Onetime Secret - Self-Hosted Secret Sharing

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Onetime Secret is a widely adopted open source service for sharing sensitive information safely. A sender pastes a secret - a password, an API key, a private note - and receives a unique one-time link. The recipient opens that link exactly once to reveal the secret, after which it is permanently destroyed and the link returns not-found. Secrets can carry an optional passphrase and an expiry, so nothing lingers in inboxes or chat history. This AMI gives you a private, self-hosted Onetime Secret you run and control entirely within your own AWS account, delivered fully installed and hardened so a working service is available within minutes of launch.

## Why This Image vs a Manual Install

Onetime Secret ships Docker-first with no prebuilt binary, so a manual install means completing at least six distinct steps: compiling a Ruby runtime, bundling gems, building the Vue frontend, provisioning Redis, authoring systemd units, and terminating TLS - then hardening all of it. This image completes every one of those steps at build time. The application, its Redis store, an nginx TLS front end and a self-signed per-instance certificate are wired together and secured for you. Launch the instance, open the URL over HTTPS, and start sharing secrets immediately.

## Application Stack

The Onetime Secret web application runs under Puma and is bound to the loopback interface only. Redis, the secret store, is bound to loopback only and requires a password. An nginx reverse proxy terminates TLS on port 443 and is the sole network-facing surface; port 80 redirects to HTTPS and serves an unauthenticated health endpoint for load balancers. systemd starts Redis, the application and the web server on boot and restarts them on failure. The Redis data directory lives on a dedicated data volume, independently resizable and separate from the OS disk.

## Security Hardening

This image follows a defence-in-depth approach:

• No default or shared credentials: the application root secret, the Redis password and the administrator account are all generated uniquely on each instance's first boot and written only to a root-only file - nothing is baked into the image
• Redis is never exposed: the secret store binds exclusively to the loopback interface and requires a password, so it is unreachable from the network
• Application isolation: the web application binds to loopback only; only the nginx reverse proxy is exposed, and it enforces TLS
• Encryption in transit: a self-signed certificate is regenerated per instance with the instance's public address in its subject alternative names, so secrets never travel in plaintext
• No open sign-up and no reachable default admin: open account self-registration is disabled and the optional administrator account uses a unique per-instance password

Buyers requiring formal compliance documentation should contact cloudimg to discuss specific requirements.

## Concrete Use Cases

• Credential handoff between teams: Platform and security teams sending database passwords, cloud keys and certificate bundles to colleagues or contractors via a link that self-destructs after a single view, leaving nothing in email or chat
• Customer and vendor secret exchange: Support and onboarding teams delivering one-time access tokens or recovery codes to external users over a link that cannot be reused or forwarded
• Internal secret sharing with an audit boundary: Engineering teams replacing pasted secrets in wikis and tickets with expiring one-time links inside their own VPC, keeping sensitive values off long-lived systems

## AWS Integration

Deploy on any EC2 instance type. Front the service with an Application Load Balancer using the unauthenticated health endpoint for availability monitoring, and terminate TLS with your own certificate and domain if preferred. Back up the Redis data volume with EBS snapshots or AWS Backup, and resize it independently of the OS disk. The generated one-time links use the instance public address resolved at first boot.

## Evaluate Before You Commit

Launch on a small instance type to evaluate the full workflow - paste a secret, generate a link, view and burn it - with no configuration required. The service is fully functional after boot, then scale up when ready for production.

## Getting Started

Read your per-instance details from the root-only file, open the service over HTTPS in a browser, paste a secret and share the generated one-time link. The optional administrator (colonel) account and its credentials are in the same file for the admin dashboard and API.

## cloudimg Support

24/7 technical support by email and chat. Help with deployment, terminating TLS with your own domain and certificate, configuring expiry and passphrase policy, Redis backup planning, and integrating the API into your workflows.