App Store - one-click open-source apps on blitz.cloud

The blitz.cloud App Store has 119 open-source apps, and all of them run here. Pick one, give it a name, and it installs with the settings, storage and database it needs. Before you install, the store says how much memory and space the app takes, whether it uses your free database or brings a small cache, and whether it fits your plan.

Every app has a page of its own that says what it replaces and what it needs. We run every entry under the same rules a real install gets before we list it: in its own sandbox, inside the memory limit. Where an app can't do something here, its card says so.

The apps

The store sorts them into ten categories, named after what people want to do: Files & documents, Photos & media, Websites & blogs, Passwords & security, Money & home, Monitoring & automation, Notes & knowledge, Productivity, Developer tools and AI & chat.

Memory is what the app reserves from your plan. A database or cache adds its own, see storage and memory below.

Apps that run as root

Home Assistant, FreshRSS, Stirling PDF, NocoBase, Excalidraw, Wallabag, Etherpad, BookStack, DokuWiki, Calibre-Web, Homarr, Poznote, Ocular, Grocy, Snipe-IT, Monica, Lychee, MediaWiki, RSS-Bridge, Answer, Airsonic Advanced, LubeLogger, Pinry, NoteDiscovery, Open DroneLog, Blinko, Mautic, FreeScout, PhotoPrism, Haven, Tymeslot, ArchiveBox and Grimmory have to start as root: they set up their own system files before they begin. Until 26 September 2026 that stopped them here. Now they run as root inside their own sandbox, which keeps them apart from the server and from other people's apps, like any image you deploy yourself that needs root.

Immich needed more memory than an app got here. It now uses a larger size that comes with Pro: 768 MB reserved and up to 2 GB, enough for its first start, when it loads its map data. Face and object search stay off for now.

How installing works

1. In the dashboard, open the App Store or click "Host something new" and choose "A ready-made app".
2. Search by what you want ("photos", "blog", "passwords") or by what you'd like to replace ("Dropbox", "Google Photos"), or browse the categories. Each app also has a page of its own in the store.
3. Pick a name for the app. It becomes the subdomain, like vault.<you>.blitz.cloud.
4. Click "Put it online". The last step lists everything that gets created first, each database and cache included, and how much of your plan it uses.

The store entry brings the rest: the version, the port, the folders to keep, the settings the app reads, and a health check that knows what "working" looks like for that app. If the app needs a database, one is created and connected, and the settings it will fill in are listed before anything is applied.

Store apps are restarted automatically if they stop answering their health check. After install, the Environment tab shows every setting and lets you change it. Most store apps follow a version line, like Nextcloud 34, and get new versions within it overnight. If a new version doesn't start, the one before it keeps running.

First steps after installing

The app page lists what to do next for that app: where to sign in, and which setting to change once everyone has an account. Passwords and admin tokens that were made for you, like Vaultwarden's admin token, sit behind Show and Copy on that page, never in the text.

Do the first step soon. Many apps make the first person who opens them the admin, so until you have signed up, anyone who finds the address could. Mealie, Joplin Server and Umami start with a password everyone who knows the app knows, and their first steps tell you to change it right away.

Needs Pro

The store works out whether an app fits the free plan before you install it. If it doesn't, the card says "Needs Pro" and why, and the install is refused on the free plan. Every app except Immich fits an empty free account. Whether it fits yours depends on what you already run: the free plan has one database, so a second app that needs a database asks you to make room or move to Pro. The card names the limit it would hit. Immich needs Pro for its memory.

Apps that only work while they're awake

On the free plan an app sleeps after 15 minutes without visitors. For most apps that doesn't matter, because the next visit wakes it. A few do their job with nobody visiting, and the store card says what stops while they sleep:

• n8n only runs its schedules while it is awake, and on the free plan webhooks don't wake it.
• Uptime Kuma only checks your sites while it is awake.
• Syncthing only syncs while it is awake.
• Paperless-ngx only fetches documents from your mailbox while it is awake.
• Home Assistant only runs its automations while it is awake.
• FreshRSS only fetches new articles while it is awake.
• Umami only counts visits while it is awake. A visit wakes it, but that first one may be missed.
• Activepieces only runs its schedules while it is awake, and on the free plan webhooks don't wake it.
• WordPress only runs scheduled posts and plugin jobs while it is awake.
• WAHA and Evolution API are only connected to WhatsApp while they are awake, so messages and webhooks wait until then.
• OmniRoute and 9router only answer your tools while they are awake, and on the free plan a request from a tool doesn't wake them.
• OpenClaw only answers your chat apps and runs its reminders while it is awake, and Hermes Agent only answers and runs its scheduled tasks while it is awake.
• ntfy only delivers notifications published while it is awake; a sleeping ntfy misses them.
• Changedetection.io only checks the pages it watches while it is awake.
• Matomo only counts visits while it is awake. A visit wakes it, but that first one may be missed.
• SerpBear only checks your search rankings while it is awake. A visit wakes it, but a check already due may be missed.
• Mautic only sends campaign emails and updates segments while it is awake. A visit wakes it, but a run already due may be missed.
• Sure only runs its daily account sync and recurring-transaction jobs while it is awake.

On Pro, installing one of these keeps it awake for you.

Things some apps can't do here

• Immich: face and object search are off, because they need more memory than an app gets here.
• Home Assistant can't see devices on your home network from here, so it works with devices and services you reach over the internet.
• Stirling PDF: very large PDFs can be more than it has memory for.
• Forgejo: Git over SSH doesn't reach apps here, so you push and pull over HTTPS with a password or an access token.
• Linkwarden: anyone who can open it can make an account, and that can't be switched off reliably, so it starts private. Keep it that way. Saving a copy of a page takes most of its memory for a moment, so add links a few at a time.
• OpenCloud sends uploads to itself through its public address, so it only works while that address is public.
• Firefly III: recurring transactions and bill reminders need a daily job to call the app, and nothing here does that for you yet.
• Open WebUI, OpenClaw, Hermes Agent and SillyTavern run no AI model themselves. You bring an API key from a provider, and Open WebUI needs an embedding key as well to search your own documents.
• Hermes Agent is an API here, without its dashboard and terminal chat, which need to run as the machine's owner.
• WAHA and Evolution API: WhatsApp can block a number that is used with a third-party client, so use one you could do without. WAHA's free edition connects one number.
• Activepieces uses most of its memory before it does anything, so large flows may make it restart.
• SillyTavern asks for a user name and password before it opens. The user is admin, and the password is on the app's page after you install it.
• FileBrowser Quantum shows the folders your other apps keep, not their databases. It asks for a password too, made the same way as SillyTavern's.
• Excalidraw is the editor only: nothing you draw is saved to the server, and there is no live collaboration here.
• ntfy has no accounts by default, so anyone who learns a topic name can publish or subscribe to it; keep topic names hard to guess.
• Wallabag reinstalls part of itself on every start, so it wakes more slowly than other apps here, about four minutes rather than a few seconds.
• Etherpad has no per-pad access control: anyone who knows or guesses a pad's name can open and edit it.
• Gitea: Git over SSH doesn't reach apps here, so you push and pull over HTTPS with a password or an access token.
• Dashy has no login on the dashboard page itself by default, so anyone with the address can see and edit it; add users under its own config for a real login.
• Calibre-Web reads an existing Calibre library, it does not create one; upload a library folder with FileBrowser Quantum before it has anything to show.
• Homer has no login and nothing to click to edit: change its config.yml under the app's storage with FileBrowser Quantum to add or edit tiles.
• Fider needs a real mail server before anyone can sign in, since sign-in works by mail link; set EMAIL_SMTP_* under Environment to your own provider.
• Beszel is only the hub: it shows nothing until an agent you install on another machine connects and reports its numbers to it.
• Changedetection.io: nobody is asked for a password until you set one in its Settings, so until then anyone who finds the address can see and change your watches.
• Shlink is the API and the redirects only, not a web dashboard: use its initial API key with a Shlink web client to create and manage links.
• The Lounge runs in private mode with the one account it makes for you; there is no sign-up page.
• Homarr can't see containers running elsewhere from here, so you add tiles by address instead of through its Docker integration.
• Rallly can't send sign-in mail until you add your own SMTP settings under Environment; until then, share a poll's own link and guests can still vote on it without signing in.
• Paisa has no sign-in of its own, so it starts private and only opens on your own devices; keep it that way.
• Roundcube is a mail client for an inbox you already have elsewhere, not a mail server of its own.
• Easy!Appointments: booking confirmations and reminders need SMTP settings of your own mail provider, added after setup.
• Snipe-IT's mail needs SMTP settings of your own mail provider, added after setup.
• Monica: the first account to sign up owns it; after that, turn off new registrations in Settings so nobody else can join.
• RSS-Bridge has no accounts of its own beyond the one password, so without it anyone who finds the address could use it to fetch pages; it is on by default.
• Airsonic Advanced's first start runs a one-time database setup that can take several minutes before it answers; later starts are quick. It signs in with admin/admin until you change the password.
• Convos: the first person to open it registers the only account; sign up as soon as it's running.
• Pinry: the first person to sign up owns it; the project itself moves slowly these days, so don't expect frequent updates.
• NoteDiscovery has no login by default, so treat the app's address as the only thing keeping it private.
• Open DroneLog's interface is built for a larger screen; some things may be cramped on a phone.
• Blinko's AI features (summaries, semantic search) need your own AI provider key, added after setup; it works as a plain note tool without one.
• RSSHub: routes that need a real browser to render the page (marked with a camera icon in the route docs) do not work on this image; most routes do not need one.
• PasswordPusher sets no TLS certificate of its own, so leave any domain-verification setting in its admin area off.
• GlitchTip runs without its optional Valkey cache and task queue, so email digests and some background jobs run inline instead of queued; this does not affect catching errors.
• FreeScout has no mail server of its own; add your own mailbox's SMTP and IMAP settings under Manage > Mailboxes so it can send and fetch mail.
• PhotoPrism only runs the free AGPL core here; its Plus features (upgraded face and object recognition) are not part of this image.
• Tymeslot's PostgreSQL runs bundled inside the app's own storage, not on your plan's managed database.
• ArchiveBox's Chromium runs inside the sandbox with no extra privileges, so archiving a page can take a few minutes; pages with heavy scripts may save without every extractor finishing.
• Mattermost has no mail server configured, so invite your team by sharing a link rather than by email.
• Grimmory is a young fork of the BookLore project under a new name and licence; expect its upgrade path to keep changing.
• Sure is a community fork of the discontinued Maybe Finance app; bank sync providers need their own API keys from their docs, or accounts are tracked by hand.

Storage and memory

An app reserves the storage the table gives for it from your plan's 10 GB, whether or not it fills it. Nextcloud plus its MariaDB takes 6 of the 10 GB, for example. Most apps use the small size (128 MB reserved, up to 512 MB). n8n, Paperless-ngx, Home Assistant, Stirling PDF, Linkwarden, Docmost, OpenCloud, Activepieces, NocoBase, Open WebUI, OmniRoute, LibreTranslate, OpenClaw, Hermes Agent, WAHA, code-server, Gitea, Kavita, Komga, CommaFeed, Homarr, Rallly, Snipe-IT, Monica, Lychee, Matomo, Airsonic Advanced, Blinko, RSSHub, PasswordPusher, Mautic, GlitchTip and Tymeslot use medium (256 MB reserved, up to 1 GB). Immich, PhotoPrism, ArchiveBox, Keycloak, Mattermost, Metabase, Grimmory and Sure use large (768 MB reserved, up to 2 GB), which comes with Pro.

An app with a database uses your plan's database, and the database reserves its own memory and 1 GB of storage. See limits for how that adds up.

Apps that bring a cache

Paperless-ngx, Docmost, Evolution API, Activepieces and Sure bring a small cache (Valkey, which speaks Redis) next to their database, for their background jobs. The cache is part of its app: it sleeps and wakes with it and is deleted with it. It keeps nothing and has no backup, and it doesn't count as one of your plan's databases. Its memory, 48 MB, does count.

Can I install an app that isn't in the store?

Yes, if there is a public image for it on Docker Hub, ghcr.io, Quay or another public registry, or if you can build it from its code on GitHub. See deploy a Docker image and deploy from GitHub. The store is the list we have tested; those two paths are for everything else.