Self-Hosted Security & Identity Apps
The xCloud OneClick catalogue has 54 self-hosted security and identity apps you can deploy in one click. Pick an app, a domain and a server, and xCloud deploys its containers, volumes, any credentials its template generates and HTTPS; xCloud runs the server and the deployment, and you own the application and its data.
In the catalogue's own words: Vaultwarden — An unofficial Bitwarden-compatible password server written in Rust, so the official clients and browser extensions work against your own vault. WireGuard — Fast, modern, secure VPN tunnel with peer-to-peer connections and a minimal, auditable codebase. Keycloak — Identity and access management with single sign-on, social login, user federation and standards support for OpenID Connect, OAuth 2.0 and SAML. PrivateBin — A minimalist pastebin where the server has zero knowledge of the data — everything is encrypted and decrypted in the browser. Pocket ID — A simple OIDC provider built around passkeys, so you can put single sign-on in front of your self-hosted apps without running a full identity suite. Enclosed — Zero-knowledge service for sharing end-to-end encrypted notes and files with expiration, passwords, and read-once deletion.
Every tile below links to that app's own page, with what its template sets up and the server plan it is sold on.
All Security & Identity apps
Browse all one-click apps →
VaultwardenAn unofficial Bitwarden-compatible password server written in Rust, so the official clients and browser extensions work against your own vault.
WireGuardFast, modern, secure VPN tunnel with peer-to-peer connections and a minimal, auditable codebase.
KeycloakIdentity and access management with single sign-on, social login, user federation and standards support for OpenID Connect, OAuth 2.0 and SAML.
PrivateBinA minimalist pastebin where the server has zero knowledge of the data — everything is encrypted and decrypted in the browser.
Pocket IDA simple OIDC provider built around passkeys, so you can put single sign-on in front of your self-hosted apps without running a full identity suite.
EnclosedZero-knowledge service for sharing end-to-end encrypted notes and files with expiration, passwords, and read-once deletion.
AutheliaSelf-hosted 2FA and single sign-on portal that guards your apps with one login, deny-by-default rules and brute-force protection.
CertMateSelf-hosted certificate manager that issues and renews TLS certificates over DNS-01 across 29 DNS providers.
CasdoorIdentity and access management covering single sign-on, OAuth 2.0, OpenID Connect, SAML, LDAP, SCIM, MFA and WebAuthn from one console.
LLDAPA light identity directory with a web admin interface and an LDAP-compatible endpoint, for apps that only know how to ask LDAP.
ZITADELIdentity infrastructure with OpenID Connect, OAuth 2.0, SAML, passkeys and multi-tenancy, including the modern Login V2 experience.
One-Time SecretShare sensitive text through single-use links that expire on a timer or the first time they are opened, so nothing lingers in chat.
Password PusherShare passwords, notes, URLs, QR codes and files through links that expire by time or by view count, with an audit trail.
2FAuthA single-user 2FA and TOTP manager that stores your authenticator secrets so you can generate codes from a browser, not a phone.
OpenBaoProduction-mode secrets, certificate and encryption-key management with integrated Raft storage that you initialize and unseal yourself.
YopassEnd-to-end encrypted sharing for expiring, single-use secrets and small files, decrypted entirely in the browser.
TinyauthLightweight authentication and OpenID Connect server for protecting self-hosted applications with local users, OAuth, or LDAP.
CrowdSecOpen-source, participative security engine with a Local API and a pre-registered bouncer key for collecting detections and serving block decisions.
InfisicalOpen-source secrets management for API keys, credentials and env variables, on HTTPS with Postgres and Redis.
PresidioAn open-source engine for detecting personally identifiable information in text, via the Presidio Analyzer HTTP API.
Cap CaptchaA self-hosted, privacy-friendly proof-of-work CAPTCHA with a dashboard, per-site keys and a siteverify API.
WarpgateOpen-source bastion for SSH, HTTPS, MySQL, PostgreSQL, Kubernetes, RDP and VNC with per-target access and session recording.
FlashPaperA minimal self-hosted service for sharing passwords and short notes through AES-256 encrypted, one-time self-destructing links.
sup3rS3cretMes5ageAlgolia's open-source, self-destructing message and file-sharing service, backed by a private HashiCorp Vault cubbyhole behind one-time tokens.
OTSA self-hosted one-time secret sharing service — secrets are encrypted in the browser, shared as a link, and deleted after the first view.
VoidAuthA self-hosted single sign-on and identity provider with OpenID Connect, passkeys and invitation-based access.
mkcert Web UIA login-protected browser interface for mkcert: create a local Certificate Authority and issue trusted development certificates for hostnames, IPs and wildcards without a command line.
LogtoAn open-source OIDC and OAuth 2.1 identity provider with enterprise SSO, MFA, RBAC and organizations, offering SDKs for 30+ frameworks and SAML application support.
GoAwayA self-hosted DNS sinkhole, an alternative to Pi-hole and AdGuard Home, that blocks ads, trackers and malware domains for every device that uses it, with a web dashboard, query logs and custom block lists.
AliasVaultSelf-hosted, end-to-end encrypted password and email alias manager with passkey support, browser extensions and mobile apps, running as a single container with a generated admin password.
HemmeligEncrypted secret sharing with client-side AES-256-GCM, expiring or one-view links, optional file attachments and a first-run administrator account.
IRISOpen-source collaborative incident response platform (DFIR-IRIS) for sharing investigations and tracking cases, assets, IOCs, timelines, evidence and tasks with your analysts.
WazuhOpen-source security platform for threat detection, file integrity monitoring, vulnerability detection and compliance, with a manager, indexer and dashboard in one stack.
Stack AuthAn open-source authentication and user-management platform (now Hexclave) with SDKs, a project dashboard, teams, permissions, API keys and email flows.
PWgenA self-hosted random password and passphrase generator with an optional breach check that never sends the password itself, and no data stored on the server.
nforwardauthLightweight forward-auth service that puts one shared sign-in page in front of many self-hosted sites through nginx, Traefik or Caddy.
AuthPortalSingle sign-on and OIDC provider that signs users in with their Plex, Jellyfin or Emby account, with optional MFA, an admin console and LDAP sync.
SecroverFree, open-source security audit tool that scans your repositories and domains on a schedule and publishes readable HTML reports behind a login.
OrigamiVaultClient-side tool that encrypts passwords and recovery phrases into printable paper backups with QR codes, with all encryption running in the browser.
HoopOpen-source access gateway that puts databases, servers and internal tools behind one audited, role-based entry point with session recording, approvals and data masking.
VaulTLSRun your own certificate authority: issue and revoke TLS client and server certificates from a web UI with ACME and OpenID Connect support, behind HTTPS with a generated administrator.
CerbosAn open-source authorization policy server that answers access checks from YAML policies over HTTP and gRPC, with an API explorer.
GLAuthLightweight LDAP server for home labs, development and CI, with users and groups in one configuration file, a generated service account and no database.
HankoOpen-source authentication backend with passkeys, passcodes, passwords and social login, delivered as an API for your own app with a private PostgreSQL database.
BlockyFast, lightweight DNS proxy and ad blocker that blocks ads, trackers and malicious domains for every device, with a private DNS-over-HTTPS endpoint on your own domain.
BunkerWebOpen-source web application firewall and reverse proxy built on NGINX, with ModSecurity, the OWASP Core Rule Set and a web UI.
KanidmModern identity management server with single sign-on (OAuth2/OIDC), passkeys, groups and optional POSIX/LDAP views.
ViseronA self-hosted network video recorder that records IP camera streams and runs object, face and license plate detection on them, with login switched on from the first start.
Dependency-TrackAn OWASP software composition analysis platform that tracks the components in your projects against vulnerability, licence and policy data using SBOMs.
AnubisProof-of-work browser challenge reverse proxy that sits in front of your website and filters automated clients before traffic reaches your origin.
AuthorizerOpen-source authentication and authorization server with a login UI, OAuth 2.0 and OpenID Connect APIs, MFA and webhooks, running as one container with SQLite.
RauthyA lightweight OpenID Connect and OAuth 2.0 identity provider with passkey support, an embedded database and an admin UI for users, clients, roles and groups.
KeeWebBrowser-based password manager that opens and edits KeePass (.kdbx) databases from your own HTTPS domain, with nothing stored on the server.
Web CheckAll-in-one website analysis dashboard that reports DNS, SSL, headers, open ports, redirects, tech stack and more for any URL, run from your own server.
What is self-hosted security and identity software?
Security and identity software controls who can sign in and what they can reach: password managers, single sign-on, two-factor and VPNs. Self-hosted means you run it on a server you control instead of using it as a service hosted by its vendor: the application, its database and the files it stores sit on that server, so you decide where the data lives, who can reach it and when to move to a new release. The work that usually comes with that, provisioning the server, running the containers and putting HTTPS in front of the app, is what a OneClick deploy takes on.
Frequently Asked Questions
About hosting security and identity apps on xCloud.
Which server size do I need for a self-hosted security and identity app?
Each app's page lists the resource floor from its OneClick template and the plan it is sold on. Templates that ask for 2 GB of RAM or less are sold on Cloud VPS 6 GB (6 GB RAM, 4 vCPU cores, 100 GB NVMe SSD); templates that ask for 4 GB or more are sold on Cloud VPS 16 GB (16 GB RAM, 6 vCPU cores, 200 GB NVMe SSD). Several apps can share one server as long as it has the RAM and CPU headroom.
How much does it cost to host Security & Identity apps on xCloud?
Cloud VPS 6 GB is $24.99 a month and Cloud VPS 16 GB is $59.99 a month, at a flat monthly price. You pay for the server, so apps that share one server share its price.
Who owns the data in a self-hosted security and identity app?
You do. The app, its database and its volumes live on the server you chose, under your own account, whether that is an xCloud Cloud VPS or a server you connect yourself. xCloud runs the server and the deployment; the application and its data stay yours, and nothing is routed through a shared multi-tenant service.
Are Security & Identity apps upgraded automatically?
No. A OneClick template pins its app image by immutable digest, so new installations use the pinned release and existing sites are not upgraded for you. Back up first, read the upstream release notes, then update the image on your own schedule.
Can I cancel anytime?
Yes. There is no lock-in — cancel any time. Hosting is billed monthly and charged for what you actually use, so when you delete the server the unused balance is refunded to your account, less up to 10% in payment-processing fees.