga and digital book server with OPDS support. | MIT | Rust | 2.6k | +| [Ubooquity](https://vaemendis.net/ubooquity/) | Free to use, versatile, lightweight, multi-platform, and secure home server for your comic and e-book library. | ⊘ Proprietary | Java | — | + +## Document Management - Institutional Repository and Digital Library Software + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [DSpace](http://www.dspace.org/) | Turnkey repository application providing durable access to digital resources. | BSD-3-Clause | Java | 1.1k | +| [EPrints](https://www.eprints.org/) | Digital document management system with a flexible metadata and workflow model primarily aimed at academic institutions. | GPL-3.0 | Perl | 0.0k | +| [Fedora Commons Repository](https://wiki.lyrasis.org/display/FF/Fedora+Repository+Home) | Robust and modular repository system for the management and dissemination of digital content especially suited for digital libraries and archives, both for access and preservation. | Apache-2.0 | Java | 0.3k | +| [InvenioRDM](https://inveniordm.docs.cern.ch/) | Highly scalable turn-key research data management platform with a beautiful user experience. | MIT | Python | 0.2k | +| [Islandora](https://www.islandora.ca/) | Drupal module for browsing and managing Fedora-based digital repositories. | GPL-3.0 | PHP | 0.2k | +| [Samvera Hyrax](https://samvera.org/) | Front-end for the Samvera framework, which itself is a Ruby on Rails application for browsing and managing Fedora-based digital repositories. | Apache-2.0 | Ruby | 0.2k | + +## Document Management - Integrated Library Systems (ILS) + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Evergreen](https://evergreen-ils.org) | Highly-scalable software for libraries that helps library patrons find library materials, and helps libraries manage, catalog, and circulate those materials. | GPL-2.0 | PLpgSQL | 0.2k | +| [Koha](https://koha-community.org/) | Enterprise-class ILS with modules for acquisitions, circulation, cataloging, label printing, offline circulation for when Internet access is not available, and much more. | GPL-3.0 | Perl | 0.6k | +| [RERO ILS](https://rero21.ch/) | Large-scale ILS that can be run as a service with consortial features, intended primarily for library networks. Includes most standard modules (circulation, acquisitions, cataloging,...) and a web-based public and professional interface. | AGPL-3.0 | Python, Docker | 0.1k | + +## Groupware + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Citadel](https://www.citadel.org/) | Groupware including email, calendar/scheduling, address books, forums, mailing lists, IM, wiki and blog engines, RSS aggregation and more. | GPL-3.0 | C, Docker, Shell | — | +| [Colanode](https://colanode.com) | Collaboration suite with real-time messaging, rich text pages, file management, and dynamic databases - built for offline work (alternative to Slack, Notion). | Apache-2.0 | K8S, Docker | 5.0k | +| [Cozy Cloud](https://cozy.io/) | Personal cloud where you can manage and sync your files, notes, contacts, passwords, and documents. | GPL-3.0 | Nodejs | — | +| [Digipad](https://digipad.app/) | An online self-hosted application for creating collaborative digital notepads (Documentation in french). | AGPL-3.0 | Nodejs | — | +| [Digistorm](https://digistorm.app/) | Create collaborative surveys, quizzes, brainstorms, and word clouds (documentation in French). | AGPL-3.0 | Nodejs | — | +| [Digiwall](https://digiwall.app/) | Create multimedia collaborative walls for in-person or remote work (documentation in French). | AGPL-3.0 | Nodejs | — | +| [egroupware](https://www.egroupware.org/) | Software suite including calendars, address books, notepad, project management tools, client relationship management tools (CRM), knowledge management tools, a wiki and a CMS. | GPL-2.0 | PHP | 0.3k | +| [Group Office](https://www.group-office.com) | Enterprise CRM and groupware tool. Share projects, calendars, files and e-mail online with co-workers and clients. | AGPL-3.0 | PHP | 0.3k | +| [Openmeetings](https://openmeetings.apache.org/index.html) | Video conferencing, instant messaging, whiteboard, collaborative document editing and other groupware tools using API functions of the Red5 Streaming Server for Remoting and Streaming. | Apache-2.0 | Java | 0.7k | +| [SOGo](https://www.sogo.nu/) | SOGo offers multiple ways to access the calendaring and messaging data. CalDAV, CardDAV, GroupDAV, as well as ActiveSync, including native Outlook compatibility and Web interface. | LGPL-2.1 | Objective-C | 2.1k | +| [Tine](https://www.tine-groupware.de/) | Software for digital collaboration in companies and organizations. From powerful groupware functionalities to clever add-ons, tine combines everything to make daily team collaboration easier. | AGPL-3.0 | Docker | 0.0k | +| [Tracim](https://github.com/tracim/tracim) | Collaborative Platform for team collaboration: file,threads,notes,agenda,etc. | AGPL-3.0, LGPL-3.0, MIT | Python | 0.3k | +| [Zimbra Collaboration](https://www.zimbra.com/) | Email, calendar, collaboration server with Web interface and lots of integrations. | GPL-2.0, CPAL-1.0 | Java | — | + +## Knowledge Management Tools + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [AFFiNE Community Edition](https://affine.pro/) | Next-gen knowledge base that brings planning, sorting and creating all together. Privacy first, customizable and ready to use (alternative to Notion and Miro). | MIT, AGPL-3.0 | Docker | 71.3k | +| [Atomic Server](https://atomicserver.eu/) | Knowledge graph database with documents (similar to Notion), tables, search, and a powerful linked data API. Lightweight, very fast and no runtime dependencies. | MIT | Docker, Rust | 1.6k | +| [Digimindmap](https://ladigitale.dev/digimindmap/#/) | Create simple mindmaps (documentation in French). | AGPL-3.0 | Nodejs, PHP | — | +| [LibreKB](https://librekb.com/) | Web-based knowledge base solution. A simple web app, it runs on pretty much any web server or hosting provider with PHP and MySQL. | GPL-3.0 | PHP | 0.1k | +| [memEx](https://codeberg.org/shibao/memEx) | Structured personal knowledge base, inspired by zettlekasten and org-mode. | AGPL-3.0 | Docker | — | +| [SiYuan](https://b3log.org/siyuan/) | A privacy-first personal knowledge management software, written in typescript and golang. | AGPL-3.0 | Docker, Go | 45.7k | +| [TeamMapper](https://github.com/b310-digital/teammapper) | Host and create your own mindmaps. Share your mindmap sessions with your team and collaborate live on mindmaps. | MIT | Docker, Nodejs | 0.5k | +| [Wiznote](https://www.wiz.cn/docker) | Manage your knowledge in documents with folders, markdown, full text search and webpage collection support. | ⊘ Proprietary | Docker | — | + +## Note-taking & Editors + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Blinko](https://blinko.space/) | A personal note tool with AI features. | AGPL-3.0 | Docker | 10.8k | +| [DailyTxT](https://github.com/PhiTux/DailyTxT) | Encrypted diary Web application to save your personal memories of each day. Includes a search function and encrypted file upload. | MIT | Docker | 0.5k | +| [Docs](https://docs.numerique.gouv.fr/) | Collaborative note taking, wiki and documentation platform that scales. | MIT | K8S | 16.7k | +| [draw.io](https://draw.io) | Diagram software for making flowcharts, process diagrams, org charts, UML, ER and network diagrams. | Apache-2.0 | Javascript, Docker | 7.4k | +| [flatnotes](https://github.com/dullage/flatnotes) | Database-less note-taking web app that utilises a flat folder of markdown files for storage. | MIT | Docker | 3.2k | +| [HedgeDoc](https://hedgedoc.org/) | Realtime collaborative markdown notes on all platforms, formerly known as CodiMD and HackMD CE. | AGPL-3.0 | Docker, Nodejs | 7.4k | +| [Joplin](https://joplinapp.org/) | Note taking application with markdown editor and encryption support for mobile and desktop platforms. Runs client-side and syncs through a self hosted Nextcloud instance or similar (alternative to Evernote). | MIT | Nodejs | 55.9k | +| [Jotty](https://jotty.page) | Lightweight but powerful alternative for managing your personal, file based, notes and checklists. | AGPL-3.0 | Docker | 2.0k | +| [Livebook](https://livebook.dev) | Realtime collaborative notebook app based on Markdown that supports running Elixir code snippets, TeX and Mermaid Diagrams. Easily deployed using Docker or Elixir. | Apache-2.0 | Elixir, Docker | 5.8k | +| [Many Notes](https://github.com/brufdev/many-notes) | Markdown note-taking web application designed for simplicity. | MIT | Docker | 1.0k | +| [Memos](https://usememos.com/) | Knowledge base that works with a SQLite db file. | MIT | Docker, Go | 62.1k | +| [Note Mark](https://notemark.docs.enchantedcode.co.uk/) | Minimal web-based Markdown notes app. | AGPL-3.0 | Docker | 0.8k | +| [Overleaf](https://www.overleaf.com/) | Web-based collaborative LaTeX editor. | AGPL-3.0 | Ruby | 18.0k | +| [Plainpad](https://alextselegidis.com/get/plainpad/) | Modern note taking application for the cloud, utilizing the best features of progressive web apps technology. | GPL-3.0 | PHP | 0.4k | +| [plumio](https://plumio.app/) | Markdown notes taking app with live preview, document encryption, multi-user support, multi-organization capabilities and more. | AGPL-3.0 | Nodejs, Docker | 0.1k | +| [SilverBullet](https://silverbullet.md/) | Note-taking application optimized for people with a hacker mindset. | MIT | Docker, Deno | 5.8k | +| [Standard Notes](https://docs.standardnotes.com/self-hosting/getting-started) | Simple and private notes app. Protect your privacy while getting more done. That's Standard Notes. | GPL-3.0 | Ruby | 6.6k | +| [TriliumNext Notes](https://github.com/TriliumNext/Trilium) | Cross-platform hierarchical note taking application with focus on building large personal knowledge bases (fork of Trilium Notes). | AGPL-3.0 | Nodejs, Docker, K8S | 37.3k | +| [Turtl](https://turtl.it/) | Totally private personal database and note taking app. | GPL-3.0 | CommonLisp | — | +| [Writing](https://josephernest.github.io/writing/) | Lightweight distraction-free text editor, in the browser (Markdown and LaTeX supported). No lag when writing. | MIT | Javascript | 1.1k | + +## Office Suites + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Collabora Online Development Edition](https://www.collaboraoffice.com/code) | Collabora Online Development Edition (CODE) is a powerful LibreOffice-based online office that supports all major document, spreadsheet and presentation file formats, which you can integrate in your own infrastructure. | MPL-2.0 | C++ | — | +| [CryptPad](https://cryptpad.org) | Collaboration suite built to enable collaboration, synchronizing changes to documents in real time. | AGPL-3.0 | Nodejs, Docker | 7.8k | +| [Digislides](https://ladigitale.dev/digislides/) | Create multimedia presentations in a quick and easy way. (documentation in French). | AGPL-3.0 | Nodejs, PHP | — | +| [Etherpad](https://etherpad.org/) | Highly customizable online editor providing collaborative editing in real-time. | Apache-2.0 | Nodejs, Docker | 18.5k | +| [Grist](https://getgrist.com/) | Next-generation spreadsheet with relational structure, formula-based access control, and a portable, self-contained format (alternative to Airtable). | Apache-2.0 | Nodejs, Python, Docker | 11.4k | +| [ONLYOFFICE](https://helpcenter.onlyoffice.com/faq/server-opensource.aspx) | Office suite that enables you to manage documents, projects, team and customer relations in one place. | AGPL-3.0 | Nodejs, Docker | 6.8k | + +## Pastebins + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [1time](https://1time.io) | Zero-knowledge one-time secret sharing. Create a one-time link for a password, API key, or file. Encrypted client-side in the browser, never reaches the server in plaintext, self-destructs after the allowed number of views (one by default). | MIT | Docker | — | +| [BinPastes](https://github.com/querwurzel/BinPastes) | Minimal pastebin supporting client-side encryption, fulltext search, one-time messages. Intended for one to few users looking for a simple pastebin deployment. | Apache-2.0 | Java | 0.0k | +| [ByteStash](https://github.com/jordan-dalby/ByteStash) | Pastebin and file storage service with a simple web interface. Supports syntax highlighting, optional user authentication and public sharing. | GPL-3.0 | Docker | 2.5k | +| [Chiyogami](https://github.com/rhee876527/chiyogami) | Pastebin with API, client-side encryption, user accounts, syntax highlighting, markdown rendering, and more. | BSD-3-Clause | Docker | 0.1k | +| [dpaste](https://dpaste.org/) | Simple pastebin with multiple text and code option, with short url result easy to remember. | MIT | Docker, Python | 0.6k | +| [Hemmelig](https://hemmelig.app) | Share encrypted secrets cross organizations, or as private persons. | MIT | Docker, Nodejs | 1.2k | +| [lesma](https://lesma.eu) | Simple paste app friendly with browser and command line. | GPL-3.0 | Rust, Docker | 0.0k | +| [Local Content Share](https://github.com/Tanq16/local-content-share) | Store and share text snippets and files within your local network. | MIT | Docker, Go | 0.5k | +| [not-th.re](https://not-th.re) | Simple paste sharing platform, with client side encryption, featuring the monaco browser-based code editor. | AGPL-3.0 | Nodejs, Docker | 0.0k | +| [Opengist](https://opengist.io) | Pastebin powered by Git. | AGPL-3.0 | Docker, Go, Nodejs | 3.3k | +| [paaster](https://paaster.io) | End-to-end encrypted pastebin built with the objective of simplicity. | AGPL-3.0 | Docker | 0.6k | +| [pacebin](https://git.crueter.xyz/crueter/pacebin) | Super-minimal pastebin and file upload service focusing on small executable size, portability, and ease of configuration. | AGPL-3.0 | C | — | +| [Password Pusher](https://pwpush.com) | Dead-simple application to securely communicate passwords (or text) over the web. Passwords automatically expire after a certain number of views and/or time has passed. | Apache-2.0 | Docker, K8S, Ruby | 3.1k | +| [Pastefy](https://pastefy.app/) | Beautiful, simple and easy to deploy Pastebin with optional client encryption, multitab pastes, an API, a highlighted editor and more. | MIT | Docker, K8S, Java | 0.4k | +| [PrivateBin](https://privatebin.info/) | Minimalist pastebin/discussion board where the server has zero knowledge of hosted data. | Zlib | PHP | 8.5k | +| [rustypaste](https://github.com/orhun/rustypaste) | Minimal file upload/pastebin service. | MIT | Rust | 1.2k | +| [Snipo](https://github.com/MohamedElashri/snipo) | Lightweight, self‑hosted snippet manager for saving and organizing code and text snippets with folders, tags, API, and GitHub Gist sync. | AGPL-3.0 | Go, Docker | 0.1k | +| [SnyPy](https://snypy.com) | Open source on-prem code snippet manager. | MIT | Docker | — | +| [Sup3rS3cretMes5age](https://github.com/algolia/sup3rS3cretMes5age) | Very simple (to deploy and to use) secret message service using Hashicorp Vault as a secrets storage. | MIT | Go | 0.6k | +| [Wastebin](https://github.com/matze/wastebin) | Lightweight, minimal and fast pastebin with an SQLite backend. | MIT | Rust, Docker | 0.8k | +| [Yopass](https://github.com/jhaals/yopass) | Secure sharing of secrets, passwords and files. | Apache-2.0 | Go, Docker | 3.1k | + +## Personal Dashboards + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Dashy](https://dashy.to/) | Feature-rich homepage for your homelab, with easy YAML configuration. | MIT | Nodejs, Docker | 26.1k | +| [Glance](https://github.com/glanceapp/glance) | Highly customizable dashboard that puts all your feeds in one place. | AGPL-3.0 | Docker, Go | 36.2k | +| [gobookmarks](https://github.com/arran4/gobookmarks) | Landing page to display bookmarks stored in GitHub, GitLab or local Git. | AGPL-3.0 | Go, Docker | 0.0k | +| [Heimdall](https://heimdall.site/) | Elegant solution to organise all your web applications. | MIT | PHP | 9.3k | +| [Hiccup](https://designedbyashw.in/test/hiccup/) | Beautiful static homepage to get to your links and services quickly. It has built-in search, editing, PWA support and localstorage caching to easily organize your start page. | MIT | Javascript, Docker | 0.2k | +| [Homarr](https://homarr.dev) | Sleek, modern dashboard with many integrations and web-based config. | MIT | Docker, Nodejs | 4.5k | +| [Homepage by gethomepage](https://github.com/gethomepage/homepage) | Highly customizable homepage (or startpage / application dashboard) with Docker and service API integrations. | GPL-3.0 | Docker, Nodejs | 31.9k | +| [Homepage by tomershvueli](https://github.com/tomershvueli/homepage) | Simple, standalone, self-hosted PHP page that is your window to your server and the web. | MIT | PHP | 0.3k | +| [Homer](https://github.com/bastienwirtz/homer) | Dead simple static homepage to expose your server services, with an easy yaml configuration and connectivity check. | Apache-2.0 | Docker, K8S, Nodejs | 11.5k | +| [Hubleys](https://github.com/knrdl/hubleys-dashboard) | Personal dashboards to organize links for multiple users via a central yaml config. | MIT | Docker | 0.1k | +| [LinkStack](https://linkstack.org/) | Link all your social media platforms easily accessible on one page, customizable through an intuitive, easy to use user/admin interface (alternative to Linktree and Manylink). | AGPL-3.0 | PHP, Docker | 3.7k | +| [LittleLink](https://littlelink.io/) | Simplistic approach for links in bio with 100+ branded buttons (alternative to Linktree). | MIT | Javascript | 3.0k | +| [Mafl](https://mafl.hywax.space/) | Minimalistic flexible homepage. | MIT | Docker, Nodejs | 0.8k | +| [Nimbus](https://nimbus.turboot.com/) | Modern drag-and-drop homelab dashboard with visual editor and simple configuration. | AGPL-3.0 | Docker | 0.1k | +| [Personal Management System](https://volmarg.github.io/) | Organize the essentials of everyday life, everything from a simple to-do list, and notes up to payments, and schedules. | MIT | Docker | 4.1k | +| [portkey](https://portkey.page) | Simple web portal that serves as a startup page, displaying a compilation of links and URLs, while also allowing the addition of custom pages, all managed through a single configuration file. | AGPL-3.0 | Go, Docker | 0.2k | +| [ryot](https://github.com/ignisda/ryot) | Track various facets of your life - media, fitness, etc. | GPL-3.0 | Docker | 3.5k | +| [Starbase 80](https://github.com/notclickable-jordan/starbase-80) | A simple homepage with an iPad-style application grid, for mobile and desktop. One JSON configuration file. | MIT | Docker | 0.6k | +| [Your Spotify](https://github.com/Yooooomi/your_spotify) | Allows you to record your Spotify listening activity and have statistics about them served through a Web application. | MIT | Nodejs, Docker | 4.5k | + +## Recipe Management + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [Bar Assistant](https://barassistant.app/) | Manage your home bar while adding your ingredients, searching for cocktails and creating custom cocktail recipes. | MIT | PHP, Docker | 1.1k | +| [CookCLI](https://cooklang.org) | Command-line tool for automating meal planning and shopping with Cooklang recipes, scriptable for UNIX workflows, includes web server. | MIT | Rust | 1.4k | +| [Fork Recipes](https://mikebgrep.github.io/forkapi/latest/clients/) | Manage your food recipes with simplicity. | BSD-3-Clause | Docker | 0.1k | +| [ManageMeals](https://managemeals.com/) | Manage recipes, import recipes by URL and organize them without any ads or unnecessary text. | GPL-3.0 | Docker | 0.1k | +| [Mealie](https://nightly.mealie.io/) | Material design inspired recipe manager with category and tag management, shopping-lists, meal-planner, and site customizations. Mealie is focused on simple user interactions to keep the whole family using the app. | MIT | Python | 12.9k | +| [RecipeSage](https://github.com/julianpoy/recipesage) | A recipe keeper, meal plan organizer, and shopping list manager that can import recipes directly from any URL. | AGPL-3.0 | Nodejs | 0.9k | +| [Recipya](https://recipes.musicavis.ca) | Clean, simple and powerful recipe manager your whole family will enjoy. | GPL-3.0 | Docker, Go | 0.4k | +| [Tamari](https://tamariapp.com) | Recipe manager web app with a built-in collection of recipes. Organize by favorites and categories, create shopping lists, and plan meals. | GPL-3.0 | Docker, Python | 0.1k | +| [Tandoor Recipes](https://docs.tandoor.dev/) | Django application to manage, tag and search recipes using either built-in models or external storage providers hosting PDFs, Images or other files. | MIT, Commons-Clause | Python, Docker, K8S | 8.5k | +| [Vanilla Cookbook](https://vanilla-cookbook.readthedocs.io/en/) | Recipe manager designed with complexity under the hood, keeping the user experience as uncluttered, simply vanilla as possible. | GPL-3.0 | Docker, Nodejs | 0.2k | +| [What To Cook?](https://github.com/kassner/whattocook) | Get a recipe to cook today, based on the ingredients you have at home. | AGPL-3.0 | Docker | 0.1k | + +## Task Management & To-do Lists + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [4ga Boards](https://4gaboards.com) | Straightforward realtime kanban boards management for intuitive task tracking. Featuring an elegant dark mode, collapsible todo lists, and multitasking tools to supercharge your team's productivity. | MIT | Nodejs, Docker, K8S | 0.7k | +| [AppFlowy](https://appflowy.io/) | Build detailed lists of to-do’s for different projects while tracking the status of each one. Open Source Notion Alternative. | AGPL-3.0 | Rust, Dart, Docker | 75.1k | +| [dayGLANCE](https://dayglance.app) | Day planner with drag-and-drop time blocking, inbox, recurring tasks, habits, routines, goals, projects and Pomodoro focus mode, plus iCal and CalDAV calendar sync. Data stays in the browser, with optional WebDAV or GLANCEvault sync. | MIT | Javascript, Docker | — | +| [Donetick](https://donetick.com) | Task and chore management tool for personal and family use, with advanced scheduling, flexible assignment, and group sharing capabilities, detailed history, automation via API, simple and modern design. | AGPL-3.0 | Go, Docker | 2.4k | +| [Focus Flow](https://github.com/francesco-gaglione/focus_flow_cloud) | Complete ecosystem for time management using the Pomodoro technique. | MIT | Docker, K8S | 0.0k | +| [HamsterBase Tasks](https://tasks.hamsterbase.com) | A tool to help organize ideas and build great things. Plan, organize, build and ship. | AGPL-3.0 | Docker | 0.3k | +| [Kan](https://kan.bn/) | Flexible kanban app that helps you organise work, track progress, and deliver results (alternative to Trello). | AGPL-3.0 | Docker | 5.3k | +| [Kanboard](https://kanboard.org/) | Simple visual task board. | MIT | PHP | 9.8k | +| [Listaway](https://github.com/jeffrpowell/listaway/) | List management app for creating and publicly sharing lists of items. Supports auth, admin tools, item notes and priorities, and opt-in public read-only links with randomized URLs (alternative to Amazon Lists). | MIT | Docker | 0.0k | +| [myTinyTodo](https://www.mytinytodo.net/) | Simple way to manage your todo list in AJAX style. Uses PHP, jQuery, SQLite/MySQL. GTD compliant. | GPL-2.0 | PHP | 0.2k | +| [Nullboard](https://github.com/apankrat/nullboard) | Single-page minimalist kanban board; compact, highly readable and quick to use. | BSD-2-Clause | Javascript | 4.1k | +| [OpenHabitTracker](https://openhabittracker.net) | Track habits, tasks and notes with time tracking, calendar view and completion statistics. | GPL-3.0 | Docker | 0.3k | +| [Our Shopping List](https://codeberg.org/nanawel/our-shopping-list) | Simple shared list application including shopping lists and any other small todo-list that needs to be used collaboratively. | AGPL-3.0 | Docker | — | +| [Planka](https://planka.app/) | Realtime kanban board for workgroups (alternative to Trello). | ⊘ Proprietary | Nodejs, Docker, K8S | 12.3k | +| [Super Productivity](https://super-productivity.com) | Advanced todo list app with integrated timeboxing and time tracking capabilities. Integrates with Jira, GitHub, GitLab, Redmine and OpenProject. | MIT | Docker | 21.2k | +| [Task Keeper](https://github.com/nymanjens/piga) | List editor for power users, backed by a self-hosted server. | Apache-2.0 | Scala | 0.1k | +| [Tasks.md](https://github.com/BaldissaraMatheus/Tasks.md) | A self-hosted, file based task management board that supports Markdown syntax. | MIT | Docker | 2.2k | +| [Taskwarrior](https://taskwarrior.org/) | Taskwarrior is Free and Open Source Software that manages your TODO list from your command line. It is flexible, fast, efficient, and unobtrusive. It does its job then gets out of your way. | MIT | C++ | — | +| [Tracks](https://www.getontracks.org/) | Web-based application to help you implement David Allen’s [Getting Things Done™](https://en.wikipedia.org/wiki/Getting_Things_Done) methodology. | GPL-2.0 | Ruby | 1.2k | +| [tududi](https://tududi.com/) | Task management tool with hierarchical structure, smart recurring tasks, and seamless Telegram integration. | MIT | Docker | 3.2k | +| [Vikunja](https://vikunja.io/) | The to-do app to organize your life. | AGPL-3.0, GPL-3.0 | Go | 5.0k | +| [Wekan](https://wekan.github.io/) | Open-source Trello-like kanban. | MIT | Nodejs | 21.0k | +| [Will Be Done](https://will-be-done.app/) | Offline-first task manager with weekly planning, project boards, real-time sync, Vim keybindings, desktop quick add, and import from popular task managers (alternative to TickTick, Todoist). | AGPL-3.0 | Docker, Nodejs | 0.1k | + +## Time Tracking + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [ActivityWatch](https://activitywatch.net) | Automatically track how you spend time on your devices. | MPL-2.0 | Python | 18.5k | +| [Beaver Habit Tracker](https://github.com/daya0576/beaverhabits) | Habit tracking app to save your precious moments in your fleeting life. | BSD-3-Clause | Docker | 1.8k | +| [Ever Gauzy](https://gauzy.co) | Open business management platform for collaborative, on-demand and sharing economies (ERP/CRM/HRM/ATS/PM). | AGPL-3.0 | Docker, Nodejs | 4.3k | +| [Kimai](https://www.kimai.org/) | Track work time and print out a summary of your activities on demand. | AGPL-3.0 | PHP | 4.9k | +| [solidtime](https://www.solidtime.io) | Modern time tracking application for freelancers and agencies. | AGPL-3.0 | Docker | 8.8k | +| [TimeTagger](https://timetagger.app) | An open source time-tracker based on an interactive timeline and powerful reporting. | GPL-3.0 | Python | 1.8k | +| [Traggo](https://traggo.net/) | Traggo is a tag-based time tracking tool. In Traggo there are no tasks, only tagged time spans. | GPL-3.0 | Docker, Go | 1.6k | +| [Virtual TimeClock](https://www.redcort.com/timeclock) | Powerful, easy-to-use time tracking software. | ⊘ Proprietary | Unknown | — | +| [Wakapi](https://wakapi.dev/) | Tracking tool for coding statistics, compatible with WakaTime. | GPL-3.0 | Go, Docker | 4.4k | +| [Ziit](https://ziit.app) | The Swiss army knife of code time tracking (alternative to WakaTime). | AGPL-3.0 | Docker | 0.2k | + +## Travel Organization + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [AdventureLog](https://adventurelog.app) | Travel tracker and trip planner. | GPL-3.0 | Docker | 3.5k | +| [Surmai](https://surmai.app/) | Collaborative personal and family travel organizer. | MIT | Docker | 0.3k | +| [TRIP](https://itskovacs-trip.netlify.app/) | Minimalist POI Map tracker and Trip planner. | MIT | Docker | 1.8k | + +## Wikis + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [AmuseWiki](https://amusewiki.org/) | Amusewiki is based on the Emacs Muse markup, remaining mostly compatible with the original implementation. It can work as a read-only site, as a moderated wiki, or as a fully open wiki or even as a private site. | GPL-1.0 | Perl, Docker | 0.2k | +| [BookStack](https://www.bookstackapp.com/) | Organize and store information. Stores documentation in a book like fashion. | MIT | PHP, Docker | — | +| [django-wiki](https://github.com/django-wiki/django-wiki) | Wiki system with complex functionality for simple integration and a superb interface. Store your knowledge with style: Use django models. | GPL-3.0 | Python | 1.9k | +| [docmost Community Edition](https://docmost.com/) | Collaborative wiki and documentation software (alternative to Confluence, Notion). | AGPL-3.0 | Docker, Nodejs | 21.3k | +| [Documize](https://documize.com) | Modern Docs + Wiki software with built-in workflow, single binary executable, just bring MySQL/Percona. | AGPL-3.0 | Go | 2.4k | +| [Dokuwiki](https://www.dokuwiki.org/DokuWiki) | Easy to use, lightweight, standards-compliant wiki engine with a simple syntax allowing reading the data outside the wiki. All data is stored in plain text files, therefore no database is required. | GPL-2.0 | PHP | 4.7k | +| [Feather Wiki](https://feather.wiki) | A lightning fast and infinitely extensible tool for creating personal non-linear notebooks, databases, and wikis that is entirely self-contained, runs in your browser, and is only 58 kilobytes in size. | AGPL-3.0 | Javascript | — | +| [Gitit](https://github.com/jgm/gitit) | Wiki program that stores pages and uploaded files in a git repository, which can then be modified using the VCS command line tools or the wiki's web interface. | GPL-2.0 | Haskell | 2.3k | +| [Gollum](https://github.com/gollum/gollum) | Simple, Git-powered wiki with a sweet API and local frontend. | MIT | Ruby | 14.3k | +| [LeafWiki](https://github.com/perber/leafwiki) | A fast wiki for people who think in folders, not feeds. Fast editing. Tree navigation. Markdown on disk. | MIT | Docker, Go | 1.0k | +| [Mediawiki](https://www.mediawiki.org/wiki/MediaWiki) | Wiki software package that powers Wikipedia and all other Wikimedia projects, serving hundreds of millions of users each month. | GPL-2.0 | PHP | — | +| [Mycorrhiza Wiki](https://mycorrhiza.wiki/) | Filesystem and git-based wiki engine written in Go using Mycomarkup as its primary markup language. | AGPL-3.0 | Go | 0.4k | +| [Otter Wiki](https://otterwiki.com/) | Simple, easy to use wiki software using markdown. | MIT | Docker | 1.5k | +| [Outline](https://www.getoutline.com/) | Extensible wiki for your team. | BUSL-1.1 | Nodejs, Docker | 40.0k | +| [PmWiki](https://www.pmwiki.org) | Wiki-based system for collaborative creation and maintenance of websites. | GPL-3.0 | PHP | — | +| [Raneto](https://raneto.com/) | Knowledgebase platform that uses static Markdown files. | MIT | Nodejs | 2.9k | +| [TiddlyWiki](https://tiddlywiki.com/) | Reusable non-linear personal web notebook. | BSD-3-Clause | Nodejs | 8.6k | +| [Tiki](https://tiki.org/HomePage) | Wiki CMS Groupware with the most built-in features. | LGPL-2.1 | PHP | 0.1k | +| [W](https://w.club1.fr) | Lightweight, mutli-user, flat-file-database Wiki engine. Create pages quickly and edit them in your Web browser using Mardown/HTML/CSS/JS. The main difference with other wiki is that you are encouraged to customize each page style individually. | AGPL-3.0 | PHP | 0.1k | +| [WackoWiki](https://wackowiki.org/) | WackoWiki is a light and easy to install multilingual Wiki-engine. | BSD-3-Clause | PHP | 0.1k | +| [Wiki-Go](https://leomoon.com/downloads/web-apps/wiki-go/) | A modern, feature-rich, databaseless flat-file wiki platform. | GPL-3.0 | Go, Docker | 0.6k | +| [Wiki.js](https://js.wiki/) | Modern, lightweight and powerful wiki app using Git and Markdown. | AGPL-3.0 | Nodejs, Docker, K8S | 28.7k | +| [WikiDocs](https://www.wikidocs.app/) | A databaseless markdown flat-file wiki engine. | MIT | PHP, Docker | 0.5k | +| [WiKiss](https://wikiss.tuxfamily.org/) | Wiki, simple to use and install. | GPL-2.0 | PHP | — | +| [XWiki](https://www.xwiki.org) | Second generation wiki that allows the user to extend its functionalities with a powerful extension-based architecture. | LGPL-2.1 | Java, Docker, deb | 1.3k | +| [Zim](https://zim-wiki.org/) | Graphical text editor used to maintain a collection of wiki pages. Each page can contain links to other pages, simple formatting and images. | GPL-2.0 | Python, deb | 2.2k | + diff --git a/docs/selfhosted/catalog/seguranca-identidade.md b/docs/selfhosted/catalog/seguranca-identidade.md new file mode 100644 index 0000000..7d8de72 --- /dev/null +++ b/docs/selfhosted/catalog/seguranca-identidade.md @@ -0,0 +1,25 @@ +# Self-hosted — Segurança e identidade + +Gerenciadores de senha, SSO, identidade federada, gestão de identidade. + +**7 projetos** nesta categoria. + +> **Fonte:** [awesome-selfhosted/awesome-selfhosted-data](https://github.com/awesome-selfhosted/awesome-selfhosted-data) · **Licença:** [CC-BY-SA 3.0 Unported](https://creativecommons.org/licenses/by-sa/3.0/) · **Autores:** [AUTHORS](https://github.com/awesome-selfhosted/awesome-selfhosted-data/blob/master/AUTHORS) upstream. +> Arquivo **gerado** por `scripts/sync-selfhosted.js`. Não edite à mão — as edições se perdem na próxima sincronização. + +[← Voltar ao índice](../INDEX.md) · [Shortlist SaaS](../shortlist-saas.md) + +--- + +## Password Managers + +| Projeto | O que é | Licença | Plataforma | ⭐ | +|---|---|---|---|---| +| [AliasVault](https://www.aliasvault.net) | End-to-end encrypted password manager with a built-in email alias generator and server. | MIT | Docker | 3.0k | +| [Bitwarden](https://bitwarden.com/) | Password manager with a webapp, browser extension, and mobile app. | AGPL-3.0 | Docker, C# | 19.8k | +| [Passbolt](https://www.passbolt.com/) | Collaborative password manager. | AGPL-3.0 | PHP, deb, K8S, Docker | 6.1k | +| [PassIt](https://passit.io/) | Simple password manage with sharing features by group and user, but no administration interface. | AGPL-3.0 | Docker, Python | — | +| [Psono](https://psono.com/) | Password manager for companies. | Apache-2.0 | Python | — | +| [Teampass](https://teampass.net/) | Password manager dedicated for managing passwords in a collaborative way. One symmetric key is used to encrypt all shared/team passwords and stored server side in a file and the database. works on any server Apache, MySQL and PHP. | GPL-3.0 | PHP | 1.8k | +| [Vaultwarden](https://github.com/dani-garcia/vaultwarden) | Lightweight Bitwarden server API implementation written in Rust. | GPL-3.0 | Rust, Docker | 65.1k | + diff --git a/docs/selfhosted/shortlist-saas.md b/docs/selfhosted/shortlist-saas.md new file mode 100644 index 0000000..beafb9e --- /dev/null +++ b/docs/selfhosted/shortlist-saas.md @@ -0,0 +1,230 @@ +# Shortlist self-hosted para SaaS + +As categorias que um fundador de SaaS **de fato** substitui, com alternativas verificadas no [catálogo](INDEX.md). + +Curada à mão. Não é gerada e não é sobrescrita pelo `sync-selfhosted.js`. + +> Nomes e licenças foram extraídos do catálogo, não de memória. Ainda assim: **confirme a licença no upstream antes de adotar.** Ver a [nota de licenças](README.md#licenças-dentro-do-catálogo). + +--- + +## Antes de escolher: o trade-off honesto + +Self-hosted não é "de graça". É **trocar custo de fornecedor por custo de tempo e operação**. + +| | Gerenciado | Self-hosted | +|---|---|---| +| Custo inicial | assinatura desde o dia 1 | servidor + seu tempo | +| Custo em escala | cresce com uso, às vezes muito | cresce com o servidor, mais previsível | +| Tempo até funcionar | minutos | horas a dias, por serviço | +| Quem faz backup | o fornecedor | **você** | +| Quem acorda às 3h | o fornecedor | **você** | +| Quem aplica patch de segurança | o fornecedor | **você** | +| Dados | no fornecedor | seus, onde você escolher | +| Vendor lock-in | real | quase nenhum | +| LGPD / residência de dados | depende do contrato | você controla | + +**Regra prática:** cada serviço auto-hospedado é um serviço que você opera. Um fundador sozinho no Sprint 1 que hospeda oito coisas não está construindo produto — está fazendo SRE. Comece pelo que dói no bolso ou no controle de dados, e mantenha o resto gerenciado até doer. + +O híbrido quase sempre vence: gerenciado para o que é crítico e barato, self-hosted para o que é caro por uso ou sensível em dados. + +--- + +## O que dá para substituir + +### Analytics de produto e web + +| Você paga por | Alternativa | Licença | Atenção | +|---|---|---|---| +| Google Analytics, Fathom | [Plausible Analytics](https://plausible.io/) | AGPL-3.0 | ⚠️ copyleft de rede | +| Google Analytics | [Umami](https://umami.is/) | MIT | — | +| Adobe/GA enterprise | [Matomo](https://matomo.org/) | GPL-3.0 | ⚠️ copyleft | +| Fathom, Simple Analytics | [GoatCounter](https://www.goatcounter.com) | EUPL-1.2 | — | +| Mixpanel, Amplitude | [PostHog](https://posthog.com) | MIT | — | + +Costuma ser a **primeira** troca que vale a pena: barato de hospedar, e resolve LGPD de rastreamento de uma vez. + +### Erros e monitoramento de aplicação + +| Você paga por | Alternativa | Licença | Atenção | +|---|---|---|---| +| Sentry Cloud | [Sentry Self-Hosted](https://github.com/getsentry/self-hosted) | **BUSL-1.1** | ⚠️ **não é código aberto** — fonte disponível com restrição de uso | +| Sentry Cloud | [GlitchTip](https://glitchtip.com) | MIT | compatível com os SDKs do Sentry | +| Bugsnag | [Bugsink](https://www.bugsink.com/) | — | verificar licença no upstream | + +### Suporte e helpdesk + +| Você paga por | Alternativa | Licença | Atenção | +|---|---|---|---| +| Intercom, Crisp | [Chatwoot](https://www.chatwoot.com/) | **⊘ Proprietary** | ⚠️ o upstream marca como proprietário — confirme os termos | +| Zendesk | [Zammad](https://zammad.org/) | AGPL-3.0 | ⚠️ copyleft de rede | +| Help Scout | [FreeScout](https://freescout.net/) | AGPL-3.0 | ⚠️ copyleft de rede | + +### Email transacional e newsletter + +| Você paga por | Alternativa | Licença | Atenção | +|---|---|---|---| +| Mailgun, Postmark | [Postal](https://postalserver.io/) | MIT | 📮 ver aviso abaixo | +| Mailchimp, ConvertKit | [Listmonk](https://listmonk.app) | AGPL-3.0 | ⚠️ copyleft de rede | +| Mailchimp | [Keila](https://www.keila.io) | AGPL-3.0 | ⚠️ copyleft de rede | +| Google Workspace (email) | [Mailu](https://mailu.io/) | MIT | 📮 ver aviso abaixo | + +📮 **Aviso sério sobre email:** hospedar envio é a categoria com maior chance de dar errado de um jeito que você não controla. Reputação de IP, SPF/DKIM/DMARC, blocklists e a política de cada provedor destinatário decidem se sua mensagem chega. Muitos fundadores auto-hospedam a newsletter e mantêm o transacional gerenciado — é uma divisão sensata. + +### Conteúdo, CMS e blog + +| Você paga por | Alternativa | Licença | Atenção | +|---|---|---|---| +| Ghost Pro | [Ghost](https://ghost.org) | MIT | — | +| Contentful, Sanity | [Strapi](https://strapi.io/) | MIT | — | +| Contentful | [Directus](https://directus.io/) | **BUSL-1.1** | ⚠️ **não é código aberto** — restrição de uso comercial | + +### Código, issues e projeto + +| Você paga por | Alternativa | Licença | Atenção | +|---|---|---|---| +| GitHub | [Gitea](https://about.gitea.com/) | MIT | leve | +| GitHub | [Forgejo](https://forgejo.org/) | MIT | fork comunitário do Gitea | +| GitHub Enterprise, Jira | [GitLab](https://gitlab.com/rluna-gitlab/gitlab-ce) | MIT | pesado para começar | + +⚠️ **CI/CD não está no catálogo** — ver [lacunas](#o-que-o-catálogo-não-cobre). + +### Backend / BaaS + +| Você paga por | Alternativa | Licença | Atenção | +|---|---|---|---| +| Firebase, Supabase | [Appwrite](https://appwrite.io) | BSD-3-Clause | — | +| Firebase | [PocketBase](https://pocketbase.io/) | MIT | binário único, ótimo para MVP | + +Supabase **não** está no catálogo, apesar de ser auto-hospedável. + +### Painéis internos e low-code + +| Você paga por | Alternativa | Licença | Atenção | +|---|---|---|---| +| Retool | [Appsmith](https://www.appsmith.com/) | Apache-2.0 | — | +| Retool | [Budibase](https://www.budibase.com) | **⊘ Proprietary** | ⚠️ o upstream marca como proprietário | + +### Feature flags + +| Você paga por | Alternativa | Licença | Atenção | +|---|---|---|---| +| LaunchDarkly | [Flagsmith](https://flagsmith.com/) | BSD-3-Clause | — | + +### Armazenamento de objetos + +| Você paga por | Alternativa | Licença | Atenção | +|---|---|---|---| +| S3, R2 | [GarageHQ](https://garagehq.deuxfleurs.fr/) | AGPL-3.0 | ⚠️ copyleft de rede | +| S3 | [SeaweedFS](https://github.com/seaweedfs/seaweedfs) | Apache-2.0 | — | + +MinIO **não** está no catálogo. + +### BI e dashboards + +| Você paga por | Alternativa | Licença | Atenção | +|---|---|---|---| +| Looker, Mode | [Metabase](https://metabase.com/) | AGPL-3.0 | ⚠️ copyleft de rede | +| Mode, Periscope | [Redash](https://redash.io/) | BSD-2-Clause | — | + +### Busca + +| Você paga por | Alternativa | Licença | Atenção | +|---|---|---|---| +| Algolia | [Typesense](https://typesense.org) | GPL-3.0 | ⚠️ copyleft | +| Elastic Cloud | [ElasticSearch](https://www.elastic.co/elasticsearch/) | — | verificar licença atual no upstream | +| Algolia | [Manticore Search](https://github.com/manticoresoftware/manticoresearch/) | — | verificar upstream | + +Meilisearch **não** está no catálogo. + +### CRM + +| Você paga por | Alternativa | Licença | Atenção | +|---|---|---|---| +| HubSpot, Pipedrive | [EspoCRM](https://www.espocrm.com/) | AGPL-3.0 | ⚠️ copyleft de rede | +| Salesforce | [Corteza](https://docs.cortezaproject.org) | — | verificar upstream | + +### Formulários e pesquisas + +| Você paga por | Alternativa | Licença | Atenção | +|---|---|---|---| +| Typeform | [Formbricks](https://formbricks.com/) | AGPL-3.0 | ⚠️ copyleft de rede | + +### Documentação interna e wiki + +| Você paga por | Alternativa | Licença | Atenção | +|---|---|---|---| +| Notion, Confluence | [Outline](https://www.getoutline.com/) | **BUSL-1.1** | ⚠️ **não é código aberto** | +| Confluence | [BookStack](https://www.bookstackapp.com/) | MIT | — | + +### Automação de fluxos + +| Você paga por | Alternativa | Licença | Atenção | +|---|---|---|---| +| Zapier, Make | [n8n](https://n8n.io) | **Apache-2.0 + Commons-Clause** | ⚠️ a Commons-Clause proíbe vender o software como serviço | + +### Senhas de equipe + +| Você paga por | Alternativa | Licença | Atenção | +|---|---|---|---| +| 1Password, LastPass | [Vaultwarden](https://github.com/dani-garcia/vaultwarden) | GPL-3.0 | ⚠️ copyleft; compatível com clientes Bitwarden | +| 1Password | [Bitwarden](https://bitwarden.com/) | AGPL-3.0 | ⚠️ copyleft de rede | +| 1Password Teams | [Passbolt](https://www.passbolt.com/) | AGPL-3.0 | ⚠️ copyleft de rede | + +### Arquivos e colaboração + +| Você paga por | Alternativa | Licença | Atenção | +|---|---|---|---| +| Dropbox, Google Drive | [Nextcloud](https://nextcloud.com/) | AGPL-3.0 | ⚠️ copyleft de rede | +| Zoom | [Jitsi Meet](https://jitsi.org/Projects/JitsiMeet) | Apache-2.0 | — | + +--- + +## O que o catálogo NÃO cobre + +Nestas categorias o awesome-selfhosted **não tem nada** no snapshot atual — a tag existe upstream mas nenhum projeto a referencia. São, ironicamente, as que um fundador de SaaS procura primeiro: + +| Categoria | Você provavelmente paga por | Situação | +|---|---|---| +| **Auth / SSO** | Auth0, Clerk, Cognito | Keycloak, Authentik, Zitadel e Ory **não estão listados** | +| **Uptime e status page** | Better Stack, Pingdom, Statuspage | Uptime Kuma e Gatus **não estão listados** | +| **CI/CD** | GitHub Actions, CircleCI | Woodpecker, Drone e Jenkins **não estão listados** | +| **Backup** | Backblaze, AWS Backup | restic, Borg e Duplicati **não estão listados** | +| **PaaS / deploy** | Vercel, Railway, Heroku | Coolify, Dokku e CapRover **não estão listados** | +| **Site estático** | Netlify, Vercel | Hugo, Jekyll e Eleventy **não estão listados** | +| **VPN / rede privada** | Tailscale, NordLayer | WireGuard e Headscale **não estão listados** | + +Não é falha do catálogo: o escopo declarado do upstream é **serviços de rede e aplicações web**, então ferramentas de build, CLIs e implementações de protocolo ficam de fora. Para estas categorias, procure no [`docs/registry/`](../registry/INDEX.md) ou fora do OS. + +--- + +## Armadilhas de licença nesta shortlist + +Seis entradas acima **não são permissivas**, e é fácil não perceber: + +| Projeto | Licença | O que significa | +|---|---|---| +| Sentry Self-Hosted | BUSL-1.1 | fonte disponível, uso comercial restrito por período | +| Directus | BUSL-1.1 | idem | +| Outline | BUSL-1.1 | idem | +| Chatwoot | ⊘ Proprietary | marcado como proprietário pelo upstream | +| Budibase | ⊘ Proprietary | idem | +| n8n | Apache-2.0 + Commons-Clause | não pode vender o software como serviço | + +Além dessas, **mais de dez entradas são AGPL-3.0**. O AGPL **não** te obriga a nada se você apenas rodar sem modificar — a obrigação nasce quando você modifica e oferece o serviço pela rede a terceiros. + +**Se o seu SaaS vai revender ou embutir qualquer um destes, fale com um advogado antes.** O [`legal-compliance-agent`](../../.claude/agents/legal-compliance-agent.md) gera um primeiro rascunho, não um parecer. + +--- + +## Como decidir + +No estágio 4.2 do WIZARD o projetista escolhe entre gerenciado, self-hosted e híbrido. Cinco perguntas resolvem a maioria dos casos: + +1. **Quanto custa gerenciado no volume do ano 1?** Abaixo de uns R$ 200/mês, self-hosted raramente compensa em tempo. +2. **Os dados são sensíveis?** Dado pessoal, de saúde ou financeiro muda a conta — rode [`privacy-audit`](../../.claude/skills/privacy-audit/SKILL.md). +3. **Você já opera algum servidor hoje?** Se não, o primeiro self-hosted custa bem mais do que parece. +4. **O que acontece se cair no domingo de manhã?** Se não há resposta, é gerenciado. +5. **Vai revender ou embutir no produto?** Então a licença deixa de ser detalhe. + +Vale rodar [`cost-watchdog`](../../.claude/skills/cost-watchdog/SKILL.md) antes de fechar — ele compara o custo projetado dos dois caminhos. diff --git a/scripts/sync-selfhosted.js b/scripts/sync-selfhosted.js new file mode 100644 index 0000000..7259c22 --- /dev/null +++ b/scripts/sync-selfhosted.js @@ -0,0 +1,264 @@ +#!/usr/bin/env node +/** + * sync-selfhosted.js — regenerates docs/selfhosted/ from awesome-selfhosted-data. + * + * Purpose: keep a local, navigable mirror of the full self-hosted catalogue so the + * WIZARD (stage 4.2) can offer self-hosted alternatives without a network call. + * Version: v0.5.0 + * Sprint: v0.5.0 PR 4 + * + * Upstream: https://github.com/awesome-selfhosted/awesome-selfhosted-data + * Licence: the DATA is CC-BY-SA 3.0 Unported. Generated files carry the attribution + * header that licence requires. This script itself is MIT, like the rest of the OS. + * + * Usage: + * node scripts/sync-selfhosted.js # clones upstream into a temp dir + * node scripts/sync-selfhosted.js # uses an existing local clone + * + * Regenerates: docs/selfhosted/INDEX.md, docs/selfhosted/catalog/*.md + * Never touches: docs/selfhosted/README.md, docs/selfhosted/shortlist-saas.md (hand-curated) + */ + +'use strict'; + +const fs = require('fs'); +const os = require('os'); +const path = require('path'); +const { execFileSync } = require('child_process'); + +const UPSTREAM = 'https://github.com/awesome-selfhosted/awesome-selfhosted-data.git'; +const REPO = path.resolve(__dirname, '..'); +const OUT = path.join(REPO, 'docs', 'selfhosted'); +const CATALOG = path.join(OUT, 'catalog'); + +// ---------------------------------------------------------------- data source + +function resolveDataDir() { + const given = process.argv[2]; + if (given) { + const p = path.resolve(given); + if (!fs.existsSync(path.join(p, 'software'))) { + console.error(`error: ${p} does not look like awesome-selfhosted-data (no software/ dir)`); + process.exit(1); + } + console.log(`using existing clone: ${p}`); + return p; + } + const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'ash-data-')); + console.log(`cloning ${UPSTREAM} …`); + execFileSync('git', ['clone', '--depth', '1', '--quiet', UPSTREAM, tmp], { stdio: 'inherit' }); + return tmp; +} + +// ------------------------------------------- minimal YAML reader (flat schema) +// The upstream schema is flat: scalars, string lists, and two nested maps we skip. +// Verified against the full dataset: no multiline scalars, no anchors, no flow style. + +function unquote(s) { + s = s.trim(); + if ((s.startsWith('"') && s.endsWith('"')) || (s.startsWith("'") && s.endsWith("'"))) { + return s.slice(1, -1).replace(/''/g, "'").replace(/\\"/g, '"'); + } + return s; +} + +function parseYaml(text) { + const out = {}; + let key = null; + for (const line of text.split(/\r?\n/)) { + if (!line.trim() || line.trim().startsWith('#')) continue; + const top = line.match(/^([a-z_]+):(.*)$/); + if (top) { + key = top[1]; + const rest = top[2].trim(); + out[key] = rest === '' ? [] : unquote(rest); + continue; + } + const item = line.match(/^\s+-\s+(.*)$/); + if (item && key && Array.isArray(out[key])) out[key].push(unquote(item[1])); + // deeper indentation (current_release, commit_history) is intentionally ignored + } + return out; +} + +// ------------------------------------- 95 upstream tags -> 12 macro-categories + +const MACRO = [ + ['comunicacao', 'Comunicação', + 'Email, chat, fórum, videoconferência, XMPP, IRC, SIP, newsletters, feed readers.', + t => t.startsWith('communication') || t === 'feed-readers'], + + ['arquivos-backup', 'Arquivos e backup', + 'Sincronização, object storage, gerenciadores de arquivo, P2P, backup, arquivamento digital.', + t => t.startsWith('file-transfer') || t === 'backup' || t.startsWith('archiving')], + + ['midia', 'Mídia', + 'Streaming de áudio e vídeo, galerias de foto, gestão de biblioteca, videovigilância, jogos.', + t => t.startsWith('media') || t === 'photo-galleries' || t === 'video-surveillance' + || t === 'video_surveillance' || t.startsWith('games')], + + ['produtividade', 'Produtividade e conhecimento', + 'Notas, wikis, gestão documental, suítes de escritório, tarefas, bookmarks, calendário, dashboards.', + t => ['note-taking-editors', 'knowledge-management-tools', 'wikis', 'office-suites', + 'bookmarks-and-link-sharing', 'pastebins', 'task-management-to-do-lists', 'time-tracking', + 'personal-dashboards', 'recipe-management', 'travel-organization', 'groupware'].includes(t) + || t.startsWith('document-management') || t.startsWith('calendar-contacts')], + + ['negocio', 'Negócio e operações', + 'CRM, e-commerce, ERP, estoque, RH, finanças, ticketing, agendamento, eventos.', + t => ['customer-relationship-management-crm', 'e-commerce', 'resource-planning', + 'inventory-management', 'human-resources-management-hrm', 'money-budgeting-management', + 'ticketing', 'booking-and-scheduling', 'conference-management', 'manufacturing', + 'community-supported-agriculture-csa', 'polls-and-events'].includes(t)], + + ['desenvolvimento', 'Desenvolvimento', + 'CI/CD, API management, IDEs, testes, low-code, serverless, feature flags, geradores estáticos, bancos de dados.', + t => t.startsWith('software-development') || t === 'static-site-generators' || t === 'database-management'], + + ['infraestrutura', 'Infraestrutura e rede', + 'DNS, proxy, VPN, servidores web, acesso remoto, IoT, painéis de self-hosting.', + t => ['dns', 'proxy', 'vpn', 'web-servers', 'network-utilities', 'remote-access', + 'self-hosting-solutions', 'internet-of-things-iot'].includes(t)], + + ['seguranca-identidade', 'Segurança e identidade', + 'Gerenciadores de senha, SSO, identidade federada, gestão de identidade.', + t => ['password-managers', 'federated-identity-authentication', 'identify-management', + 'identity-management'].includes(t)], + + ['observabilidade', 'Observabilidade e busca', + 'Monitoramento, status pages, analytics, motores de busca.', + t => ['monitoring-status-pages', 'analytics', 'search-engines'].includes(t)], + + ['conteudo', 'Conteúdo e publicação', + 'CMS, blogs, encurtadores de URL, plataformas de curso.', + t => ['content-management-systems-cms', 'blogging-platforms', 'url-shorteners', + 'learning-and-courses'].includes(t)], + + ['automacao-ia', 'Automação e IA', + 'Automação de fluxos e IA generativa auto-hospedada.', + t => t === 'automation' || t.startsWith('generative-a')], + + ['outros', 'Outros', + 'Mapas e GPS, saúde, genealogia, e o balde "Miscellaneous" do upstream.', + () => true], +]; + +// Software files carry tag DISPLAY names ("Note-taking & Editors"); the tags/ directory +// carries file slugs ("note-taking--editors"). Slugifying the display name collapses runs +// of separators to a single dash, so both sides must be canonicalised the same way or +// equality tests silently never match. +const slugifyTag = name => name.toLowerCase() + .replace(/&/g, '-').replace(/\+/g, '-') + .replace(/[^a-z0-9]+/g, '-') + .replace(/-{2,}/g, '-') + .replace(/^-+|-+$/g, ''); + +// ---------------------------------------------------------------------- load + +function load(dataDir) { + const dir = path.join(dataDir, 'software'); + const entries = []; + for (const f of fs.readdirSync(dir)) { + if (!f.endsWith('.yml')) continue; + const y = parseYaml(fs.readFileSync(path.join(dir, f), 'utf8')); + entries.push({ + name: y.name || f.replace(/\.yml$/, ''), + description: String(y.description || '').replace(/\|/g, '\\|').trim(), + licenses: Array.isArray(y.licenses) ? y.licenses : [], + platforms: Array.isArray(y.platforms) ? y.platforms : [], + tags: Array.isArray(y.tags) ? y.tags : [], + website: y.website_url || '', + source: y.source_code_url || '', + stars: y.stargazers_count ? parseInt(y.stargazers_count, 10) : null, + archived: String(y.archived) === 'true', + }); + } + entries.sort((a, b) => a.name.toLowerCase().localeCompare(b.name.toLowerCase(), 'en')); + return entries; +} + +// Returns { id, tag } — the macro-category AND the upstream tag that put it there. +// Grouping sections by tags[0] instead would bury entries: something tagged +// ["Miscellaneous", "Monitoring & Status Pages"] would render under "Miscellaneous" +// and the monitoring signal would vanish from the catalogue entirely. +const macroFor = e => { + for (const t of e.tags) { + const s = slugifyTag(t); + for (const [id, , , test] of MACRO) { + if (id !== 'outros' && test(s)) return { id, tag: t }; + } + } + return { id: 'outros', tag: e.tags[0] || 'Miscellaneous' }; +}; + +// -------------------------------------------------------------------- render + +const ATTRIBUTION = `> **Fonte:** [awesome-selfhosted/awesome-selfhosted-data](https://github.com/awesome-selfhosted/awesome-selfhosted-data) · **Licença:** [CC-BY-SA 3.0 Unported](https://creativecommons.org/licenses/by-sa/3.0/) · **Autores:** [AUTHORS](https://github.com/awesome-selfhosted/awesome-selfhosted-data/blob/master/AUTHORS) upstream. +> Arquivo **gerado** por \`scripts/sync-selfhosted.js\`. Não edite à mão — as edições se perdem na próxima sincronização.`; + +function row(e) { + const link = e.website || e.source; + const nm = link ? `[${e.name}](${link})` : e.name; + const lic = e.licenses.length ? e.licenses.join(', ') : '—'; + const plat = e.platforms.length + ? e.platforms.slice(0, 4).join(', ') + (e.platforms.length > 4 ? '…' : '') + : '—'; + const stars = e.stars != null ? `${(e.stars / 1000).toFixed(1)}k` : '—'; + return `| ${nm}${e.archived ? ' ⚠️' : ''} | ${e.description} | ${lic} | ${plat} | ${stars} |`; +} + +function render(entries) { + fs.mkdirSync(CATALOG, { recursive: true }); + + const buckets = Object.fromEntries(MACRO.map(([id]) => [id, []])); + for (const e of entries) { + const { id, tag } = macroFor(e); + e.sectionTag = tag; + buckets[id].push(e); + } + + for (const [id, title, blurb] of MACRO) { + const list = buckets[id]; + const byTag = {}; + for (const e of list) (byTag[e.sectionTag] ||= []).push(e); + + let md = `# Self-hosted — ${title}\n\n${blurb}\n\n**${list.length} projetos** nesta categoria.\n\n${ATTRIBUTION}\n\n[← Voltar ao índice](../INDEX.md) · [Shortlist SaaS](../shortlist-saas.md)\n\n---\n\n`; + for (const t of Object.keys(byTag).sort()) { + md += `## ${t}\n\n| Projeto | O que é | Licença | Plataforma | ⭐ |\n|---|---|---|---|---|\n`; + md += byTag[t].map(row).join('\n') + '\n\n'; + } + fs.writeFileSync(path.join(CATALOG, `${id}.md`), md); + } + + let idx = `# Catálogo self-hosted — índice + +Espelho navegável do **awesome-selfhosted**: **${entries.length} projetos** de código aberto que você pode hospedar por conta própria, agrupados em ${MACRO.length} categorias. + +Para escolher o que usar num projeto novo, comece pela [**shortlist SaaS**](shortlist-saas.md) — as categorias que um fundador de SaaS de fato substitui. Este índice é o acervo completo, para quando a shortlist não cobre o caso. + +${ATTRIBUTION} + +--- + +## Categorias + +| Categoria | Projetos | O que tem dentro | +|---|---:|---| +`; + for (const [id, title, blurb] of MACRO) { + idx += `| [${title}](catalog/${id}.md) | ${buckets[id].length} | ${blurb} |\n`; + } + idx += `\n**Total: ${entries.length} projetos.**\n\n---\n\n## Como regenerar\n\n\`\`\`bash\nnode scripts/sync-selfhosted.js\n\`\`\`\n\nO script clona o upstream, lê os arquivos YAML e reescreve \`INDEX.md\` e \`catalog/\`. O \`README.md\` e a \`shortlist-saas.md\` são curados à mão e **não** são sobrescritos.\n\n---\n\n## Legenda\n\n- **⭐** — estrelas no GitHub quando disponíveis. Sinal de tração, não de qualidade.\n- **⚠️** — o upstream marcou o projeto como arquivado. Não adote sem verificar.\n- **Licença** — copyleft (AGPL, GPL) impõe obrigações se você distribuir modificações. Ver a nota de licenças no [README](README.md).\n`; + + fs.writeFileSync(path.join(OUT, 'INDEX.md'), idx); + return buckets; +} + +// ----------------------------------------------------------------------- run + +const dataDir = resolveDataDir(); +const entries = load(dataDir); +const buckets = render(entries); + +console.log(`\ngenerated ${entries.length} entries into docs/selfhosted/`); +for (const [id, title] of MACRO) console.log(` ${String(buckets[id].length).padStart(4)} ${title}`); diff --git a/session-log/2026-08-08-v0.5.0-selfhosted-catalog.md b/session-log/2026-08-08-v0.5.0-selfhosted-catalog.md new file mode 100644 index 0000000..5a16b9e --- /dev/null +++ b/session-log/2026-08-08-v0.5.0-selfhosted-catalog.md @@ -0,0 +1,90 @@ +# 2026-08-08 — v0.5.0 PR 4: awesome-selfhosted vendored, managed-vs-self-hosted question added + +## What the user asked for + +> "quero apresentar um outro repo que tem uma lista inteira de projetos self-hosted, e vamos copiar integralmente esta lista e trazer pra cá, e acrescentar como opção ao estágio do Technical Plan" + +And, when offered four import shapes: + +> "Vamos de hibrido, com o shortlist, mas tem que ter alguma forma de ter conhecimento da lista inteira, e ter o link deste repo a disposição em nossa documentação para achar com facilidade caso queira aprofundar e buscar outros." + +The user also stated their own bias openly — self-hosted for infra independence, data control and cost. That is recorded as a stance, not encoded as a default. + +## What was measured before deciding + +Everything below was verified against a shallow clone of `awesome-selfhosted-data`, not assumed: + +| Fact | Value | +|---|---| +| Software entries | **1.346** YAML files | +| Tag files | 95 | +| Tags actually used | 86 | +| Platforms | 36 | +| Licence of the data | **CC-BY-SA 3.0 Unported**, `AUTHORS` file upstream | +| Schema | flat YAML; no multiline scalars, anchors, or flow style | + +Licence distribution across the 1.346 entries: MIT 360, **AGPL-3.0 302**, **GPL-3.0 224**, Apache-2.0 143, BSD 51, **⊘ Proprietary 70**. Roughly **39% copyleft**. + +## Decisions worth preserving + +### 1. Hybrid, in three layers — not a verbatim dump + +- `catalog/` — all 1.346 entries, generated, 12 macro-categories (95 upstream tags collapsed). +- `shortlist-saas.md` — hand-curated by *SaaS category being replaced*, which is how a founder actually thinks. +- `README.md` — licence carve-out, regeneration instructions, and the honest trade-off table. + +Plus `scripts/sync-selfhosted.js` so the copy can be refreshed instead of rotting, and one registry pack so it is discoverable from the existing catalogue. + +### 2. CC-BY-SA quarantined to one directory + +The OS is MIT. The data is share-alike. Mixing them silently would make the licence boundary unfindable. The mirror lives in `docs/selfhosted/` with an explicit carve-out in its README, attribution stamped on every generated file, and entries in `ATTRIBUTIONS.md` and `UPSTREAM-SOURCES.md`. + +`UPSTREAM-SOURCES.md` section 7 explicitly says *"avoid vendoring third-party content"* and *"prefer linking to upstream instead of duplicating it"*. Rather than quietly violate the repo's own policy, the new entry states this is an exception and gives four reasons it clears the bar. Future vendoring should clear the same four. + +### 3. The catalogue does NOT cover what a SaaS founder needs most — say so + +The most useful finding of the whole PR, and it is a negative one. + +**Nine upstream tags are orphaned** — the tag file exists, zero software references it: + +`Backup` · `Federated Identity & Authentication` · `Identity Management` · `Monitoring & Status Pages` · `CI/CD` · `FaaS & Serverless` · `Static Site Generators` · `VPN` · `Distributed Filesystems` + +Verified absent from the dataset entirely: Keycloak, Authentik, Zitadel, Ory, MinIO, Supabase, Uptime Kuma, Gatus, Coolify, Dokku, CapRover, Woodpecker, Drone, Jenkins, WireGuard, Headscale, restic, Borg, Duplicati, Hugo, Jekyll, Eleventy, Cal.com, Meilisearch, Unleash. + +That is auth, observability, CI/CD, backup, PaaS, static sites and VPN — the first seven things a SaaS founder looks for. It follows from the upstream scope (self-hosted *network services and web applications*, not build tools, CLIs or protocol implementations), and the empty tag files are residue of an earlier scope. + +**The shortlist marks these as gaps in a dedicated table instead of quietly omitting them.** A catalogue that silently lacks auth is worse than one that says it lacks auth. + +### 4. Licence traps surfaced per entry, not buried in a footnote + +Six entries in the curated shortlist are **not permissive**, and it is easy to miss: Sentry Self-Hosted, Directus and Outline are BUSL-1.1; Chatwoot and Budibase are marked ⊘ Proprietary; n8n is Apache-2.0 + Commons-Clause. Each carries a ⚠️ in its own row. + +The AGPL note is stated precisely rather than alarmingly: running unmodified triggers nothing; the obligation begins when you modify *and* serve over a network. + +### 5. The stage 4.2 question does not sell self-hosting + +The maintainer prefers self-hosted. The wizard must not. Stage 4.2 offers three options (managed / self-hosted / hybrid), states operational cost plainly — backup, uptime, patching, being the person who wakes up at 3am — and carries an explicit instruction: *"Do not push (b)."* + +The framing that survived: **self-hosting trades vendor cost for time and operations.** A solo founder in Sprint 1 hosting eight services is doing SRE, not product. + +## Two bugs found and fixed during the work + +1. **Tag-slug mismatch.** The macro-category map was built from tag *filenames* (`note-taking--editors`, double dash), but software files carry tag *display names*, whose slug collapses to a single dash (`note-taking-editors`). Prefix tests matched; equality tests silently never did — 203 entries dumped into "Outros" and Security showed 7. Fixed by canonicalising both sides; "Outros" fell to 103 and now contains only genuinely-other tags. + +2. **Sections grouped by `tags[0]`.** An entry tagged `["Miscellaneous", "Monitoring & Status Pages"]` rendered under "Miscellaneous" and its monitoring signal vanished. `macroFor` now returns the tag that *determined* the bucket, and sections group by that. + +The second bug is why the orphan-tag finding is trustworthy. Before fixing it, "no Monitoring section" could have meant either "no entries" or "entries buried elsewhere". After the fix, it means what it says. + +## Verification performed + +- Generator run end-to-end: 1.346 entries, 12 catalogue files, 544K total. +- `node --check scripts/sync-selfhosted.js` passes. +- All relative `.md` links across the repo resolve — zero broken. +- CI canon check reproduced; the `rules/` root duplicate is an empty untracked directory (`git ls-files rules/` empty), invisible to CI. +- Every project named in the shortlist was grep-verified against the generated catalogue, with its licence read from the data rather than from memory. + +## Open questions + +- **When to re-sync.** No automation. The upstream has dead-link and unmaintained-project checks; our snapshot has none and is accurate only as of today. A cron or CI job would help, but would make the repo depend on an external clone at build time. Left manual on purpose. +- **The gap categories deserve their own answer.** Auth, uptime, CI/CD, backup and PaaS are exactly what a self-hosting founder needs and exactly what this catalogue lacks. A hand-curated `docs/selfhosted/gaps.md` — Keycloak, Authentik, Uptime Kuma, Woodpecker, Coolify, restic — would close it, but that list would be authored here rather than mirrored, carrying its own maintenance burden. +- The macro-category mapping is a judgement call. "Outros" still holds 103 entries, mostly the upstream `Miscellaneous` bucket. diff --git a/session-log/INDEX.md b/session-log/INDEX.md index 3ad5dd9..4357c03 100644 --- a/session-log/INDEX.md +++ b/session-log/INDEX.md @@ -6,6 +6,7 @@ Each entry captures the reasoning behind a material decision: what was true befo | Date | Topic | File | |---|---|---| +| 2026-08-08 | v0.5.0 PR 4 — awesome-selfhosted (1.346 projetos) espelhado em `docs/selfhosted/` sob CC-BY-SA 3.0 com carve-out de licença, shortlist curada por categoria de SaaS, e a pergunta gerenciado-vs-self-hosted no estágio 4.2 | [`2026-08-08-v0.5.0-selfhosted-catalog.md`](2026-08-08-v0.5.0-selfhosted-catalog.md) | | 2026-08-08 | v0.5.0 PR 2 — Pitch artifact created (none existed) at new stage 2.9, plus the "BP/Pitch online?" question with a mandatory redaction gate; publication added to the privacy rule as a form of processing | [`2026-08-08-v0.5.0-pitch-publication.md`](2026-08-08-v0.5.0-pitch-publication.md) | | 2026-08-08 | v0.5.0 PR 3 — skill audit: 6 core wizard skills had no frontmatter (invisible to auto-invocation), 10 more had no trigger phrases; 3 overlapping pairs cross-linked; `release-check` converted to a delegation table | [`2026-08-08-v0.5.0-skills-audit.md`](2026-08-08-v0.5.0-skills-audit.md) | | 2026-08-08 | v0.5.0 PR 1 — WIZARD restructured into 5 phases (1:1 with commit tags), Prototype Lab moved before Product Brief/Technical Plan, fractional stages eliminated, `registry-pick` split into design + stack passes | [`2026-08-08-v0.5.0-wizard-5-phases.md`](2026-08-08-v0.5.0-wizard-5-phases.md) | From d66bc3c13030256204cc156aedb11bbd3e18ddea Mon Sep 17 00:00:00 2001 From: lglucas Date: Sat, 8 Aug 2026 19:24:24 -0300 Subject: [PATCH 04/14] =?UTF-8?q?docs(selfhosted):=20pesquisa=20de=20equiv?= =?UTF-8?q?alentes=20para=20as=207=20lacunas=20do=20cat=C3=A1logo?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit O PR 4 registrou que o awesome-selfhosted não cobre auth, uptime, CI/CD, backup, PaaS, site estático nem VPN. docs/selfhosted/gaps.md fecha isso com pesquisa própria: 90+ repositórios consultados na API do GitHub em 2026-08-08 — estrelas, licença, último push e status de arquivamento. Nenhum número escrito de memória. Diferente do resto de docs/selfhosted/, este arquivo é AUTORAL, não espelhado: MIT em vez de CC-BY-SA, e o sync-selfhosted.js não o toca. Cobre auth/SSO, uptime, CI/CD, backup, PaaS, site estático, VPN, BaaS e eventos, mais observabilidade, erros, segredos, object storage, feature flags, busca, workflow e infra de LLM. Cada categoria fecha com uma recomendação única — e no caso de CI/CD a recomendação é ficar no gerenciado. Achado principal: OPEN CORE é uma terceira armadilha de licença, além de copyleft e source-available. Treze projetos abrem o arquivo de licença com "Portions of this software are licensed as follows" — authentik, SuperTokens, Dokploy, Pangolin, SigNoz, Infisical, n8n, LiteLLM, Langfuse, GrowthBook, Meilisearch, Windmill e Duplicati. O núcleo é livre, mas SSO, RBAC e audit log ficam na edição paga. É a pior pro fundador: só aparece quando chega o primeiro cliente corporativo. Ler o arquivo de licença também corrigiu fatos que eu teria errado: Sentry é FSL-1.1 e não BUSL; Vault é BUSL-1.1, e é exatamente por isso que o OpenBao existe; Open WebUI tem licença própria "all rights reserved" apesar de 148k estrelas. Na direção oposta, CapRover, Astro, NetBird e Borg pareciam suspeitos como NOASSERTION mas são permissivos. Sobre o que o usuário citou: o Supabase de fato tem self-hosted próprio (Apache-2.0, 107.7k — o mais estrelado da pesquisa), com a ressalva de que o compose tem ~10 serviços. E NÃO existe clone do Luma: o que há cobre ticketing ou agendamento, não o calendário de comunidade. O mais próximo, Mobilizon, não vive no GitHub — está no framagit, então nunca apareceria numa busca por estrelas. Dois avisos incidentais: calcom/cal.com foi renomeado para calcom/cal.diy, e o Attendize está sem commits desde 2024-08 apesar de liderar a categoria em estrelas — motivo para estrela ranquear candidatos, não escolher. Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 25 ++ WIZARD.md | 12 +- docs/selfhosted/README.md | 5 +- docs/selfhosted/gaps.md | 287 ++++++++++++++++++ docs/selfhosted/shortlist-saas.md | 20 +- scripts/sync-selfhosted.js | 2 +- .../2026-08-08-v0.5.1-selfhosted-gaps.md | 77 +++++ session-log/INDEX.md | 1 + 8 files changed, 415 insertions(+), 14 deletions(-) create mode 100644 docs/selfhosted/gaps.md create mode 100644 session-log/2026-08-08-v0.5.1-selfhosted-gaps.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 24b55f5..e2be1f9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,31 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), > - [x] **PR 2** — Pitch artifact + "BP/Pitch online?" decision > - [x] **PR 3** — Skill frontmatter fix + audit > - [x] **PR 4** — awesome-selfhosted catalog + managed-vs-self-hosted question +> - [x] **PR 5** — researched equivalents for the gap categories + +### Added — `docs/selfhosted/gaps.md`, closing what the mirror cannot + +PR 4 documented that the awesome-selfhosted mirror covers nothing for auth, uptime, CI/CD, backup, PaaS, static sites or VPN. This closes that with original research: **90+ candidate repositories queried through the GitHub API on 2026-08-08** — stars, licence, last push, archived status. No figure written from memory. + +Unlike the rest of `docs/selfhosted/`, this file is **authored, not mirrored** — MIT rather than CC-BY-SA, and never touched by `sync-selfhosted.js`. + +Covers auth/SSO, uptime, CI/CD, backup, PaaS, static sites, VPN, BaaS and events, plus observability, error tracking, secrets, object storage, feature flags, search, workflow and LLM infrastructure. Each category ends with a single "if you only want one choice" recommendation — and for CI/CD that recommendation is to stay managed. + +### Added — "open core" as a third licence trap + +Reading the actual licence file wherever the API returned `NOASSERTION` surfaced a category the previous PR missed. **Thirteen projects open their licence with _"Portions of this software are licensed as follows"_** — authentik, SuperTokens, Dokploy, Pangolin, SigNoz, Infisical, n8n, LiteLLM, Langfuse, GrowthBook, Meilisearch, Windmill, Duplicati. + +Open core means the core is free but **SSO, RBAC and audit logs live in the paid edition**. It is the cruellest trap for a founder: the project presents as open source and gets adopted, and the limitation only appears when the first corporate customer asks for single sign-on. Stage 4.2 now instructs Claude to check which edition holds the needed feature before recommending. + +Reading the files also corrected facts that would otherwise have been wrong: **Sentry is FSL-1.1, not BUSL**; **Vault is BUSL-1.1**, which is precisely why **OpenBao** exists (pre-BUSL fork, MPL-2.0, Linux Foundation); **Open WebUI** ships a custom "all rights reserved" licence despite 148k stars. Conversely CapRover, Astro, NetBird and Borg looked suspicious as `NOASSERTION` but are plainly permissive. + +### Documented — Supabase self-hosts, Luma has no equivalent + +**Supabase** (Apache-2.0, 107.7k stars) is the most-starred repository in the entire research and does self-host — with the honest caveat that the compose file is ~10 services and running it in production is its own job. + +**There is no Luma clone.** What exists covers ticketing (Hi.Events, pretix, alf.io) or 1-to-1 scheduling (Cal.com), not Luma's community-calendar experience. The closest in spirit, Mobilizon, **does not live on GitHub** — it is on framagit — so it can never surface in a star-ranked search. Stated plainly rather than pushing Cal.com as a substitute. + +Two incidental warnings recorded: `calcom/cal.com` has been **renamed to `calcom/cal.diy`**, and **Attendize has had no commits since 2024-08** despite leading its category on stars — which is why stars rank candidates but do not choose them. ### Added — self-hosted catalogue (1.346 projects) and the stage 4.2 question diff --git a/WIZARD.md b/WIZARD.md index 9709eee..613f95f 100644 --- a/WIZARD.md +++ b/WIZARD.md @@ -531,14 +531,20 @@ Existe o caminho self-hosted — você roda o software no teu próprio servidor. Qual faz sentido pro teu momento? ``` -**Consult [`docs/selfhosted/shortlist-saas.md`](docs/selfhosted/shortlist-saas.md)** for concrete alternatives per category, with licences. The full catalogue of 1.346 projects lives in [`docs/selfhosted/`](docs/selfhosted/README.md). +Where to look for concrete alternatives: + +| File | Covers | +|---|---| +| [`docs/selfhosted/shortlist-saas.md`](docs/selfhosted/shortlist-saas.md) | analytics, CMS, CRM, helpdesk, email, BI, search, forms, wiki — what the mirrored catalogue has | +| [`docs/selfhosted/gaps.md`](docs/selfhosted/gaps.md) | **auth, uptime, CI/CD, backup, PaaS, static sites, VPN, BaaS, events** — researched separately, ranked by GitHub stars | +| [`docs/selfhosted/INDEX.md`](docs/selfhosted/README.md) | the full 1.346-project catalogue | Rules for this conversation: - **State the real cost of self-hosting.** It trades vendor cost for time and operations: backup, uptime, security patching, and being the person who wakes up when it breaks. A solo founder in Sprint 1 hosting eight services is doing SRE, not product. - **Do not push (b).** The maintainer of this OS prefers self-hosted, and that stance is recorded in `ETHOS.md` — explicitly as a stance, not a rule. "Managed for everything" is frequently the right answer for a solo non-developer. -- **Flag the gaps honestly.** The catalogue has nothing for auth/SSO, uptime monitoring, CI/CD, backup, PaaS, static site generators or VPN. If the project needs those self-hosted, say so and look elsewhere. -- **Flag copyleft and source-available licences.** Roughly 39% of the catalogue is AGPL or GPL, and several popular options are BUSL-1.1, Commons-Clause, or outright proprietary. If the project will resell or embed the component, this stops being a detail — route it to `legal-compliance-agent`. +- **Flag the three licence traps, not just copyleft.** Roughly 39% of the mirrored catalogue is AGPL or GPL (modify **and** serve over a network triggers the obligation). Some options are source-available rather than open source — Vault is BUSL-1.1, Sentry is FSL-1.1. And **thirteen of the researched alternatives are open core**, where the free edition deliberately omits SSO, RBAC and audit logs. That last one bites hardest: the project looks open source until the founder needs corporate login. If the project will resell or embed the component, route it to `legal-compliance-agent`. +- **Check whether the feature you need is in the free edition** before recommending an open-core option. - **Run `cost-watchdog`** to compare the projected cost of both paths before closing. - **Record the decision and its reasoning** in the Technical Plan and in `session-log/`. A founder who chose managed in year 1 will want to know why when the invoice grows in year 2. diff --git a/docs/selfhosted/README.md b/docs/selfhosted/README.md index 2d66698..a7e9158 100644 --- a/docs/selfhosted/README.md +++ b/docs/selfhosted/README.md @@ -5,6 +5,7 @@ Espelho local do **[awesome-selfhosted](https://github.com/awesome-selfhosted/aw | Arquivo | O que é | Gerado? | |---|---|---| | [`shortlist-saas.md`](shortlist-saas.md) | **Comece por aqui.** As categorias que um fundador de SaaS de fato substitui, curadas à mão. | ✋ manual | +| [`gaps.md`](gaps.md) | O que o awesome-selfhosted **não** cobre — auth, uptime, CI/CD, backup, PaaS, VPN, eventos — pesquisado à parte e ranqueado por estrelas no GitHub. | ✋ manual | | [`INDEX.md`](INDEX.md) | Índice das 12 categorias com contagem. | 🤖 gerado | | [`catalog/`](catalog) | O acervo completo, 1.346 projetos em 12 arquivos. | 🤖 gerado | @@ -65,7 +66,9 @@ E projetos conhecidos dessas áreas estão ausentes do dataset: Keycloak, Authen Isso é coerente com o escopo declarado do upstream — **serviços de rede e aplicações web** auto-hospedados. Ferramentas de build, CLIs de backup e implementações de protocolo caem fora do escopo, e os arquivos de tag vazios são resíduo de um escopo anterior. -**Consequência prática:** para auth, observabilidade, CI/CD, backup e PaaS, este catálogo não vai te ajudar. Procure no `docs/registry/` ou fora. A [`shortlist-saas.md`](shortlist-saas.md) marca essas lacunas explicitamente em vez de fingir que não existem. +**Consequência prática:** para auth, observabilidade, CI/CD, backup e PaaS, o catálogo espelhado não te ajuda. + +➡️ **Essas categorias foram pesquisadas à parte e vivem em [`gaps.md`](gaps.md)** — equivalentes ranqueados por estrelas no GitHub, com licença verificada arquivo por arquivo (foi assim que treze projetos "open core" apareceram). É conteúdo autoral sob MIT, não dado espelhado. --- diff --git a/docs/selfhosted/gaps.md b/docs/selfhosted/gaps.md new file mode 100644 index 0000000..a457c63 --- /dev/null +++ b/docs/selfhosted/gaps.md @@ -0,0 +1,287 @@ +# Lacunas — o que o awesome-selfhosted não cobre + +O [catálogo espelhado](INDEX.md) tem 1.346 projetos e **nada** para auth, uptime, CI/CD, backup, PaaS, site estático e VPN — justamente as primeiras coisas que um fundador de SaaS procura. Este arquivo fecha o buraco. + +Diferente do resto de `docs/selfhosted/`, **isto é autoral, não espelhado.** Não vem do upstream, não é regenerado por script, e a manutenção é nossa. + +| | [`shortlist-saas.md`](shortlist-saas.md) | **este arquivo** | +|---|---|---| +| Origem | curado a partir do catálogo espelhado | pesquisa própria | +| Cobre | o que **existe** no awesome-selfhosted | o que **falta** nele | +| Licença | CC-BY-SA 3.0 (dado derivado) | MIT (conteúdo autoral) | + +--- + +## Como esta lista foi montada + +Estrelas, licença e última atividade de cada projeto foram consultadas na **API do GitHub em 2026-08-08**, não escritas de memória. Onde a API devolveu `NOASSERTION` (licença fora do padrão SPDX), o arquivo de licença foi lido para descobrir o que realmente é. + +**Estrela é sinal de tração, não de qualidade.** Serve para ordenar candidatos, não para escolher. Os números envelhecem — trate como ordem de grandeza. + +### Três tipos de armadilha de licença + +O terceiro é o que mais pega vibe coder desprevenido: + +| Tipo | O que significa | Exemplos aqui | +|---|---|---| +| 🟡 **Copyleft** (AGPL, GPL) | modificar **e** servir pela rede obriga a liberar o código | Grafana, MinIO, Unleash, Zitadel | +| 🟠 **Source-available** (BUSL, FSL) | código visível, uso comercial restrito por prazo | Vault (BUSL-1.1), Sentry (FSL-1.1) | +| 🔴 **Open core** | *"Portions of this software are licensed as follows"* — o núcleo é livre, mas **SSO, RBAC e audit log ficam na edição paga** | authentik, SigNoz, Infisical, n8n, Meilisearch, Langfuse, GrowthBook, SuperTokens, Dokploy, LiteLLM, Windmill, Pangolin | + +🔴 é o mais traiçoeiro porque o projeto se apresenta como open source — e é, até você precisar de login corporativo. **Treze dos projetos pesquisados são open core.** Se o teu SaaS vai depender de um recurso específico, confirme em qual edição ele mora **antes** de adotar. + +--- + +## Auth / SSO + +Substitui **Auth0, Clerk, AWS Cognito, Firebase Auth**. + +| Projeto | ⭐ | Licença | Observação | +|---|---:|---|---| +| [Keycloak](https://github.com/keycloak/keycloak) | 36.1k | Apache-2.0 ✅ | padrão de facto; Red Hat; pesado mas completo | +| [Authelia](https://github.com/authelia/authelia) | 28.5k | Apache-2.0 ✅ | leve; ótimo como portal 2FA na frente de um reverse proxy | +| [authentik](https://github.com/goauthentik/authentik) | 23.9k | 🔴 open core | UX moderna; confira o que fica na edição paga | +| [Ory Hydra](https://github.com/ory/hydra) | 17.5k | Apache-2.0 ✅ | só OAuth2/OIDC; parear com Kratos para identidade | +| [SuperTokens](https://github.com/supertokens/supertokens-core) | 15.3k | 🔴 open core | fácil de embutir em app próprio | +| [Logto](https://github.com/logto-io/logto) | 14.3k | MPL-2.0 ✅ | copyleft fraco, por arquivo | +| [Casdoor](https://github.com/casdoor/casdoor) | 14.1k | Apache-2.0 ✅ | — | +| [Ory Kratos](https://github.com/ory/kratos) | 13.8k | Apache-2.0 ✅ | identidade sem UI própria | +| [LLDAP](https://github.com/lldap/lldap) | 6.4k | GPL-3.0 🟡 | LDAP simplificado; bom para lab caseiro | + +**Se você quer só uma escolha:** Keycloak se precisa de tudo e aguenta a complexidade; Authelia se quer proteger um punhado de serviços atrás de um proxy sem virar administrador de IAM. + +--- + +## Uptime e status page + +Substitui **Better Stack, Pingdom, Statuspage.io, UptimeRobot**. + +| Projeto | ⭐ | Licença | Observação | +|---|---:|---|---| +| [Uptime Kuma](https://github.com/louislam/uptime-kuma) | 90.0k | MIT ✅ | o mais estrelado desta pesquisa toda; sobe em minutos | +| [Cachet](https://github.com/CachetHQ/cachet) | 15.2k | ver upstream | status page, não monitor | +| [Gatus](https://github.com/TwiN/gatus) | 11.8k | Apache-2.0 ✅ | config em YAML, cabe em GitOps | +| [Kener](https://github.com/rajnandan1/kener) | 5.1k | MIT ✅ | status page moderna | +| [Statping-ng](https://github.com/statping-ng/statping-ng) | 2.0k | GPL-3.0 🟡 | ⚠️ sem commits desde 2025-06 | + +**Se você quer só uma escolha:** Uptime Kuma. É a resposta óbvia e raramente errada. + +--- + +## CI/CD + +Substitui **GitHub Actions, CircleCI, Travis**. + +| Projeto | ⭐ | Licença | Observação | +|---|---:|---|---| +| [Drone](https://github.com/harness/drone) | 37.7k | Apache-2.0 ✅ | agora sob a Harness; confirme o rumo do projeto | +| [Jenkins](https://github.com/jenkinsci/jenkins) | 26.4k | MIT ✅ | plugin para tudo; peso e idade à altura | +| [Argo CD](https://github.com/argoproj/argo-cd) | 23.9k | Apache-2.0 ✅ | GitOps para Kubernetes, não CI genérico | +| [Dagger](https://github.com/dagger/dagger) | 16.1k | Apache-2.0 ✅ | pipeline como código, roda dentro de qualquer CI | +| [Tekton](https://github.com/tektoncd/pipeline) | 9.0k | Apache-2.0 ✅ | nativo de Kubernetes | +| [Woodpecker](https://github.com/woodpecker-ci/woodpecker) | 7.7k | Apache-2.0 ✅ | fork comunitário do Drone; leve, ótimo com Gitea | + +**Se você quer só uma escolha:** Woodpecker se você já roda Gitea/Forgejo — a dupla é a substituição mais limpa do GitHub. Fora disso, pense duas vezes: CI gerenciado é barato, e CI próprio é manutenção eterna. + +--- + +## Backup + +Substitui **Backblaze, AWS Backup, Time Machine**. + +| Projeto | ⭐ | Licença | Observação | +|---|---:|---|---| +| [rclone](https://github.com/rclone/rclone) | 59.0k | MIT ✅ | sincroniza com 70+ provedores; não é backup versionado | +| [restic](https://github.com/restic/restic) | 35.4k | BSD-2-Clause ✅ | deduplicado, criptografado, um binário | +| [Duplicati](https://github.com/duplicati/duplicati) | 14.9k | MIT ✅ | tem UI web; bom para quem foge de terminal | +| [Kopia](https://github.com/kopia/kopia) | 13.8k | Apache-2.0 ✅ | CLI + GUI, rápido | +| [Borg](https://github.com/borgbackup/borg) | 13.6k | BSD ✅ | veterano; deduplicação excelente | +| [Backrest](https://github.com/garethgeorge/backrest) | 7.1k | GPL-3.0 🟡 | UI web **em cima do restic** — combinação prática | + +**Se você quer só uma escolha:** restic, com Backrest por cima se quiser interface. E **teste a restauração** — backup que nunca foi restaurado não é backup. + +--- + +## PaaS / deploy + +Substitui **Vercel, Railway, Render, Heroku**. + +| Projeto | ⭐ | Licença | Observação | +|---|---:|---|---| +| [Coolify](https://github.com/coollabsio/coolify) | 60.3k | Apache-2.0 ✅ | o mais próximo de "Vercel no meu servidor" | +| [Dokploy](https://github.com/Dokploy/dokploy) | 36.4k | 🔴 open core | crescimento rápido; verifique o que é pago | +| [Dokku](https://github.com/dokku/dokku) | 32.1k | MIT ✅ | mini-Heroku via `git push`; maduro e estável | +| [CapRover](https://github.com/caprover/caprover) | 15.1k | Apache-2.0 ✅ | UI amigável, apps de um clique | +| [Kamal](https://github.com/basecamp/kamal) | 14.5k | MIT ✅ | do Basecamp; deploy por SSH, sem painel | + +**Se você quer só uma escolha:** Coolify. É a categoria onde self-hosted mais compensa em custo — mas você assume TLS, backup e uptime do próprio painel. + +--- + +## Site estático + +Substitui **Netlify, Vercel (para conteúdo)**. + +| Projeto | ⭐ | Licença | Observação | +|---|---:|---|---| +| [Hugo](https://github.com/gohugoio/hugo) | 89.4k | Apache-2.0 ✅ | absurdamente rápido; templates Go | +| [Docusaurus](https://github.com/facebook/docusaurus) | 65.9k | MIT ✅ | documentação; React | +| [Astro](https://github.com/withastro/astro) | 61.7k | MIT ✅ | conteúdo com ilhas de interatividade | +| [Jekyll](https://github.com/jekyll/jekyll) | 51.6k | MIT ✅ | Ruby; nativo do GitHub Pages | +| [Eleventy](https://github.com/11ty/eleventy) | 19.8k | MIT ✅ | JS, sem opinião forte | +| [Zola](https://github.com/getzola/zola) | 17.3k | EUPL-1.2 | binário único em Rust | + +Categoria inteiramente permissiva — **nenhuma armadilha de licença aqui**. Note que gerador estático e *hospedagem* são coisas diferentes: você ainda precisa de onde servir (Coolify, um bucket, ou o próprio Netlify). + +--- + +## VPN / rede privada + +Substitui **Tailscale, NordLayer, ZeroTier**. + +| Projeto | ⭐ | Licença | Observação | +|---|---:|---|---| +| [Headscale](https://github.com/juanfont/headscale) | 42.6k | BSD-3-Clause ✅ | servidor de controle Tailscale próprio; usa os clientes oficiais | +| [NetBird](https://github.com/netbirdio/netbird) | 28.2k | BSD-3-Clause ✅ | solução completa, com painel | +| [wg-easy](https://github.com/wg-easy/wg-easy) | 26.6k | AGPL-3.0 🟡 | WireGuard com UI; o caminho mais simples | +| [Pangolin](https://github.com/fosrl/pangolin) | 22.1k | 🔴 open core | túnel reverso + acesso; alternativa ao Cloudflare Tunnel | +| [Nebula](https://github.com/slackhq/nebula) | 17.6k | MIT ✅ | do Slack; mesh, escala bem | +| [Firezone](https://github.com/firezone/firezone) | 9.0k | Apache-2.0 ✅ | com controle de acesso | + +**Se você quer só uma escolha:** Headscale se você já gosta do Tailscale e só quer tirar o painel deles do caminho; wg-easy se quer WireGuard funcionando hoje. + +--- + +## Backend / BaaS — o Supabase que você mencionou + +Substitui **Firebase, Supabase Cloud**. + +| Projeto | ⭐ | Licença | Observação | +|---|---:|---|---| +| [Supabase](https://github.com/supabase/supabase) | 107.7k | Apache-2.0 ✅ | **auto-hospedável via Docker Compose** | +| [PocketBase](https://github.com/pocketbase/pocketbase) | 60.6k | MIT ✅ | um binário, SQLite; imbatível para MVP | +| [Appwrite](https://github.com/appwrite/appwrite) | 56.8k | BSD-3-Clause ✅ | — | +| [Nhost](https://github.com/nhost/nhost) | 9.3k | MIT ✅ | Postgres + GraphQL (Hasura) | + +**Você estava certo — o Supabase tem self-hosted próprio**, Apache-2.0, e é o repositório mais estrelado desta pesquisa inteira (107.7k). Vale um aviso honesto: o self-hosted é um `docker-compose` com cerca de dez serviços (Postgres, GoTrue, PostgREST, Realtime, Storage, Kong, Studio…). Sobe fácil; **operar em produção com backup e upgrade é outro trabalho.** + +**Conexão com o OS:** a skill [`deploy-vercel-supabase`](../../.claude/skills/deploy-vercel-supabase/SKILL.md) hoje cobre só o Supabase gerenciado. Se você adotar o self-hosted, ela precisa de um caminho paralelo — registrado nas pendências no fim deste arquivo. + +--- + +## Eventos e RSVP — o "Luma" que você mencionou + +Substitui **Luma (lu.ma), Eventbrite, Meetup**. + +| Projeto | ⭐ | Licença | Observação | +|---|---:|---|---| +| [Cal.com](https://github.com/calcom/cal.diy) | 47.4k | MIT ✅ | ⚠️ repo **renomeado para `cal.diy`**; é agendamento (Calendly), não página de evento | +| [Attendize](https://github.com/Attendize/Attendize) | 4.3k | Attribution Assurance | ⚠️ **sem commits desde 2024-08** | +| [Hi.Events](https://github.com/HiEventsDev/Hi.Events) | 4.0k | AGPL-3.0 🟡 | ativo; já está no catálogo espelhado | +| [pretix](https://github.com/pretix/pretix) | 2.5k | ver upstream | forte em conferência e ingresso pago | +| [eventyay](https://github.com/fossasia/eventyay) | 1.6k | Apache-2.0 ✅ | da FOSSASIA; eventos + palestras + check-in | +| [alf.io](https://github.com/alfio-event/alf.io) | 1.6k | GPL-3.0 🟡 | reserva de ingresso; já está no catálogo | + +**Aviso honesto: não existe um clone do Luma.** O Luma junta três coisas — página bonita de evento, RSVP sem atrito, e calendário de comunidade. As opções acima cobrem **ticketing** (Hi.Events, pretix, alf.io) ou **agendamento 1-a-1** (Cal.com), não a experiência social do Luma. + +O mais próximo em espírito é o **Mobilizon** (Framasoft) — eventos federados com grupos, exatamente o ângulo de comunidade. Mas ele **não vive no GitHub**: o canônico é `framagit.org/framasoft/mobilizon`, e por isso não aparece em nenhuma busca por estrelas. No GitHub só existem empacotamentos e espelhos. + +**Se você quer só uma escolha:** Hi.Events se precisa vender ingresso; Cal.com se o que você chama de "Luma" é na prática agendamento. + +--- + +## Outras categorias ausentes do catálogo + +Não estavam nas sete lacunas originais, mas também faltam no awesome-selfhosted e substituem SaaS caro. + +### Observabilidade — substitui Datadog, New Relic + +| Projeto | ⭐ | Licença | +|---|---:|---| +| [Grafana](https://github.com/grafana/grafana) | 76.2k | AGPL-3.0 🟡 | +| [Prometheus](https://github.com/prometheus/prometheus) | 65.6k | Apache-2.0 ✅ | +| [SigNoz](https://github.com/SigNoz/signoz) | 31.8k | 🔴 open core | +| [OpenObserve](https://github.com/openobserve/openobserve) | 20.6k | AGPL-3.0 🟡 | + +### Erros — substitui Sentry Cloud, Bugsnag + +| Projeto | ⭐ | Licença | +|---|---:|---| +| [Sentry](https://github.com/getsentry/sentry) | 44.5k | 🟠 **FSL-1.1** — vira Apache-2.0 depois de 2 anos | +| [Bugsink](https://github.com/bugsink/bugsink) | 2.0k | ver upstream | + +### Segredos — substitui Doppler, AWS Secrets Manager + +| Projeto | ⭐ | Licença | +|---|---:|---| +| [Vault](https://github.com/hashicorp/vault) | 36.1k | 🟠 **BUSL-1.1** — não é mais open source | +| [Infisical](https://github.com/Infisical/infisical) | 28.6k | 🔴 open core | +| [OpenBao](https://github.com/openbao/openbao) | 7.0k | MPL-2.0 ✅ — **fork do Vault pré-BUSL, sob a Linux Foundation** | + +Se a licença do Vault te incomoda, o OpenBao existe exatamente por isso. + +### Armazenamento de objetos — substitui S3, R2 + +| Projeto | ⭐ | Licença | +|---|---:|---| +| [MinIO](https://github.com/minio/minio) | 61.4k | AGPL-3.0 🟡 — ⚠️ sem commits desde 2026-04 | +| [SeaweedFS](https://github.com/seaweedfs/seaweedfs) | 34.0k | Apache-2.0 ✅ | +| [Garage](https://github.com/deuxfleurs-org/garage) | 4.3k | AGPL-3.0 🟡 | + +### Feature flags — substitui LaunchDarkly + +| Projeto | ⭐ | Licença | +|---|---:|---| +| [Unleash](https://github.com/Unleash/unleash) | 13.7k | AGPL-3.0 🟡 | +| [GrowthBook](https://github.com/growthbook/growthbook) | 8.1k | 🔴 open core | +| [Flagsmith](https://github.com/Flagsmith/flagsmith) | 6.5k | BSD-3-Clause ✅ | + +### Busca — substitui Algolia + +| Projeto | ⭐ | Licença | +|---|---:|---| +| [Meilisearch](https://github.com/meilisearch/meilisearch) | 58.9k | 🔴 open core (Enterprise Edition) | +| [Qdrant](https://github.com/qdrant/qdrant) | 33.9k | Apache-2.0 ✅ — vetorial | +| [Typesense](https://github.com/typesense/typesense) | 26.4k | GPL-3.0 🟡 | + +### Workflow e filas — substitui Zapier, Temporal Cloud + +| Projeto | ⭐ | Licença | +|---|---:|---| +| [n8n](https://github.com/n8n-io/n8n) | 199.9k | 🔴 open core + Commons-Clause | +| [Temporal](https://github.com/temporalio/temporal) | 22.2k | MIT ✅ | +| [Windmill](https://github.com/windmill-labs/windmill) | 17.5k | 🔴 open core | +| [Hatchet](https://github.com/hatchet-dev/hatchet) | 7.7k | MIT ✅ | + +### Infra de LLM — substitui OpenAI API, LangSmith + +| Projeto | ⭐ | Licença | +|---|---:|---| +| [Ollama](https://github.com/ollama/ollama) | 178.1k | MIT ✅ — roda modelo local | +| [Open WebUI](https://github.com/open-webui/open-webui) | 148.3k | ⚠️ licença própria, *"all rights reserved"* | +| [LiteLLM](https://github.com/BerriAI/litellm) | 55.9k | 🔴 open core — proxy para 100+ provedores | +| [Langfuse](https://github.com/langfuse/langfuse) | 32.7k | 🔴 open core — observabilidade de LLM | + +--- + +## Manutenção + +Esta lista **não é gerada**. As estrelas são de **2026-08-08** e envelhecem; licenças mudam — Vault e Sentry mudaram, e é por isso que a coluna existe. + +Revalide antes de adotar qualquer coisa daqui: + +```bash +gh api repos/OWNER/REPO --jq '[.stargazers_count, .license.spdx_id, .pushed_at[0:10], .archived] | @tsv' +``` + +Se a licença voltar `NOASSERTION`, leia o arquivo — foi assim que os treze open core apareceram: + +```bash +gh api repos/OWNER/REPO/license --jq '.content' | base64 -d | head -20 +``` + +## Pendências que esta pesquisa abriu + +- **`deploy-vercel-supabase` cobre só o Supabase gerenciado.** Com o self-hosted sendo Apache-2.0 e o repo mais estrelado desta pesquisa, a skill merece um caminho paralelo — ou uma irmã, `deploy-selfhosted`. +- **Nenhum destes tem pack no registry.** São 60+ projetos verificados; os mais fortes (Coolify, Uptime Kuma, Supabase, Keycloak, restic, Headscale) justificariam one-pagers em `docs/registry/packs/`. +- **`cost-watchdog` poderia consultar este arquivo** ao comparar gerenciado vs. self-hosted no estágio 4.2, em vez de raciocinar no abstrato. diff --git a/docs/selfhosted/shortlist-saas.md b/docs/selfhosted/shortlist-saas.md index beafb9e..bff3b4e 100644 --- a/docs/selfhosted/shortlist-saas.md +++ b/docs/selfhosted/shortlist-saas.md @@ -186,15 +186,17 @@ Nestas categorias o awesome-selfhosted **não tem nada** no snapshot atual — a | Categoria | Você provavelmente paga por | Situação | |---|---|---| -| **Auth / SSO** | Auth0, Clerk, Cognito | Keycloak, Authentik, Zitadel e Ory **não estão listados** | -| **Uptime e status page** | Better Stack, Pingdom, Statuspage | Uptime Kuma e Gatus **não estão listados** | -| **CI/CD** | GitHub Actions, CircleCI | Woodpecker, Drone e Jenkins **não estão listados** | -| **Backup** | Backblaze, AWS Backup | restic, Borg e Duplicati **não estão listados** | -| **PaaS / deploy** | Vercel, Railway, Heroku | Coolify, Dokku e CapRover **não estão listados** | -| **Site estático** | Netlify, Vercel | Hugo, Jekyll e Eleventy **não estão listados** | -| **VPN / rede privada** | Tailscale, NordLayer | WireGuard e Headscale **não estão listados** | - -Não é falha do catálogo: o escopo declarado do upstream é **serviços de rede e aplicações web**, então ferramentas de build, CLIs e implementações de protocolo ficam de fora. Para estas categorias, procure no [`docs/registry/`](../registry/INDEX.md) ou fora do OS. +| **Auth / SSO** | Auth0, Clerk, Cognito | ausentes → [`gaps.md`](gaps.md#auth--sso) tem Keycloak (36.1k), Authelia, authentik | +| **Uptime e status page** | Better Stack, Pingdom, Statuspage | ausentes → [`gaps.md`](gaps.md#uptime-e-status-page) tem Uptime Kuma (90.0k), Gatus | +| **CI/CD** | GitHub Actions, CircleCI | ausentes → [`gaps.md`](gaps.md#cicd) tem Drone, Jenkins, Woodpecker | +| **Backup** | Backblaze, AWS Backup | ausentes → [`gaps.md`](gaps.md#backup) tem rclone (59.0k), restic, Borg | +| **PaaS / deploy** | Vercel, Railway, Heroku | ausentes → [`gaps.md`](gaps.md#paas--deploy) tem Coolify (60.3k), Dokku, Kamal | +| **Site estático** | Netlify, Vercel | ausentes → [`gaps.md`](gaps.md#site-estático) tem Hugo (89.4k), Astro, Jekyll | +| **VPN / rede privada** | Tailscale, NordLayer | ausentes → [`gaps.md`](gaps.md#vpn--rede-privada) tem Headscale (42.6k), NetBird | + +Não é falha do catálogo: o escopo declarado do upstream é **serviços de rede e aplicações web**, então ferramentas de build, CLIs e implementações de protocolo ficam de fora. + +➡️ **Todas essas categorias foram pesquisadas à parte e estão em [`gaps.md`](gaps.md)** — equivalentes ranqueados por estrelas no GitHub, com licença verificada arquivo por arquivo. Lá estão Keycloak, Uptime Kuma, Woodpecker, restic, Coolify, Hugo, Headscale, o Supabase self-hosted e as opções de evento tipo Luma. --- diff --git a/scripts/sync-selfhosted.js b/scripts/sync-selfhosted.js index 7259c22..dfa4b72 100644 --- a/scripts/sync-selfhosted.js +++ b/scripts/sync-selfhosted.js @@ -16,7 +16,7 @@ * node scripts/sync-selfhosted.js # uses an existing local clone * * Regenerates: docs/selfhosted/INDEX.md, docs/selfhosted/catalog/*.md - * Never touches: docs/selfhosted/README.md, docs/selfhosted/shortlist-saas.md (hand-curated) + * Never touches: docs/selfhosted/README.md, shortlist-saas.md, gaps.md (all hand-curated) */ 'use strict'; diff --git a/session-log/2026-08-08-v0.5.1-selfhosted-gaps.md b/session-log/2026-08-08-v0.5.1-selfhosted-gaps.md new file mode 100644 index 0000000..f1fd222 --- /dev/null +++ b/session-log/2026-08-08-v0.5.1-selfhosted-gaps.md @@ -0,0 +1,77 @@ +# 2026-08-08 — v0.5.1: pesquisa de equivalentes para as lacunas do awesome-selfhosted + +## O que originou + +O PR 4 fechou registrando uma lacuna: o awesome-selfhosted não cobre auth, uptime, CI/CD, backup, PaaS, site estático nem VPN. O usuário respondeu antes do merge: + +> "o que acha de fazwermos uma pesquisa por equivalentes com melhor numero de estrelas no github para cada um deles? Tem um pro luma, o supabase tem o seu próprio, e vários outros interessantes que devemos nos conectar." + +Resultado: `docs/selfhosted/gaps.md`. Este log registra o método e o que a pesquisa revelou. + +## Método + +~90 repositórios candidatos consultados via `gh api repos/{owner}/{repo}` — `stargazers_count`, `license.spdx_id`, `pushed_at`, `archived`. **Nenhum número escrito de memória.** + +Onde a API devolveu `NOASSERTION`, o arquivo de licença foi baixado e lido (`repos/{repo}/license`). Esse segundo passo é o que produziu o achado principal. + +## O achado principal: open core é a terceira armadilha + +O PR 4 já tratava duas categorias de licença — copyleft (AGPL/GPL) e source-available (BUSL). A leitura dos arquivos revelou uma terceira, mais frequente e menos visível. + +**Treze projetos começam o arquivo de licença com _"Portions of this software are licensed as follows"_**: authentik, SuperTokens, Dokploy, Pangolin, SigNoz, Infisical, n8n, LiteLLM, Langfuse, GrowthBook, Meilisearch, Windmill, Duplicati. + +Open core significa que o núcleo é livre mas **SSO, RBAC e audit log ficam na edição paga**. É a armadilha mais cruel para um fundador: o projeto se apresenta como open source, é adotado, e a limitação só aparece quando chega o primeiro cliente corporativo pedindo login único — o clássico "SSO tax". + +Isso virou linha explícita no estágio 4.2: *"Check whether the feature you need is in the free edition before recommending an open-core option."* + +Correções de fato que a leitura trouxe: + +- **Sentry é FSL-1.1**, não BUSL — Functional Source License, que converte para Apache-2.0 depois de dois anos. Eu teria escrito BUSL de memória. +- **Vault é BUSL-1.1** (texto da MariaDB). O **OpenBao** existe exatamente por isso: fork pré-BUSL sob a Linux Foundation, MPL-2.0. +- **Open WebUI** usa licença própria com *"All rights reserved"*, apesar dos 148k de estrelas. +- **CapRover, Astro, NetBird e Borg** apareciam como `NOASSERTION` mas são Apache-2.0, MIT, BSD-3 e BSD — arquivo fora do padrão, licença permissiva. Sem a leitura, teriam sido marcados como suspeitos injustamente. + +## Sobre os dois projetos que o usuário citou + +### Supabase — estava certo + +`supabase/supabase`, Apache-2.0, **107.7k estrelas — o repositório mais estrelado de toda a pesquisa**. Auto-hospedável via Docker Compose. + +Registrado com ressalva honesta: são ~10 serviços no compose (Postgres, GoTrue, PostgREST, Realtime, Storage, Kong, Studio). Sobe fácil; operar em produção com backup e upgrade é outro trabalho. + +**Abriu uma pendência real:** a skill `deploy-vercel-supabase` cobre só o Supabase gerenciado. + +### Luma — não existe equivalente, e isso precisou ser dito + +A busca não encontrou clone. O Luma junta página de evento, RSVP sem atrito e calendário de comunidade; o que existe cobre **ticketing** (Hi.Events 4.0k, pretix 2.5k, alf.io 1.6k) ou **agendamento 1-a-1** (Cal.com 47.4k). + +O mais próximo em espírito é o **Mobilizon** (Framasoft), federado e com grupos — mas ele **não vive no GitHub**. O canônico é `framagit.org`, então nunca apareceria numa pesquisa por estrelas. No GitHub só há empacotamentos e espelhos. + +Optei por dizer isso explicitamente em vez de empurrar Cal.com como se fosse Luma. São produtos diferentes. + +Dois avisos que apareceram no caminho: **`calcom/cal.com` foi renomeado para `calcom/cal.diy`** (o redirect funciona, mas o nome mudou), e **Attendize está sem commits desde 2024-08** apesar de liderar em estrelas na categoria — motivo para não ranquear só por estrela. + +## Decisões worth preserving + +1. **`gaps.md` é MIT, não CC-BY-SA.** O resto de `docs/selfhosted/` é dado espelhado sob share-alike. Este arquivo é pesquisa autoral e fica sob a licença do OS. A distinção está numa tabela no topo do próprio arquivo, para ninguém herdar obrigação que não existe. + +2. **Não é gerado, e isso é dito em voz alta.** `sync-selfhosted.js` não o toca — o comentário do cabeçalho foi atualizado para listar os três arquivos curados à mão. Em troca, as estrelas envelhecem: o arquivo carrega a data e o comando de revalidação. + +3. **"Se você quer só uma escolha" em cada categoria.** Tabela de seis opções não decide nada para quem não é dev. Cada seção termina com uma recomendação única e o critério dela. + +4. **Estrela não decide.** Dito explicitamente no topo: sinal de tração, não de qualidade. Attendize lidera a categoria de eventos em estrelas e está abandonado; MinIO tem 61.4k e está sem commits desde 2026-04. + +5. **Recomendei contra self-hosting em uma categoria.** CI/CD: *"CI gerenciado é barato, e CI próprio é manutenção eterna."* O arquivo perde credibilidade se recomendar tudo. + +## Verificação + +- 90+ repos consultados; 2 retornaram 404 (`porter-dev/porter`, `framasoft/mobilizon`) e ambos estão registrados como tal. +- As 7 âncoras que `shortlist-saas.md` usa para apontar `gaps.md` foram conferidas contra o algoritmo de slug do GitHub — todas batem. +- Zero links relativos quebrados no repo. + +## Pendências abertas + +- **`deploy-vercel-supabase` só cobre o gerenciado.** Merece caminho paralelo, ou uma irmã `deploy-selfhosted`. +- **Nenhum dos 60+ projetos tem pack no registry.** Coolify, Uptime Kuma, Supabase, Keycloak, restic e Headscale justificariam one-pagers. +- **`cost-watchdog` poderia ler este arquivo** no estágio 4.2 em vez de raciocinar no abstrato sobre custo de gerenciado vs. self-hosted. +- **Sem revalidação automática.** Estrelas e licenças são de 2026-08-08. Vault e Sentry já mudaram de licença uma vez — vão mudar de novo. diff --git a/session-log/INDEX.md b/session-log/INDEX.md index 4357c03..15c2cda 100644 --- a/session-log/INDEX.md +++ b/session-log/INDEX.md @@ -6,6 +6,7 @@ Each entry captures the reasoning behind a material decision: what was true befo | Date | Topic | File | |---|---|---| +| 2026-08-08 | v0.5.1 — pesquisa de equivalentes self-hosted para as 7 lacunas + Supabase e alternativas ao Luma; 90+ repos consultados na API do GitHub, revelando "open core" como terceira armadilha de licença (13 projetos) | [`2026-08-08-v0.5.1-selfhosted-gaps.md`](2026-08-08-v0.5.1-selfhosted-gaps.md) | | 2026-08-08 | v0.5.0 PR 4 — awesome-selfhosted (1.346 projetos) espelhado em `docs/selfhosted/` sob CC-BY-SA 3.0 com carve-out de licença, shortlist curada por categoria de SaaS, e a pergunta gerenciado-vs-self-hosted no estágio 4.2 | [`2026-08-08-v0.5.0-selfhosted-catalog.md`](2026-08-08-v0.5.0-selfhosted-catalog.md) | | 2026-08-08 | v0.5.0 PR 2 — Pitch artifact created (none existed) at new stage 2.9, plus the "BP/Pitch online?" question with a mandatory redaction gate; publication added to the privacy rule as a form of processing | [`2026-08-08-v0.5.0-pitch-publication.md`](2026-08-08-v0.5.0-pitch-publication.md) | | 2026-08-08 | v0.5.0 PR 3 — skill audit: 6 core wizard skills had no frontmatter (invisible to auto-invocation), 10 more had no trigger phrases; 3 overlapping pairs cross-linked; `release-check` converted to a delegation table | [`2026-08-08-v0.5.0-skills-audit.md`](2026-08-08-v0.5.0-skills-audit.md) | From ec7494fd9db5075844f0cec179177f48daf05c82 Mon Sep 17 00:00:00 2001 From: lglucas Date: Sat, 8 Aug 2026 19:58:01 -0300 Subject: [PATCH 05/14] =?UTF-8?q?feat(hooks):=20kernel=20=E2=80=94=20bloqu?= =?UTF-8?q?eia=20commit=20de=20segredo=20e=20escrita=20em=20.env?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Até aqui o OS era 100% persuasão: regras que o modelo lê, skills que ele invoca. O settings.json versionado tinha três linhas e nenhum hook. A golden rule nº 1 é "nunca commite segredos" e nada impedia isso mecanicamente — o CI só pega depois do push. Dois PreToolUse, ambos Node sem dependência: - block-secret-commit.js (matcher Bash) — inspeciona o diff staged em qualquer git commit. Bloqueia se alguma linha ADICIONADA tem formato de credencial, ou se um .env/.pem/.key foi staged. - protect-env-files.js (Write|Edit|MultiEdit|NotebookEdit) — impede o agente de escrever em .env real. .env.example é liberado. Os padrões exigem FORMATO COMPLETO, não prefixo. A regra secrets.md cita "sk-" e "AKIA" como texto literal; casar por prefixo bloquearia commitar a própria regra que define os padrões. Agora é sk- mais 20 caracteres, AKIA mais exatamente 16, ghp_ mais exatamente 36, e assim por diante. O hook nunca imprime o valor casado — só arquivo e nome do padrão. Um alerta que ecoa a credencial no terminal a espalha em vez de contê-la. Só linhas adicionadas são inspecionadas: remover uma chave vazada precisa continuar possível. Ambos falham ABERTO em payload malformado. Hook que trava a sessão por engano é pior que hook nenhum — o usuário desliga tudo e perde junto o que funcionava. Escape hatch por execução via AIOS_ALLOW_SECRET_COMMIT=1 e AIOS_ALLOW_ENV_WRITE=1, com instrução de registrar o porquê no session-log. Verificado ponta a ponta em repo git temporário: commit com chave é bloqueado nomeando arquivo e padrão sem vazar o valor, arquivo limpo passa, e 12/12 casos de caminho .env incluindo Windows. O README documenta também o que deliberadamente NÃO virou hook — forçar ordem do wizard, exigir changelog, bloquear push pra main. Regra de bolso: hook para o que é irreversível. Co-Authored-By: Claude Opus 5 (1M context) --- .claude/hooks/README.md | 91 ++++++++++++++++++ .claude/hooks/block-secret-commit.js | 135 +++++++++++++++++++++++++++ .claude/hooks/protect-env-files.js | 71 ++++++++++++++ .claude/settings.example.json | 26 +++++- .claude/settings.json | 26 +++++- 5 files changed, 347 insertions(+), 2 deletions(-) create mode 100644 .claude/hooks/README.md create mode 100644 .claude/hooks/block-secret-commit.js create mode 100644 .claude/hooks/protect-env-files.js diff --git a/.claude/hooks/README.md b/.claude/hooks/README.md new file mode 100644 index 0000000..4b0830c --- /dev/null +++ b/.claude/hooks/README.md @@ -0,0 +1,91 @@ +# Hooks — o kernel do OS + +Todo o resto deste operating system é **instrução**: regras que o agente lê, skills que ele invoca, um wizard que ele segue. Funciona porque o modelo colabora. + +Hooks são a única camada que **não depende de colaboração.** São processos que o Claude Code executa antes da ferramenta rodar, e cujo código de saída ele não pode ignorar. + +Por isso existe pouco aqui, e por isso o que existe é só sobre segredo — a única classe de erro cujo custo não dá para desfazer pedindo desculpa. + +--- + +## O que está ativo + +| Hook | Dispara em | Bloqueia | +|---|---|---| +| [`block-secret-commit.js`](block-secret-commit.js) | `Bash` → qualquer `git commit` | commit cujo diff adiciona algo com formato de credencial, ou que staged um `.env`/`.pem`/`.key` | +| [`protect-env-files.js`](protect-env-files.js) | `Write`, `Edit`, `MultiEdit`, `NotebookEdit` | escrita em `.env` real (libera `.env.example`) | + +Configurados em [`../settings.json`](../settings.json). Contrato: **exit 0 permite, exit 2 bloqueia** e mostra o stderr ao Claude. + +--- + +## Por que os padrões exigem formato completo + +A regra [`../rules/secrets.md`](../rules/secrets.md) lista `sk-`, `ghp_`, `AKIA` como padrões a detectar. Se o hook casasse por prefixo, **bloquearia commitar a própria regra que define os padrões** — o arquivo contém aquele texto literalmente. + +Então os padrões exigem o formato inteiro: + +| Padrão | Exige | +|---|---| +| OpenAI | `sk-` + 20 caracteres ou mais | +| GitHub PAT | `ghp_` + exatamente 36 | +| GitHub fine-grained | `github_pat_` + 50 ou mais | +| AWS | `AKIA` + exatamente 16 maiúsculas/dígitos | +| Google | `AIza` + exatamente 35 | +| Slack | `xox[baprs]-` + 10 ou mais | +| Stripe | `sk_live_` / `rk_live_` + 20 ou mais | +| Chave privada | bloco `-----BEGIN ... PRIVATE KEY-----` | + +Documentação que menciona o prefixo passa. Uma chave real, não. + +**O hook nunca imprime o valor encontrado** — só o arquivo e o nome do padrão. Um alerta que ecoa a credencial no terminal a espalha em vez de contê-la. + +Só linhas **adicionadas** são inspecionadas. Remover uma chave vazada precisa continuar possível. + +--- + +## Escape hatch + +Falso positivo acontece. Cada hook tem uma variável de ambiente que o desliga por uma execução: + +```bash +AIOS_ALLOW_SECRET_COMMIT=1 git commit -m "fixture de teste com token falso" +AIOS_ALLOW_ENV_WRITE=1 +``` + +**Se usar, registre o porquê no `session-log/`.** Um escape sem justificativa vira hábito, e o hook para de servir para alguma coisa. + +--- + +## Requisito + +**Node.js.** Os hooks são `.js` sem nenhuma dependência — rodam com o Node que já está na máquina. + +A escolha foi por portabilidade: shell script quebra no Windows sem git-bash, e Python não é garantido. Node é o denominador comum de quem constrói SaaS, que é o público deste OS. + +Sem Node instalado, os hooks falham ao iniciar e o Claude Code segue sem eles. **O OS continua funcionando, só perde o kernel** — volta a depender de o modelo colaborar. + +--- + +## Adicionar um hook novo + +1. Escreva o `.js` em `.claude/hooks/`, lendo o payload JSON do stdin. +2. Saia com 0 para permitir, 2 para bloquear com mensagem no stderr. +3. **Falhe aberto** em payload malformado — um hook quebrado não pode travar a sessão inteira. +4. Registre em `settings.json` e `settings.example.json`. +5. Escreva o teste em `scripts/test/`. +6. Documente aqui, com o escape hatch. + +O ponto 3 é o mais importante. Um hook que bloqueia por engano é pior que hook nenhum: o usuário desliga tudo e perde junto o que funcionava. + +--- + +## O que deliberadamente NÃO virou hook + +Foi tentador, e seria errado: + +- **Forçar o wizard.** Bloquear escrita em `src/` antes da Fase 5 pune quem legitimamente quer só um protótipo rápido. O wizard convence; não prende. +- **Exigir changelog em todo commit.** Vira ruído em commit de typo. +- **Bloquear push para `main`.** Isso é branch protection do GitHub, e já existe. Hook local seria redundante e contornável. + +Regra de bolso: **hook para o que é irreversível.** Segredo vazado é irreversível. Ordem de estágio do wizard, não. diff --git a/.claude/hooks/block-secret-commit.js b/.claude/hooks/block-secret-commit.js new file mode 100644 index 0000000..2cedeb8 --- /dev/null +++ b/.claude/hooks/block-secret-commit.js @@ -0,0 +1,135 @@ +#!/usr/bin/env node +/** + * block-secret-commit.js — PreToolUse hook. Blocks `git commit` when the staged + * diff contains something shaped like a real credential, or stages a secret file. + * + * Purpose: turn golden rule #9 ("never hardcode secrets") from a request into a guarantee. + * The `secrets-scan` skill finds leaks when invoked; this stops them at the commit. + * Version: v0.5.2 + * Sprint: v0.5.2 P1 + * + * Contract: reads the PreToolUse JSON payload on stdin. Exit 0 allows the tool call; + * exit 2 blocks it and shows stderr to Claude. + * + * Escape hatch: AIOS_ALLOW_SECRET_COMMIT=1 (documented in .claude/hooks/README.md). + * + * NOTE ON PATTERNS: these require the full token shape, not just the prefix. The repo's + * own `.claude/rules/secrets.md` documents `sk-`, `AKIA` and friends as literal text — a + * prefix match would block committing the very rule that defines the patterns. + */ + +'use strict'; + +const { execFileSync } = require('child_process'); +const fs = require('fs'); + +const PATTERNS = [ + ['OpenAI-style key', /\bsk-[A-Za-z0-9_-]{20,}/], + ['GitHub personal token', /\bghp_[A-Za-z0-9]{36}\b/], + ['GitHub fine-grained token', /\bgithub_pat_[A-Za-z0-9_]{50,}/], + ['AWS access key id', /\bAKIA[0-9A-Z]{16}\b/], + ['Google API key', /\bAIza[0-9A-Za-z_-]{35}\b/], + ['Slack token', /\bxox[baprs]-[A-Za-z0-9-]{10,}/], + ['Private key block', /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----/], + ['Stripe secret key', /\b[sr]k_live_[A-Za-z0-9]{20,}/], +]; + +// Staged filenames that should never be committed. `.env.example` is the documented +// exception — it is how the OS tells you which variables exist, without their values. +const FORBIDDEN_FILE = /(^|\/)\.env(\.local|\.production|\.[a-z]+\.local)?$|\.pem$|\.key$|\.p12$|\.pfx$/i; +const ALLOWED_FILE = /(^|\/)\.env\.(example|sample|template)$/i; + +function readStdin() { + try { + return fs.readFileSync(0, 'utf8'); + } catch { + return ''; + } +} + +function git(args, cwd) { + try { + return execFileSync('git', args, { cwd, encoding: 'utf8', maxBuffer: 20 * 1024 * 1024 }); + } catch { + return ''; + } +} + +/** Exported for tests: scan a unified diff and a staged file list, return findings. */ +function scan(diff, stagedFiles) { + const findings = []; + + // 1. Secret-shaped strings in ADDED lines only — removing a leaked key must stay possible. + let currentFile = '(unknown)'; + for (const line of String(diff || '').split('\n')) { + const header = line.match(/^\+\+\+ b\/(.+)$/); + if (header) { currentFile = header[1]; continue; } + if (!line.startsWith('+') || line.startsWith('+++')) continue; + for (const [label, re] of PATTERNS) { + if (re.test(line)) findings.push({ file: currentFile, label }); + } + } + + // 2. Forbidden files being staged at all. + for (const f of stagedFiles || []) { + if (FORBIDDEN_FILE.test(f) && !ALLOWED_FILE.test(f)) { + findings.push({ file: f, label: 'secret-bearing file staged' }); + } + } + + // Deduplicate on file+label. The matched value is deliberately never retained. + const seen = new Set(); + return findings.filter(f => { + const k = `${f.file}::${f.label}`; + if (seen.has(k)) return false; + seen.add(k); + return true; + }); +} + +function isGitCommit(command) { + return /\bgit\s+(?:-[^\s]+\s+)*commit\b/.test(String(command || '')); +} + +function main() { + if (process.env.AIOS_ALLOW_SECRET_COMMIT === '1') process.exit(0); + + let payload = {}; + try { + payload = JSON.parse(readStdin() || '{}'); + } catch { + process.exit(0); // a malformed payload is not the user's problem — fail open + } + + const command = payload?.tool_input?.command || ''; + if (!isGitCommit(command)) process.exit(0); + + const cwd = payload?.cwd || process.cwd(); + + // `git commit -a` stages tracked modifications at commit time, so also inspect unstaged. + const includeUnstaged = /\bcommit\b[^&|;]*\s-[a-zA-Z]*a/.test(command); + const diff = git(['diff', '--cached', '--unified=0'], cwd) + + (includeUnstaged ? git(['diff', '--unified=0'], cwd) : ''); + const staged = git(['diff', '--cached', '--name-only'], cwd).split('\n').filter(Boolean); + + const findings = scan(diff, staged); + if (findings.length === 0) process.exit(0); + + const lines = findings.map(f => ` • ${f.file} — ${f.label}`); + + process.stderr.write( + `BLOQUEADO: este commit parece conter credencial.\n\n${lines.join('\n')}\n\n` + + `O que fazer:\n` + + ` 1. Tire o valor do código e ponha numa variável de ambiente.\n` + + ` 2. Confirme que o arquivo real está no .gitignore.\n` + + ` 3. Documente a variável (sem o valor) no .env.example.\n` + + ` 4. Se a chave já foi exposta, ROTACIONE — tirar do commit não desfaz o vazamento.\n\n` + + `Regra: .claude/rules/secrets.md · Workflow: .claude/skills/secrets-discipline/SKILL.md\n` + + `Falso positivo? Rode uma vez com AIOS_ALLOW_SECRET_COMMIT=1 e registre o porquê no session-log.\n` + ); + process.exit(2); +} + +module.exports = { scan, isGitCommit, PATTERNS, FORBIDDEN_FILE, ALLOWED_FILE }; + +if (require.main === module) main(); diff --git a/.claude/hooks/protect-env-files.js b/.claude/hooks/protect-env-files.js new file mode 100644 index 0000000..a2f0f43 --- /dev/null +++ b/.claude/hooks/protect-env-files.js @@ -0,0 +1,71 @@ +#!/usr/bin/env node +/** + * protect-env-files.js — PreToolUse hook. Stops Claude writing into real `.env` files. + * + * Purpose: the OS position is that real secrets live in the user's local environment and + * the agent maintains `.env.example` instead. This enforces that split. + * Version: v0.5.2 + * Sprint: v0.5.2 P1 + * + * Why separate from block-secret-commit.js: that hook guards the commit; this one guards + * the write. A `.env` can be written and never committed and still leak — through a log, + * a screenshot, or a paste into the chat. + * + * Contract: reads the PreToolUse JSON payload on stdin. Exit 0 allows the tool call; + * exit 2 blocks it and shows stderr to Claude. + * + * Escape hatch: AIOS_ALLOW_ENV_WRITE=1 (documented in .claude/hooks/README.md). + */ + +'use strict'; + +const fs = require('fs'); + +const REAL_ENV = /(^|[\\/])\.env(\.[A-Za-z0-9_-]+)?$/i; +const TEMPLATE_ENV = /(^|[\\/])\.env\.(example|sample|template|dist)$/i; + +/** Exported for tests. True when the path is a real env file, not a template. */ +function isProtectedEnvPath(filePath) { + const p = String(filePath || ''); + if (!p) return false; + if (TEMPLATE_ENV.test(p)) return false; + return REAL_ENV.test(p); +} + +function readStdin() { + try { + return fs.readFileSync(0, 'utf8'); + } catch { + return ''; + } +} + +function main() { + if (process.env.AIOS_ALLOW_ENV_WRITE === '1') process.exit(0); + + let payload = {}; + try { + payload = JSON.parse(readStdin() || '{}'); + } catch { + process.exit(0); // fail open on a malformed payload + } + + const filePath = payload?.tool_input?.file_path || payload?.tool_input?.notebook_path || ''; + if (!isProtectedEnvPath(filePath)) process.exit(0); + + process.stderr.write( + `BLOQUEADO: escrita em arquivo de ambiente real (${filePath}).\n\n` + + `Neste OS, o .env real é do usuário — o agente não escreve nele.\n\n` + + `O que fazer em vez disso:\n` + + ` 1. Adicione a variável ao .env.example, com valor placeholder e um comentário do que é.\n` + + ` 2. Peça ao usuário para preencher o valor real no .env dele, fora do chat.\n` + + ` 3. Nunca peça a chave colada na conversa — ela fica no histórico.\n\n` + + `Regra: .claude/rules/secrets.md · Workflow: .claude/skills/secrets-discipline/SKILL.md\n` + + `Precisa mesmo escrever? Rode uma vez com AIOS_ALLOW_ENV_WRITE=1.\n` + ); + process.exit(2); +} + +module.exports = { isProtectedEnvPath, REAL_ENV, TEMPLATE_ENV }; + +if (require.main === module) main(); diff --git a/.claude/settings.example.json b/.claude/settings.example.json index 2a0370d..aa47ab0 100644 --- a/.claude/settings.example.json +++ b/.claude/settings.example.json @@ -1,4 +1,28 @@ { "$schema": "https://json.schemastore.org/claude-code-settings.json", - "includeCoAuthoredBy": true + "includeCoAuthoredBy": true, + "hooks": { + "PreToolUse": [ + { + "matcher": "Bash", + "hooks": [ + { + "type": "command", + "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/block-secret-commit.js\"", + "timeout": 15 + } + ] + }, + { + "matcher": "Write|Edit|MultiEdit|NotebookEdit", + "hooks": [ + { + "type": "command", + "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/protect-env-files.js\"", + "timeout": 10 + } + ] + } + ] + } } diff --git a/.claude/settings.json b/.claude/settings.json index 2a0370d..aa47ab0 100644 --- a/.claude/settings.json +++ b/.claude/settings.json @@ -1,4 +1,28 @@ { "$schema": "https://json.schemastore.org/claude-code-settings.json", - "includeCoAuthoredBy": true + "includeCoAuthoredBy": true, + "hooks": { + "PreToolUse": [ + { + "matcher": "Bash", + "hooks": [ + { + "type": "command", + "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/block-secret-commit.js\"", + "timeout": 15 + } + ] + }, + { + "matcher": "Write|Edit|MultiEdit|NotebookEdit", + "hooks": [ + { + "type": "command", + "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/protect-env-files.js\"", + "timeout": 10 + } + ] + } + ] + } } From f8160efca45e4e0bc7b11869a2e8e537f941907c Mon Sep 17 00:00:00 2001 From: lglucas Date: Sat, 8 Aug 2026 20:21:30 -0300 Subject: [PATCH 06/14] fix(commands,agents): frontmatter nos 11 comandos e gatilhos nos 12 agentes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mesmo defeito que o PR #12 corrigiu nas skills, uma camada abaixo — duas vezes. COMANDOS: 11 de 11 não tinham frontmatter nenhum. Começavam direto no "# /nome". Sem a chave description, a lista de slash commands sai crua e o usuário não sabe o que cada um faz sem abrir o arquivo. Agora todos têm description em português, e o /sprint-start ganhou argument-hint espelhando o formato que já estava documentado no corpo dele. AGENTES: 10 de 12 tinham descrição puramente declarativa — "Reviews business model, pricing, CAC" — que diz o que o agente faz e nunca quando acioná-lo. Só bug-triage-agent e launch-agent tinham gatilho, e não por acaso: são os dois nascidos no pack vibe-coder v0.3.0. A mesma fratura geracional das skills. comandos com frontmatter: 0/11 -> 11/11 agentes com gatilho: 2/12 -> 12/12 Casos que a auditoria destacou: - legal-compliance-agent é acionado por dez arquivos vivos (ETHOS, launch-agent, deploy-vercel-supabase, WIZARD 4.2, gaps.md, shortlist-saas, registry packs) e tinha zero gatilho. - competitor-research-agent e dev-product-agent são citados só por prosa no WIZARD ("Competitor Research Agent"), nunca pelo slug — vínculo mais fraco, agora compensado por descrição acionável. Nenhuma chave name: foi alterada, então toda referência existente por slug ou por caminho segue válida. Verificado: 23/23 frontmatter YAML parseável. Co-Authored-By: Claude Opus 5 (1M context) --- .claude/agents/business-red-team-agent.md | 2 +- .claude/agents/competitor-research-agent.md | 2 +- .claude/agents/coordinator-agent.md | 2 +- .claude/agents/copywriter-agent.md | 2 +- .claude/agents/dev-product-agent.md | 2 +- .claude/agents/devils-advocate-agent.md | 2 +- .claude/agents/legal-compliance-agent.md | 2 +- .claude/agents/market-research-agent.md | 2 +- .claude/agents/research-agent.md | 2 +- .claude/agents/technical-security-red-team-agent.md | 2 +- .claude/commands/bp-review.md | 4 ++++ .claude/commands/grow-sustainably.md | 4 ++++ .claude/commands/multi-ai-review.md | 4 ++++ .claude/commands/processize.md | 4 ++++ .claude/commands/project-start.md | 4 ++++ .claude/commands/prototype-lab.md | 4 ++++ .claude/commands/registry-pick.md | 4 ++++ .claude/commands/research-waves.md | 4 ++++ .claude/commands/sprint-close.md | 4 ++++ .claude/commands/sprint-plan.md | 4 ++++ .claude/commands/sprint-start.md | 5 +++++ 21 files changed, 55 insertions(+), 10 deletions(-) diff --git a/.claude/agents/business-red-team-agent.md b/.claude/agents/business-red-team-agent.md index 97a599b..652110d 100644 --- a/.claude/agents/business-red-team-agent.md +++ b/.claude/agents/business-red-team-agent.md @@ -1,6 +1,6 @@ --- name: business-red-team-agent -description: Reviews business model, pricing, CAC, LTV, GTM, margins, operations, and financial realism. +description: Attacks the business model — pricing, CAC, LTV, margins, GTM, retention and financial realism — proposing a fix for each hole. Runs in Wave 2 of WIZARD stage 2.5, and as a reviewer role in multi-ai-review. Use when the user says "quanto devo cobrar?", "isso fecha a conta?", "esse preço faz sentido?", "dá pra viver disso?", or before any pricing or packaging change. tools: Read, Write, Edit, Grep, Glob model: opus --- diff --git a/.claude/agents/competitor-research-agent.md b/.claude/agents/competitor-research-agent.md index 8ae4f32..69709cf 100644 --- a/.claude/agents/competitor-research-agent.md +++ b/.claude/agents/competitor-research-agent.md @@ -1,6 +1,6 @@ --- name: competitor-research-agent -description: Finds, filters, and analyzes competitors for a new project. +description: Finds up to 20 competitors, narrows to the top 5, and analyzes positioning, pricing, onboarding, integrations and public complaints into knowledge-base/competitors/. Runs in Wave 1 of WIZARD stage 2.4. Use when the user asks "quem são meus concorrentes?", "alguém já faz isso?", "por que alguém escolheria eu e não eles?". Never invents a competitor or a price. tools: Read, Write, Edit, WebSearch, WebFetch model: sonnet --- diff --git a/.claude/agents/coordinator-agent.md b/.claude/agents/coordinator-agent.md index 873112b..834fa6f 100644 --- a/.claude/agents/coordinator-agent.md +++ b/.claude/agents/coordinator-agent.md @@ -1,6 +1,6 @@ --- name: coordinator-agent -description: Consolidates multi-agent work, resolves conflicts, checks completeness, and approves deliverables. +description: Consolidates the output of several agents, resolves their contradictions, checks completeness and approves the deliverable. Runs in Wave 3 of WIZARD stage 2.6 and as the final gate in release-check. Use when two agents disagree, or when the user asks "e agora, quem tá certo?", "dá pra fechar isso?", "tá completo?", "posso considerar pronto?". tools: Read, Write, Edit, Grep, Glob model: opus --- diff --git a/.claude/agents/copywriter-agent.md b/.claude/agents/copywriter-agent.md index 664902f..1dd4ab2 100644 --- a/.claude/agents/copywriter-agent.md +++ b/.claude/agents/copywriter-agent.md @@ -1,6 +1,6 @@ --- name: copywriter-agent -description: Turns structured research and decisions into persuasive, clear business and product documents. +description: Turns validated research and decisions into readable, persuasive text — the Business Plan v0.0.1 in Wave 3 of WIZARD stage 2.6, plus landing copy, product messaging and emails later. Use when the user says "escreve isso bonito", "como eu explico isso pro investidor?", "faz o texto da landing", "isso tá confuso demais". Never adds a claim the research does not support. tools: Read, Write, Edit, Grep, Glob model: sonnet --- diff --git a/.claude/agents/dev-product-agent.md b/.claude/agents/dev-product-agent.md index e4b26cc..d95fd8f 100644 --- a/.claude/agents/dev-product-agent.md +++ b/.claude/agents/dev-product-agent.md @@ -1,6 +1,6 @@ --- name: dev-product-agent -description: Reviews product scope, architecture, implementation plans, and technical feasibility. +description: Reviews product scope, architecture and implementation plans for feasibility — whether what is described can actually be built at this size, in this order, by this team. Reads PRODUCT-BRIEF.md and TECHNICAL-PLAN.md. Use when the user asks "dá pra fazer isso no MVP?", "isso é muita coisa?", "por onde eu começo a construir?", "esse escopo cabe na sprint?". tools: Read, Write, Edit, Grep, Glob, Bash model: sonnet --- diff --git a/.claude/agents/devils-advocate-agent.md b/.claude/agents/devils-advocate-agent.md index c354c27..1e909c1 100644 --- a/.claude/agents/devils-advocate-agent.md +++ b/.claude/agents/devils-advocate-agent.md @@ -1,6 +1,6 @@ --- name: devils-advocate-agent -description: Stress-tests ideas, business plans, assumptions, and sprint plans while proposing concrete fixes. +description: Attacks weak assumptions, contradictions and fragile claims in an idea, BP or sprint plan — and proposes a concrete fix for every objection. Runs in Wave 2 of WIZARD stage 2.5, and as a reviewer role in multi-ai-review. Use when the user says "acha que isso funciona?", "onde isso pode dar errado?", "me critica isso", "tá bom demais pra ser verdade?". tools: Read, Write, Edit, Grep, Glob model: opus --- diff --git a/.claude/agents/legal-compliance-agent.md b/.claude/agents/legal-compliance-agent.md index 41d27d7..c574bc2 100644 --- a/.claude/agents/legal-compliance-agent.md +++ b/.claude/agents/legal-compliance-agent.md @@ -1,6 +1,6 @@ --- name: legal-compliance-agent -description: Vibe-coder-friendly legal baseline — Privacy Policy, Terms of Service, LGPD/GDPR data flows, age gates, refund policy, cookie disclosure. Generates plain-Portuguese first drafts that a real lawyer can later review. Activated before public launch, before collecting user data, or when payments are wired. +description: Vibe-coder-friendly legal baseline — Privacy Policy, Terms of Service, LGPD/GDPR data flows, age gates, refund policy, cookie disclosure. Generates plain-Portuguese first drafts a real lawyer can later review; never a legal opinion. Activated before public launch, before collecting user data, before charging, and when the user says "preciso de política de privacidade?", "e a LGPD?", "posso usar essa licença no meu SaaS?", "isso me processa?". Activated before public launch, before collecting user data, or when payments are wired. --- # Legal Compliance Agent diff --git a/.claude/agents/market-research-agent.md b/.claude/agents/market-research-agent.md index cfc6d90..fc4c12c 100644 --- a/.claude/agents/market-research-agent.md +++ b/.claude/agents/market-research-agent.md @@ -1,6 +1,6 @@ --- name: market-research-agent -description: Researches market context, trends, customer behavior, and validation sources. +description: Researches market size, customer behaviour, regulatory constraints and credible benchmarks into knowledge-base/market/, always with a source index. Runs in Wave 1 of WIZARD stage 2.4. Use when the user asks "esse mercado existe?", "quantas pessoas têm esse problema?", "tem regulação nisso?", "quanto o pessoal cobra por isso?". Never fabricates a market number — asks for links when it cannot verify. tools: Read, Write, Edit, WebSearch, WebFetch model: sonnet --- diff --git a/.claude/agents/research-agent.md b/.claude/agents/research-agent.md index 648afb0..1dec976 100644 --- a/.claude/agents/research-agent.md +++ b/.claude/agents/research-agent.md @@ -1,6 +1,6 @@ --- name: research-agent -description: Performs source-backed research and separates facts from assumptions. +description: Does general source-backed research into knowledge-base/, always separating fact-with-source from inference, assumption and open question per .claude/rules/research-discipline.md. Broader than the market and competitor agents — use it for anything else the project needs verified. Triggers on "pesquisa isso pra mim", "isso é verdade?", "tem dado sobre isso?", "de onde veio esse número?". Says "não encontrei" instead of inventing. tools: Read, Write, Edit, WebSearch, WebFetch model: sonnet --- diff --git a/.claude/agents/technical-security-red-team-agent.md b/.claude/agents/technical-security-red-team-agent.md index 5f1a5e8..5f6762a 100644 --- a/.claude/agents/technical-security-red-team-agent.md +++ b/.claude/agents/technical-security-red-team-agent.md @@ -1,6 +1,6 @@ --- name: technical-security-red-team-agent -description: Reviews technical feasibility, architecture, security, privacy, compliance, scalability, and MVP complexity. +description: Attacks technical feasibility, architecture, security, privacy, compliance, scalability and MVP complexity — proposing a fix for each risk. Runs in Wave 2 of WIZARD stage 2.5, and as a reviewer role in multi-ai-review. Use when the user says "isso é seguro?", "aguenta quanta gente?", "dá pra construir isso mesmo?", "e se alguém tentar invadir?", or before wiring auth, payments or personal data. tools: Read, Write, Edit, Grep, Glob, Bash model: opus --- diff --git a/.claude/commands/bp-review.md b/.claude/commands/bp-review.md index 6a3d1dd..2c1ae0f 100644 --- a/.claude/commands/bp-review.md +++ b/.claude/commands/bp-review.md @@ -1,3 +1,7 @@ +--- +description: Aplica suas correções ao Business Plan e roda o impact review — preço mexe em projeção e LTV, persona mexe em GTM e escopo. Produz o BP v0.0.2. +--- + # /bp-review Run BP revision after user feedback: apply corrections, run impact review, produce BP v0.0.2, update changelog and session log. diff --git a/.claude/commands/grow-sustainably.md b/.claude/commands/grow-sustainably.md index 44996dd..e28a918 100644 --- a/.claude/commands/grow-sustainably.md +++ b/.claude/commands/grow-sustainably.md @@ -1,3 +1,7 @@ +--- +description: Planeja o crescimento de 100 para ~1000 usuários sem queimar fundador, caixa nem base. Sucessor do first-100-users. Use ao dizer "já tenho 100 usuários, e agora?" ou "o WhatsApp 1-a-1 não escala mais". +--- + # /grow-sustainably Plan post-first-100-users growth without burning out the founder, the budget, or the user base. diff --git a/.claude/commands/multi-ai-review.md b/.claude/commands/multi-ai-review.md index 1fc0e75..bcc2bf8 100644 --- a/.claude/commands/multi-ai-review.md +++ b/.claude/commands/multi-ai-review.md @@ -1,3 +1,7 @@ +--- +description: Passa uma decisão difícil de reverter por 2–4 revisores independentes e reconcilia as divergências antes de você agir. Use ao dizer "não dá pra desfazer fácil" — arquitetura, segurança, preço, deploy, texto jurídico. +--- + # /multi-ai-review Cross-review a hard-to-reverse decision through 2–4 independent reviewer roles, reconcile disagreements, and decide proceed / modify / block before committing. diff --git a/.claude/commands/processize.md b/.claude/commands/processize.md index c672bc1..da037dd 100644 --- a/.claude/commands/processize.md +++ b/.claude/commands/processize.md @@ -1,3 +1,7 @@ +--- +description: Transforma um fluxo que você já validou na mão em processo documentado e parcialmente automatizável. Use ao dizer "tô fazendo isso toda semana" ou "vamos automatizar?". Nunca automatiza o que ainda não funcionou manualmente. +--- + # /processize Codify a manually-validated workflow into a documented, partially-automatable process. Validate-then-automate, never the reverse. diff --git a/.claude/commands/project-start.md b/.claude/commands/project-start.md index 62c001a..7dbd5c2 100644 --- a/.claude/commands/project-start.md +++ b/.claude/commands/project-start.md @@ -1,3 +1,7 @@ +--- +description: Inicia o Project Genesis Wizard — do "me fale sobre teu projeto" até o primeiro sprint de código, em 5 fases. Não escreve código. +--- + # /project-start Start the Project Genesis Wizard. diff --git a/.claude/commands/prototype-lab.md b/.claude/commands/prototype-lab.md index 77a03db..4c4c054 100644 --- a/.claude/commands/prototype-lab.md +++ b/.claude/commands/prototype-lab.md @@ -1,3 +1,7 @@ +--- +description: Cria o Prototype Lab da Fase 3 — três direções visuais distintas em HTML/CSS/JS com o mesmo mock data. Roda ANTES do Product Brief, não depois. +--- + # /prototype-lab Create the isolated HTML Prototype Lab with three distinct UI/UX directions using the same mock data. diff --git a/.claude/commands/registry-pick.md b/.claude/commands/registry-pick.md index 8d2a05b..4c9a73f 100644 --- a/.claude/commands/registry-pick.md +++ b/.claude/commands/registry-pick.md @@ -1,3 +1,7 @@ +--- +description: Recomenda packs externos do registry que servem pro projeto atual. Roda duas vezes no wizard — packs de design no 3.1, stack completa no 4.3. Nunca instala nada. +--- + # /registry-pick Recommend external repository packs from the registry that fit the current project. diff --git a/.claude/commands/research-waves.md b/.claude/commands/research-waves.md index b6e0bc9..07e38e6 100644 --- a/.claude/commands/research-waves.md +++ b/.claude/commands/research-waves.md @@ -1,3 +1,7 @@ +--- +description: Executa as 3 ondas de pesquisa da Fase 2 — mercado e concorrentes, red team, consolidação e BP v0.0.1. Nunca inventa dado de mercado. +--- + # /research-waves Prepare or execute the 3-wave research plan from `WIZARD.md`. diff --git a/.claude/commands/sprint-close.md b/.claude/commands/sprint-close.md index e5ab978..98e91a6 100644 --- a/.claude/commands/sprint-close.md +++ b/.claude/commands/sprint-close.md @@ -1,3 +1,7 @@ +--- +description: Fecha a sprint ativa — atualiza changelog e session log, checa a DoD e prepara a tag. Use ao dizer "fecha a sprint" ou "terminei essa etapa". +--- + # /sprint-close Close the active sprint. diff --git a/.claude/commands/sprint-plan.md b/.claude/commands/sprint-plan.md index 55b999d..4490fcb 100644 --- a/.claude/commands/sprint-plan.md +++ b/.claude/commands/sprint-plan.md @@ -1,3 +1,7 @@ +--- +description: Monta o roadmap de 14–20 sprints com DoD, entregáveis, gates de segurança e riscos. Roda no estágio 4.4, depois do Product Brief e do Technical Plan. +--- + # /sprint-plan Create or update the 14–20 sprint roadmap with DoD, deliverables, agents, skills, tests, security gates, risks, and artifacts. diff --git a/.claude/commands/sprint-start.md b/.claude/commands/sprint-start.md index fe6a56c..91b3b4f 100644 --- a/.claude/commands/sprint-start.md +++ b/.claude/commands/sprint-start.md @@ -1,3 +1,8 @@ +--- +description: Abre uma sprint — cria a branch, o doc da sprint e o objetivo com DoD. Use quando disser "vamos começar a sprint" ou ao terminar a anterior. +argument-hint: sprint=NN theme="Foundation" dates="YYYY-MM-DD to YYYY-MM-DD" +--- + # /sprint-start Start a new sprint. From 9ee500557dcf6c7f4ba2a009d541a1a2479c2b90 Mon Sep 17 00:00:00 2001 From: lglucas Date: Sat, 8 Aug 2026 20:33:18 -0300 Subject: [PATCH 07/14] =?UTF-8?q?feat(ci):=20os-self-test=20vira=20script?= =?UTF-8?q?=20execut=C3=A1vel=20e=20roda=20no=20CI?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A skill os-self-test existia pra validar coerência do OS, mas dependia de alguém lembrar de invocá-la — e três session-logs (2026-04-30, 2026-05-09, 2026-08-08) registram justamente ela NÃO sendo executada quando teria ajudado. Verificação que depende de memória não é verificação. scripts/os-self-test.js faz 8 grupos de checagem: estrutura canônica, frontmatter de skills/agents/commands, links relativos, integridade do registry (pack <-> INDEX nos dois sentidos), indexação do session-log, hooks declarados vs. presentes em disco, higiene do gitignore, e artefatos de projeto. Sai 0 coerente, 1 com erro. Dois modos, detectados pelo marcador .aios-self: no repo do OS os artefatos de projeto NÃO devem existir; num projeto derivado a ausência deles é aviso e não erro, porque o wizard pode não ter chegado na fase. Novo job "OS coherence" no CI, em paralelo ao lint-docs existente. Dois achados durante a implementação: - Falso positivo em ./rules. O check contava entradas de diretório, e o repo tem rules/quality e rules/stack-specific vazios e não versionados. Git não os vê, readdir sim — então falhava local e passava no CI. Agora conta arquivos recursivamente, o mesmo critério do checkout. - .claude/skills/external/ não tinha SKILL.md nem README. A regra agora é: diretório sob skills/ precisa de um dos dois, e a ausência dos dois indica skill quebrada. Como external/ é legitimamente diretório de referência, ganhou README declarando isso — e explicando por que o OS aponta pra skills de terceiros em vez de copiá-las. A skill virou wrapper: invoca o script e interpreta o resultado. Decidir se link quebrado significa arquivo faltando ou link sobrando continua sendo trabalho do modelo. Estado atual: 67 verificações passam, zero erro, zero aviso. Co-Authored-By: Claude Opus 5 (1M context) --- .claude/skills/external/README.md | 29 +++ .claude/skills/os-self-test/SKILL.md | 100 ++++------ .github/workflows/ci.yml | 16 ++ scripts/os-self-test.js | 275 +++++++++++++++++++++++++++ 4 files changed, 357 insertions(+), 63 deletions(-) create mode 100644 .claude/skills/external/README.md create mode 100644 scripts/os-self-test.js diff --git a/.claude/skills/external/README.md b/.claude/skills/external/README.md new file mode 100644 index 0000000..5239a89 --- /dev/null +++ b/.claude/skills/external/README.md @@ -0,0 +1,29 @@ +# Skills externas — referências, não código + +Este diretório **não contém skills**. Não há `SKILL.md` aqui, e não deve haver. + +Ele guarda ponteiros para coleções de skills mantidas por terceiros: o que são, por que interessam, e como instalar a partir do upstream — sem copiar o código para dentro deste repositório. + +## Por que ponteiro em vez de cópia + +[`docs/skill-system.md`](../../../docs/skill-system.md) diz: *"Do not vendor third-party skill repos unless the license and attribution are clear."* + +Copiar skill de terceiro para cá cria três problemas de uma vez: a licença vem junto e nem sempre é compatível, a cópia congela numa versão e apodrece, e o usuário perde o upstream de vista quando precisa de suporte. + +A exceção documentada no OS é `docs/selfhosted/`, onde o dado é de fato copiado — mas lá a licença é explícita, o carve-out está declarado e existe script de re-sincronização. A justificativa está em [`UPSTREAM-SOURCES.md`](../../../UPSTREAM-SOURCES.md). + +## O que tem aqui + +| Arquivo | Upstream | +|---|---| +| [`affaan-everything-claude-code.md`](affaan-everything-claude-code.md) | [affaan-m/everything-claude-code](https://github.com/affaan-m/everything-claude-code) | + +Para o catálogo completo de repositórios instaláveis sobre este OS — incluindo coleções de skills — veja [`docs/registry/INDEX.md`](../../../docs/registry/INDEX.md) e a tag [`agents-marketplace`](../../../docs/registry/tags/agents-marketplace.md). + +## Adicionar uma referência + +1. Crie `-.md` aqui, com URL, licença, o que traz e quando vale instalar. +2. Se o repo também merece entrar no catálogo instalável, crie o one-pager em `docs/registry/packs/` e indexe. +3. Se ele influenciou o desenho deste OS, registre em `UPSTREAM-SOURCES.md`. + +> Este README existe também por um motivo mecânico: `scripts/os-self-test.js` falha em qualquer diretório sob `.claude/skills/` que não tenha `SKILL.md` nem `README.md` — a ausência dos dois indica skill quebrada. Este arquivo é como o diretório se declara referência, e não defeito. diff --git a/.claude/skills/os-self-test/SKILL.md b/.claude/skills/os-self-test/SKILL.md index d5094c5..ca0f5a9 100644 --- a/.claude/skills/os-self-test/SKILL.md +++ b/.claude/skills/os-self-test/SKILL.md @@ -1,84 +1,58 @@ --- name: os-self-test -description: Verify the AI Dev Operating System is in a coherent state inside a project. Detects missing canonical files, broken cross-references, version drift, gitignore gaps, stale paths after a migration, and orphaned artifacts. Run after major edits to the OS, after renaming or moving canonical files, before opening a new sprint, before a release, and when the user says "tá tudo certo aqui?", "quebrou alguma coisa na estrutura?", "faz um check geral", "os links estão funcionando?". +description: Verify the AI Dev Operating System is in a coherent state inside a project. Detects missing canonical files, broken cross-references, skills/agents/commands without frontmatter, registry drift, unindexed session logs, unwired hooks and gitignore gaps. Run after major edits to the OS, after renaming or moving canonical files, before opening a new sprint, before a release, and when the user says "tá tudo certo aqui?", "quebrou alguma coisa na estrutura?", "faz um check geral", "os links estão funcionando?". --- # OS Self-Test -## When to run this skill +## Rode o script -- After the user manually edited the OS (rules, agents, skills, commands). -- Before opening a new sprint. -- Before tagging a release. -- When something feels off ("Claude tá agindo estranho"). - -## Checks - -### 1. Canonical structure present - -- [ ] `CLAUDE.md` at root -- [ ] `START-HERE.md` at root -- [ ] `WIZARD.md` at root -- [ ] `.claude/` directory with `agents/`, `rules/`, `skills/`, `commands/` -- [ ] No duplicate `agents/`, `rules/`, `skills/`, `commands/` at root +```bash +node scripts/os-self-test.js +``` -### 2. Required artifacts (if a project is in progress) +É a verificação inteira. Exit `0` = coerente, exit `1` = pelo menos um erro. -- [ ] `docs/product/PRODUCT-BRIEF.md` -- [ ] `docs/business/BUSINESS-PLAN.md` -- [ ] `docs/technical/TECHNICAL-PLAN.md` -- [ ] `docs/SPRINTS.md` -- [ ] `CHANGELOG.md` -- [ ] `session-log/INDEX.md` +**Isto era um checklist manual dentro deste arquivo, e esse era o problema.** Verificação que depende de alguém lembrar não é verificação — três session-logs (`2026-04-30`, `2026-05-09`, `2026-08-08`) registram esta skill não sendo executada exatamente quando teria ajudado. Desde a v0.5.2 é script, e o CI roda em todo push e PR. -### 3. Version consistency +## O que o script verifica -- [ ] README badge version matches latest `RELEASE-NOTES-vX.Y.Z.md` -- [ ] CHANGELOG top entry version matches release notes -- [ ] `templates/project/CLAUDE.md` version is a placeholder (`0.0.1`), not a real OS version +| Grupo | Verifica | +|---|---| +| Estrutura canônica | `CLAUDE.md`, `START-HERE.md`, `WIZARD.md`, `README.md`, `CHANGELOG.md`, `LICENSE`, `.claude/{agents,rules,skills,commands}`, e duplicata na raiz | +| Frontmatter | toda skill tem `name` + `description` e o `name` bate com o diretório; todo agente e comando tem `description` | +| Links | todo link relativo `.md` do repo resolve | +| Registry | todo pack está no `INDEX.md`, e todo link do `INDEX.md` aponta pack existente | +| Session-log | toda entrada datada está indexada | +| Hooks | os hooks declarados em `settings.json` existem em disco, e todo hook em disco está declarado | +| Gitignore | cobre `.env`, `node_modules/`, `CLAUDE.local.md` | +| Artefatos | modo repo-do-OS *versus* projeto derivado, detectado pelo marcador `.aios-self` | -### 4. Gitignore baseline +## Dois modos -- [ ] `.env` and friends ignored -- [ ] `node_modules/` ignored -- [ ] `CLAUDE.local.md` ignored -- [ ] `*.zip` and archive patterns ignored -- [ ] Personal canonical references (e.g. `docs/instrucoes-master.md`) ignored +O script se adapta ao contexto: -### 5. Cross-reference integrity +- **Repo do AI Dev OS** (tem `.aios-self`) — os artefatos de projeto (`BUSINESS-PLAN.md`, `PRODUCT-BRIEF.md`…) **não** devem existir; se existirem, avisa. +- **Projeto derivado** — os mesmos artefatos são esperados, e a ausência vira aviso e não erro, porque o wizard pode simplesmente não ter chegado naquela fase. -- [ ] No reference to deleted paths (`agents/`, `rules/`, `skills/`, `commands/` at root) -- [ ] No reference to stale release notes -- [ ] All README links resolve to existing files +## Seu trabalho quando falha -### 6. Skill / agent header sanity +O script diz **o que** está quebrado. Interpretar e consertar continua sendo trabalho seu: -- [ ] Every `SKILL.md` has frontmatter with `name` and `description` -- [ ] Every agent file has clear "use when" guidance -- [ ] No skill or agent references a deleted command +1. Rode e leia os erros. +2. Para cada um, decida se o certo é corrigir a referência ou remover o alvo — link quebrado às vezes significa que falta o arquivo, às vezes que sobra o link. +3. Avisos (🟡) não bloqueiam, mas acumulam. Skill sem frase-gatilho na descrição é o caso típico: funciona, mas ninguém a invoca. +4. Se consertar algo estrutural, registre no `session-log/`. -## Output format +## Quando rodar além do CI -``` -🩺 OS Self-Test — [date] - -Canonical structure: ✅ -Required artifacts: ⚠️ 3 of 6 present (project may be early — OK if pre-coding) -Version consistency: ✅ -Gitignore baseline: ✅ -Cross-reference scan: ❌ 2 issues found: - • docs/foo.md links to deleted skills/secrets-scan/ - • README badge points to RELEASE-NOTES-v0.1.0.md (deleted) -Skill / agent headers: ✅ - -Action needed: fix the 2 cross-reference issues above before next sprint. -``` +- Depois de renomear ou mover arquivo canônico. +- Depois de mergear uma pilha de PRs. +- Antes de abrir sprint ou cortar release — o `release-check` já delega para cá. +- Quando o usuário desconfiar que alguma coisa quebrou. -## Implementation note +## Related -When asked to run, Claude should: -1. Glob the canonical paths. -2. Grep for deleted-path references using known migration mappings. -3. Read the README badge URL and verify the file exists. -4. Read CHANGELOG top entry and compare versions. -5. Produce the report above with specific line numbers for any failures. +- Script: `scripts/os-self-test.js` +- Testes do próprio script: `scripts/test/` +- Gate de release que o invoca: [`release-check`](../release-check/SKILL.md) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ada282a..68a8e8a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -7,6 +7,22 @@ on: branches: [main] jobs: + os-self-test: + runs-on: ubuntu-latest + name: OS coherence + steps: + - uses: actions/checkout@v4 + + - uses: actions/setup-node@v4 + with: + node-version: '20' + + # Canonical structure, frontmatter coverage across skills/agents/commands, + # relative link integrity, registry ↔ INDEX consistency, session-log indexing, + # hooks wiring, gitignore hygiene. Exits non-zero on any error. + - name: Run os-self-test + run: node scripts/os-self-test.js + lint-docs: runs-on: ubuntu-latest name: Markdown structure & links diff --git a/scripts/os-self-test.js b/scripts/os-self-test.js new file mode 100644 index 0000000..d2ad338 --- /dev/null +++ b/scripts/os-self-test.js @@ -0,0 +1,275 @@ +#!/usr/bin/env node +/** + * os-self-test.js — verifies the AI Dev Operating System is internally coherent. + * + * Purpose: the `os-self-test` skill did this, but only when a human or a model + * remembered to invoke it — and three session logs record it NOT being run + * when it would have helped. As a script it runs in CI, every time. + * Version: v0.5.2 + * Sprint: v0.5.2 P3 + * + * Usage: + * node scripts/os-self-test.js # human-readable report + * node scripts/os-self-test.js --quiet # suppress the pass count + * + * Exit 0 = coherent (warnings allowed). Exit 1 = at least one error. + * + * Two modes, detected via the `.aios-self` marker: + * - OS repo → checks the OS itself; project artifacts must NOT exist + * - derived project → checks the OS is installed correctly inside a real project + */ + +'use strict'; + +const fs = require('fs'); +const path = require('path'); + +const ROOT = path.resolve(__dirname, '..'); +const QUIET = process.argv.includes('--quiet'); + +const errors = []; +const warnings = []; +const passes = []; + +const fail = (check, detail) => errors.push({ check, detail }); +const warn = (check, detail) => warnings.push({ check, detail }); +const pass = (check) => passes.push(check); + +const abs = (p) => path.join(ROOT, p); +const exists = (p) => fs.existsSync(abs(p)); +const read = (p) => fs.readFileSync(abs(p), 'utf8'); +const isOsRepo = exists('.aios-self'); + +/** Every .md in the repo, excluding git internals and dependencies. */ +function allMarkdown(dir = ROOT, out = []) { + for (const entry of fs.readdirSync(dir, { withFileTypes: true })) { + if (entry.name === '.git' || entry.name === 'node_modules') continue; + const full = path.join(dir, entry.name); + if (entry.isDirectory()) allMarkdown(full, out); + else if (entry.name.endsWith('.md')) out.push(full); + } + return out; +} + +/** + * True when a directory contains at least one real file, at any depth. + * + * Counting directory ENTRIES instead would false-positive on empty leftover folders: + * this repo has `rules/quality/` and `rules/stack-specific/` sitting empty and untracked, + * which git never sees but readdir does. CI checks out from git, so the script has to + * apply the same standard or it fails locally and passes in CI. + */ +function hasFiles(dir) { + if (!fs.existsSync(dir)) return false; + for (const entry of fs.readdirSync(dir, { withFileTypes: true })) { + if (entry.isFile()) return true; + if (entry.isDirectory() && hasFiles(path.join(dir, entry.name))) return true; + } + return false; +} + +/** Parse a frontmatter block into a flat key→value map. Null when absent. */ +function frontmatter(text) { + if (!text.startsWith('---')) return null; + const end = text.indexOf('\n---', 3); + if (end < 0) return null; + const out = {}; + for (const line of text.slice(3, end).split('\n')) { + const m = line.match(/^([a-z][a-z-]*):\s*(.*)$/); + if (m) out[m[1]] = m[2].trim(); + } + return out; +} + +// ─────────────────────────────────────────────── 1. canonical structure + +function checkCanonicalStructure() { + for (const f of ['CLAUDE.md', 'START-HERE.md', 'WIZARD.md', 'README.md', 'CHANGELOG.md', 'LICENSE']) { + exists(f) ? pass(`arquivo canônico ${f}`) : fail('estrutura', `falta o arquivo canônico ${f}`); + } + for (const d of ['agents', 'rules', 'skills', 'commands']) { + exists(`.claude/${d}`) ? pass(`.claude/${d}`) : fail('estrutura', `falta .claude/${d}`); + // A populated root-level duplicate means an old layout survived a migration. + if (exists(d) && exists(`.claude/${d}`) && hasFiles(abs(d))) { + fail('estrutura', `duplicata na raiz: ./${d} coexiste com .claude/${d}`); + } + } +} + +// ─────────────────────────────────────────────── 2. runtime frontmatter + +function checkRuntimeFrontmatter() { + const skillsDir = abs('.claude/skills'); + if (fs.existsSync(skillsDir)) { + for (const entry of fs.readdirSync(skillsDir, { withFileTypes: true })) { + if (!entry.isDirectory()) continue; + const rel = `.claude/skills/${entry.name}/SKILL.md`; + if (!exists(rel)) { + // A directory under skills/ with no SKILL.md is either a reference folder + // (must declare itself with a README) or a broken skill. + if (exists(`.claude/skills/${entry.name}/README.md`)) pass(`skills/${entry.name} (referência)`); + else fail('skills', `${entry.name}/ não tem SKILL.md nem README.md — skill quebrada?`); + continue; + } + const fm = frontmatter(read(rel)); + if (!fm) { fail('skills', `${entry.name} sem frontmatter — invisível para auto-invocação`); continue; } + if (!fm.name) fail('skills', `${entry.name} sem chave name:`); + else if (fm.name !== entry.name) fail('skills', `${entry.name} declara name: ${fm.name} — não bate com o diretório`); + if (!fm.description) fail('skills', `${entry.name} sem chave description:`); + else if (!fm.description.includes('"')) warn('skills', `${entry.name} sem frase-gatilho entre aspas na description`); + else pass(`skill ${entry.name}`); + } + } + + for (const [dir, needsName] of [['agents', true], ['commands', false]]) { + const d = abs(`.claude/${dir}`); + if (!fs.existsSync(d)) continue; + for (const f of fs.readdirSync(d)) { + if (!f.endsWith('.md')) continue; + const slug = f.replace(/\.md$/, ''); + const fm = frontmatter(read(`.claude/${dir}/${f}`)); + if (!fm) { fail(dir, `${slug} sem frontmatter`); continue; } + if (needsName && fm.name && fm.name !== slug) fail(dir, `${slug} declara name: ${fm.name}`); + if (!fm.description) fail(dir, `${slug} sem description:`); + else pass(`${dir} ${slug}`); + } + } +} + +// ─────────────────────────────────────────────── 3. relative links + +function checkLinks() { + let broken = 0; + for (const file of allMarkdown()) { + const dir = path.dirname(file); + for (const m of fs.readFileSync(file, 'utf8').matchAll(/\]\(([^)\s]+\.md)(#[^)]*)?\)/g)) { + if (/^https?:/.test(m[1])) continue; + if (!fs.existsSync(path.resolve(dir, m[1]))) { + fail('links', `${path.relative(ROOT, file)} → ${m[1]}`); + broken++; + } + } + } + if (broken === 0) pass('todos os links relativos .md resolvem'); +} + +// ─────────────────────────────────────────────── 4. registry integrity + +function checkRegistry() { + if (!exists('docs/registry/INDEX.md') || !exists('docs/registry/packs')) return; + const index = read('docs/registry/INDEX.md'); + const packs = fs.readdirSync(abs('docs/registry/packs')).filter(f => f.endsWith('.md')); + let bad = 0; + for (const p of packs) { + if (!index.includes(`packs/${p}`)) { fail('registry', `pack fora do INDEX: ${p}`); bad++; } + } + for (const m of index.matchAll(/\]\(packs\/([^)]+\.md)\)/g)) { + if (!packs.includes(m[1])) { fail('registry', `INDEX aponta pack inexistente: ${m[1]}`); bad++; } + } + if (bad === 0) pass(`registry coerente (${packs.length} packs)`); +} + +// ─────────────────────────────────────────────── 5. session-log index + +function checkSessionLog() { + if (!exists('session-log/INDEX.md')) { warn('session-log', 'INDEX.md ausente'); return; } + const index = read('session-log/INDEX.md'); + const entries = fs.readdirSync(abs('session-log')).filter(f => /^\d{4}-\d{2}-\d{2}-.+\.md$/.test(f)); + let bad = 0; + for (const e of entries) { + if (!index.includes(e)) { fail('session-log', `entrada não indexada: ${e}`); bad++; } + } + if (bad === 0) pass(`session-log indexado (${entries.length} entradas)`); +} + +// ─────────────────────────────────────────────── 6. hooks wired and present + +function checkHooks() { + if (!exists('.claude/settings.json')) { warn('hooks', 'settings.json ausente'); return; } + let cfg; + try { cfg = JSON.parse(read('.claude/settings.json')); } + catch (e) { fail('hooks', `settings.json inválido: ${e.message}`); return; } + + const declared = JSON.stringify(cfg.hooks || {}); + let bad = 0; + for (const m of declared.matchAll(/hooks\/([a-z-]+\.js)/g)) { + if (!exists(`.claude/hooks/${m[1]}`)) { fail('hooks', `settings.json referencia hook inexistente: ${m[1]}`); bad++; } + } + if (!cfg.hooks) warn('hooks', 'nenhum hook configurado — o OS fica sem enforcement mecânico'); + else if (bad === 0) pass('hooks declarados existem no disco'); + + // A hook on disk that nothing wires up is dead code. + if (exists('.claude/hooks')) { + for (const f of fs.readdirSync(abs('.claude/hooks'))) { + if (f.endsWith('.js') && !declared.includes(f)) warn('hooks', `${f} existe mas não está em settings.json`); + } + } +} + +// ─────────────────────────────────────────────── 7. gitignore hygiene + +function checkGitignore() { + if (!exists('.gitignore')) { fail('gitignore', 'ausente'); return; } + const gi = read('.gitignore'); + const required = [['.env', /^\.env$/m], ['node_modules/', /node_modules/], ['CLAUDE.local.md', /CLAUDE\.local\.md/]]; + let bad = 0; + for (const [label, re] of required) { + if (!re.test(gi)) { fail('gitignore', `não ignora ${label}`); bad++; } + } + if (bad === 0) pass('gitignore cobre .env, node_modules, CLAUDE.local.md'); +} + +// ─────────────────────────────────────────────── 8. project artifacts + +function checkProjectArtifacts() { + const artifacts = [ + 'docs/business/BUSINESS-PLAN.md', + 'docs/product/PRODUCT-BRIEF.md', + 'docs/technical/TECHNICAL-PLAN.md', + 'docs/SPRINTS.md', + ]; + if (isOsRepo) { + // The OS repo ships templates, not a filled-in project. + for (const a of artifacts) { + if (exists(a)) warn('artefatos', `${a} existe no repo do OS — deveria ser só template?`); + } + pass('modo repo-do-OS: artefatos de projeto corretamente ausentes'); + } else { + for (const a of artifacts) { + if (!exists(a)) warn('artefatos', `${a} ainda não existe (normal se o wizard não chegou nessa fase)`); + } + } +} + +// ─────────────────────────────────────────────── report + +function main() { + checkCanonicalStructure(); + checkRuntimeFrontmatter(); + checkLinks(); + checkRegistry(); + checkSessionLog(); + checkHooks(); + checkGitignore(); + checkProjectArtifacts(); + + console.log(`\nos-self-test — modo: ${isOsRepo ? 'repo do AI Dev OS' : 'projeto derivado'}\n`); + + if (!QUIET && passes.length) console.log(`✅ ${passes.length} verificações passaram`); + + if (warnings.length) { + console.log(`\n🟡 ${warnings.length} aviso(s):`); + for (const w of warnings) console.log(` [${w.check}] ${w.detail}`); + } + if (errors.length) { + console.log(`\n❌ ${errors.length} erro(s):`); + for (const e of errors) console.log(` [${e.check}] ${e.detail}`); + console.log('\nVeredito: INCOERENTE\n'); + process.exit(1); + } + console.log(`\nVeredito: COERENTE${warnings.length ? ' (com avisos)' : ''}\n`); +} + +module.exports = { frontmatter, allMarkdown }; + +if (require.main === module) main(); From ad3fe3efa14e9301c8ed215dee5a6a89ec7406c3 Mon Sep 17 00:00:00 2001 From: lglucas Date: Sat, 8 Aug 2026 20:36:08 -0300 Subject: [PATCH 08/14] =?UTF-8?q?feat(plugin):=20manifesto=20para=20distri?= =?UTF-8?q?bui=C3=A7=C3=A3o=20como=20plugin=20do=20Claude=20Code?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Não existia .claude-plugin/plugin.json, plugin.json, marketplace.json nem equivalente. Consequência: o OS só se distribuía por clone ou "Use this template" — sem instalação versionada, sem marketplace, sem caminho de atualização. O manifesto segue o schema dos plugins oficiais (conferido contra code-review, frontend-design e security-guidance): name, version, description, author, homepage, repository, license e keywords. Versão 0.5.2, coerente com a seção Unreleased do CHANGELOG. Dados do autor vindos do ATTRIBUTIONS.md, nada novo exposto. Isto era item de arquitetura anotado desde a auditoria da v0.5 e seguia aberto. Co-Authored-By: Claude Opus 5 (1M context) --- .claude-plugin/plugin.json | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 .claude-plugin/plugin.json diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json new file mode 100644 index 0000000..205ab14 --- /dev/null +++ b/.claude-plugin/plugin.json @@ -0,0 +1,24 @@ +{ + "name": "ai-dev-operating-system", + "version": "0.5.2", + "description": "Day-zero operating system for AI-assisted SaaS development. A 5-phase Project Genesis Wizard that prototypes before it specifies, 27 skills, 12 agents, 11 commands, a curated registry of 72 external packs, a 1.346-project self-hosted catalogue, and PreToolUse hooks that block secret commits mechanically rather than by asking nicely.", + "author": { + "name": "Lucas Galvão", + "url": "https://github.com/lglucas" + }, + "homepage": "https://github.com/lglucas/ai-dev-operating-system", + "repository": "https://github.com/lglucas/ai-dev-operating-system", + "license": "MIT", + "keywords": [ + "saas", + "wizard", + "vibe-coding", + "product-discovery", + "business-plan", + "prototyping", + "sprint-planning", + "secrets", + "self-hosted", + "portuguese" + ] +} From 441139f15309b4dcbad132eb304cc076b0131321 Mon Sep 17 00:00:00 2001 From: lglucas Date: Sat, 8 Aug 2026 20:41:26 -0300 Subject: [PATCH 09/14] =?UTF-8?q?refactor(rules):=20reequilibra=20o=20or?= =?UTF-8?q?=C3=A7amento=20de=20contexto=20das=20regras?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Tudo em .claude/rules/ entra em TODO prompt. A distribuição estava invertida: security-baseline tinha 3 linhas e wizard-stage-tags tinha 60 — 25% do orçamento inteiro para uma convenção opt-in. security-baseline 3 -> 42 linhas wizard-stage-tags 60 -> 19 linhas (ponteiro) TOTAL 236 -> 234 linhas O total quase não mudou. O ponto não era cortar, era gastar onde importa. security-baseline dizia "defina auth antes de features sensíveis" e parava aí. Agora é procedimento: 5 regras sempre válidas, checklist de 8 itens antes de expor ao público (incluindo o clássico de testar com dois usuários diferentes pra pegar IDOR), como integrar serviço externo, e a ordem certa quando algo vaza — rotacionar ANTES de investigar, porque tirar do commit não desfaz a exposição. O detalhe das stage tags foi para docs/wizard-stage-tags.md. Os 5 valores de tag não mudaram e o mapeamento 1:1 com as fases continua declarado na regra, então o Grand Prix e as outras 12 referências seguem válidos. Correção ao meu próprio relatório: eu tinha apontado três regras curtas como deficientes. Reexaminando, só security-baseline era. code-style e research-discipline são concisas mas completas — declaram o limite e o procedimento. Não foram infladas. Co-Authored-By: Claude Opus 5 (1M context) --- .claude/rules/security-baseline.md | 41 +++++++++++++++++- .claude/rules/wizard-stage-tags.md | 63 +++++---------------------- docs/wizard-stage-tags.md | 68 ++++++++++++++++++++++++++++++ 3 files changed, 119 insertions(+), 53 deletions(-) create mode 100644 docs/wizard-stage-tags.md diff --git a/.claude/rules/security-baseline.md b/.claude/rules/security-baseline.md index 68913ed..7fac05d 100644 --- a/.claude/rules/security-baseline.md +++ b/.claude/rules/security-baseline.md @@ -1,3 +1,42 @@ # Security Baseline -No secrets in repo. Use `.env.example`. Define auth and authorization before sensitive features. Run privacy/compliance review for personal data. Document security risks in `TECHNICAL-PLAN.md`. +Mínimo obrigatório antes de qualquer feature que toque usuário, dinheiro ou dado pessoal. Não substitui revisão profissional de segurança. + +## Sempre + +1. **Segredo nunca no código.** Variável de ambiente, sempre. `.env` no `.gitignore`, `.env.example` com placeholder. Padrões em [`secrets.md`](secrets.md); bloqueio mecânico em [`../hooks/`](../hooks/README.md). +2. **Defina autenticação antes da primeira feature sensível**, não depois. Retrofitar auth é reescrever a feature. +3. **Autorização é separada de autenticação.** "Está logado" não é "pode ver este registro". Toda query que devolve dado de usuário precisa filtrar por dono. +4. **Nunca confie em input do cliente.** Valide no servidor, mesmo tendo validado no formulário. +5. **Dado pessoal aciona [`privacy-audit`](privacy-audit.md)** — as nove perguntas, antes do merge. + +## Antes de expor ao público + +- [ ] Auth e autorização testadas com **dois usuários diferentes** — o clássico é o usuário A ler o registro do B trocando o ID na URL. +- [ ] Nenhuma rota administrativa acessível sem sessão. +- [ ] Rate limit em login, cadastro, recuperação de senha e qualquer endpoint que dispare email. +- [ ] Mensagem de erro não revela se o email existe, nem devolve stack trace. +- [ ] Chaves de serviço (`service_role`, admin, webhook secret) só no servidor, nunca no bundle do cliente. +- [ ] HTTPS obrigatório; cookie com `Secure`, `HttpOnly`, `SameSite`. +- [ ] Upload de arquivo: tipo e tamanho validados, servido de domínio ou bucket separado. +- [ ] [`secrets-scan`](../skills/secrets-scan/SKILL.md) rodou limpo. + +## Ao integrar um serviço externo + +- Use a chave de **menor privilégio** que resolve o caso. +- Chave de teste em dev; chave de produção só em produção. +- Anote onde a chave vive e **como rotacionar** — no dia do vazamento ninguém tem tempo de descobrir. +- Webhook: valide a assinatura. Endpoint de webhook sem verificação é porta aberta. + +## Quando algo vaza + +Nesta ordem, sem pular: + +1. **Rotacione a chave.** Antes de investigar, antes de limpar o histórico. Remover do commit não desfaz a exposição. +2. Verifique o que foi acessado com ela. +3. Só então limpe o repositório. +4. Registre no `session-log/` — inclusive o que faltou para evitar. + +## Documente + +Riscos conhecidos, decisões de segurança e o que foi deliberadamente adiado vão para `docs/technical/TECHNICAL-PLAN.md`. Risco não escrito volta como surpresa. diff --git a/.claude/rules/wizard-stage-tags.md b/.claude/rules/wizard-stage-tags.md index 743016e..27f700b 100644 --- a/.claude/rules/wizard-stage-tags.md +++ b/.claude/rules/wizard-stage-tags.md @@ -1,60 +1,19 @@ # Wizard stage tags (opt-in) -Convenção opcional para marcar em qual fase do WIZARD um commit pertence. Útil pra rastreamento automático de progresso (ex.: dashboards, métricas, relatórios). Quem não usa **não perde nada**. +Convenção **opcional**: marque a fase do WIZARD no fim da mensagem de commit com `[STAGE:X]`. As 5 tags correspondem 1:1 às 5 fases do [`WIZARD.md`](../../WIZARD.md). -## Como usar - -Adicione `[STAGE:X]` no fim da mensagem de commit. As 5 tags correspondem **1:1 às 5 fases** do [`WIZARD.md`](../../WIZARD.md) — não existe tabela de tradução: um commit `[STAGE:PROTOTIPO]` *é* um commit da Fase 3. - -| Tag | Fase | Significado | Quando aparece | -|---|---|---|---| -| `[STAGE:LARGADA]` | **Fase 1** | Repositório é seu, desacoplado e seguro pra commitar. | Logo após "Use this template" + `git init` ou primeiro commit. | -| `[STAGE:IDEACAO]` | **Fase 2** | O pensamento: ideação, 10 perguntas, pesquisa, red team, BP v0.0.1 → v0.0.2. | Commits de ideação raw, brainstorming, pesquisa em `knowledge-base/`, BP e suas revisões. | -| `[STAGE:PROTOTIPO]` | **Fase 3** | O produto fica visível: marca, cores, UI, UX. | Primeiro código no `prototype-lab/`, as 3 direções, e o `DESIGN-DIRECTION.md`. | -| `[STAGE:DOCUMENTACAO]` | **Fase 4** | Engenharia reversa do protótipo aprovado + plano de execução. | Product Brief, Technical Plan, registry picks, sprint roadmap. | -| `[STAGE:CHEGADA]` | **Fase 5** | Sprint 1 começou ou primeiro deploy/run local. | Ambiente rodando, fluxo principal funcional. | - -## Exemplos +| Tag | Fase | +|---|---| +| `[STAGE:LARGADA]` | 1 — repo desacoplado e seu | +| `[STAGE:IDEACAO]` | 2 — pesquisa, red team, BP, Pitch | +| `[STAGE:PROTOTIPO]` | 3 — marca, cores, UI, UX | +| `[STAGE:DOCUMENTACAO]` | 4 — Brief, Technical Plan, roadmap | +| `[STAGE:CHEGADA]` | 5 — Sprint 1, deploy | ``` -feat: setup inicial e estrutura canônica [STAGE:LARGADA] -docs: 10 perguntas estratégicas respondidas [STAGE:IDEACAO] -docs(business): BP v0.0.2 com correções do red team [STAGE:IDEACAO] -feat(prototype): três direções visuais com mock data compartilhado [STAGE:PROTOTIPO] -docs(product): Product Brief derivado do protótipo aprovado [STAGE:DOCUMENTACAO] -feat: app rodando no localhost com fluxo principal [STAGE:CHEGADA] +feat(prototype): três direções visuais [STAGE:PROTOTIPO] ``` -## Por que as tags agora são cronológicas - -Até a v0.4.5 o WIZARD colocava o Prototype Lab **depois** do Product Brief, do Technical Plan e do roadmap. Isso deixava `PROTOTIPO` cronologicamente *depois* de `DOCUMENTACAO` — as tags saíam fora de ordem, e qualquer sistema que inferisse progresso pela sequência das tags via o projeto "andar pra trás". - -A reordenação da v0.5.0 (protótipo antes da documentação) conserta isso. As 5 tags agora aparecem na ordem em que estão listadas acima, sempre. - -**Os 5 valores de tag não mudaram.** Commits antigos continuam válidos; só a ordem esperada mudou. - -## Por que existe - -Sistemas externos (ex.: o "Grand Prix do Trilho" do `course/systems/grand-prix/`) podem ler os commits via GitHub API e inferir progresso automaticamente — sem precisar que o usuário marque manualmente. Isto torna possível dashboards de turma, métricas de adoção, relatórios de uso. - -## Detecção como fallback - -Se você esquecer a tag, ferramentas que dependem dela podem inferir a fase a partir dos arquivos modificados: - -| Arquivos tocados | Fase inferida | -|---|---| -| `knowledge-base/`, `docs/business/BUSINESS-PLAN.md` | `IDEACAO` | -| `prototype-lab/`, `docs/product/DESIGN-DIRECTION.md` | `PROTOTIPO` | -| `docs/product/PRODUCT-BRIEF.md`, `docs/technical/`, `docs/SPRINTS.md` | `DOCUMENTACAO` | -| `src/`, `app/` | `CHEGADA` | - -Tags explícitas são preferidas porque eliminam ambiguidade. - -## Quando NÃO usar - -- Em commits que não correspondem a uma fase do WIZARD (ex.: ajuste de typo, fix de CI). Apenas omita a tag. -- Em projetos que não seguem o WIZARD do AI Dev OS. - -## Convenção é opt-in +Permite que sistemas externos infiram progresso lendo o git. Quem ignora não perde nada — não há lint nem gate. Omita a tag em commits que não correspondem a uma fase (typo, fix de CI). -O OS não força esta convenção. Não há lint, não há gate, não há reclamação se você ignorar. Skills e sistemas que dependem das tags devem fazer fallback gracioso quando não encontram. +📖 **Detalhamento completo** — exemplos, fallback por arquivo modificado, quem consome, e por que as tags são cronológicas desde a v0.5.0: [`docs/wizard-stage-tags.md`](../../docs/wizard-stage-tags.md). diff --git a/docs/wizard-stage-tags.md b/docs/wizard-stage-tags.md new file mode 100644 index 0000000..1080b27 --- /dev/null +++ b/docs/wizard-stage-tags.md @@ -0,0 +1,68 @@ +# Wizard stage tags — convenção completa + +Convenção **opcional** para marcar em qual fase do WIZARD um commit pertence. Permite rastreamento automático de progresso via GitHub API — painel de turma, métricas de adoção, relatórios de uso. Quem não usa **não perde nada**. + +A regra resumida vive em [`.claude/rules/wizard-stage-tags.md`](../.claude/rules/wizard-stage-tags.md); este documento é o detalhamento. + +> **Por que o detalhe mora aqui e não na regra:** tudo em `.claude/rules/` entra em **todo prompt**, consumindo contexto em toda sessão. Esta convenção opt-in ocupava 60 das 236 linhas de regras — 25% do orçamento — competindo com a regra de segurança, que tinha 3 linhas. O ponteiro fica na regra; o manual fica aqui. + +--- + +## Como usar + +Adicione `[STAGE:X]` no fim da mensagem de commit. As 5 tags correspondem **1:1 às 5 fases** do [`WIZARD.md`](../WIZARD.md) — não existe tabela de tradução: um commit `[STAGE:PROTOTIPO]` *é* um commit da Fase 3. + +| Tag | Fase | Significado | Quando aparece | +|---|---|---|---| +| `[STAGE:LARGADA]` | **Fase 1** | Repositório é seu, desacoplado e seguro pra commitar. | Logo após "Use this template" + `git init`, ou primeiro commit. | +| `[STAGE:IDEACAO]` | **Fase 2** | O pensamento: ideação, 10 perguntas, pesquisa, red team, BP v0.0.1 → v0.0.2, Pitch. | Ideação raw, brainstorming, pesquisa em `knowledge-base/`, BP e revisões. | +| `[STAGE:PROTOTIPO]` | **Fase 3** | O produto fica visível: marca, cores, UI, UX. | Primeiro código no `prototype-lab/`, as 3 direções, e o `DESIGN-DIRECTION.md`. | +| `[STAGE:DOCUMENTACAO]` | **Fase 4** | Engenharia reversa do protótipo aprovado + plano de execução. | Product Brief, Technical Plan, registry picks, sprint roadmap. | +| `[STAGE:CHEGADA]` | **Fase 5** | Sprint 1 começou, ou primeiro deploy/run local. | Ambiente rodando, fluxo principal funcional. | + +## Exemplos + +``` +feat: setup inicial e estrutura canônica [STAGE:LARGADA] +docs: 10 perguntas estratégicas respondidas [STAGE:IDEACAO] +docs(business): BP v0.0.2 com correções do red team [STAGE:IDEACAO] +feat(prototype): três direções visuais com mock data compartilhado [STAGE:PROTOTIPO] +docs(product): Product Brief derivado do protótipo aprovado [STAGE:DOCUMENTACAO] +feat: app rodando no localhost com fluxo principal [STAGE:CHEGADA] +``` + +## Por que as tags são cronológicas desde a v0.5.0 + +Até a v0.4.5 o WIZARD colocava o Prototype Lab **depois** do Product Brief, do Technical Plan e do roadmap. Isso deixava `PROTOTIPO` cronologicamente *depois* de `DOCUMENTACAO` — as tags saíam fora de ordem, e qualquer sistema que inferisse progresso pela sequência via o projeto "andar pra trás". + +A reordenação da v0.5.0 (protótipo antes da documentação) consertou isso. As 5 tags agora aparecem na ordem da tabela acima, sempre. + +**Os 5 valores de tag não mudaram.** Commits antigos continuam válidos; só a ordem esperada mudou. + +## Detecção como fallback + +Se a tag for esquecida, ferramentas que dependem dela podem inferir a fase pelos arquivos modificados: + +| Arquivos tocados | Fase inferida | +|---|---| +| `knowledge-base/`, `docs/business/BUSINESS-PLAN.md`, `docs/business/PITCH.md` | `IDEACAO` | +| `prototype-lab/`, `docs/product/DESIGN-DIRECTION.md` | `PROTOTIPO` | +| `docs/product/PRODUCT-BRIEF.md`, `docs/technical/`, `docs/SPRINTS.md` | `DOCUMENTACAO` | +| `src/`, `app/` | `CHEGADA` | + +Tags explícitas são preferidas porque eliminam ambiguidade. + +## Quem consome isto + +O **Grand Prix do Trilho** (`course/systems/grand-prix/`) lê os commits via GitHub API e infere progresso automaticamente, sem o usuário marcar nada à mão. É o que torna possível painel de turma ao vivo e métricas de adoção. + +Qualquer sistema que dependa das tags deve **fazer fallback gracioso** quando não as encontra. + +## Quando NÃO usar + +- Em commits que não correspondem a uma fase do WIZARD — ajuste de typo, fix de CI. Apenas omita. +- Em projetos que não seguem o WIZARD do AI Dev OS. + +## Convenção é opt-in + +O OS não força isto. Não há lint, não há gate, não há reclamação se você ignorar. From fe2d0c1bec85106f7462be11df96eacb0c25efa1 Mon Sep 17 00:00:00 2001 From: lglucas Date: Sat, 8 Aug 2026 20:54:30 -0300 Subject: [PATCH 10/14] =?UTF-8?q?test:=20su=C3=ADte=20para=20hooks=20e=20g?= =?UTF-8?q?erador=20de=20cat=C3=A1logo,=20plugada=20no=20CI?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit O relatório apontou zero testes de qualquer tipo, com scripts reais já em produção — inclusive um parser YAML escrito à mão que tinha apresentado dois bugs descobertos só por conferência manual da saída. 75 testes em 11 suítes, com node:test. Zero dependências. Os testes acharam DOIS BYPASS REAIS no hook de segredo, ambos corrigidos aqui: 1. "git -C /tmp commit" não era reconhecido. O regex só tratava flags sem valor, e -C consome o próximo token. Quem usasse git -C passava direto pelo gate. 2. "git add . && git commit" também passava. Eu retornava no primeiro segmento do shell em vez de continuar procurando nos demais. isGitCommit deixou de ser regex e virou tokenização: separa por &&, ||, ; e |, pula flags (com lista explícita das que consomem valor) e checa se o primeiro token não-flag é "commit". Revalidado ponta a ponta em repo git temporário — os três vetores agora saem com exit 2. Cobertura: - block-secret-commit: 7 formatos de credencial; a documentação dos próprios padrões NÃO é bloqueada (a razão de existirem); só linhas adicionadas disparam; arquivos proibidos vs. .env.example; o achado nunca retém o valor casado; deduplicação; 15 formas de comando. - protect-env-files: 14 caminhos, incluindo Windows, sem depender de escaping do shell. - sync-selfhosted: slugifyTag, parseYaml com CRLF e mapas aninhados, e macroFor — este último cobrindo especificamente os dois bugs que vazaram no PR #14 (hífen duplo vs. simples, e agrupamento por tags[0] enterrando entradas). Todo segredo nos testes é sintético: formato válido, valor inventado. sync-selfhosted.js ganhou guarda require.main e passou a exportar as funções puras — sem isso, importá-lo num teste dispararia um git clone do upstream como efeito colateral. O step do CI usa glob e não diretório: node --test scripts/test/ faz o Node v24 resolver o caminho como módulo e falhar com Cannot find module. Verificado: 75/75 passam, os-self-test coerente, e o gerador reproduz o catálogo byte a byte (git diff vazio). Co-Authored-By: Claude Opus 5 (1M context) --- .claude/hooks/README.md | 2 +- .claude/hooks/block-secret-commit.js | 26 ++++- .claude/skills/os-self-test/SKILL.md | 2 +- .github/workflows/ci.yml | 6 ++ scripts/sync-selfhosted.js | 18 +++- scripts/test/hooks.test.js | 129 ++++++++++++++++++++++++ scripts/test/sync-selfhosted.test.js | 145 +++++++++++++++++++++++++++ 7 files changed, 320 insertions(+), 8 deletions(-) create mode 100644 scripts/test/hooks.test.js create mode 100644 scripts/test/sync-selfhosted.test.js diff --git a/.claude/hooks/README.md b/.claude/hooks/README.md index 4b0830c..6b3268d 100644 --- a/.claude/hooks/README.md +++ b/.claude/hooks/README.md @@ -73,7 +73,7 @@ Sem Node instalado, os hooks falham ao iniciar e o Claude Code segue sem eles. * 2. Saia com 0 para permitir, 2 para bloquear com mensagem no stderr. 3. **Falhe aberto** em payload malformado — um hook quebrado não pode travar a sessão inteira. 4. Registre em `settings.json` e `settings.example.json`. -5. Escreva o teste em `scripts/test/`. +5. Escreva o teste em `scripts/test/` e rode com `node --test "scripts/test/*.test.js"` — o glob é necessário, passar o diretório faz o Node v24 tentar resolvê-lo como módulo. 6. Documente aqui, com o escape hatch. O ponto 3 é o mais importante. Um hook que bloqueia por engano é pior que hook nenhum: o usuário desliga tudo e perde junto o que funcionava. diff --git a/.claude/hooks/block-secret-commit.js b/.claude/hooks/block-secret-commit.js index 2cedeb8..9d531e1 100644 --- a/.claude/hooks/block-secret-commit.js +++ b/.claude/hooks/block-secret-commit.js @@ -87,8 +87,32 @@ function scan(diff, stagedFiles) { }); } +// Global git flags that consume the NEXT token as their value. Without this list, +// `git -C /tmp commit` reads as "git, flag -C, then /tmp" and the commit is missed — +// which is a bypass, not a cosmetic bug. Caught by scripts/test/hooks.test.js. +const VALUE_FLAGS = new Set(['-C', '-c', '--git-dir', '--work-tree', '--namespace', '--exec-path', '--config-env']); + +/** + * True when the command runs `git commit` in any segment. + * Token-based rather than regex-based so that global flags with values are handled. + */ function isGitCommit(command) { - return /\bgit\s+(?:-[^\s]+\s+)*commit\b/.test(String(command || '')); + const segments = String(command || '').split(/&&|\|\||;|\|/); + for (const segment of segments) { + const tokens = segment.trim().split(/\s+/).filter(Boolean); + const gitAt = tokens.indexOf('git'); + if (gitAt === -1) continue; + for (let i = gitAt + 1; i < tokens.length; i++) { + const t = tokens[i]; + if (VALUE_FLAGS.has(t)) { i++; continue; } // flag + separate value + if (t.startsWith('-')) continue; // valueless flag or --flag=value + // First non-flag token is the subcommand. Only a match ends the search — + // `git add . && git commit` must not be dismissed on the first segment. + if (t === 'commit') return true; + break; + } + } + return false; } function main() { diff --git a/.claude/skills/os-self-test/SKILL.md b/.claude/skills/os-self-test/SKILL.md index ca0f5a9..36e2804 100644 --- a/.claude/skills/os-self-test/SKILL.md +++ b/.claude/skills/os-self-test/SKILL.md @@ -54,5 +54,5 @@ O script diz **o que** está quebrado. Interpretar e consertar continua sendo tr ## Related - Script: `scripts/os-self-test.js` -- Testes do próprio script: `scripts/test/` +- Testes dos scripts e hooks: `node --test "scripts/test/*.test.js"` - Gate de release que o invoca: [`release-check`](../release-check/SKILL.md) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 68a8e8a..fe66b8f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,6 +23,12 @@ jobs: - name: Run os-self-test run: node scripts/os-self-test.js + # Unit tests for the hooks and the catalogue generator. Node's built-in runner — + # no dependencies, nothing to install. The glob is required: passing the directory + # makes Node v24 resolve it as a module path and fail with "Cannot find module". + - name: Script unit tests + run: node --test "scripts/test/*.test.js" + lint-docs: runs-on: ubuntu-latest name: Markdown structure & links diff --git a/scripts/sync-selfhosted.js b/scripts/sync-selfhosted.js index dfa4b72..dfd75df 100644 --- a/scripts/sync-selfhosted.js +++ b/scripts/sync-selfhosted.js @@ -256,9 +256,17 @@ ${ATTRIBUTION} // ----------------------------------------------------------------------- run -const dataDir = resolveDataDir(); -const entries = load(dataDir); -const buckets = render(entries); +function main() { + const dataDir = resolveDataDir(); + const entries = load(dataDir); + const buckets = render(entries); -console.log(`\ngenerated ${entries.length} entries into docs/selfhosted/`); -for (const [id, title] of MACRO) console.log(` ${String(buckets[id].length).padStart(4)} ${title}`); + console.log(`\ngenerated ${entries.length} entries into docs/selfhosted/`); + for (const [id, title] of MACRO) console.log(` ${String(buckets[id].length).padStart(4)} ${title}`); +} + +// Exported for scripts/test/. The guard matters: without it, importing this module +// would run resolveDataDir() and clone the upstream repo as a side effect of a test. +module.exports = { slugifyTag, parseYaml, macroFor, MACRO }; + +if (require.main === module) main(); diff --git a/scripts/test/hooks.test.js b/scripts/test/hooks.test.js new file mode 100644 index 0000000..19f9f2b --- /dev/null +++ b/scripts/test/hooks.test.js @@ -0,0 +1,129 @@ +/** + * hooks.test.js — unit tests for the PreToolUse hooks. + * + * Version: v0.5.2 · Sprint: v0.5.2 P6 + * Run: node --test scripts/test/ + * + * All "secrets" below are SYNTHETIC — correct shape, invented value. Nothing here + * is or ever was a real credential. `AKIAIOSFODNN7EXAMPLE` is AWS's own published + * documentation placeholder. + * + * The regression these tests exist for: an earlier draft matched on prefix alone + * (`sk-`, `AKIA`), which would have blocked committing `.claude/rules/secrets.md` — + * the file that documents those very prefixes. + */ + +'use strict'; + +const { test, describe } = require('node:test'); +const assert = require('node:assert/strict'); + +const { scan, isGitCommit } = require('../../.claude/hooks/block-secret-commit.js'); +const { isProtectedEnvPath } = require('../../.claude/hooks/protect-env-files.js'); + +const diffAdding = (file, line) => `+++ b/${file}\n+${line}\n`; + +describe('block-secret-commit: deteta credencial com formato completo', () => { + const cases = [ + ['OpenAI', 'const k = "sk-abcdefghij0123456789XYZQRS";'], + ['GitHub PAT', 'TOKEN=ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'], + ['AWS', 'aws_access_key_id = AKIAIOSFODNN7EXAMPLE'], + ['Google', 'key: AIzaSyD-ABCDEFGHIJKLMNOPQRSTUVWXYZ01234'], + ['Slack', 'SLACK=xoxb-1234567890-abcdefghij'], + ['Stripe', 'STRIPE=sk_live_abcdefghij0123456789'], + ['chave privada', '-----BEGIN RSA PRIVATE KEY-----'], + ]; + for (const [label, line] of cases) { + test(`bloqueia ${label}`, () => { + const found = scan(diffAdding('src/config.ts', line), []); + assert.equal(found.length, 1, `${label} deveria ter sido detectado`); + assert.equal(found[0].file, 'src/config.ts'); + }); + } +}); + +describe('block-secret-commit: não bloqueia a documentação dos próprios padrões', () => { + test('a regra secrets.md pode ser commitada', () => { + const doc = '+++ b/.claude/rules/secrets.md\n+- sk-\n+- ghp_\n+- AKIA\n+- .env\n'; + assert.equal(scan(doc, []).length, 0); + }); + + test('prosa que menciona prefixo passa', () => { + const prose = diffAdding('README.md', 'Chaves da OpenAI começam com sk- e as da AWS com AKIA.'); + assert.equal(scan(prose, []).length, 0); + }); +}); + +describe('block-secret-commit: só inspeciona linhas adicionadas', () => { + test('remover uma chave vazada continua possível', () => { + const removal = '+++ b/src/config.ts\n-const k = "sk-abcdefghij0123456789XYZQRS";\n'; + assert.equal(scan(removal, []).length, 0); + }); + + test('linha de contexto não dispara', () => { + const context = '+++ b/src/config.ts\n const k = "sk-abcdefghij0123456789XYZQRS";\n'; + assert.equal(scan(context, []).length, 0); + }); +}); + +describe('block-secret-commit: arquivos proibidos no stage', () => { + for (const f of ['.env', '.env.local', '.env.production', 'certs/server.pem', 'id_rsa.key']) { + test(`bloqueia ${f}`, () => assert.equal(scan('', [f]).length, 1)); + } + for (const f of ['.env.example', '.env.sample', '.env.template', 'src/index.ts']) { + test(`permite ${f}`, () => assert.equal(scan('', [f]).length, 0)); + } +}); + +describe('block-secret-commit: nunca retém o valor casado', () => { + test('o achado carrega só arquivo e rótulo', () => { + const secret = 'sk-abcdefghij0123456789XYZQRS'; + const found = scan(diffAdding('src/config.ts', `const k="${secret}";`), []); + assert.equal(found.length, 1); + assert.deepEqual(Object.keys(found[0]).sort(), ['file', 'label']); + assert.ok(!JSON.stringify(found).includes(secret), 'o valor não pode aparecer no achado'); + }); +}); + +describe('block-secret-commit: deduplicação', () => { + test('mesmo arquivo e mesmo padrão contam uma vez', () => { + const twice = '+++ b/a.ts\n+sk-abcdefghij0123456789XYZQRS\n+sk-zyxwvutsrq9876543210ABCDEF\n'; + assert.equal(scan(twice, []).length, 1); + }); +}); + +describe('block-secret-commit: reconhece o comando', () => { + // The -C case is a real bypass this suite caught: an earlier regex only handled + // valueless flags, so `git -C dir commit` slipped through the gate entirely. + const isCommit = [ + 'git commit -m "x"', + 'git commit', + 'git commit --amend', + 'git -C /tmp commit -am y', // global flag consuming a value + 'git -c user.name=x commit -m y', // -c takes a value too + 'git --git-dir /r/.git commit', + 'cd /projeto && git commit -m y', // segundo segmento do shell + 'git add . && git commit -m y', + ]; + const isNotCommit = [ + 'git status', + 'git push', + 'git commit-tree abc', // subcomando diferente, prefixo igual + 'npm run commit-lint', + 'echo "git commitment"', + 'git log --format=commit', + '', + ]; + for (const c of isCommit) test(`é commit: ${c}`, () => assert.equal(isGitCommit(c), true)); + for (const c of isNotCommit) test(`não é commit: ${c || '(vazio)'}`, () => assert.equal(isGitCommit(c), false)); +}); + +describe('protect-env-files: caminhos', () => { + const B = String.fromCharCode(92); // barra invertida, sem depender do escaping do shell + const blocked = ['/p/.env', '/p/.env.local', '/p/.env.production', `C:${B}p${B}.env`, `C:${B}p${B}.env.local`, '.env']; + const allowed = ['/p/.env.example', '/p/.env.sample', '/p/.env.template', '/p/.env.dist', + '/p/src/index.ts', '/p/environment.ts', '/p/envelope.md', '']; + + for (const p of blocked) test(`bloqueia ${JSON.stringify(p)}`, () => assert.equal(isProtectedEnvPath(p), true)); + for (const p of allowed) test(`permite ${JSON.stringify(p)}`, () => assert.equal(isProtectedEnvPath(p), false)); +}); diff --git a/scripts/test/sync-selfhosted.test.js b/scripts/test/sync-selfhosted.test.js new file mode 100644 index 0000000..82dbb2c --- /dev/null +++ b/scripts/test/sync-selfhosted.test.js @@ -0,0 +1,145 @@ +/** + * sync-selfhosted.test.js — unit tests for the self-hosted catalogue generator. + * + * Version: v0.5.2 · Sprint: v0.5.2 P6 + * Run: node --test scripts/test/ + * + * Two of these suites exist because of bugs that actually shipped during v0.5.0 PR 4 + * and were only caught by eyeballing the generated output: + * + * 1. The macro-category map was built from tag FILE slugs (`note-taking--editors`, + * double dash) while software files carry DISPLAY names, whose slug collapses to + * a single dash. Equality tests silently never matched — 203 entries landed in + * "Outros" and Security showed 7. + * 2. Sections grouped by `tags[0]`, so an entry tagged + * ["Miscellaneous", "Monitoring & Status Pages"] rendered under Miscellaneous + * and its monitoring signal vanished from the catalogue. + * + * All fixtures are synthetic, in the upstream's real shape. + */ + +'use strict'; + +const { test, describe } = require('node:test'); +const assert = require('node:assert/strict'); + +const { slugifyTag, parseYaml, macroFor } = require('../sync-selfhosted.js'); + +describe('slugifyTag: nomes de exibição colapsam separadores', () => { + const cases = [ + ['Note-taking & Editors', 'note-taking-editors'], + ['Task Management & To-do Lists', 'task-management-to-do-lists'], + ['Money, Budgeting & Management', 'money-budgeting-management'], + ['Monitoring & Status Pages', 'monitoring-status-pages'], + ['Federated Identity & Authentication', 'federated-identity-authentication'], + ['Communication - Email - Complete Solutions', 'communication-email-complete-solutions'], + ['Software Development - CI/CD', 'software-development-ci-cd'], + ['Maps and Global Positioning System (GPS)', 'maps-and-global-positioning-system-gps'], + ['Password Managers', 'password-managers'], + ]; + for (const [input, expected] of cases) { + test(`${input} → ${expected}`, () => assert.equal(slugifyTag(input), expected)); + } + + test('nunca devolve hífen duplo — a causa raiz do bug', () => { + for (const [input] of cases) assert.ok(!slugifyTag(input).includes('--'), input); + }); + + test('nunca começa nem termina com hífen', () => { + for (const [input] of cases) assert.ok(!/^-|-$/.test(slugifyTag(input)), input); + }); +}); + +describe('parseYaml: o schema plano do upstream', () => { + // CRLF on purpose: the upstream repo checks out with Windows line endings here. + const fixture = [ + 'name: Exemplo', + 'website_url: https://exemplo.test', + 'description: Uma ferramenta de exemplo, com vírgula: e dois-pontos.', + 'licenses:', + ' - AGPL-3.0', + ' - MIT', + 'platforms:', + ' - Docker', + ' - PHP', + 'tags:', + ' - Miscellaneous', + ' - Monitoring & Status Pages', + 'stargazers_count: 4089', + "updated_at: '2026-07-05'", + 'archived: false', + 'current_release:', + ' tag: v8.0.1', + ' published_at: 2026-07-05', + 'commit_history:', + ' 2026-06: 104', + ].join('\r\n'); + + const y = parseYaml(fixture); + + test('escalares', () => { + assert.equal(y.name, 'Exemplo'); + assert.equal(y.website_url, 'https://exemplo.test'); + assert.equal(y.stargazers_count, '4089'); + assert.equal(y.archived, 'false'); + }); + + test('descrição preserva pontuação interna', () => { + assert.equal(y.description, 'Uma ferramenta de exemplo, com vírgula: e dois-pontos.'); + }); + + test('remove aspas simples da data', () => assert.equal(y.updated_at, '2026-07-05')); + + test('listas', () => { + assert.deepEqual(y.licenses, ['AGPL-3.0', 'MIT']); + assert.deepEqual(y.platforms, ['Docker', 'PHP']); + assert.deepEqual(y.tags, ['Miscellaneous', 'Monitoring & Status Pages']); + }); + + test('mapas aninhados são ignorados sem quebrar o parse', () => { + assert.ok(Array.isArray(y.current_release)); + assert.equal(y.current_release.length, 0); + }); + + test('descrição entre aspas duplas', () => { + assert.equal(parseYaml('description: "Com aspas duplas."\n').description, 'Com aspas duplas.'); + }); + + test('arquivo vazio não explode', () => assert.deepEqual(parseYaml(''), {})); +}); + +describe('macroFor: classifica pela tag que casou, não pela primeira', () => { + test('primeira tag genérica não sequestra a entrada', () => { + // Exactly the shipped bug: Miscellaneous first, real signal second. + const { id, tag } = macroFor({ tags: ['Miscellaneous', 'Monitoring & Status Pages'] }); + assert.equal(id, 'observabilidade'); + assert.equal(tag, 'Monitoring & Status Pages', 'a seção precisa usar a tag que decidiu o bucket'); + }); + + test('tag única e específica', () => { + assert.equal(macroFor({ tags: ['Password Managers'] }).id, 'seguranca-identidade'); + }); + + test('prefixos amplos continuam funcionando', () => { + assert.equal(macroFor({ tags: ['Communication - IRC'] }).id, 'comunicacao'); + assert.equal(macroFor({ tags: ['Software Development - Testing'] }).id, 'desenvolvimento'); + assert.equal(macroFor({ tags: ['File Transfer - Object Storage & File Servers'] }).id, 'arquivos-backup'); + assert.equal(macroFor({ tags: ['Document Management - E-books'] }).id, 'produtividade'); + }); + + test('nomes de exibição com hífen simples casam a lista de igualdade', () => { + // These are the ones the double-dash bug silently dropped into "Outros". + assert.equal(macroFor({ tags: ['Note-taking & Editors'] }).id, 'produtividade'); + assert.equal(macroFor({ tags: ['Money, Budgeting & Management'] }).id, 'negocio'); + assert.equal(macroFor({ tags: ['Task Management & To-do Lists'] }).id, 'produtividade'); + }); + + test('IA generativa tem nome diferente do slug do arquivo de tag', () => { + assert.equal(macroFor({ tags: ['Generative Artificial Intelligence (GenAI)'] }).id, 'automacao-ia'); + }); + + test('sem tag reconhecida cai em outros', () => { + assert.equal(macroFor({ tags: ['Miscellaneous'] }).id, 'outros'); + assert.equal(macroFor({ tags: [] }).id, 'outros'); + }); +}); From 244f00e4b316ecfdbf7dab87ad4c74ffd09ceeef Mon Sep 17 00:00:00 2001 From: lglucas Date: Sat, 8 Aug 2026 20:58:23 -0300 Subject: [PATCH 11/14] docs(v0.5.2): changelog e session-log do kernel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Registra as seis prioridades, as decisões que não são óbvias e os dois bypass que os testes acharam no próprio hook de segurança. Inclui correção a mim mesmo: o relatório apontou três regras curtas como deficientes; reexaminando, só security-baseline era. code-style e research-discipline são concisas mas completas, e não foram infladas só pra ficar consistente com o que eu tinha escrito antes. Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 60 ++++++++++ session-log/2026-08-08-v0.5.2-kernel.md | 141 ++++++++++++++++++++++++ session-log/INDEX.md | 1 + 3 files changed, 202 insertions(+) create mode 100644 session-log/2026-08-08-v0.5.2-kernel.md diff --git a/CHANGELOG.md b/CHANGELOG.md index e2be1f9..bcd8717 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,66 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), > - [x] **PR 3** — Skill frontmatter fix + audit > - [x] **PR 4** — awesome-selfhosted catalog + managed-vs-self-hosted question > - [x] **PR 5** — researched equivalents for the gap categories +> - [x] **PR 6 (v0.5.2)** — the kernel: hooks, frontmatter, self-test in CI, plugin manifest, rule rebalance, tests + +--- + +## v0.5.2 — o kernel + +Até aqui o OS era **100% persuasão**: regras que o modelo lê, skills que ele invoca, um wizard que ele segue. O `settings.json` versionado tinha três linhas e nenhum hook. A golden rule nº 1 é "nunca commite segredos" e nada impedia isso mecanicamente. + +### Added — hooks PreToolUse (enforcement de verdade) + +| Hook | Dispara em | Bloqueia | +|---|---|---| +| `block-secret-commit.js` | `Bash` → `git commit` | diff que adiciona algo com formato de credencial, ou `.env`/`.pem`/`.key` staged | +| `protect-env-files.js` | `Write`, `Edit`, `MultiEdit`, `NotebookEdit` | escrita em `.env` real (`.env.example` liberado) | + +**Os padrões exigem formato completo, não prefixo.** `.claude/rules/secrets.md` cita `sk-` e `AKIA` como texto literal; casar por prefixo bloquearia commitar a própria regra que os define. Agora é `sk-` + 20 caracteres, `AKIA` + exatamente 16, `ghp_` + exatamente 36. + +Três decisões que não são óbvias: **o hook nunca imprime o valor casado** (um alerta que ecoa a credencial a espalha); **só linhas adicionadas disparam** (remover chave vazada precisa continuar possível); e **ambos falham abertos** em payload malformado, porque hook que trava a sessão por engano faz o usuário desligar tudo. + +Escape hatch por execução: `AIOS_ALLOW_SECRET_COMMIT=1`, `AIOS_ALLOW_ENV_WRITE=1`. + +`.claude/hooks/README.md` documenta também **o que deliberadamente não virou hook** — forçar ordem do wizard, exigir changelog, bloquear push. Regra de bolso: hook para o que é irreversível. + +### Fixed — frontmatter em comandos e agentes + +Mesmo defeito do PR 3, uma camada abaixo: + +| | Antes | Depois | +|---|---|---| +| Comandos com frontmatter | 0/11 | **11/11** | +| Agentes com frase-gatilho | 2/12 | **12/12** | + +Os dois agentes que já tinham gatilho nasceram no pack v0.3.0 — a mesma fratura geracional das skills. `legal-compliance-agent` é acionado por dez arquivos vivos e tinha zero. + +### Changed — `os-self-test` virou script e roda no CI + +Era skill; dependia de alguém lembrar. Três session-logs registram ela **não sendo executada** quando teria ajudado. + +`scripts/os-self-test.js` verifica estrutura canônica, frontmatter, links relativos, integridade do registry nos dois sentidos, indexação do session-log, wiring dos hooks, gitignore e artefatos de projeto — com modo repo-do-OS vs. projeto derivado detectado pelo `.aios-self`. Novo job no CI. **67 verificações, zero erro.** + +### Added — manifesto de plugin + +`.claude-plugin/plugin.json`. Antes o OS só se distribuía por clone ou "Use this template", sem instalação versionada nem marketplace. + +### Changed — orçamento de contexto das regras reequilibrado + +Tudo em `.claude/rules/` entra em todo prompt. `security-baseline` tinha **3 linhas**; `wizard-stage-tags`, **60** — 25% do orçamento para uma convenção opt-in. + +Agora: `security-baseline` 42 linhas de procedimento acionável (incluindo testar com dois usuários para pegar IDOR, e rotacionar **antes** de investigar quando algo vaza), `wizard-stage-tags` 19 de ponteiro. Total 236 → 234: o ponto não era cortar, era gastar onde importa. + +### Added — 75 testes, que acharam 2 bypass reais + +`node:test`, zero dependências. E encontraram duas formas de contornar o hook de segredo: + +1. **`git -C /tmp commit`** não era reconhecido — o regex só tratava flags sem valor. +2. **`git add . && git commit`** também passava — eu retornava no primeiro segmento do shell. + +`isGitCommit` virou tokenização em vez de regex. Um hook de segurança revisado e testado à mão ainda tinha dois furos que só apareceram quando um teste tentou quinze formas de escrever o comando. + +`sync-selfhosted.js` ganhou guarda `require.main` — sem ela, importá-lo num teste dispararia um `git clone`. ### Added — `docs/selfhosted/gaps.md`, closing what the mirror cannot diff --git a/session-log/2026-08-08-v0.5.2-kernel.md b/session-log/2026-08-08-v0.5.2-kernel.md new file mode 100644 index 0000000..d146488 --- /dev/null +++ b/session-log/2026-08-08-v0.5.2-kernel.md @@ -0,0 +1,141 @@ +# 2026-08-08 — v0.5.2: o kernel que faltava + +## O que originou + +O usuário pediu um relatório do estado do OS e uma avaliação. O veredito foi: + +> O OS é forte em processo e fraco em execução mecânica. A camada de pensamento está madura. A camada de enforcement praticamente não existe. Você construiu um sistema operacional muito bem documentado que **não tem kernel**. + +A resposta foi: *"vamos abrir esta nova PR para empilhar com as demais, e fazer todas estas 6 prioridades."* + +Seis prioridades, seis commits, um PR. + +--- + +## P1 — Hooks: o kernel + +O `.claude/settings.json` versionado tinha **três linhas**. Nenhum hook, nenhuma permissão. A golden rule nº 1 é "nunca commite segredos" e nada impedia isso mecanicamente — o CI só pega depois do push. + +Dois `PreToolUse`, Node sem dependência: + +- `block-secret-commit.js` (matcher `Bash`) — inspeciona o diff staged em qualquer `git commit`. +- `protect-env-files.js` (`Write|Edit|MultiEdit|NotebookEdit`) — impede escrita em `.env` real. + +### A decisão que definiu o desenho: formato completo, não prefixo + +`.claude/rules/secrets.md` documenta `sk-`, `ghp_`, `AKIA` como padrões a detectar. Casar por prefixo **bloquearia commitar a própria regra que os define**. Então cada padrão exige o formato inteiro: `sk-` + 20 caracteres, `AKIA` + exatamente 16, `ghp_` + exatamente 36. + +Documentação que menciona o prefixo passa. Chave real, não. + +### Três decisões de segurança que não são óbvias + +1. **O hook nunca imprime o valor casado** — só arquivo e nome do padrão. Alerta que ecoa a credencial no terminal a espalha em vez de contê-la. Há teste verificando isso explicitamente. +2. **Só linhas adicionadas são inspecionadas.** Remover uma chave vazada precisa continuar possível — o inverso transformaria o hook numa armadilha. +3. **Falha aberto em payload malformado.** Hook que trava a sessão por engano é pior que hook nenhum: o usuário desliga tudo e perde junto o que funcionava. + +### O que deliberadamente NÃO virou hook + +Forçar a ordem do wizard, exigir changelog por commit, bloquear push para `main`. Regra de bolso adotada e documentada: **hook para o que é irreversível**. Segredo vazado é irreversível; ordem de estágio, não. + +--- + +## P2 — Frontmatter em comandos e agentes + +O mesmo defeito do PR #12, uma camada abaixo, duas vezes: + +| | Antes | Depois | +|---|---|---| +| Comandos com frontmatter | 0/11 | **11/11** | +| Agentes com frase-gatilho | 2/12 | **12/12** | + +Os dois agentes que já tinham gatilho eram `bug-triage-agent` e `launch-agent` — nascidos no pack vibe-coder v0.3.0. Mesma fratura geracional das skills: o que veio na v0.2.0 nunca foi retrofitado. + +Pior caso: `legal-compliance-agent` é acionado por dez arquivos vivos e tinha zero gatilho. + +--- + +## P3 — `os-self-test` vira script + +A skill dependia de alguém lembrar de invocá-la — e três session-logs registram exatamente ela não sendo executada quando teria ajudado. **Verificação que depende de memória não é verificação.** + +`scripts/os-self-test.js`, 8 grupos de checagem, rodando no CI a cada push. Estado atual: 67 verificações, zero erro. + +### Dois achados durante a implementação + +1. **Falso positivo em `./rules`.** O check contava entradas de diretório; o repo tem `rules/quality` e `rules/stack-specific` vazios e não versionados. Git não os vê, `readdir` sim — falhava local e passava no CI. Agora conta arquivos recursivamente, o mesmo critério do checkout. +2. **`.claude/skills/external/` não tinha `SKILL.md` nem README.** A regra virou: diretório sob `skills/` precisa de um dos dois, e a ausência dos dois indica skill quebrada. Como `external/` é legitimamente diretório de referência, ganhou README declarando isso. + +A skill virou wrapper. Decidir se link quebrado significa arquivo faltando ou link sobrando continua sendo trabalho do modelo. + +--- + +## P4 — Manifesto de plugin + +Não existia `plugin.json` em lugar nenhum. O OS só se distribuía por clone ou "Use this template" — sem instalação versionada, sem marketplace, sem caminho de atualização. Item aberto desde a auditoria da v0.5. + +Schema conferido contra três plugins oficiais. + +--- + +## P5 — Reequilíbrio das regras + +Tudo em `.claude/rules/` entra em **todo prompt**. A distribuição estava invertida: + +| | Antes | Depois | +|---|---|---| +| `security-baseline` | 3 linhas | **42** | +| `wizard-stage-tags` | 60 linhas | **19** (ponteiro) | +| **Total** | 236 | **234** | + +O total quase não mudou — **o ponto não era cortar, era gastar onde importa**. Uma convenção opt-in ocupava 25% do orçamento enquanto a regra de segurança tinha três linhas. + +### Correção a mim mesmo + +O relatório apontou **três** regras curtas como deficientes. Reexaminando na hora de escrever: só `security-baseline` era. `code-style` e `research-discipline` são concisas mas completas — declaram o limite e o procedimento. Não foram infladas só para ficar consistente com o relatório. + +--- + +## P6 — Testes, que acharam dois bypass reais + +75 testes em 11 suítes, `node:test`, zero dependências. + +**Os testes encontraram duas formas de contornar o hook de segredo**, ambas corrigidas: + +1. **`git -C /tmp commit` não era reconhecido.** O regex só tratava flags sem valor, e `-C` consome o próximo token. Quem usasse `git -C dir commit` passava direto pelo gate. +2. **`git add . && git commit` também passava.** Eu retornava no primeiro segmento do shell em vez de continuar procurando nos demais. + +`isGitCommit` deixou de ser regex e virou tokenização: separa por `&&`, `||`, `;`, `|`, pula flags com lista explícita das que consomem valor, e checa se o primeiro token não-flag é `commit`. + +**Isto é a justificativa inteira da P6 num parágrafo.** Um hook de segurança escrito com cuidado, revisado por mim, testado à mão ponta a ponta — e ainda assim tinha dois furos que só apareceram quando um teste tentou quinze formas diferentes de escrever o comando. + +`sync-selfhosted.js` ganhou guarda `require.main` — sem ela, importá-lo num teste dispararia um `git clone` do upstream como efeito colateral. + +--- + +## Decisões worth preserving + +1. **Node como runtime dos hooks.** Shell script quebra no Windows sem git-bash; Python não é garantido. Node é o denominador comum de quem constrói SaaS. Sem Node, os hooks falham ao iniciar e o Claude Code segue sem eles — o OS continua funcionando, só perde o kernel. + +2. **Escape hatch por variável de ambiente, com instrução de registrar o porquê.** `AIOS_ALLOW_SECRET_COMMIT=1` e `AIOS_ALLOW_ENV_WRITE=1`. Sem escape, o primeiro falso positivo faz o usuário desativar tudo. Com escape mas sem justificativa registrada, vira hábito. + +3. **Um PR, seis commits.** O usuário pediu "esta nova PR" no singular. Commits separados por prioridade mantêm o review navegável sem contrariar o pedido. Cada commit intermediário deixa o CI válido — o step de teste só entrou no commit da P6, junto com os testes. + +4. **O glob no CI não é detalhe.** `node --test scripts/test/` faz o Node v24 resolver o diretório como caminho de módulo e falhar com `Cannot find module`. Precisa ser `node --test "scripts/test/*.test.js"`. Descoberto rodando, não lendo documentação. + +--- + +## Verificação + +- 75/75 testes passam. +- `os-self-test`: 67 verificações, zero erro, zero aviso. +- Os três vetores de bypass revalidados ponta a ponta em repo git temporário: exit 2 nos três. +- `sync-selfhosted.js` reproduz o catálogo **byte a byte** — `git diff` vazio após regeneração, provando que a refatoração para exportar funções não alterou a saída. +- Todos os JSON validados por parse. + +## O que continua aberto + +- **Não existe skill de `technical-plan`** — estágio 4.2 segue só com prosa. Vem do PR #12 e não foi tocado. +- **`templates/project/CLAUDE.md:62` anuncia `/release-check`**, que não existe entre os 11 comandos. O `os-self-test` ainda não pega isso porque não cruza comandos anunciados em templates com comandos reais. +- **`deploy-vercel-supabase` cobre só o Supabase gerenciado** — pendência do PR #15. +- **PR #9 segue aberto há 95+ dias**, e o `course/` continua referenciando a ordem antiga do wizard. +- **Os hooks não têm teste de integração no CI** — os testes cobrem as funções puras; a execução via payload real foi verificada à mão nesta sessão, não automaticamente. diff --git a/session-log/INDEX.md b/session-log/INDEX.md index 15c2cda..b66544e 100644 --- a/session-log/INDEX.md +++ b/session-log/INDEX.md @@ -6,6 +6,7 @@ Each entry captures the reasoning behind a material decision: what was true befo | Date | Topic | File | |---|---|---| +| 2026-08-08 | v0.5.2 — o kernel: hooks PreToolUse que bloqueiam commit de segredo e escrita em `.env`, frontmatter em comandos e agentes, `os-self-test` como script no CI, manifesto de plugin, reequilíbrio das regras, e 75 testes que acharam 2 bypass reais no hook | [`2026-08-08-v0.5.2-kernel.md`](2026-08-08-v0.5.2-kernel.md) | | 2026-08-08 | v0.5.1 — pesquisa de equivalentes self-hosted para as 7 lacunas + Supabase e alternativas ao Luma; 90+ repos consultados na API do GitHub, revelando "open core" como terceira armadilha de licença (13 projetos) | [`2026-08-08-v0.5.1-selfhosted-gaps.md`](2026-08-08-v0.5.1-selfhosted-gaps.md) | | 2026-08-08 | v0.5.0 PR 4 — awesome-selfhosted (1.346 projetos) espelhado em `docs/selfhosted/` sob CC-BY-SA 3.0 com carve-out de licença, shortlist curada por categoria de SaaS, e a pergunta gerenciado-vs-self-hosted no estágio 4.2 | [`2026-08-08-v0.5.0-selfhosted-catalog.md`](2026-08-08-v0.5.0-selfhosted-catalog.md) | | 2026-08-08 | v0.5.0 PR 2 — Pitch artifact created (none existed) at new stage 2.9, plus the "BP/Pitch online?" question with a mandatory redaction gate; publication added to the privacy rule as a form of processing | [`2026-08-08-v0.5.0-pitch-publication.md`](2026-08-08-v0.5.0-pitch-publication.md) | From 81f8f4590634e9b897b1d08161b96e9c23eec782 Mon Sep 17 00:00:00 2001 From: lglucas Date: Sat, 8 Aug 2026 21:23:46 -0300 Subject: [PATCH 12/14] =?UTF-8?q?fix:=20aplica=20as=2014=20corre=C3=A7?= =?UTF-8?q?=C3=B5es=20do=20review=20do=20CodeRabbit=20no=20PR=20#11?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Todas as 14 threads eram legítimas, e três apontavam erro factual meu: - README.md declarava uma ordem "autoritativa" de artefatos que estava errada: knowledge-base/ nasce na Onda 1, antes do BP, e faltavam os dois outputs de registry-pick. Agora a lista é agrupada por fase. - CLAUDE.md descrevia a Fase 3 parando em "três direções clicáveis", omitindo o DESIGN-DIRECTION.md — um agente lendo só aquela tabela entraria na Fase 4 sem criar a ponte que ela consome. - phase-4-documentacao.md tratava o mock data como schema honesto. Mock data mostra o que a UI renderiza e omite id, dono do registro, timestamps, papéis e auditoria. Virou ponto de partida, com tabela do que costuma faltar. Contradições internas corrigidas: - WIZARD.md dizia que os quatro campos do BP eram "a única especificação" da Fase 3, enquanto a doc da própria fase lista knowledge-base/ e as dez perguntas como inputs. Agora são o mínimo. - Sprint -1 foi criado no 4.4 mas o gate da Fase 5 só falava em Sprint 0/1, tornando-o inalcançável. A sequência -1 para 0 para 1 agora é explícita. - O comando registry-pick mandava ler PRODUCT-BRIEF e TECHNICAL-PLAN como sinais padrão; na passada 3.1 esses arquivos não existem. O contrato de input passou a ser declarado por passada. - phase-1-largada.md afirmava que todo usuário termina com repo desacoplado, mas o estágio 1.2 permite adiar com aviso. - A tabela de fallback das tags classificava docs/technical/ inteiro como DOCUMENTACAO, rotulando errado o registry-pick-design.md, que pertence à Fase 3.1. Lacunas fechadas: - prototype-lab/SKILL.md dizia "same mock data" sem nomear o arquivo. A Fase 4.2 deriva entidades dele, então precisa ser o mesmo arquivo. - A Fase 3 produz decisão durável e não exigia registro no session-log. - O template de DESIGN-DIRECTION permitia combinação de direções mas depois exigia prototype-lab//, inexistente para combinação. Agora pede identificador estável, pastas de origem e consolidação. - O mesmo template não tinha tabela de rejeitados. - MD040: três fences sem linguagem, dois deles encontrados por verificação própria depois que o CodeRabbit apontou o primeiro. Ressalva honesta no CHANGELOG: a convenção de tags está monotônica, mas o consumidor real (Grand Prix) vive no PR #9, que segue aberto. A inferência de progresso só para de andar pra trás quando o #9 mergear. Correções aplicadas no topo da pilha; chegam à main pelos PRs #12 a #16. Co-Authored-By: Claude Opus 5 (1M context) --- .claude/commands/registry-pick.md | 9 ++++++- .claude/rules/wizard-stage-tags.md | 2 +- .claude/skills/prototype-lab/SKILL.md | 3 ++- CHANGELOG.md | 3 ++- CLAUDE.md | 2 +- README.md | 24 ++++++++++--------- WIZARD.md | 14 +++++++++-- docs/wizard-stage-tags.md | 8 ++++--- docs/wizard/phase-1-largada.md | 2 ++ docs/wizard/phase-2-ideacao.md | 2 +- docs/wizard/phase-3-prototipo.md | 2 ++ docs/wizard/phase-4-documentacao.md | 12 +++++++++- .../2026-08-08-v0.5.0-wizard-5-phases.md | 2 +- .../product/DESIGN-DIRECTION.template.md | 21 +++++++++++++++- 14 files changed, 81 insertions(+), 25 deletions(-) diff --git a/.claude/commands/registry-pick.md b/.claude/commands/registry-pick.md index 4c9a73f..b6e359f 100644 --- a/.claude/commands/registry-pick.md +++ b/.claude/commands/registry-pick.md @@ -18,7 +18,14 @@ Optional arguments: /registry-pick stack="" domain="" compliance="" ``` -If arguments are omitted, the skill will read project signals from `docs/business/BUSINESS-PLAN.md`, `docs/product/PRODUCT-BRIEF.md`, `docs/technical/TECHNICAL-PLAN.md`, and the repo manifest files (`package.json`, `Anchor.toml`, etc.). +If arguments are omitted, the skill reads project signals from whatever exists at that point in the wizard — the input contract differs per pass: + +| Pass | Lê | NÃO lê | +|---|---|---| +| **3.1** design | `docs/business/BUSINESS-PLAN.md` v0.0.2, `knowledge-base/` | Product Brief e Technical Plan — ainda não existem | +| **4.3** stack | tudo acima + `docs/product/PRODUCT-BRIEF.md`, `docs/technical/TECHNICAL-PLAN.md`, `prototype-lab/`, manifestos (`package.json`, `Anchor.toml`…) | — | + +Pedir na passada de design um arquivo que a Fase 3 ainda não produziu trava o wizard sem motivo. ## Actions diff --git a/.claude/rules/wizard-stage-tags.md b/.claude/rules/wizard-stage-tags.md index 27f700b..79b6da8 100644 --- a/.claude/rules/wizard-stage-tags.md +++ b/.claude/rules/wizard-stage-tags.md @@ -10,7 +10,7 @@ Convenção **opcional**: marque a fase do WIZARD no fim da mensagem de commit c | `[STAGE:DOCUMENTACAO]` | 4 — Brief, Technical Plan, roadmap | | `[STAGE:CHEGADA]` | 5 — Sprint 1, deploy | -``` +```text feat(prototype): três direções visuais [STAGE:PROTOTIPO] ``` diff --git a/.claude/skills/prototype-lab/SKILL.md b/.claude/skills/prototype-lab/SKILL.md index ecc660b..56c5c68 100644 --- a/.claude/skills/prototype-lab/SKILL.md +++ b/.claude/skills/prototype-lab/SKILL.md @@ -18,7 +18,8 @@ All prototypes must reflect `BP v0.0.2` (personas, positioning, MVP scope, prima ## Rules - Three directions, genuinely distinct — not three shades of one idea. -- Same mock data and same core flows across all three, so the comparison is about design and not content. +- **All three read the same file: `prototype-lab/shared/mock-data.js`.** Not "equivalent data" — the same file. Phase 4.2 derives the Technical Plan's entities from it, so it needs one guaranteed shared source. +- Same core flows across all three, so the comparison is about design and not content. - Each direction carries an explicit brand hypothesis: palette, typography, density, tone. - Do not contaminate the production app with prototype code. diff --git a/CHANGELOG.md b/CHANGELOG.md index bcd8717..4a77f34 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -236,7 +236,8 @@ Checked, and **no change needed**. 23 of 26 skills are original to this repo. Th - **Prototype Lab moved from last-before-coding to Phase 3** — before the Product Brief and Technical Plan, which are now reverse-engineered from the approved prototype. - **Fractional stages eliminated.** `Stage 0.5` (detach) → `1.2`. `Stage 11.5` (registry pick) → split into `3.1` (design packs, before prototyping) and `4.3` (stack packs, after the Technical Plan). -- **Phases map 1:1 onto the five commit tags** in `.claude/rules/wizard-stage-tags.md`. No translation table. This also fixes a pre-existing bug: under the old order `PROTOTIPO` came chronologically *after* `DOCUMENTACAO`, so systems inferring progress from tag sequence saw projects moving backwards. The five tag values are unchanged; old commits stay valid. +- **Phases map 1:1 onto the five commit tags** in `.claude/rules/wizard-stage-tags.md`. No translation table. This also corrects a pre-existing ordering bug: under the old order `PROTOTIPO` came chronologically *after* `DOCUMENTACAO`, so systems inferring progress from tag sequence saw projects moving backwards. The five tag values are unchanged; old commits stay valid. + > **The convention is fixed; the consumer is not yet.** The Grand Prix system that reads these tags lives in PR `#9`, which remains open. Progress inference stops moving backwards only once `#9` merges and adopts the monotonic order. - **Sprint -1 changed job** from building the prototype to consolidating it into a design system. `docs/sprints/sprint--1-prototype-lab.md` → `docs/sprints/sprint--1-design-system.md`. - **BP v0.0.2 gained an exit condition** at stage 2.8: it must explicitly state personas, positioning, MVP scope, and the primary user flow, because Phase 3 has no Product Brief to read. diff --git a/CLAUDE.md b/CLAUDE.md index bface45..37f9621 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -49,7 +49,7 @@ The canonical wizard is `WIZARD.md`. It runs in **5 phases**: |---|---|---| | 1 | Largada | detached repo, project intro | | 2 | Ideação | research, red team, BP v0.0.2 | -| 3 | Protótipo | brand, color, UI, UX — three clickable directions | +| 3 | Protótipo | brand, color, UI, UX — three clickable directions, one approved, and `docs/product/DESIGN-DIRECTION.md` written as the bridge into Phase 4 | | 4 | Documentação | Product Brief + Technical Plan reverse-engineered from the prototype, then the roadmap | | 5 | Chegada | Sprint 0 / Sprint 1 | diff --git a/README.md b/README.md index 8b1a6fc..89da8a2 100644 --- a/README.md +++ b/README.md @@ -176,19 +176,21 @@ Me fale sobre teu projeto. Behind the scenes, Claude is instructed to create and maintain: ```txt -docs/business/BUSINESS-PLAN.md -docs/business/PITCH.md -prototype-lab/ -docs/product/DESIGN-DIRECTION.md -docs/product/PRODUCT-BRIEF.md -docs/technical/TECHNICAL-PLAN.md -docs/SPRINTS.md -CHANGELOG.md -session-log/ -knowledge-base/ +Phase 2 knowledge-base/ ← Wave 1, before the BP + docs/business/BUSINESS-PLAN.md + docs/business/PITCH.md +Phase 3 docs/technical/registry-pick-design.md ← 3.1, before prototyping + prototype-lab/ + docs/product/DESIGN-DIRECTION.md +Phase 4 docs/product/PRODUCT-BRIEF.md + docs/technical/TECHNICAL-PLAN.md + docs/technical/registry-pick.md ← 4.3, before the roadmap + docs/SPRINTS.md +always CHANGELOG.md + session-log/ ``` -The order above is the order the wizard produces them in. +That is the order the wizard produces them in. `CHANGELOG.md` and `session-log/` are maintained throughout every phase, not written at the end. --- diff --git a/WIZARD.md b/WIZARD.md index 613f95f..f4fa164 100644 --- a/WIZARD.md +++ b/WIZARD.md @@ -299,7 +299,7 @@ docs/business/BUSINESS-PLAN.md BP version becomes `v0.0.2`. -**BP v0.0.2 is the contract that Phase 3 builds against.** Before leaving this phase, confirm the BP explicitly states: personas, positioning, MVP scope, and the primary user flow. Phase 3 has no Product Brief to lean on — these four items are its only specification. +**BP v0.0.2 is the contract that Phase 3 builds against.** Before leaving this phase, confirm the BP explicitly states: personas, positioning, MVP scope, and the primary user flow. Phase 3 has no Product Brief to lean on, so these four are the **minimum** it can rely on — alongside the research in `knowledge-base/` and the ten strategic questions, which remain inputs. --- @@ -605,7 +605,17 @@ Each sprint should include objective, DoD, deliverables, agents, skills, securit ## 5.1 — Start coding only after approval -Only after the user approves BP v0.0.2, the prototype direction, the Product Brief, the Technical Plan, and the sprint roadmap may Claude begin Sprint 0 / Sprint 1 implementation. +Only after the user approves BP v0.0.2, the prototype direction, the Product Brief, the Technical Plan, and the sprint roadmap may Claude begin implementation. + +The sequence is **Sprint -1 → Sprint 0 → Sprint 1**: + +| Sprint | Job | +|---|---| +| **-1 — Design System** | Consolidate the approved prototype and `DESIGN-DIRECTION.md` into real tokens, components and layout primitives. Defined at stage 4.4. | +| **0 — Setup** | Environment, repo hygiene, CI, deploy target. | +| **1 — Foundation** | The first real feature, on top of the design system. | + +Skipping Sprint -1 means Sprint 1 reinvents the design decisions the prototype already made. The first coding sprint must follow `.claude/rules/`. diff --git a/docs/wizard-stage-tags.md b/docs/wizard-stage-tags.md index 1080b27..b6fbe2a 100644 --- a/docs/wizard-stage-tags.md +++ b/docs/wizard-stage-tags.md @@ -22,7 +22,7 @@ Adicione `[STAGE:X]` no fim da mensagem de commit. As 5 tags correspondem **1:1 ## Exemplos -``` +```text feat: setup inicial e estrutura canônica [STAGE:LARGADA] docs: 10 perguntas estratégicas respondidas [STAGE:IDEACAO] docs(business): BP v0.0.2 com correções do red team [STAGE:IDEACAO] @@ -46,10 +46,12 @@ Se a tag for esquecida, ferramentas que dependem dela podem inferir a fase pelos | Arquivos tocados | Fase inferida | |---|---| | `knowledge-base/`, `docs/business/BUSINESS-PLAN.md`, `docs/business/PITCH.md` | `IDEACAO` | -| `prototype-lab/`, `docs/product/DESIGN-DIRECTION.md` | `PROTOTIPO` | -| `docs/product/PRODUCT-BRIEF.md`, `docs/technical/`, `docs/SPRINTS.md` | `DOCUMENTACAO` | +| `prototype-lab/`, `docs/product/DESIGN-DIRECTION.md`, **`docs/technical/registry-pick-design.md`** | `PROTOTIPO` | +| `docs/product/PRODUCT-BRIEF.md`, `docs/technical/TECHNICAL-PLAN.md`, `docs/technical/registry-pick.md`, `docs/SPRINTS.md` | `DOCUMENTACAO` | | `src/`, `app/` | `CHEGADA` | +⚠️ **A ordem das regras importa.** `registry-pick-design.md` mora em `docs/technical/` mas é produzido no estágio **3.1**, antes de prototipar. Uma regra genérica de `docs/technical/ → DOCUMENTACAO` o classificaria errado. Case o caminho específico **antes** do diretório. + Tags explícitas são preferidas porque eliminam ambiguidade. ## Quem consome isto diff --git a/docs/wizard/phase-1-largada.md b/docs/wizard/phase-1-largada.md index 7873fb3..4ae513b 100644 --- a/docs/wizard/phase-1-largada.md +++ b/docs/wizard/phase-1-largada.md @@ -9,6 +9,8 @@ The user ends this phase with a repository that belongs to them, is detached from the OS origin, and is safe to commit to. +**Exceção documentada:** o usuário pode adiar o setup de Git/GitHub. Nesse caso o wizard continua, mas o estágio 1.2 registra o adiamento e **nenhum commit pode acontecer até o desacoplamento estar completo** — commitar antes disso é exatamente o cenário que esta fase existe para evitar. + --- ## 1.1 — Repository comprehension diff --git a/docs/wizard/phase-2-ideacao.md b/docs/wizard/phase-2-ideacao.md index 9cbf377..237e375 100644 --- a/docs/wizard/phase-2-ideacao.md +++ b/docs/wizard/phase-2-ideacao.md @@ -53,7 +53,7 @@ Claude applies the corrections, then runs a second pass checking every change fo `BP v0.0.2` becomes the contract that Phase 3 builds against. -**Before leaving stage 2.8**, confirm the BP explicitly states four things: personas, positioning, MVP scope, and the primary user flow. Phase 3 has no Product Brief to lean on — these four are its only specification. +**Before leaving stage 2.8**, confirm the BP explicitly states four things: personas, positioning, MVP scope, and the primary user flow. Phase 3 has no Product Brief to lean on, so these four are the **minimum** it can rely on — the research in `knowledge-base/` and the ten strategic questions remain inputs too. --- diff --git a/docs/wizard/phase-3-prototipo.md b/docs/wizard/phase-3-prototipo.md index 43e2cc2..6d3dd73 100644 --- a/docs/wizard/phase-3-prototipo.md +++ b/docs/wizard/phase-3-prototipo.md @@ -63,4 +63,6 @@ Claude then writes `docs/product/DESIGN-DIRECTION.md`: chosen direction and why, **This file is the bridge to Phase 4.** Without it, the reverse engineering has nothing concrete to read. +Além do artefato, a fase produz uma **decisão durável** — e decisão vai para o `session-log/`, por golden rule 4. Registre a direção aprovada, as alternativas rejeitadas e por quê, a data e quem aprovou. Daqui a seis meses "por que a gente escolheu essa cara?" é uma pergunta real, e o `DESIGN-DIRECTION.md` responde *o quê*, não *por quê*. + Hard stop — Claude waits for explicit approval before entering Phase 4. diff --git a/docs/wizard/phase-4-documentacao.md b/docs/wizard/phase-4-documentacao.md index 485ef61..c01f828 100644 --- a/docs/wizard/phase-4-documentacao.md +++ b/docs/wizard/phase-4-documentacao.md @@ -38,7 +38,17 @@ Reverse-engineering checks specific to the new order: `docs/technical/TECHNICAL-PLAN.md` — stack, rationale, architecture assumptions, data model, auth model, API conventions, security baseline, privacy/compliance baseline, testing strategy, CI/CD, environment variables, deployment assumptions, risks, open questions. -The data model is derived from the entities visible in `prototype-lab/shared/mock-data.js`. Mock data written to make three screens look real is a surprisingly honest first schema — it contains exactly the fields the product actually displays, and nothing speculative. +The data model **starts** from the entities visible in `prototype-lab/shared/mock-data.js`. Mock data written to make three screens look real is an honest first draft — it holds exactly the fields the product displays, and nothing speculative. + +**It is a starting point, not the schema.** Mock data shows what the UI renders; it routinely omits what the system needs. Reconcile it against BP v0.0.2, the approved design and the gaps table before calling it a data model: + +| Costuma faltar no mock | Por quê | +|---|---| +| Identificadores e chaves estrangeiras | a tela mostra nome, não `id` | +| Dono do registro / tenant | uma tela só renderiza os dados de um usuário | +| Timestamps, soft delete, versão | invisíveis na interface | +| Papéis e estados de permissão | o mock assume o caminho feliz | +| Campos de auditoria | ninguém desenha log | No alpha/beta stack unless the user explicitly accepts it. diff --git a/session-log/2026-08-08-v0.5.0-wizard-5-phases.md b/session-log/2026-08-08-v0.5.0-wizard-5-phases.md index 8dcd540..eaa4c9d 100644 --- a/session-log/2026-08-08-v0.5.0-wizard-5-phases.md +++ b/session-log/2026-08-08-v0.5.0-wizard-5-phases.md @@ -21,7 +21,7 @@ The Prototype Lab ran **after** the Product Brief, the Technical Plan, and the s ### 1. Five phases replace four numberings -``` +```text FASE 1 — LARGADA [STAGE:LARGADA] 1.1 – 1.3 FASE 2 — IDEAÇÃO [STAGE:IDEACAO] 2.1 – 2.8 FASE 3 — PROTÓTIPO [STAGE:PROTOTIPO] 3.1 – 3.3 diff --git a/templates/product/DESIGN-DIRECTION.template.md b/templates/product/DESIGN-DIRECTION.template.md index 89bc41b..efc8c5b 100644 --- a/templates/product/DESIGN-DIRECTION.template.md +++ b/templates/product/DESIGN-DIRECTION.template.md @@ -5,9 +5,19 @@ > Replace every `<...>` placeholder. Delete this block when done. - **Project:** `` -- **Chosen direction:** `` - **Approved on:** `` - **Approved by:** `` +- **Chosen direction:** `` + +**Se for combinação**, dê a ela um identificador estável e liste toda pasta de origem. O resto deste documento e a Fase 4 referenciam `prototype-lab//`, e uma combinação não tem pasta única: + +| Identificador | `` | +|---|---| +| Pastas de origem | `prototype-lab/prototype-a/`, `prototype-lab/prototype-b/` | +| O que veio de cada | `` | +| Pasta consolidada | `` | + +Sem pasta consolidada, a Fase 4 não tem o que ler. --- @@ -19,6 +29,15 @@ `` +## What was rejected, and why + +A Fase 3 exige registrar o que foi **descartado**, não só o que ficou. Sem isso, a mesma ideia volta daqui a três meses como se fosse nova. + +| Elemento rejeitado | Veio de | Por que não | +|---|---|---| +| `` | `` | `` | +| `<...>` | `<...>` | `<...>` | + --- ## Color tokens From dd045d0e891235cc30ee53487c87e1bae08242f1 Mon Sep 17 00:00:00 2001 From: lglucas Date: Sat, 8 Aug 2026 21:45:55 -0300 Subject: [PATCH 13/14] docs(readme): atualiza o front door para a v0.5.2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit O usuário perguntou se eu tinha lembrado do README. Parcialmente: eu atualizei só o que a reordenação de fases obrigava (Core flow, Prototype Lab, camadas de documentação, PITCH). Tudo que veio depois ficou de fora. Faltava: - badge travado em v0.4.5 - hooks: zero menções à única camada de enforcement do OS - docs/selfhosted/: zero menções aos 1.346 projetos e ao gaps.md - manifesto de plugin: zero menções, então ninguém sabia que dá pra instalar sem clonar - os-self-test.js e a suíte de testes: zero menções Adicionado: - Seção "Hooks — the kernel", explicando por que os padrões exigem formato completo e por que o hook nunca imprime o valor casado. - Seção do catálogo self-hosted, com o carve-out CC-BY-SA em destaque e as três armadilhas de licença. - Seção "The OS tests itself", com os dois comandos e a admissão de que os testes acharam dois bypass que o teste manual não pegou. - Nota de instalação como plugin no Quick start. - Skills: a lista de 9 exemplos virou tabela por estágio do wizard, com a contagem real de 27 e a regra de que descrição precisa dizer QUANDO acionar, não só o que faz. - Postura de segurança agora lidera com os hooks. Co-Authored-By: Claude Opus 5 (1M context) --- README.md | 91 +++++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 75 insertions(+), 16 deletions(-) diff --git a/README.md b/README.md index 89da8a2..c66fca8 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE) [![Claude Code Ready](https://img.shields.io/badge/Claude%20Code-ready-7B61FF)](START-HERE.md) -[![Status](https://img.shields.io/badge/status-v0.4.5%20course--vertical-green)](RELEASE-NOTES-v0.4.5.md) +[![Status](https://img.shields.io/badge/status-v0.5.2%20kernel-green)](CHANGELOG.md) [![Made for SaaS](https://img.shields.io/badge/made%20for-SaaS%20builders-111827)](#what-this-gives-you) **Day-zero operating system for serious vibe coding and AI-assisted SaaS development.** @@ -54,6 +54,8 @@ Claude, vamos iniciar um novo projeto. Leia primeiro o arquivo START-HERE.md e s Claude should read the repo structure, understand the operating system, and start the **Project Genesis Wizard** — including Stage 1.2 (detach from OS-origin) if you used the fallback `git clone` path. +> **Também é um plugin.** Desde a v0.5.2 o repo carrega [`.claude-plugin/plugin.json`](.claude-plugin/plugin.json), então dá para instalá-lo como plugin do Claude Code em vez de clonar — útil quando você quer as skills e os hooks dentro de um projeto que já existe, sem trazer a estrutura de documentos junto. + 📘 Need help setting up your IDE, Git, GitHub account, or Claude Code? Start here: [`docs/installation.md`](docs/installation.md). 🤝 Want to contribute back to the OS itself (bug fix, new skill, registry pack)? See [`CONTRIBUTING.md`](CONTRIBUTING.md). The `main` branch is protected — all changes go through PR. @@ -62,7 +64,7 @@ Claude should read the repo structure, understand the operating system, and star ## 🧠 What this gives you -- A ready-to-use `.claude/` runtime with agents, skills, commands, rules, and settings. +- A ready-to-use `.claude/` runtime: **27 skills, 12 agents, 11 commands, 11 rules** — and **hooks that block secret commits mechanically**, not by asking nicely. - A single start file: [`START-HERE.md`](START-HERE.md). - A guided wizard for ideation, research, business planning, review, sprint planning, prototyping, and first implementation. - Agent workflows for market research, competitor analysis, red-team critique, technical/security review, coordination, and investor-ready copywriting. @@ -70,6 +72,42 @@ Claude should read the repo structure, understand the operating system, and star - A disposable `prototype-lab/` for 3 HTML prototype directions — built before the Product Brief and Technical Plan, which are then reverse-engineered from the direction you approve. - Security, privacy, changelog, sprint, and coding rules from day zero. - Optional stack packs for SaaS, Next.js/Supabase, Solana, marketplace products, and other specialized projects. +- A **1.346-project self-hosted catalogue**, so "managed or self-hosted?" is a real question with real answers. + +--- + +## 🔑 Hooks — the kernel (v0.5.2) + +Everything else in this OS is **instruction**: rules the agent reads, skills it invokes, a wizard it follows. It works because the model cooperates. + +Hooks are the one layer that **does not depend on cooperation**. + +| Hook | Fires on | Blocks | +|---|---|---| +| [`block-secret-commit.js`](.claude/hooks/block-secret-commit.js) | `Bash` → any `git commit` | a diff that adds something credential-shaped, or stages `.env`/`.pem`/`.key` | +| [`protect-env-files.js`](.claude/hooks/protect-env-files.js) | `Write`, `Edit`, `MultiEdit`, `NotebookEdit` | writing into a real `.env` (`.env.example` allowed) | + +Patterns require the **full token shape**, not the prefix — otherwise the hook would block committing `.claude/rules/secrets.md`, the file that documents those prefixes. The hook **never prints the matched value**: an alert that echoes a credential spreads it instead of containing it. + +Both fail **open** on a malformed payload, and each has a documented escape hatch. Details and the list of what deliberately did *not* become a hook: [`.claude/hooks/README.md`](.claude/hooks/README.md). + +Requires Node. Without it the hooks are skipped and the OS still works — it just loses the kernel. + +--- + +## 🏠 Self-hosted catalogue (v0.5.0) + +The Technical Plan (stage 4.2) asks whether you want managed platforms, self-hosted, or hybrid. That question is only honest if there is a concrete answer on the self-hosted side. + +| File | What | +|---|---| +| [`docs/selfhosted/shortlist-saas.md`](docs/selfhosted/shortlist-saas.md) | **Start here.** ~20 categories a SaaS founder actually replaces, framed as "you pay for X → alternative Y" | +| [`docs/selfhosted/gaps.md`](docs/selfhosted/gaps.md) | What awesome-selfhosted does **not** cover — auth, uptime, CI/CD, backup, PaaS, VPN, events — researched separately and ranked by GitHub stars | +| [`docs/selfhosted/INDEX.md`](docs/selfhosted/INDEX.md) | All **1.346 projects**, 12 categories, generated from upstream | + +⚠️ The mirrored data is **CC-BY-SA 3.0**, not MIT like the rest of this OS. The carve-out is explained in [`docs/selfhosted/README.md`](docs/selfhosted/README.md). + +The catalogue also flags three kinds of licence trap — copyleft, source-available, and **open core**, where SSO and audit logs live in the paid edition. --- @@ -214,19 +252,39 @@ Core roles include: ## 🛠️ Skills -The `.claude/skills/` layer contains reusable workflows. +The `.claude/skills/` layer contains **27 reusable workflows**. Full inventory grouped by job: [`docs/skill-system.md`](docs/skill-system.md). + +One per wizard stage: + +| Skill | Stage | Job | +|---|---|---| +| `project-genesis` | all | drives the full 5-phase wizard | +| `research-waves` | 2.4–2.6 | market, competitors, red team, consolidation | +| `business-plan-impact-review` | 2.8 | downstream impact of every BP change | +| `pitch` | 2.9 | the pitch, plus the "BP online?" decision | +| `registry-pick` | 3.1 + 4.3 | external packs — design pass, then stack pass | +| `prototype-lab` | 3.2 | three visual directions, then design tokens | +| `product-brief` | 4.1 | reverse-engineers the brief from the prototype | +| `sprint-roadmap` | 4.4 | the 14–20 sprint roadmap | + +Plus build-and-ship (`feature-scaffold`, `verify-build-works`, `rollback-safe`, `release-check`…), safety (`secrets-discipline`, `secrets-scan`, `privacy-audit`, `multi-ai-review`), money and growth (`cost-watchdog`, `usage-monitor`, `first-100-users`, `grow-sustainably`), and working-with-a-vibe-coder (`daily-standup`, `plain-portuguese-explainer`, `decision-log`, `processize`, `os-self-test`). + +**Every skill declares when to reach for it**, in Portuguese, in its frontmatter — a description that only says what a skill *does* never gets invoked. See the [skill audit](docs/skill-audit-2026-08-08.md) for how that was fixed. + +--- + +## ✅ The OS tests itself + +```bash +node scripts/os-self-test.js # 8 coherence checks +node --test "scripts/test/*.test.js" # 75 unit tests +``` + +`os-self-test` verifies canonical structure, frontmatter coverage across skills/agents/commands, every relative link, registry ↔ INDEX consistency both ways, session-log indexing, hook wiring, and gitignore hygiene. It runs in CI on every push. -Important skills include: +It used to be a checklist a human had to remember — and three session logs record it going unrun exactly when it would have helped. That is why it is a script now. -- **project-genesis** — drives the full wizard. -- **sprint-management** — opens/closes sprints and maintains sprint docs. -- **feature-scaffold** — creates feature structure with rules and headers. -- **business-plan-impact-review** — checks downstream impact after BP edits. -- **prototype-lab** — creates three disposable HTML prototype directions. -- **privacy-audit** — reviews privacy/LGPD-style risks. -- **secrets-scan** — enforces secret scanning habits. -- **release-check** — checks readiness before tagging/release. -- **decision-log** — records why decisions were made. +The unit tests cover the hooks and the catalogue generator. They earned their keep immediately: they found **two ways to bypass the secret-blocking hook** (`git -C dir commit` and `git add . && git commit`) that manual testing had missed. --- @@ -311,14 +369,15 @@ The first-class target is a SaaS project, but the system can be adapted for web3 This repository is not a substitute for professional security review. It provides a baseline for safer AI-assisted development: -- secrets scanning habits; +- **hooks that mechanically block secret commits and `.env` writes** — the only layer that does not rely on the model cooperating; +- secrets scanning habits (`secrets-discipline` preventive, `secrets-scan` detective); - security review agents; - dependency and release checks; -- privacy audit workflow; +- privacy audit workflow, extended to cover publishing documents; - documentation of security decisions; - optional references to security-focused external skills. -See [`SECURITY.md`](SECURITY.md) and [`docs/security-baseline.md`](docs/security-baseline.md). +See [`SECURITY.md`](SECURITY.md), [`docs/security-baseline.md`](docs/security-baseline.md), and [`.claude/hooks/README.md`](.claude/hooks/README.md). --- From 9335b2615f9b18e30baeabd1c83906c287e4a231 Mon Sep 17 00:00:00 2001 From: lglucas Date: Sat, 8 Aug 2026 21:52:19 -0300 Subject: [PATCH 14/14] =?UTF-8?q?fix(ci):=20glob=20sem=20aspas=20nos=20tes?= =?UTF-8?q?tes=20e=20exclui=20o=20cat=C3=A1logo=20do=20lychee?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Duas falhas no primeiro run do CI novo, ambas legítimas: 1. Testes: "Could not find scripts/test/*.test.js". O glob entre aspas só funciona no Node 21+, que adicionou suporte a glob no --test; o runner usa Node 20 e recebeu a string literal. Meu Node 24 local mascarou o problema. Sem aspas, quem expande é o shell, e funciona em qualquer versão. 2. Lychee: 21 erros, todos em docs/selfhosted/catalog/. São os 1.346 links de terceiros que o PR anterior vendorizou — falham por TLS não confiável, HTTP/2 mal implementado e sites fora do ar. Não é defeito deste repo, e o upstream já roda o próprio verificador de link morto. Diretório excluído com --exclude-path, e a justificativa está no comentário do workflow pra ninguém "consertar" isso depois. As duas docs que ensinavam a forma com aspas (hooks/README e a skill os-self-test) foram corrigidas junto, mais o README. Co-Authored-By: Claude Opus 5 (1M context) --- .claude/hooks/README.md | 2 +- .claude/skills/os-self-test/SKILL.md | 2 +- .github/workflows/ci.yml | 16 +++++++++++++--- README.md | 2 +- 4 files changed, 16 insertions(+), 6 deletions(-) diff --git a/.claude/hooks/README.md b/.claude/hooks/README.md index 6b3268d..0cc7b1d 100644 --- a/.claude/hooks/README.md +++ b/.claude/hooks/README.md @@ -73,7 +73,7 @@ Sem Node instalado, os hooks falham ao iniciar e o Claude Code segue sem eles. * 2. Saia com 0 para permitir, 2 para bloquear com mensagem no stderr. 3. **Falhe aberto** em payload malformado — um hook quebrado não pode travar a sessão inteira. 4. Registre em `settings.json` e `settings.example.json`. -5. Escreva o teste em `scripts/test/` e rode com `node --test "scripts/test/*.test.js"` — o glob é necessário, passar o diretório faz o Node v24 tentar resolvê-lo como módulo. +5. Escreva o teste em `scripts/test/` e rode com `node --test scripts/test/*.test.js` — **sem aspas**. Passar o diretório faz o Node resolvê-lo como módulo; aspas só funcionam no Node 21+, que adicionou glob ao `--test`. Sem aspas, quem expande é o shell, e funciona em qualquer versão. 6. Documente aqui, com o escape hatch. O ponto 3 é o mais importante. Um hook que bloqueia por engano é pior que hook nenhum: o usuário desliga tudo e perde junto o que funcionava. diff --git a/.claude/skills/os-self-test/SKILL.md b/.claude/skills/os-self-test/SKILL.md index 36e2804..1874e7e 100644 --- a/.claude/skills/os-self-test/SKILL.md +++ b/.claude/skills/os-self-test/SKILL.md @@ -54,5 +54,5 @@ O script diz **o que** está quebrado. Interpretar e consertar continua sendo tr ## Related - Script: `scripts/os-self-test.js` -- Testes dos scripts e hooks: `node --test "scripts/test/*.test.js"` +- Testes dos scripts e hooks: `node --test scripts/test/*.test.js` (sem aspas — o shell expande; aspas exigem Node 21+) - Gate de release que o invoca: [`release-check`](../release-check/SKILL.md) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fe66b8f..2bdfa98 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,10 +24,14 @@ jobs: run: node scripts/os-self-test.js # Unit tests for the hooks and the catalogue generator. Node's built-in runner — - # no dependencies, nothing to install. The glob is required: passing the directory - # makes Node v24 resolve it as a module path and fail with "Cannot find module". + # no dependencies, nothing to install. + # + # The glob is UNQUOTED on purpose, so the shell expands it. Passing the directory + # makes Node resolve it as a module path ("Cannot find module"), and quoting the + # glob only works on Node 21+, which added glob support to --test. Node 20 reports + # "Could not find '.../scripts/test/*.test.js'". Shell expansion works everywhere. - name: Script unit tests - run: node --test "scripts/test/*.test.js" + run: node --test scripts/test/*.test.js lint-docs: runs-on: ubuntu-latest @@ -81,9 +85,15 @@ jobs: - name: Lychee link checker uses: lycheeverse/lychee-action@v2 with: + # docs/selfhosted/catalog/ is excluded on purpose: it is a generated mirror of + # 1.346 third-party project URLs from awesome-selfhosted. We do not control those + # hosts, and a handful always fail CI for TLS, HTTP/2 or plain downtime — none of + # which is a defect in this repo. Upstream already runs its own dead-link checker, + # and `node scripts/sync-selfhosted.js` pulls the cleaned result. args: >- --no-progress --exclude-loopback + --exclude-path docs/selfhosted/catalog --exclude 'github\.com/lglucas/boringco' --exclude 'linkedin\.com' --exclude 'lume\.ufrgs\.br' diff --git a/README.md b/README.md index c66fca8..717773f 100644 --- a/README.md +++ b/README.md @@ -277,7 +277,7 @@ Plus build-and-ship (`feature-scaffold`, `verify-build-works`, `rollback-safe`, ```bash node scripts/os-self-test.js # 8 coherence checks -node --test "scripts/test/*.test.js" # 75 unit tests +node --test scripts/test/*.test.js # 75 unit tests ``` `os-self-test` verifies canonical structure, frontmatter coverage across skills/agents/commands, every relative link, registry ↔ INDEX consistency both ways, session-log indexing, hook wiring, and gitignore hygiene. It runs in CI on every push.