fen
e54fbc36ef
Owner decision 2026-10-16: the cans feature (bundles of pastes, #4) was half-integrated and has zero prod usage; removing it eliminates four audit findings by deletion. Removed: - internal/api/cans.go and all can routes (/api/pastes/can, /api/cans/*, /can/{id}) plus handleCanPage/renderCan - is_can from /api/mine and /api/public responses - store layer: CanRow, can store funcs, paste_cans UNION in listings, cans sweep; reserved slugs 'can'/'cans' released - templates/can.html, can CSS, is_can badges in history.js/mine.js - cans tests (cans_test.go, cans_flow_test.go, cans_expiry_test.go, TestErrorCodeCanValidation) - docs/api.md cans section, README/LICENSE/docker-compose mentions Store migration: drops paste_cans only when empty (non-empty table is kept and logged; prod verified clean 2026-10-16) and drops the dormant pastes.can_id column. Covered by new TestMigrateDropsCansSchema. Security hardening (audit findings): pw_<id> (unlock) and tok_<id> (deletion-token) cookies now carry Secure: true in addition to HttpOnly + SameSite=Lax; all deployments are HTTPS-only. cookie_set_test now asserts Secure. go vet ./... and go test ./... pass.
Palette
Palette is a fast, self-hosted pastebin. One Go binary, a SQLite database, and a web UI for sharing text and small files.
Note
✨ This project was built by AI — GLM 5.3 Flash on the Hermes Agent harness, with a human in the loop.
Features
- Text pastes
- File attachments (one file per paste, up to 25 MB)
- Password protected pastes
- Expire after a specified time
- Burn after a number of views
- Custom URLs
- Syntax highlighting with language auto-detection (go-enry)
- Public paste listing with search, sort and pagination
- Cookie based saved pastes and settings
- Five base themes (midnight, smooth, pastel-lavender, pastel-peach, pastel-cloud), each with a dark and light variant
- Dark mode toggle in the topbar and settings, with a configurable default
- Polished code viewer: line-number gutter sized to the widest number and pinned during horizontal scroll, optional line wrap, jump-to-top/bottom buttons, and theme-aware scrollbars
Screenshots
 |
 |
 |
 |
Get Started
Docker
docker run -p 8080:8080 -v palette-data:/data git.archfox.org/poslop/palette
The SQLite database lives in the /data volume inside the container.
Docker Compose
See docker-compose.yml for a ready-to-use example with every environment variable documented, including which are required (only the /data volume) and which are optional.
Build from source
Requires Go 1.27+.
go build -o palette ./cmd/palette
./palette
# open http://localhost:8080
Configuration
| Setting | Default | Description |
|---|---|---|
PALETTE_ADDR |
:8080 |
Listen address |
PALETTE_DB |
palette.db |
SQLite database path |
PALETTE_MAX_TEXT |
5242880 |
Max paste size in bytes (5 MB) |
PALETTE_MAX_ITEM |
26214400 |
Max file attachment / multipart size in bytes (25 MB) |
PALETTE_ADMIN_KEY |
generated | Admin key; if unset a 32-char hex key is generated and persisted to <db-dir>/admin-key (0600) |
PALETTE_DEFAULT_DARK |
dark on | Default dark mode for new visitors. Set false, 0, or off to default to light mode. Visitors who toggle dark mode keep their choice in their browser. |
PALETTE_UNLOCK_SECRET |
random per start | HMAC secret for password-unlock cookies. Set a fixed value to keep unlock sessions across restarts or across replicas. |
An /admin page exists for runtime settings, protected by a key set at
install (PALETTE_ADMIN_KEY env var) and resettable locally. See
API and the design docs in the wiki for details.
API
Full REST API: wiki/API. One example:
curl -X POST http://localhost:8080/api/pastes -d '{"content":"hello"}'
Design docs: wiki/design (e2e encryption, attachments & storage, cookie preferences).
License
Palette is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0-only). See LICENSE.
The software is provided AS IS, without warranty of any kind, express or implied, including merchantability and fitness for a particular purpose. In no event shall the authors be liable for any claim, damages, or other liability, including without limitation any security vulnerabilities, data loss, or legal issues arising from use of the software. You use it at your own risk.
If you run a modified version of Palette as a network service, the AGPL requires you to offer your modified source code to its users.