wastebin

Search the Azure Marketplace for wastebin, choose the plan and create the VM. In the networking step, attach an NSG that allows inbound TCP 22 (SSH) and TCP 80 (the web UI) from your client networks only. For production, put a TLS reverse proxy in front of port 80.

RG="wastebin-prod"; LOCATION="eastus"; VM_NAME="wastebin-01" IMAGE_URN="sac1647283583153:wastebin-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name wb-vnet --address-prefix 10.103.0.0/16 --subnet-name wb-subnet --subnet-prefix 10.103.1.0/24 az network nsg create -g "$RG" --name wb-nsg az network nsg rule create -g "$RG" --nsg-name wb-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name wb-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:wastebin-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name wb-vnet --subnet wb-subnet --nsg wb-nsg --public-ip-sku Standard

SSH in to the VM as azureuser:

ssh azureuser@<vm-ip>

wastebin.service, nginx.service and wastebin-firstboot.service all start automatically on first boot.

Check the services, the first-boot marker and the listening ports:

sudo systemctl is-active wastebin nginx wastebin-firstboot
sudo test -f /var/lib/sac/data/wastebin-firstboot.done && echo FIRSTBOOT_DONE
sudo ss -tlnp | grep -E ':80 |:8088 '

In the expected output, all services are active, nginx is bound to the public port 80, and wastebin is bound to loopback 127.0.0.1:8088 only:

active active active FIRSTBOOT_DONE LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",...)) LISTEN 0 128 127.0.0.1:8088 0.0.0.0:* users:(("wastebin",...))

wastebin binds only to loopback, and nginx fronts it, rate limiting requests and capping the paste size. On first boot, a per-VM signing key and password salt are generated and written to a root-only note. Print the note and confirm the loopback binding:

sudo cat /root/wastebin-info.txt
sudo ss -tlnp | grep 8088 grep -E 'limit_req|client_max_body_size' /etc/nginx/conf.d/sac-wastebin-ratelimit.conf /etc/nginx/sites-available/sac-wastebin

The note contains the per-VM signing key (unique to this machine, never baked into the image) and the resolved paste URL:

WASTEBIN_SIGNING_KEY=<WASTEBIN_SIGNING_KEY> WASTEBIN_URL=http://<vm-ip>/ NOTE=Open WASTEBIN_URL in a browser to create a paste. There is no login.

wastebin exposes a small JSON API. POST to / to create a paste, and GET /raw/:id to retrieve its raw content:

RESP=$(curl -s -H 'Content-Type: application/json' \
  --data '{"text":"hello from sac","extension":"txt","expires":3600}' \
  http://127.0.0.1/)
echo "$RESP"
ID=$(echo "$RESP" | jq -r '.path' | sed 's#^/##')
curl -s "http://127.0.0.1/raw/$ID"

The create call returns a path and a signed owner token, and the raw call returns your text:

{"path":"/7a5mYKOI-Ai.txt","owner":"ZjnP4qIy1XAuwTMkorgn..."} hello from sac

Set "burn_after_reading": true to delete the paste the first time it is read raw. Set "expires" to a number of seconds for automatic expiry.

Open the web form in a browser to paste interactively:

open http://<vm-ip>/

The index page is the new paste form: an editor with line numbers, a language picker with 170+ languages, an expiry selector defaulting to one day, and toggles for burn after reading and password encryption.

Type or paste your content into the editor, pick a language for highlighting and choose an expiry. Then submit with the submit button or with the Ctrl+S shortcut:

Opening a paste URL shows the content with syntax highlighting. The header shows the remaining time before expiry. Toolbar icons let you view the raw text, download it, copy the URL or show a QR code:

You can view pastes created with an md or markdown extension as rendered HTML at /md/:id, including GitHub-flavored tables, task lists and admonitions:

These are the key components and their paths:

• wastebin binary: /usr/local/bin/wastebin
• Maintenance CLI: /usr/local/bin/wastebin-ctl
• Config (EnvironmentFile): /etc/wastebin/wastebin.env
• SQLite database: /var/lib/wastebin/state.db
• Systemd unit: /etc/systemd/system/wastebin.service
• First-boot script: /usr/local/sbin/wastebin-firstboot.sh
• Per-VM info note: /root/wastebin-info.txt (mode 0600)
• Sentinel: /var/lib/sac/data/wastebin-firstboot.done

/usr/local/bin/wastebin-ctl --version ls /usr/local/bin/wastebin /usr/local/bin/wastebin-ctl /var/lib/wastebin/state.db

Restart the service and read its logs:

sudo systemctl restart wastebin.service
sudo journalctl -u wastebin.service --no-pager -n 20

wastebin-ctl manages the database directly. It can list and filter entries, delete specific ids, or purge expired entries:

sudo WASTEBIN_DATABASE_PATH=/var/lib/wastebin/state.db /usr/local/bin/wastebin-ctl list

wastebin is configured entirely through environment variables in /etc/wastebin/wastebin.env. The image already sets these keys:

• WASTEBIN_ADDRESS_PORT is the bind address and port. Image default: 127.0.0.1:8088 (loopback).
• WASTEBIN_DATABASE_PATH is the SQLite database file. Image default: /var/lib/wastebin/state.db.
• WASTEBIN_MAX_BODY_SIZE is the maximum paste size in bytes. Image default: 2097152 (2 MiB).
• WASTEBIN_PASTE_EXPIRATIONS lists the selectable expiries, where =d marks the default. Image default: 600,3600,86400=d,604800,2592000.
• WASTEBIN_SIGNING_KEY is the cookie signing key (per VM, 128 bytes). Image default: generated at first boot.
• WASTEBIN_BASE_URL is the base URL used for the paste QR code. Image default: resolved to this VM's address.
• WASTEBIN_TITLE is the HTML page title. Image default: wastebin.

After editing the file, apply changes with sudo systemctl restart wastebin.service. Set WASTEBIN_BASE_URL to your public hostname so the QR code links resolve for external users.

For production, terminate TLS at nginx. Point a DNS record at the VM, then use the packaged nginx with a certificate from Let's Encrypt:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

certbot installs the certificate, rewrites the nginx server block to listen on 443 and sets up automatic renewal.

• Restrict the NSG so ports 80 and 22 only reach trusted networks. wastebin has no authentication, so exposing it broadly makes it a public paste service.
• Terminate TLS at nginx (Step 12) so pastes travel encrypted.
• Keep the rate limit in /etc/nginx/conf.d/sac-wastebin-ratelimit.conf. wastebin has no built-in denial-of-service mitigation, so the reverse proxy limit is what protects it.
• Back up /var/lib/wastebin/state.db to Azure Blob if you need paste history to survive.
• Patch the OS monthly with sudo apt-get update && sudo apt-get upgrade. Unattended security upgrades are already enabled.

wastebin is MIT licensed, with no per-CPU or per-user fee. SecureAnyCloud provides commercial support separately.

• Email: sales@secureanycloud.com
• Website: secureanycloud.com
• Support hours: 24/7, 24h response SLA

Deploy on Azure

Launch wastebin on Ubuntu 24.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7. sales@secureanycloud.com

Deploy on Azure

Launch wastebin on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com