pass-along

Pass-along

The main application uses port 8080.

/healthz, /readyz, and /metrics endpoints use port 8888.

Server config

The following config can be set via environment variables

SERVER_SALT

Required. Must be at least 32 characters and high entropy. This value is used as server-side secret material for key derivation.

DATABASE_TYPE

Can either be in-memory or redis.

REDIS_SERVER

Address to your redis server.

REDIS_PORT

Used to specify the port your redis server is using.

SERVER_PORT

Listen port for api and ui endpoint.

HEALTH_PORT

Listen port for health endpoint, used mainly for liveness probes.

LOG_LEVEL

Used to specify loglevels, valid values are: debug, info, warn and error

VALID_FOR_OPTIONS

Which options are available in the UI for secret expiration. Only these values are accepted server-side for expires_in.

MAX_SECRET_BYTES

Maximum size of secret text content.

MAX_FILES

Maximum number of attached files.

MAX_FILE_SIZE_BYTES

Maximum size per file attachment.

ENABLE_HSTS

Enable HSTS response header. Keep disabled unless TLS is correctly terminated upstream.

HSTS_MAX_AGE_SECONDS

HSTS max-age value when ENABLE_HSTS=true.

GRACEFUL_SHUTDOWN_SECONDS

Total shutdown budget after the process receives SIGTERM or SIGINT. This includes readiness draining, HTTP shutdown, and hard-cancel delay. Keep this lower than the platform termination grace period so cleanup can complete before the process is killed.

READINESS_DRAIN_SECONDS

Time to wait after /readyz starts returning 503 and before the public listener is shut down. This gives load balancers and orchestrators time to stop routing new requests to the instance.

SHUTDOWN_HARD_SECONDS

Time to wait after the graceful shutdown timeout is reached so request contexts can observe cancellation before datastore resources are closed.

Create a new secret

curl --request POST \
  --url http://localhost:8080/api \
  --header 'Content-Type: application/json' \
  --data '{
	"content": "some super secret stuff goes here",
	"expires_in": 10
}'

expires_in is number of seconds until it expires.

The response will be the ID of your secret, which can be used to fetch it again.

Note: this returned value is a token containing both lookup identifier and access key.

Fetch a secret

To fetch you secret again to a GET request to http://localhost:8080/api/<your-secret-id-goes-here>

For example:

curl --request GET \
  --url http://localhost:8080/api/Jsm9nDvKVhtAQEfz1Bukx7jHeKIBpPV8kX0B_a4w2rEqAke0MYJ_uvGc30s6o85TiIn-qeBm_9S55ajlDzysRw

Security and deployment notes

• Keep /healthz, /readyz, and /metrics on a non-public network.
• Use /healthz for liveness probes and /readyz for readiness probes.
• Set the platform termination grace period higher than GRACEFUL_SHUTDOWN_SECONDS.
• Always run behind TLS (reverse proxy / ingress is supported).
• Security headers and no-store cache controls are enabled by default.
• Rotate SERVER_SALT as part of incident response.
• If a link is leaked, treat the secret as compromised and rotate underlying credentials.