ByteStash 1.6.0

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened Node.js & Developer and API Tools AMIs listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• Once the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace (or Launch from EC2 Console for the full launch wizard). In Version, choose ByteStash 1.6.0 on Ubuntu 24.04, then choose your Region.
• Pick an instance type and your key pair. m5.large is recommended, and the software charge is $0.04 per vCPU per hour.
• Security group: allow SSH (22), HTTP (80) and HTTPS (443). Restrict SSH to your own IP address, and restrict ports 80 and 443 to the people and API clients that use ByteStash.
• Choose your VPC and a subnet that gives the instance a public IP, leave the metadata defaults (the image already requires IMDSv2), then choose Launch.

Option B: AWS CLI

Run this on your own workstation. It creates a security group that allows SSH and HTTPS from your management address only, then launches the instance.

Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the VPC, subnet, key pair and CIDR with your own:

SG=$(aws ec2 create-security-group --group-name bytestash \
  --description "ByteStash" --vpc-id vpc-0123456789abcdef0 \
  --query GroupId --output text) for p in 22 80 443; do aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port "$p" --cidr <your-mgmt-cidr> done aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids "$SG" \
  --subnet-id subnet-0123456789abcdef0 \
  --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=bytestash}]'

You do not need --metadata-options, because the AMI already requires IMDSv2.

Connect as ubuntu with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

First boot finishes within a minute of launch. It creates the certificate, the JWT signing secret, the database and the admin account, then lets ByteStash and nginx start. Read your credentials from a root-only file:

sudo cat /root/bytestash-credentials.txt

# ByteStash - generated on this instance's first boot by bytestash-firstboot.service. # Unique to this instance; nothing here shipped in the image. Store it somewhere safe. BYTESTASH_URL=https://ec2-54-81-216-2.compute-1.amazonaws.com/ BYTESTASH_USERNAME=admin BYTESTASH_ADMIN_PASSWORD=<BYTESTASH_ADMIN_PASSWORD> # # Open BYTESTASH_URL and sign in as admin (self-signed certificate minted on this instance; port 80 redirects). # Sign-up is closed: nobody can register an account. After first login change this password in the user menu # (your account name, top right) -> Change password. REST API and MCP clients use an API key: user menu -> API Keys. # Change the name ByteStash is served as:
sudo bytestash-set-hostname <your-dns-name>
# Restrict 80/443 in the security group to the people and clients that need them.
# Guide: https://secureanycloud.com/stacks/bytestash-1-6-0/

BYTESTASH_ADMIN_PASSWORD holds your instance's own password. Keep it somewhere safe, and change it after your first sign-in (see Maintenance).

Expect first boot, ByteStash and nginx to be active, and ByteStash to run as its own unprivileged user. The start guard, which runs before every start of ByteStash and nginx, passes:

systemctl is-active bytestash-firstboot.service bytestash.service nginx.service ps -o user:12=,comm= -p "$(systemctl show -p MainPID --value bytestash.service)"
sudo /usr/local/sbin/bytestash-guard

active active active bytestash node GUARD_OK

If a service ever refuses to start, run the guard. It names the exact reason.

List the TCP ports that the instance listens on:

sudo ss -Hltn | awk '{print $4}' | sort -u

0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:5000 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::]:80

ByteStash (5000) listens on loopback only, and nginx publishes it on 443. The loopback port 53 entries are Ubuntu's local stub resolver (systemd-resolved).

Check the versions and the build record:

node --version grep -E '^(ByteStash|source|tag commit|audit|database)' /usr/share/doc/sac-bytestash/BUILD-INFO.txt

v22.23.4 ByteStash 1.6.0 on Ubuntu 24.04 - sac build record source https://github.com/jordan-dalby/ByteStash/archive/refs/tags/v1.6.0.tar.gz source sha256 6e534ea3b82e01e043ab55d042cb1ebab78e204d63ac35f5822bfd414c96f8f6 tag commit da3a7afe93cf06c7c01d3cd09e4a2ea52aff4e6a audit server: 0 advisories; web UI bundle: katex + mermaid LOW only (GHSA-238p-pmpm-9mq7) database SQLite (/var/lib/bytestash/snippets/snippets.db); PostgreSQL mode off

Browse to the BYTESTASH_URL from Step 2, for example https://ec2-54-81-216-2.compute-1.amazonaws.com/. The certificate is self-signed, so your browser warns you once. Accept it, or install your own certificate (Step 8). ByteStash shows its sign-in page, without a link to register.

Sign in as admin with BYTESTASH_ADMIN_PASSWORD. Your snippet list opens, and a new instance has none yet. The screenshot below is from an instance with a few snippets added.

The Private and Public switch under the name toggles between your own snippets and the public ones. The small vdev label next to the name is ByteStash's version tag, which upstream fills in only for its own container builds. The version is in the build record above.

The image ships a round-trip test that signs in through nginx as a browser would. It proves that the API refuses anonymous requests, and that sign-up and a wrong password are refused. It also proves that your admin password returns an administrator session that can read your snippets:

sudo /usr/local/sbin/sac-bytestash-probe

PROBE_OK anonymous API 401, sign-up 403, wrong password 401, admin JWT (is_admin), verify valid, authenticated API 200 at https://ec2-54-81-216-2.compute-1.amazonaws.com/

You can also confirm from the command line that sign-up is closed. Port 80 only redirects to HTTPS, ByteStash reports that new accounts are not allowed, a registration attempt is refused, and the account table holds only admin. The block stops with an error if any answer is not the expected one:

H=$(sudo sed -n 's/^set $bs_host "\(.*\)";$/\1/p' /etc/nginx/sac-bytestash-host.conf) C=(--cacert /etc/ssl/sac/bytestash.crt --resolve "$H:443:127.0.0.1" --resolve "$H:80:127.0.0.1")
R=$(curl -s "${C[@]}" -o /dev/null -w '%{http_code} %{redirect_url}' "http://$H/"); echo "$R"
A=$(curl -s "${C[@]}" "https://$H/api/auth/config" | jq -c '{allowNewAccounts, hasUsers, disableAccounts}'); echo "$A"
G=$(curl -s "${C[@]}" -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -d '{"username":"someone","password":"Some-Password-123"}' "https://$H/api/auth/register"); echo "register: $G"
U=$(sudo sqlite3 "file:/var/lib/bytestash/snippets/snippets.db?mode=ro" "SELECT username FROM users;"); echo "$U" [ "$R" = "301 https://$H/" ] && [ "$A" = '{"allowNewAccounts":false,"hasUsers":true,"disableAccounts":false}' ] && [ "$G" = 403 ] && [ "$U" = admin ]

301 https://ec2-54-81-216-2.compute-1.amazonaws.com/ {"allowNewAccounts":false,"hasUsers":true,"disableAccounts":false} register: 403 admin

Choose New snippet, give it a title, add one or more files with their language, optional categories and a Markdown description, and save. Open a snippet to read it with syntax highlighting, copy a file, or edit it.

A snippet is private to you unless you tick Make snippet public. That lists it under Public snippets for anybody who can reach the instance.

To show one snippet to someone without making it public, open its share menu and choose Create Share Link. The link can Require authentication and can expire (for example 2d).

Move to Recycle Bin keeps a snippet for 30 days before it is deleted. From 1.6.0, the public API no longer serves a recycled snippet.

Create an API key from the user menu (your account name, top right), API Keys, and copy it. ByteStash shows the key only once. Scripts send it in an x-api-key header.

You can try it on your instance. Put your key in a file that only you can read first, so it never appears on a command line:

umask 077; printf 'x-api-key: %s\n' '<your-api-key>' > ~/.bytestash-key curl -s --cacert /etc/ssl/sac/bytestash.crt -H @$HOME/.bytestash-key \
  "https://<your-dns-name>/api/snippets?search=python" | jq '.data[] | {id, title}'

The full API is described at https://<your-dns-name>/api-docs.

ByteStash serves a remote MCP (Model Context Protocol) endpoint at https://<your-host>/mcp. Add it to an MCP client (Claude, ChatGPT, Perplexity or any client that supports remote MCP servers over HTTP), with your API key as the bearer token. For example, in a client configuration file:

{ "mcpServers": { "bytestash": { "url": "https://<your-dns-name>/mcp", "headers": { "Authorization": "Bearer <your-api-key>" } } } }

The assistant can then list, search, read, create, update and recycle your snippets with the six ByteStash tools. The endpoint refuses requests without a valid key. Your client must trust the instance's certificate, so install your own certificate first (Step 8).

An assistant has the same access as your account. Give it a key of its own, and delete the key under API Keys in the user menu when you no longer need it.

The certificate was created on your instance's first boot for the instance's public DNS name, public IP, private IP and localhost. Only their owners can read the key, the JWT secret, the credentials file and the data directory:

sudo openssl x509 -in /etc/ssl/sac/bytestash.crt -noout -subject -ext subjectAltName
sudo stat -c '%a %U:%G %n' /etc/ssl/sac/bytestash.key /etc/bytestash/jwt-secret /root/bytestash-credentials.txt /var/lib/bytestash

subject=CN = ec2-54-81-216-2.compute-1.amazonaws.com, O = sac X509v3 Subject Alternative Name: DNS:ec2-54-81-216-2.compute-1.amazonaws.com, IP Address:54.81.216.2, IP Address:172.31.81.44, IP Address:127.0.0.1, DNS:localhost 600 root:root /etc/ssl/sac/bytestash.key 640 root:bytestash /etc/bytestash/jwt-secret 600 root:root /root/bytestash-credentials.txt 750 bytestash:bytestash /var/lib/bytestash

To serve ByteStash under your own DNS name (for example snippets.example.com, pointed at this instance), run the helper. It records the name, creates a new self-signed certificate for it, updates nginx, and rewrites the URL in the credentials file:

sudo bytestash-set-hostname snippets.example.com

If the instance's public address changes after a stop and start, run the helper again.

To use a certificate from your own certificate authority, replace /etc/ssl/sac/bytestash.key (keep it 0600 root) and /etc/ssl/sac/bytestash.crt, then run sudo systemctl reload nginx. Do this before others sign in or you connect an AI assistant.

ByteStash makes no outbound connection unless you turn on single sign-on. ByteStash and nginx cannot reach the instance metadata service, the Amazon Time Sync Service at 169.254.169.123 keeps working, and the firmware-metadata refresh is masked:

systemctl show -p IPAddressDeny bytestash.service nginx.service chronyc -n sources | grep 169.254
FW=$(systemctl is-enabled fwupd-refresh.timer fwupd-refresh.service || true); echo "$FW" [ "$(sort -u <<<"$FW")" = masked ] && [ "$(systemctl show -p IPAddressDeny --value bytestash.service nginx.service | grep -c 169.254.169.254)" = 2 ]

IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128 IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128 ^* 169.254.169.123 3 4 37 11 +5785ns[ -39us] +/- 522us masked masked