Self-Hosted Apps Built with Go

76 self-hostable apps built with Go you can run on your own server — compared on specs, deployment difficulty, and the SaaS each one replaces.

Network-wide ad blocking

AdGuard Home

A single-binary, network-wide DNS ad and tracker blocker with a modern UI, built-in DoH/DoT encrypted DNS, and per-client rules out of the box. The polished alternative to Pi-hole.

easyRead guide →

AI Agent Platforms

AgentArea

A self-hosted runtime for governed agentic networks: instead of an agent library you import into your own app, AgentArea runs agents durably as infrastructure, with VPC-style network isolation between them, tool-approval workflows, ReBAC authorization, and full audit trails. Built on Temporal for durable execution, provider-agnostic via LiteLLM, and extensible through hosted MCP servers.

PythonNext.jsGoTemporal

hardRead guide →

Authelia

A lightweight, open-source authentication and authorization server providing 2FA and SSO via a forward-auth portal in front of your reverse proxy — a self-hosted gatekeeper for existing apps, not a full identity provider.

moderateRead guide →

authentik

An open-source identity provider supporting SAML, OAuth2/OIDC, and LDAP — a flexible, self-hostable alternative to Auth0, Okta, and Azure AD with a visual flow-based login builder.

PythonGoTypeScript

moderateRead guide →

Beszel

A lightweight server monitoring hub with a small agent per machine, charting CPU, memory, disk, network and Docker container stats with history and threshold alerts. The hub is a single Go binary built on PocketBase, so there is no separate database to run.

GoPocketBaseSQLite

easyRead guide →

Caddy

A web server and reverse proxy with automatic HTTPS on by default: name a domain in a two-line Caddyfile and it obtains and renews the certificate from Let's Encrypt or ZeroSSL and redirects HTTP to HTTPS for you. A single Apache-2.0 Go binary with no external dependencies, HTTP/3 on by default, and a JSON admin API for zero-downtime config changes — no web UI and no container auto-discovery out of the box.

easyRead guide →

Casdoor

An identity and access management server with a web admin console that exposes one user directory over OAuth 2.0, OIDC, SAML, CAS, LDAP and SCIM, with Casbin-based authorization policies. It runs as a single Go binary backed by MySQL, PostgreSQL or SQLite.

easyRead guide →

CrowdSec

An open-source intrusion-prevention engine that parses your server and application logs, detects brute force, scanning and other abusive behaviour with shared scenarios from its hub, and bans the offending IPs through separate 'bouncer' components for your firewall, reverse proxy or CDN. Every instance also pulls a community blocklist built from signals shared by other installs. The agent is MIT-licensed Go and runs as a single container with a SQLite database; it has no web UI of its own.

moderateRead guide →

Container registry

Distribution (Docker Registry)

The reference implementation of the OCI Distribution Specification and the registry engine inside Docker Hub, GitHub Container Registry, GitLab and Harbor, published on Docker Hub as the registry image: push and pull images and other OCI artifacts over HTTP, store them on local disk or S3-compatible, Azure and GCS backends, and gate access with htpasswd or a token server. Apache-2.0 licensed, a CNCF project written in Go; it runs as a single container with one data directory and no database or web UI.

easyRead guide →

Project Management

Donetick

Task and chore manager for individuals, families and small groups, with flexible recurring schedules, assignee rotation, subtasks, labels, points and natural-language task entry. Stores data in SQLite by default, with PostgreSQL as an option.

easyRead guide →

Container management

Dozzle

A real-time log viewer for Docker containers that streams logs in the browser with search, filtering, container grouping and optional multi-host agents. It is a single container that reads the Docker socket; login, container actions and shell access are off until you enable them.

easyRead guide →

Photo backup & gallery

Ente

End-to-end encrypted photo and video backup — Ente Photos, with its self-hostable server, museum. Files and metadata are encrypted on your device before upload, and face recognition and natural-language search run on your phone or desktop rather than the server. Apps for iOS, Android, desktop and web.

moderateRead guide →

File sync & storage

FileBrowser Quantum

A web file manager for folders on your server, with indexed search, share links, multiple users with OIDC or LDAP sign-in, WebDAV and file previews. It is a heavily reworked fork of the original File Browser project, whose filebrowser/filebrowser repository has since been archived on GitHub.

easyRead guide →

Forgejo

A community-run hard fork of Gitea, stewarded by the Codeberg nonprofit. Near-identical to use, with independent, community-first governance.

easyRead guide →

Gatus

A developer-oriented health dashboard and status page driven entirely by a YAML file, checking endpoints over HTTP, ICMP, TCP and DNS and evaluating each result against conditions on status code, response time, body values or certificate expiry. There is no setup UI — the monitor list lives in your repo.

easyRead guide →

Gitea

A lightweight, self-hosted Git service with pull requests, issues, and a CI runner — a fast GitHub alternative that runs comfortably on a small box.

easyRead guide →

GitLab CE

The whole DevOps platform in one install: repositories, merge requests, issues, a built-in CI/CD runner fleet, container and package registries, and Pages. It is open core — the community edition is MIT, the ee/ directory behind the paid tiers is not — and it is by far the heaviest thing on this list.

RubyGoPostgreSQL

hardRead guide →

Glance

A lightweight dashboard that puts RSS feeds, Hacker News and Reddit posts, weather, market prices, video channels and other widgets on one page, configured through a YAML file.

easyRead guide →

GoAlert

An on-call scheduling, alerting and escalation tool: define services, on-call schedules with rotations and escalation policies, accept alerts from monitoring through integration keys and notify the person on call, with most settings in an admin page of the web UI. Apache-2.0 Go and TypeScript; a single binary or container that needs only a PostgreSQL database.

GoTypeScriptPostgreSQL

easyRead guide →

GoatCounter

The smallest serious web analytics server: a single statically compiled Go binary (or the project's own Docker image) writing to a SQLite file, with PostgreSQL optional for big sites. It counts unique visits without cookies or identifiers, tracks referrers, campaigns, browsers, locations and screen sizes, and offers a JavaScript-free tracking pixel, a backend API, and log-file import. Its own README says it doesn't need a GDPR notice. Licensed EUPL-1.2; the same author runs a free hosted service.

easyRead guide →

Gogs

A self-hosted Git service that ships as one small Go binary — the original project Gitea and later Forgejo were forked from, still maintained and still the leanest of the three. Repositories, issues, pull requests, wiki and webhooks are all there; a built-in CI runner is not.

easyRead guide →

Push notifications

Gotify

A self-hosted server for push notifications with a web UI, per-app tokens, and an Android client. Point your apps and scripts at it and get instant alerts you fully control — no third-party push service in the middle.

easyRead guide →

Social network (Fediverse)

GoToSocial

A lightweight ActivityPub social network server written in Go that federates with Mastodon and the rest of the Fediverse. It has no built-in posting client beyond a basic web view; you use a Mastodon-compatible app to post.

GoSQLitePostgreSQL

easyRead guide →

Grafana

The standard open-source dashboarding and visualization layer for metrics, logs, and traces, querying Prometheus, Loki, and dozens of other data sources.

easyRead guide →

Container registry

Harbor

A full container registry for teams: projects with role-based access, a web UI, image and Helm chart storage, replication to and from other registries, retention and immutability rules, audit logs, robot accounts and optional Trivy vulnerability scanning, all on top of the CNCF Distribution registry. Apache-2.0 licensed and a CNCF graduated project, written in Go with an Angular portal; it runs as a set of containers (core, jobservice, portal, registry, PostgreSQL, Redis, nginx) generated and started by its own installer.

GoTypeScriptPostgreSQLRedisNginx

moderateRead guide →

VPN & Mesh Networking

Headscale

An open-source, self-hosted implementation of the Tailscale control server — run your own coordination plane for a private WireGuard mesh and keep using the official Tailscale clients, without depending on Tailscale's hosted service.

moderateRead guide →

Homebox

A home inventory and organization system for tracking items, locations, labels, warranties and receipts. It is a single Go binary with an embedded web UI and a SQLite database.

GoVueNuxtSQLite

easyRead guide →

AI Chat Interfaces

Jan

Offline-first, open-source ChatGPT alternative that runs LLMs locally on the desktop (llama.cpp based, GPU-accelerated where available), with an optional self-hosted Jan Server for OpenAI-compatible API access across a team.

moderateRead guide →

Kopia

A backup tool with a CLI, a desktop GUI (KopiaUI) and a server mode with a web UI: encrypted, deduplicated snapshots with per-path policies for retention, scheduling and compression (zstd, s2, pgzip; off by default), stored on S3-compatible storage, B2, Azure, Google Cloud, SFTP, WebDAV, rclone or a local disk. Repository maintenance runs automatically, and a repository server can take backups from many machines, each user seeing only its own snapshots.

easyRead guide →

listmonk

A self-hosted newsletter and mailing-list manager distributed as a single Go binary backed by PostgreSQL. It handles subscriber lists, campaigns, templates and transactional mail sent through your own SMTP servers.

GoVuePostgreSQL

easyRead guide →

AI Chat Interfaces

LocalAI

Drop-in, self-hosted OpenAI-compatible API server for running LLM, image, and voice models on consumer CPU hardware — no GPU required, with optional NVIDIA/AMD/Intel acceleration when available.

easyRead guide →

Grafana Loki

Grafana's log aggregation system, described by its README as "like Prometheus, but for logs": it indexes only a set of labels for each log stream, not the text of the logs, and stores compressed chunks, which keeps it simpler and cheaper to run than a full-text engine. Queried with LogQL, usually through Grafana. AGPL-3.0 Go; the image's stock config runs it as one process with filesystem storage.

easyRead guide →

Mattermost

A polished, Slack-style team chat you fully own — channels, threads, DMs, integrations, and a solid mobile app. The go-to self-hosted Slack replacement for teams that want their messages on their own server. The default Docker image is the Enterprise build: without a licence it runs as the free Entry edition, which keeps only the latest 10,000 channel messages. Set MATTERMOST_IMAGE=mattermost-team-edition in .env for the MIT-licensed Team Edition.

GoReactPostgreSQL

moderateRead guide →

Memos

A lightweight, self-hosted note stream for short-form Markdown notes, links and work logs, organized by timeline, tags and search rather than folders. It runs as a single container backed by SQLite by default.

easyRead guide →

Vector database

Milvus

A vector database built for similarity search over embeddings at scale: collections with multiple index types, scalar filtering, hybrid dense-plus-sparse search, partitions and role-based access, served over gRPC and a REST API with SDKs for Python, Go, Java and Node.js. Apache-2.0 licensed, written in Go and C++; in standalone mode it runs as one Milvus container that depends on etcd for metadata and MinIO (or S3) for the vectors themselves, with the message queue embedded.

moderateRead guide →

Miniflux

A deliberately minimalist RSS reader — a single Go binary backed by Postgres, opinionated, fast, and almost maintenance-free.

easyRead guide →

Navidrome

A self-hosted music streaming server (Subsonic-compatible) — stream your own library to dozens of mobile and desktop apps. Your music, your server.

easyRead guide →

VPN & Mesh Networking

NetBird

An open-source WireGuard-based mesh VPN that connects your devices, servers, and clouds into a single private network with SSO and access controls — a self-hostable alternative to Tailscale and Twingate. The client is BSD-3-licensed; the self-hosted control-plane components (management, signal, relay, combined) are AGPL-3.0.

hardRead guide →

Push notifications

ntfy

Send push notifications to your phone or desktop from any script with a simple HTTP PUT or POST — no accounts, no cloud. A tiny Go binary that turns `curl` into a notification pipeline for your servers and cron jobs.

easyRead guide →

OAuth2 Proxy

A reverse proxy and middleware that puts OAuth2 and OIDC sign-in in front of applications that have no login of their own: a generic OIDC client plus provider implementations for Google, Microsoft Entra ID, GitHub, login.gov and others. Runs as a standalone proxy or as an `auth_request` target behind an existing proxy. MIT-licensed Go, stateless with cookie sessions.

easyRead guide →

AI Chat Interfaces

Ollama

Lightweight local model runner and OpenAI-compatible API server for downloading and serving open LLMs on your own hardware, with optional NVIDIA/AMD GPU acceleration — CPU-only also works for smaller models.

easyRead guide →

Secrets management

OpenBao

A community fork of HashiCorp Vault under the Linux Foundation, kept under the MPL-2.0 license after Vault moved to the BSL. It stores and issues secrets, certificates and encryption keys through a Vault-compatible API, CLI and web UI.

moderateRead guide →

File sync & storage

OpenCloud

A Go file sync and share server built on ownCloud Infinite Scale's code and developed since 2025 by OpenCloud GmbH, part of Berlin's Heinlein Group. It runs with no database: files are stored as a normal folder tree on disk and their metadata in extended attributes. Spaces, share links, desktop and mobile apps, and Collabora for office editing through an optional compose module.

moderateRead guide →

Opengist

A self-hosted pastebin powered by Git: every snippet is a Git repository you can clone and push to over HTTP or SSH, with revisions, search and embeds, as an open-source alternative to GitHub Gist.

easyRead guide →

Owncast

A self-hosted live-streaming and chat server for a single streamer: point OBS or any RTMP broadcaster at it and viewers watch on your own web page, with built-in chat, moderation, viewer stats and optional publishing to the Fediverse. It is MIT-licensed Go with an embedded SQLite database and ships as one container, so there is no separate database or cache to run.

GoTypeScriptSQLite

easyRead guide →

File sync & storage

ownCloud

ownCloud's modern flagship, Infinite Scale (oCIS) — a cloud-native rewrite in Go that replaces the legacy PHP server Nextcloud originally forked from. Single binary, lighter to run, enterprise-focused file sync and sharing.

moderateRead guide →

VPN & Mesh Networking

Pangolin

A self-hosted tunneled reverse proxy that exposes services on your private network to the internet over WireGuard, with built-in identity, access control, and automatic SSL — and, in recent releases, client-based private access to resources as well. A self-hostable alternative to Cloudflare Tunnel that keeps the ingress on a server you own.

moderateRead guide →

pgweb

A small PostgreSQL browser that runs as a single Go binary: connect to a database, browse tables and schemas, run queries, view results and export tables and query results to CSV, JSON or XML. It keeps a query history and server bookmarks, supports SSH tunnels and can hold several database sessions.

easyRead guide →

Photo backup & gallery

PhotoPrism

Self-hosted AI-powered photo gallery in Go. Lighter on RAM than Immich, strong tagging and search.

easyRead guide →

Pocket ID

A simple, self-hostable OIDC provider that lets users sign in to your apps with passkeys only — no passwords, built for small self-hosted setups that just need lightweight SSO.

easyRead guide →

PocketBase

Open-source backend in a single Go binary — embedded SQLite database, built-in auth, realtime subscriptions, file storage, and an admin dashboard with zero external dependencies.

easyRead guide →

Container management

Portainer CE

A web UI for managing Docker, Swarm, Podman and Kubernetes environments: containers, images, volumes, networks and Compose stacks. The Community Edition is zlib-licensed and, per its README, intended for homelabs and other non-production use; the paid Business Edition adds RBAC, SSO and support.

easyRead guide →

Prometheus

The de facto open-source metrics time-series database and alerting engine, scraping targets over HTTP and powering most self-hosted dashboarding stacks.

easyRead guide →

Readeck

A read-it-later and bookmark archiver: paste a link and it stores the readable text and images on your server, with labels, highlights, saved-search collections, full-text search, EPUB export, an OPDS catalog, browser extensions and mobile apps. AGPL-3.0-only, written in Go; it runs as a single container with SQLite in one data volume (PostgreSQL optional).

easyRead guide →

restic

A single-binary command-line backup program: deduplicated (content-defined chunking), encrypted (AES-256 with Poly1305-AES) and, since repository format v2, zstd-compressed snapshots, written straight to local disk, SFTP, S3-compatible storage, Backblaze B2, Azure, Google Cloud, its own REST server or anything rclone reaches. No daemon and no GUI upstream: you schedule it with cron or a systemd timer.

easyRead guide →

File sync & storage

Seafile

File sync and share built around libraries: each one syncs separately with delta transfers and resumable uploads, and any library can be encrypted on the desktop client with a password the server never stores. The Community Edition server core is AGPL-3.0 with an Apache-2.0 web UI; the Professional Edition adds full-text search, file locking, audit logs and S3 storage, and is free for up to three users.

moderateRead guide →

Semaphore UI

A web interface for running Ansible playbooks, as well as Terraform/OpenTofu, PowerShell and shell scripts, with projects, inventories, stored credentials, schedules and a run history.

easyRead guide →

SFTPGo

A file transfer server that exposes local disk, S3-compatible, Google Cloud Storage or Azure Blob storage over SFTP, FTP/S, WebDAV and HTTP, with a web admin for users and a web client for uploads and share links. The Community Edition is AGPL-3.0; a commercial Enterprise Edition adds features such as antivirus scanning and in-browser document editing.

easyRead guide →

Shiori

A simple bookmark manager distributed as a single Go binary, with a web UI and a CLI, offline archives of saved pages, Pocket and Netscape-file import, and SQLite, PostgreSQL or MySQL/MariaDB storage.

easyRead guide →

SigNoz

OpenTelemetry-native APM, logs, metrics, and traces in a single application, backed by ClickHouse for unified storage and querying.

GoTypeScriptClickHouse

hardRead guide →

SiYuan

A block-based personal knowledge management system: block-level references and two-way links, Markdown WYSIWYG editing, a database table view, flashcards with spaced repetition and PDF annotation, served from your own server to the browser. The user interface and Go kernel are AGPL-3.0, with notes stored as JSON files in a workspace folder you mount; the Docker build is browser-only and some member features are paid.

GoTypeScriptSQLite

easyRead guide →

Soft Serve

An SSH-first Git server you drive from a terminal UI: clone over SSH, HTTP or the Git protocol, browse repositories, files and commits without leaving the shell, and manage access entirely with SSH public keys. It has no pull requests, no issues and no web forge UI, so it sits alongside a hosted forge rather than replacing one.

easyRead guide →

step-ca

An online certificate authority from Smallstep for automated certificate management: it issues X.509 certificates for HTTPS and TLS and SSH certificates, and runs an ACME server so ACME clients can request certificates from it. In the Docker image it initialises itself on first start from environment variables.

easyRead guide →

File sync & storage

Syncthing

Continuous, peer-to-peer file synchronization with no central server and no cloud — your files sync directly between your devices, end-to-end encrypted in transit.

easyRead guide →

Workflow automation

Temporal

A durable execution platform: you write workflows as ordinary code with an SDK (Go, Java, Python, TypeScript, .NET and others), and the Temporal Service persists every step of their history so they survive crashes, restarts and long waits, with retries, timers and a web UI to inspect runs. MIT-licensed Go; this install runs the server with PostgreSQL and the UI.

hardRead guide →

Tinyauth

The tiniest self-hosted login screen for your apps — a single small Go container that adds authentication, OAuth login, and access controls in front of Traefik, Nginx, or Caddy, and since v5 doubles as an OpenID Certified OIDC provider.

easyRead guide →

Traefik

A cloud-native reverse proxy that auto-discovers your Docker containers via labels and provisions TLS for them automatically. More setup than a UI proxy, but unbeatable once your stack grows.

moderateRead guide →

Traggo

A self-hosted time tracker built around tags instead of tasks and projects: you record tagged time spans, then slice them in dashboards by any tag. One Go binary with a built-in web UI and SQLite, shipped as a single container.

easyRead guide →

VictoriaMetrics

A fast, resource-light time-series database for metrics: it speaks the Prometheus remote-write, scrape and query APIs plus InfluxDB, Graphite and OpenTSDB ingestion, extends PromQL as MetricsQL, and ships the vmui web UI for exploring data, so Grafana and Prometheus-style exporters plug straight in. Apache-2.0 licensed (an Enterprise edition with extra features is a separate licence), written in Go; the single-node version runs as one container writing to one data directory with no other services.

easyRead guide →

Project Management

Vikunja

Open-source to-do and task manager for organizing work across multiple projects, with list, table, kanban, and Gantt-style views, labels, filters, reminders, and recurring tasks. The free AGPL-3.0 self-hosted build ships the full task-management feature set including SSO/LDAP login; a separate self-hosted Pro add-on layers an admin panel, audit logs, and time tracking on top as a paid upgrade and isn't part of the free build.

GoVue.jsPostgreSQL

easyRead guide →

Vector database

Weaviate

A vector database that stores objects alongside their vectors and combines vector search with structured filtering, exposed over REST and gRPC. Optional modules call embedding, generative and reranker model providers for you, or you can import pre-vectorized data. Written in Go; everything outside the repository's wl directory is BSD-3-Clause, while the wl directory holds enterprise features unlocked by a licence key.

easyRead guide →

Woodpecker CI

A lightweight CI/CD engine, forked from Drone, that runs pipelines defined in YAML as Docker containers. It has no user accounts of its own: you log in through a connected forge such as GitHub, Gitea, Forgejo or GitLab.

easyRead guide →

Workout Tracker

A workout tracking web application for personal use (or family and friends), geared towards running and other GPX-based activities: upload GPX, TCX or FIT files, add manual workouts, follow statistics, route segments, equipment and a heatmap of where you have been. A single Go binary with SQLite by default.

easyRead guide →

Social network (Fediverse)

WriteFreely

A minimalist, distraction-free blogging platform for one writer or a whole community. Blogs federate over ActivityPub, so readers on Mastodon and other Fediverse software can follow them.

easyRead guide →

Zitadel

A cloud-native, open-source identity and access management platform — OIDC, SAML, and passwordless auth with multi-tenancy built in, a self-hostable alternative to Auth0 and Okta.

hardRead guide →

Zoraxy

A general-purpose reverse proxy managed entirely from a web UI, built for homelabs: proxy rules with load balancing and basic auth, redirection rules, ACME certificates with auto-renew and DNS challenges, TCP/UDP stream proxying, country and IP allow/deny lists, plus an uptime monitor, web SSH terminal and network utilities in the same AGPL-3.0 Go binary. The admin UI listens on port 8000 and asks you to create the single admin account on first visit.

easyRead guide →

Analytics cookies only (Google Analytics, PostHog). No ad networks, no cross-site tracking. See our privacy policy.