pastebinlisted

# PrivateBin (paste.${DOMAIN}) Self-hosted zero-knowledge pastebin. Encryption and decryption happen client side; the server stores ciphertext only. The decryption key is the URL fragment after `#` and never reaches the server — anyone holding the full link can decrypt, so treat links to sensitive content as secrets themselves. The public hostname is **read-only** (Caddy rejects tunnel-tagged write methods with 403). Pastes are created only from this server, through the loopback origin. ## Publish `pbincli` (a uv tool on PATH) is preconfigured in `~/.config/pbincli/pbincli.conf` to use the loopback origin `http://127.0.0.1:8095/` — the only endpoint that accepts writes: ```bash OUT=$(pbincli send --format markdown --expire 1week --json --text "$(cat document.md)") echo "$OUT" | jq -r '.result.link, .result.deletelink' \ | sed 's|http://127.0.0.1:8095|https://paste.${DOMAIN}|' ``` **Always rewrite the host** in `link`/`deletelink` to `https://paste.${DOMAIN}/` before sharing, as above — the paste id and key are host-independent, so the rewritten links work for anyone. - **Default to `--format markdown`** (also the instance default; renders headings, lists, links). Use `syntaxhighlighting` for code, `plaintext` for raw text. - **Always pass `--expire` explicitly** (pbincli's own default is 1day). Choices: `5min 10min 1hour 1day 1week 1month 1year never`. Default to `1week`; prefer `1month`/`1year` for documents meant to stay up; confirm with the user before `