Onetime Secret on Ubuntu 24.04 LTS
by cloudimg
Self hosted one time secret sharing: a link that reveals a secret once then self destructs.
Onetime Secret is a popular open source, self hosted service for sharing sensitive information safely. Instead of pasting a password into email or chat where it lingers forever, you paste it into Onetime Secret and get back a one time link. The recipient opens the link once to reveal the secret, after which it is permanently burned and the link stops working. Secrets also carry a time to live, so anything left unread expires on its own.
Secure by default
The image ships with no known credential baked in. Every per instance secret is generated on first boot only: the application root secret from which all other cryptographic material is derived, the Redis password, and the colonel administrator account password. The credentials and per VM connection details are written to a root only file. Sharing a one time secret needs no login at all; the colonel account is the optional administrator.
Hardened and ready on first boot
- The application is served by Puma under systemd as an unprivileged system user, bound to loopback only.
- Redis is bound to loopback only and protected by a per instance password; neither component is network exposed.
- nginx terminates TLS on port 443 and reverse proxies to the application, with HSTS and sensible security headers. Port 80 redirects to HTTPS.
- A self signed certificate is regenerated per VM on first boot, with the VM public IP and hostname in its Subject Alternative Names. Replace it with your own CA signed certificate for production.
- A built in self test proves the one time self destruct semantics and the administrator credential end to end over TLS.
Why cloudimg
cloudimg delivers Onetime Secret fully patched on a hardened Ubuntu 24.04 LTS base, serving on first boot, with no shared credentials. Every image is built from source at the latest stable release, passes an automated verification gate, and is backed by 24/7 support with a guaranteed 24 hour response SLA.
Licensing
Onetime Secret is open source software distributed under the MIT License, and is free. The cloudimg charge covers packaging, hardening, security patching, image maintenance and 24/7 support. A step by step deployment guide is provided.