ByteStash

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet.

The recommended VM size is Standard_B2s. ByteStash is lightweight, and 4 GB RAM is comfortable.

Optional: enable OIDC single sign on

ByteStash supports OIDC single sign-on. Set the OIDC variables in /etc/bytestash/bytestash.env and restart the service:

if
sudo grep -q '^OIDC_ENABLED=' /etc/bytestash/bytestash.env; then
sudo sed -i 's/^OIDC_ENABLED=.*/OIDC_ENABLED=true/' /etc/bytestash/bytestash.env else echo 'OIDC_ENABLED=true' | sudo tee -a /etc/bytestash/bytestash.env fi
# then add OIDC_ISSUER_URL, OIDC_CLIENT_ID and OIDC_CLIENT_SECRET for your provider
sudo systemctl restart bytestash

Ask your identity provider for the issuer URL and client credentials. Internal username and password accounts continue to work alongside OIDC unless you disable them.

Managing the service

sudo systemctl status bytestash
sudo systemctl restart bytestash
sudo journalctl -u bytestash -f

The Node server logs to the journal. nginx logs are under /var/log/nginx/.

To back up the instance, snapshot the OS disk, or copy /opt/bytestash/data/snippets while the service is stopped.

Support

SecureAnyCloud provides 24/7 support for this image via email and live chat. Support covers deployment, nginx TLS termination, upgrades, OIDC integration and performance tuning. Email sales@secureanycloud.com.

This is a repackaged open source software product with additional charges for SecureAnyCloud support services. ByteStash is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Their use does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch ByteStash on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Prerequisites

You need an AWS account, an EC2 key pair in the target Region, and a VPC with a public subnet.

The recommended instance type is m5.large (2 vCPU / 8 GiB RAM). Configure the security group to allow inbound 22/tcp from your management network for SSH and 443/tcp for the HTTPS web UI. The application port 5000 is bound to loopback only and is never exposed.

Step 1 - Launch the AMI

Subscribe to the listing in AWS Marketplace and choose Continue to Launch. Launch through the EC2 console or the AWS CLI. Select the m5.large instance type, your key pair, and a security group that opens ports 22 and 443.

On first boot, the instance generates its per-VM JWT secret and TLS certificate and seeds the administrator account. It then brings up ByteStash behind nginx and writes your credential to a root-only file.

Step 2 - Connecting to your instance

Connect over SSH as the default login user for the OS variant you launched:

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i /path/to/your-key.pem ubuntu@<public-ip>

Step 3 - Read your per-instance credential

The administrator username and password are unique to each instance and written to a root-only file:

sudo cat /root/bytestash-credentials.txt

BYTESTASH_URL=https://<instance-public-ip>/ BYTESTASH_USERNAME=admin BYTESTASH_ADMIN_PASSWORD=<your-per-vm-password> NOTE=Log in at BYTESTASH_URL with BYTESTASH_USERNAME and BYTESTASH_ADMIN_PASSWORD. Rotate the password from the account menu after first login.

Step 4 - Confirm the services and the loopback binding

Both units should be active, the application should listen on loopback only, and nginx should hold ports 80 and 443:

systemctl is-active bytestash nginx

active active

sudo ss -tlnp | grep -E ':5000|:443'

LISTEN 0 511 127.0.0.1:5000 0.0.0.0:* LISTEN 0 511 0.0.0.0:443 0.0.0.0:*

The application is reachable only through the nginx TLS proxy. Nothing is served from 5000 to the network.

Step 5 - Confirm authentication from the command line

The image is secure by default. Unauthenticated API requests are refused, and the per-instance admin credential authenticates end to end. Because the certificate is self-signed, curl needs -k (or your own trusted certificate):

# Unauthenticated requests are refused curl -ks -o /dev/null -w '%{http_code}\n' https://127.0.0.1/api/snippets
# -> 401
# Log in with your per-instance credential and capture the JWT
PW=$(sudo grep '^BYTESTASH_ADMIN_PASSWORD=' /root/bytestash-credentials.txt | cut -d= -f2-)
TOK=$(curl -ks -X POST https://127.0.0.1/api/auth/login \
  -H 'Content-Type: application/json' \
  -d "{\"username\":\"admin\",\"password\":\"$PW\"}" | python3 -c 'import json,sys;print(json.load(sys.stdin)["token"])')
# The token is valid and carries admin authorization curl -ks https://127.0.0.1/api/auth/verify -H "bytestashauth: Bearer $TOK"
# -> {"valid":true,...,"is_admin":true}
# Authenticated snippet listing succeeds curl -ks -o /dev/null -w '%{http_code}\n' https://127.0.0.1/api/snippets -H "bytestashauth: Bearer $TOK"
# -> 200

Step 6 - Sign in to the web UI

Open https://<instance-public-ip>/ in your browser. The certificate is self-signed per instance, so your browser warns on the first visit. Proceed, or install the instance's certificate, or replace it with your own for production.

Sign in with the admin username and the password from the credentials file.

After you sign in, you land on the snippet dashboard, which lists your snippets with syntax highlighting, tags and full-text search:

Step 7 - Create and view snippets

Click New snippet to add a snippet with a title, a description, categories and one or more code fragments. Toggle Make snippet public only if you want an unauthenticated share link.

Open any snippet to view it with language syntax highlighting, copy it to your clipboard, or open the raw content. To find snippets quickly, use the search box (type # to browse categories) and the language filter.

Step 8 - Confirm the dedicated data volume

The SQLite datastore lives on its own EBS volume, separate from the OS disk. You can resize and snapshot it independently:

findmnt -no SOURCE,TARGET,FSTYPE /var/lib/bytestash

/dev/nvme1n1 /var/lib/bytestash ext4

Security notes

• No default credentials. The administrator password and the JWT signing secret are generated on each instance's first boot. Nothing is baked into the image. Rotate the password from the account menu after your first login.
• Open registration disabled. ByteStash permits only the first account to be created. Once the admin is seeded, the registration endpoint returns 403, so there is no world-open sign-up window.
• Loopback binding and TLS. The application binds to 127.0.0.1:5000 and is reachable only through the nginx TLS proxy. The security group opens only SSH and HTTPS.
• Replace the certificate for production. The per-instance certificate is self-signed. For a trusted connection, point nginx at your own domain certificate (for example with Certbot), or terminate TLS at an Application Load Balancer.
• Optional OIDC single sign-on. ByteStash supports OIDC (OIDC_ENABLED plus issuer and client settings in /etc/bytestash/bytestash.env). It ships disabled. Contact support for help enabling it.

Backups

Back up your snippet library with EBS snapshots or AWS Backup against the /var/lib/bytestash data volume, or export snippets from the UI (Settings -> Data management -> Export Snippets).

Support

SecureAnyCloud provides 24/7 technical support for this product by email and live chat at sales@secureanycloud.com . Support covers deployment, replacing the self-signed certificate with your own domain and certificate, OIDC configuration, and backup planning for your snippet library.

For refund requests, contact sales@secureanycloud.com with your AWS account ID and subscription details.

Deploy on AWS

Launch ByteStash with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com