Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Self-hosting Onetime Secret on a VPS is a practical way to keep the application and its secret storage under your control. The shortest production path is a Linux VPS running Docker Compose, an internal Redis or Valkey service, and a reverse proxy that terminates HTTPS. Use the documented baseline of at least two CPU cores, 2 GB RAM, and 10 GB disk, preserve a high-entropy SECRET, and decide deliberately whether Redis data should survive a restart.
What a self-hosted Onetime Secret deployment contains
Onetime Secret is an application that stores an encrypted or otherwise protected value until its link is opened, expired, or deleted according to the instance configuration. A VPS deployment normally has four layers:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →- Application: the version-pinned
onetimesecret/onetimesecretcontainer, listening on port 3000 inside the VPS. - Redis or Valkey: the data service required by simple mode. Keep it on a private Docker network rather than exposing its port to the internet.
- Reverse proxy: Nginx, Caddy, Apache, or another web server that receives HTTPS traffic and forwards it to the application.
- DNS and TLS: an A or AAAA record for the public hostname and a valid certificate at the proxy.
The official self-hosting overview recommends Docker because it is the most portable deployment method and documents the current stable release as v0.26 at the time of writing. Read the official self-hosting overview and the container image documentation together when selecting an image tag and environment variables.
Choose simple mode or full mode first
Decide which feature set you need before provisioning services. Adding account infrastructure later is possible, but it increases migration and recovery work.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
| Mode | Services | Capabilities | Operational trade-off |
|---|---|---|---|
| Simple | Onetime Secret plus Redis or Valkey | Core one-time-secret creation, retrieval, expiration, and administration | Fewest containers, smallest attack surface, and simplest backups |
| Full | Onetime Secret, Redis or Valkey, PostgreSQL, and RabbitMQ | Account-oriented features including MFA, SSO, WebAuthn, and organizations | More dependencies, credentials, upgrades, monitoring, and restore procedures |
Choose simple mode when you need a private secret-sharing endpoint without user accounts. Choose full mode only when the account controls or organization features justify operating PostgreSQL and RabbitMQ as well. The feature and dependency distinctions are described in the official self-hosting documentation.
VPS requirements and sizing
The documented recommended baseline is 2 or more CPU cores, 2 GB or more RAM, and 10 GB or more disk. The getting-started documentation separately describes 1 GB or more RAM as suitable for optimal performance in its example deployment. Treat the larger baseline as the safer starting point for a production VPS, especially when the reverse proxy, monitoring, backups, and full mode services share the machine.
| Resource | Baseline to provision | What to check before buying |
|---|---|---|
| CPU | 2+ cores | Headroom for TLS handshakes, container updates, compression, and any PostgreSQL or RabbitMQ workload |
| Memory | 2 GB+ | Whether the provider allows an upgrade without reinstalling the VPS; full mode needs additional service memory |
| Disk | 10 GB+ | SSD or NVMe performance, Docker image layers, logs, Redis persistence, snapshots, and encrypted backup capacity |
| Network | Public IPv4 and, where useful, IPv6 | Firewall controls, bandwidth limits, region latency, and DNS support |
A small VPS can run simple mode, but do not confuse the minimum disk figure with a backup plan. Keep encrypted backups outside the machine and monitor free space. If Redis persistence, container logs, PostgreSQL, or RabbitMQ are enabled, reserve additional disk rather than allowing the root filesystem to fill.
Plan the network, hostname, and trust boundaries
Use one public hostname
Create a DNS A record, and an AAAA record if the VPS has working IPv6, such as secrets.example.net. Set the Onetime Secret HOST variable to this externally reachable hostname. The value must match the URL users will open; otherwise generated links can use the wrong host.
Keep the application and Redis private
Bind the application port to localhost or the private Docker network and let only the reverse proxy accept public web traffic. Redis or Valkey should have no public port mapping. If a managed firewall is available, allow SSH only from your administration addresses and allow TCP 80 and 443 for certificate issuance and HTTPS. Do not expose TCP 6379 to the internet.
Choose the proxy termination point
Terminate TLS at the VPS reverse proxy and forward requests to the container on port 3000. When HTTPS is provided by that proxy, set SSL=true so the application generates secure links and understands the external scheme. The environment-variable reference explains the HOST and SSL settings: Onetime Secret environment variables.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #2
- Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Provision and harden the VPS
- Install a supported Linux distribution and apply its security updates.
- Create an administrator account with sudo access. Disable password SSH login after testing key-based login; do not disable your only working access path.
- Configure the provider firewall and the operating-system firewall for SSH and web traffic only. Keep Docker’s internal service ports off the public interface.
- Install Docker Engine and the Docker Compose plugin from the distribution’s official repository or Docker’s official installation instructions.
- Choose a deployment directory such as
/opt/onetimesecret, make it readable only by the administrator, and keep environment files outside any web root.
Enable automatic security updates where they are appropriate, but schedule Docker image upgrades deliberately. A kernel update and an application image update have different rollback procedures, so record what changed and when.
Build the private Docker deployment
Create the directory and network
sudo mkdir -p /opt/onetimesecret
sudo chown $USER:$USER /opt/onetimesecret
cd /opt/onetimesecret
docker network create ots_privateIf you use Compose, the project network is created automatically. A separately named network is useful when you launch the services with individual docker run commands. Do not create both approaches accidentally; use one network definition consistently.
Run Redis or Valkey internally
The following simple-mode example keeps Redis in memory by disabling append-only persistence:
docker run -d --name ots-redis --network ots_private --restart unless-stopped redis:7-alpine redis-server --appendonly noUse a tested, pinned Redis or Valkey image tag rather than an unbounded latest tag. The official getting-started material confirms that secrets can remain entirely in memory depending on Redis configuration: getting started. Memory-only operation minimizes disk residue but loses the Redis dataset after a restart. If your recovery requirements favor restart survival, mount a protected volume and use AOF or RDB persistence instead; that writes data to disk and must be included in your threat model and backup plan.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Generate and protect the root secret
Generate the root secret once, before creating production secrets:
cd /opt/onetimesecret
openssl rand -hex 32 > .ots_secret
chmod 600 .ots_secretSECRET is the root secret from which derived secrets are generated. Back up the file in encrypted storage, keep it out of Git and the public web root, and restrict the directory to the account that runs the deployment. Changing or losing this value can invalidate existing data and links. Other authentication secrets used by a fuller configuration may not be recoverable from it, so back up those values separately as documented in the environment-variable reference.
Rank #3
- CanaKit Raspberry Pi 5 Essentials Starter Kit
Configure and start the application
Create an environment file without putting the secret in shell history
Write the generated value into a root-readable environment file, then append the non-secret settings:
cd /opt/onetimesecret
printf 'SECRET=%s
' "$(cat .ots_secret)" > .env
cat >> .env <<'EOF'
HOST=secrets.example.net
SSL=true
REDIS_URL=redis://redis:6379/0
EOF
chmod 600 .envReplace the hostname with the DNS name you actually control. If you run Valkey instead, use the documented VALKEY_URL variable in place of REDIS_URL. For email features, add the SMTP credentials and sender settings supported by your release to this protected environment file or a secret manager; never commit them to source code.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use Compose with a pinned application image
Create compose.yml with the application and its private Redis service. This example maps port 3000 only to the VPS loopback interface, where the reverse proxy can reach it:
services:
redis:
image: redis:7-alpine
command: redis-server --appendonly no
restart: unless-stopped
networks:
- ots_private
app:
image: onetimesecret/onetimesecret:v0.26
env_file: .env
depends_on:
- redis
ports:
- 127.0.0.1:3000:3000
restart: unless-stopped
networks:
- ots_private
networks:
ots_private:
driver: bridgeThe image tag shown is the documented current stable release at the time of writing. Before deploying, check the container image page and release notes, test the selected tag, and pin that exact tag in your file. Start it with:
docker compose up -d
docker compose ps
docker compose logs --tail=100 appIn the Compose example, the service name redis resolves inside the private network, so redis://redis:6379/0 does not expose Redis publicly. If you use a separate container named ots-redis on ots_private, set the hostname in REDIS_URL to that container name instead.
Put HTTPS in front of port 3000
Configure your reverse proxy for the chosen hostname, obtain a certificate, and forward requests to http://127.0.0.1:3000. A minimal Nginx-style location needs the original host and forwarding headers:
Rank #4
- All-in-One Complete Kit: This SANOOV RPi 5 bundle comes with Raspberry Pi 5 4GB RAM single board, active cooler, durable ABS case and screwdriver. No extra parts needed, ready to use right out of the box for beginners and hobbyists
- Powerful Single Board Computer: Equipped with 4GB RAM and high-performance processor, delivers fast running speed for 4K playback, AI projects, programming and daily computing tasks. SANOOV for raspberry pi 5 4GB is equipped with broadcom 64 quad-core Arm Cortex A76 processor with gigabit ethernet and upgraded with IEEE 802.11ac Wi-Fi, Bluetooth 5.0 dual-band 2.4Ghz and 5Ghz and Power Over Ethernet (POE). Upgrading delivers 2-3 x speed vs Pi 4, redefining the experience
- Efficient Active Cooler: Effectively lowers operating temperature and prevents performance throttling. Runs quietly even under long-time heavy load, ensures stable operation all day long. SANOOV RPi 5 4GB kit offer an active cooler, which combines an aluminium heatsink with a high-performance PWM fan. Active cooler is fully compatible with the Pi OS, which can effectively reduce the temperature of RPi5 and ensure its good performance during long-term high load operation
- Sturdy ABS Protective Case: Well-fitted for Raspberry Pi 5 board, can be secured with 4 screws to effectively protect the Pi 5 motherboard from damage, reserves full access to all ports and buttons. SANOOV uses ABS material to produce the case, which has a softer texture and feel. Meanwhile, SANOOV case adopts a layered design for easy disassembly and installation. (Tip: The Case cannot install M.2 HAT Add on Board and Solid State Drive!)
- Wide Application & Full Compatibility: Seamlessly compatible with official OS and mainstream peripheral accessories for Raspberry Pi 5. Whether you are a beginner, student, electronics hobbyist or professional developer, this all-in-one kit meets your diverse needs. It excels in IoT projects, robotics design, retro gaming devices, home media servers and other DIY creations. Backed by a large global community, you can easily find guides, technical support and shared projects online
server {
listen 443 ssl http2;
server_name secrets.example.net;
ssl_certificate /path/to/fullchain.pem;
ssl_certificate_key /path/to/privkey.pem;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
}
}Use your proxy’s normal certificate-issuance and renewal mechanism rather than copying private keys into the container. Redirect HTTP to HTTPS. Add HSTS only after you have verified certificate renewal and can reliably serve the hostname over HTTPS; the installation guide includes HSTS in its proxy configuration: installation guide.
Test the deployment before inviting users
- From an external network, open the HTTPS hostname and confirm the certificate, hostname, and secure redirect.
- Create a test secret containing a harmless value. Confirm that the generated link uses HTTPS and the configured hostname.
- Open the link once, then try to open it again. Verify that the second retrieval is rejected according to the application’s one-time behavior.
- Set a short expiration for a separate test and confirm that an expired secret cannot be retrieved.
- If SMTP is configured, test delivery, sender identity, and failure handling without sending production secrets.
- Restart the application and proxy containers. Check whether behavior matches your Redis persistence choice.
- Restore the root secret and any persistent data in a disposable test environment. A backup that has never been restored is not a verified backup.
Record the expected result for each check. This gives you a baseline for future upgrades and distinguishes an application problem from a DNS, proxy, or Redis problem.
Security controls that matter most
Protect credentials and keys
- Use a randomly generated
SECRET; do not substitute a memorable password. - Set filesystem permissions on
.env,.ots_secret, and backup archives so other local users cannot read them. - Use a secret manager when available, and ensure process listings, CI logs, and shell history do not reveal values.
- Never commit environment files, Redis dumps, PostgreSQL dumps, or TLS private keys to a public repository.
Reduce network exposure
- Expose only the reverse proxy’s web ports and the SSH port you administer.
- Keep Redis or Valkey on the private Docker network. Require authentication where supported if another trusted network must reach it.
- Bind the application to localhost when the proxy is on the same VPS.
- Use secure cookies and HTTPS redirects at the proxy.
Harden administrator access
Full mode can enable MFA and WebAuthn through the documented authentication variables. A FIDO2/WebAuthn security key is an optional physical control for administrators, not a requirement for the base deployment. Start with SSH keys, least-privilege sudo, timely operating-system updates, and a tested recovery account before enabling account registration.
Monitor the failure points
Watch disk consumption, memory pressure, Redis or Valkey health, certificate expiry, container restart counts, and proxy errors. Alerting thresholds are operator decisions rather than a universal Onetime Secret standard. Keep logs useful for diagnosis while ensuring they do not contain secret values or request bodies.
Choose Redis persistence deliberately
| Redis behavior | Benefit | Cost or risk | Use when |
|---|---|---|---|
| Memory-only | Minimal disk residue and simple cleanup | Secrets and state disappear after a process or VPS restart | Restart loss is acceptable and privacy against disk recovery is the priority |
| AOF persistence | More complete restart recovery | Writes secret-related data to disk and increases backup and deletion obligations | You need stronger recovery and have encrypted storage and retention controls |
| RDB snapshots | Periodic point-in-time recovery with fewer continuous writes | Changes since the last snapshot can be lost; snapshot files still contain sensitive data | Periodic recovery is sufficient and you can secure snapshot files |
Document the selected mode, retention period, encryption, and restore command. The one-time-secret privacy promise does not by itself determine whether persistence is right; your threat model and recovery objective do.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Backups, upgrades, and recovery
Back up what is actually required
Always preserve the root SECRET in encrypted backups. If full mode is enabled, include PostgreSQL data and every authentication or integration secret that cannot be derived from the root value. Include Redis persistence files only if your chosen recovery procedure depends on them. Store at least one backup outside the VPS and restrict who can decrypt it.
Best Value
- 【What you Get】You will get 1*Pi 5 8GB Single Board,1*RasTech Case,1*Active Cooler,1*Screwdriver,1*Installation instructions,12-month free warranty, lifetime service, 24-hour prompt and friendly response.
- 【More Connectors】There are two USB 3.0 ports(5Gbps simultaneously) and two USB 2.0 ports, which triple total bandwidth ,support any combination of up to two cameras or displays. Peak SD card performance is doubled through support for the SDR104 high-speed mode. It provides a smooth desktop experience for you. Offer Gigabit Ethernet and a PCIe interface, along with dual-band Wi-Fi and Bluetooth 5.0/BLE wireless capability. The RasTech Pi 5 Kit use the new 27W 5.1V 5A USB-C power connector.
- 【 Support Dual 4Kp60 Display 】Each of the two microHDMI sockets can control a 4K display at 60 Hertz, now support HDR, offering super HD video for media streaming projects. RPi 5 is the first RPi model that comes with a PCI Express port (PCIe 2.0 x1 with 500 MB/s) to attach SSDs (requires separate M.2 HAT).
- 【 Excellent Chips And Applications】Pi 5 is a full-size Pi computer using silicon built in-house at Pi. The RP1 “southbridge” provides the bulk of the I/O capabilities for Pi 5. Pi 5 is more friendly and convenient in the development of Internet of Things, Web development, machine identification, automatic control and other electronic equipment applications and network.
- 【 Faster CPU, Better GPU 】 Pi 5 features a Broadcom BCM2712 64-bit quad-core Arm Cortex-A76 processor running at 2.4GHz, it delivers a 2–3× increase in CPU performance relative to RaspberryPi 4. The 800MHz VideoCore VII GPU is compatible to OpenGL ES 3.1 and Vulkan 1.2, substantial uplift in graphics performance. Pi 5 Offers lightning-fast CPU speed, a PCI Express interface, a Real Time Clock (RTC) and a power button and runs significantly cooler than Pi 4.
Upgrade with a rollback path
- Read the release notes for the target image tag.
- Back up the environment files and relevant data, then record the current image digest or tag.
- Pull the new pinned image and start it in a maintenance window.
- Check container logs, health behavior, secret creation, one-time retrieval, expiration, and email delivery.
- Keep the previous image tag available until the validation period is complete.
Do not change SECRET during an upgrade. Changing or losing it can make existing data and links unusable even if the containers themselves start normally.
Free tools Windows power users keep installed
One-click scans. No signup required.
Troubleshoot common failures
| Symptom | Likely cause | What to check |
|---|---|---|
| Generated links use HTTP or the wrong hostname | HOST, SSL, or proxy forwarding is wrong |
Confirm the public hostname in .env, set SSL=true behind HTTPS, and pass X-Forwarded-Proto https. |
| Application cannot connect to Redis | Wrong service hostname, network, URL scheme, or container state | Run docker compose ps, inspect logs, verify the URL uses the Compose service name, and ensure both containers share a network. |
| Redis data disappears after restart | Memory-only configuration or an unmounted volume | Check the Redis command and volume configuration; enable AOF or RDB only after assessing disk-residue and backup implications. |
| HTTPS works locally but not externally | DNS, firewall, certificate, or proxy binding issue | Check A/AAAA records, inbound 80/443 rules, certificate names, and whether the proxy listens on the public interface. |
| Users receive no email | SMTP variables, credentials, DNS, or provider restrictions | Inspect application logs without exposing credentials, verify sender settings, and test outbound SMTP connectivity. |
| Existing links fail after a rebuild | The root SECRET changed or was omitted |
Restore the original value from the protected backup and restart the application; do not generate a replacement casually. |
How to compare VPS plans for this workload
Price alone is a poor selector for a privacy-sensitive service. Compare these characteristics before ordering:
- CPU and RAM headroom: account for the proxy, Docker, monitoring, and full-mode services rather than sizing only the application container.
- Storage: prefer SSD or NVMe, check whether disk encryption or encrypted snapshots are available, and verify snapshot restore procedures.
- Network controls: look for provider firewalls, private networking, IPv6 support, bandwidth limits, and abuse-response policies.
- Region: select a location that gives users acceptable latency and satisfies your data-residency requirements.
- Operational access: confirm console access, rescue mode, image reinstall options, and whether Docker runs without provider restrictions.
- Backup economics: calculate the recurring cost of off-site encrypted backups and snapshots, not just the compute price.
- Upgrade path: ensure you can add CPU, RAM, or disk before load forces a migration.
For simple mode, a single VPS with an internal Redis or Valkey container is usually easier to audit than splitting services across hosts. Full mode may benefit from separate service instances as usage and recovery requirements grow, but that also creates more networks, credentials, and failure boundaries to manage.
When self-hosting is the right choice
Self-hosting is a good fit when you need control over the hostname, deployment region, retention policy, network boundary, and administrative access. It is less attractive when you cannot patch a public server, protect backups, monitor certificates, or test restores. The application container is only one part of the security responsibility: the VPS operating system, proxy, DNS account, Redis data, credentials, and backups all become part of your trusted computing environment.
Start with simple mode, a pinned image, private Redis, HTTPS, and a tested restore procedure. Move to full mode only after you can operate that foundation reliably and have a clear requirement for MFA, SSO, WebAuthn, or organizations.
Bottom line
A secure Onetime Secret VPS deployment is small but deliberate: pin the application version, preserve the root secret, isolate Redis or Valkey, terminate HTTPS at a hardened proxy, and test both one-time retrieval and disaster recovery. Those controls matter more than choosing an oversized server or adding account services you do not need.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
