OTS on Ubuntu 24.04 LTS
by cloudimg
One time secret sharing: encrypted in the browser, destroyed on first read.
OTS is an open source, self hosted platform for handing someone a secret exactly once. A sender pastes a password or key into the web page, OTS encrypts it in the browser with 256 bit AES, and returns a single link. The recipient opens that link once to reveal the secret, after which it is destroyed, so anyone who finds the link later sees nothing.
What separates OTS from a paste service is where the decryption password lives: in the fragment of the link, the part browsers never transmit. The server receives the secret identifier but never the password, and stores only ciphertext it has no practical way to decrypt.
OTS is unauthenticated by design, so no login or API key is baked into the image. The TLS private key and the internal store password are both generated per VM on first boot, and the application is held shut until that finishes, so no instance serves with build time settings.
The server runs as a static Go binary under systemd as an unprivileged user, bound to loopback. Its store is loopback only, password protected, and runs with disk persistence off, so ciphertext is held in memory with a hard maximum lifetime and never reaches disk. nginx is the sole network facing surface and terminates TLS on port 443; port 80 redirects to HTTPS.
cloudimg delivers OTS fully patched on a hardened Ubuntu 24.04 LTS base, serving on first boot. The release is checksum verified against the upstream manifest, and every image passes an automated gate proving the one time self destruct behaviour end to end. OTS is Apache 2.0 and free; the cloudimg charge covers packaging, hardening, patching and 24/7 support.