If we're going to be cheeky, it's almost certainly BIND (behind unbound and nsd, driven by blacklists fed by minemeld), followed by ISC DHCP and other plumbing running in the background like mrtg/sflow/pnp/netdisco. If we're going to just talk about user interactive self-hosting then it would be a toss-up between my private searx instance and kodi via diskless netbooted openelec. Roundcube, sandstorm and invidious get honourable mentions