How to Self-Host MicroBin on a VPS

Tutorial · 8 min read

MicroBin is a compact paste service for text, code snippets, and small files. Self-host it when a team needs an expiring paste URL without sending internal material to a public paste site. A private deployment still needs authentication, HTTPS, persistent storage, and a retention policy; a random URL is not an access-control system.

What you need

• An Ubuntu or Debian VPS with Docker Engine and Docker Compose
• A domain such as paste.example.com
• A long basic-auth password and separate administrator credentials

MicroBin itself is small, so gc.pico can fit a light text-only deployment. Choose more disk and memory when accepting files or sharing the VPS with other containers.

1. Create secrets and storage

mkdir -p /opt/microbin/data
chown 65532:65532 /opt/microbin/data
cd /opt/microbin
openssl rand -base64 36
openssl rand -base64 36

Save the two generated values in a password manager. Create a root-readable .env file and restrict it:

install -m 600 /dev/null /opt/microbin/.env
nano /opt/microbin/.env

Add your own values:

MICROBIN_BASIC_AUTH_USERNAME=team
MICROBIN_BASIC_AUTH_PASSWORD=replace-with-first-secret
MICROBIN_ADMIN_USERNAME=operator
MICROBIN_ADMIN_PASSWORD=replace-with-second-secret
MICROBIN_PUBLIC_PATH=https://paste.example.com/

MicroBin's documented defaults are not safe credentials for a public server. Do not leave the administrator password at its example or default value.

2. Create the Compose service

Create /opt/microbin/compose.yaml:

services:
  microbin:
    image: danielszabo99/microbin:latest
    restart: unless-stopped
    env_file: .env
    ports:
      - "127.0.0.1:8080:8080"
    volumes:
      - ./data:/app/microbin_data

The loopback bind keeps port 8080 off the public interface. The data mount preserves pastes when the container is replaced. Confirm the current image name and data path against MicroBin's Docker documentation before a major upgrade.

3. Start and test locally

docker compose up -d
docker compose logs --tail=100 microbin
curl -I http://127.0.0.1:8080

A 401 Unauthorized response is expected when basic authentication is active. Test with credentials without placing the password in shell history or a shared terminal transcript.

4. Publish only through HTTPS

After pointing DNS at the VPS, add this Caddy site:

paste.example.com {
    encode zstd gzip
    reverse_proxy 127.0.0.1:8080
}

caddy validate --config /etc/caddy/Caddyfile
systemctl reload caddy

Open https://paste.example.com, authenticate, create a short expiring paste, and retrieve it in a private browser window. Confirm that plain HTTP redirects to HTTPS and that http://SERVER_IP:8080 is unreachable remotely.

5. Decide what users may upload

For an internal paste service, disable features you do not need, require an uploader password or basic authentication, set expiry defaults, and limit file size at the proxy and application layers. Never use a paste service for passwords, API keys, recovery codes, or regulated data. Anyone with read access to the VPS or its backups may be able to read stored content.

6. Back up and update

Copy /opt/microbin/data and the protected configuration to another system. Test a restore into a temporary directory. To update:

cd /opt/microbin
docker compose pull
docker compose up -d
docker compose logs --tail=100 microbin

Review the official MicroBin Docker guide and configuration reference for current controls. See how to harden a new server before exposing any self-hosted application, and compare storage options on the LayerOne pricing page.