Base
Hardened build
minimal ports, security patches applied at build time
OTS on Ubuntu 24.04 LTS
Azure
Security
OTS, a self hosted one time secret service that encrypts in the browser and destroys the secret on first read.
Overview
OTS is an open source, self hosted platform for handing someone a secret exactly once. You paste a password, key or short note into the web page and OTS encrypts it in your browser with 256 bit AES before anything is sent, then gives you back a single link. The decryption password travels in the fragment of that link, the part browsers never send to a server, so the service stores only ciphertext it has no way to read. The recipient opens the link once to reveal the secret and it is destroyed on that first read, so a link that has already been used shows nothing to anyone who finds it later. Secrets also carry an expiry, so anything never collected disappears on its own. There are no accounts and nothing to sign up for: you share a link, it works once, and then it is gone.
Why the cloudimg image
cloudimg delivers OTS hardened and fully patched, served over TLS with a certificate generated for each instance on first boot so no key material is ever shared between deployments. The application and its store both bind to loopback behind a single reverse proxy, so the only thing reachable from the network is the HTTPS front end, and plain HTTP redirects to it. Secrets are held in memory with disk persistence switched off and a hard maximum lifetime, so nothing sensitive is ever written to the disk. OTS is unauthenticated by design and ships with no login of any kind; the one internal password the appliance uses is generated fresh per instance at first boot and written to a root only file, so nothing usable is baked into the image. The application is held shut until that first boot bootstrap has finished, which closes the window where a freshly started instance could serve with build time settings. Backed by 24/7 cloudimg support and a paired deploy guide.
Common uses
- Hand a password or API key to a colleague as a link that works once
- Send credentials to a contractor or customer with no lasting email trail
- Run a private, self hosted alternative to public paste and secret sites
See it running
Real screenshots taken while testing this image against its deployment guide.
More in Security
AliasVault Self-Hosted Password Manager & Aliases
Security
The cloudimg image ships the free and open source, AGPL-3.0 licensed AliasVault, run the officially supported way as the...
Apache Directory Server LDAP - Managed Support
Security
This image runs Apache Directory Server (ApacheDS) 2.0, the Apache Software Foundation's extensible, embeddable director...
Apache SpamAssassin Anti-Spam Filter
Security
This image runs Apache SpamAssassin, the open source, Apache-2.0 licensed anti-spam platform.
Authentik - Self-Hosted Identity Provider and SSO Platform
Security
Authentik is an open source identity provider: single sign-on, multi-factor authentication, user management and access c...
Authgear - Open Source Identity Provider
Security
This image runs Authgear, the open source authentication server and identity provider.
Bl
Beelzebub Low-Code Honeypot Framework
Security
This image runs Beelzebub, the open source low code honeypot and deception framework.