ByteStash - Secure Self-Hosted Code Snippet Manager

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

ByteStash is a free and open source, self-hosted code-snippet manager for developers and teams. Store, organise, search, tag and share reusable code snippets with syntax highlighting for dozens of languages, Markdown and Mermaid rendering, multi-file snippets, snippet sharing with optional expiry, an embed API and a remote MCP endpoint for AI clients - a private snippet library you run and control in your own AWS account. It is delivered fully built from source, hardened and reverse-proxied behind nginx over TLS, so your snippet library is operational within minutes of launch with no manual package installation.

## Why This Image vs a Manual Install

This image eliminates the manual work of building the Node.js server and React client from source, compiling native dependencies, authoring systemd units, configuring a TLS reverse proxy and hardening credentials. ByteStash's registration can be open by default; this image never ships an open-registration or default-credential instance. What typically takes many steps across package management, service configuration and security hardening is completed for you at image build time. Launch the instance, read your unique credential, and start saving snippets.

## Application Stack

The ByteStash server runs under systemd as an unprivileged system user and binds to the loopback interface only. It is fronted by an nginx reverse proxy on port 443 with a self-signed certificate generated per instance (ready to be replaced with your own domain certificate); port 80 redirects to 443. The embedded SQLite datastore lives on a dedicated data volume, independently resizable and separate from the OS disk. systemd starts the service and the web server on boot and restarts them on failure.

## Security Hardening

This image follows a defence-in-depth approach:

• Network isolation: the application binds exclusively to the loopback interface; only the nginx TLS reverse proxy is exposed, and the security group opens only SSH and HTTPS
• No default or shared credentials: a cryptographically random administrator password and a per-instance JWT signing secret are generated on each instance's first boot; the password is written only to a root-only file
• Open registration disabled: self-registration is turned off, so no world-open signup window is ever exposed - the seeded administrator is the only account until you create more
• Least privilege: the service runs as an unprivileged system user under a systemd unit
• Dedicated data volume: the SQLite datastore lives on its own disk, surviving OS-disk changes and resizable independently
• Encrypted transport: the web interface is served over TLS by default

Buyers requiring formal compliance documentation should contact cloudimg to discuss specific requirements.

## Concrete Use Cases

• Team snippet library: an engineering team keeping vetted, syntax-highlighted code snippets, config fragments and runbook commands in one searchable private store instead of scattered gists
• Personal knowledge base for developers: an individual developer cataloguing reusable functions, one-liners and boilerplate with tags, full-text search and Markdown notes
• Shareable reference snippets: creating public share links with optional expiry for onboarding docs, support answers or teaching material, without exposing a whole account

## AWS Integration

Deploy on any EC2 instance type. Terminate TLS at the instance or place the instance behind an Application Load Balancer with your own certificate. Back up your snippet library using EBS snapshots or AWS Backup, and resize the dedicated data volume independently of the OS disk as your library grows.

## Getting Started

Read your credential from the root-only file, open the web interface in your browser over HTTPS, sign in, and start creating snippets - organise them with tags, search across everything, and share individual snippets with a link.

## cloudimg Support

24/7 technical support by email and chat. Help with deployment, replacing the self-signed certificate with your own domain and certificate, OIDC single sign-on configuration, and backup planning for your snippet library.