# ⚡ ZBin ⚡
Pastebin with encryption, syntax highlighting and media previews, optionally without JS enabled in the browser. Also supports easy interaction via curl
## Setup
A `Containerfile` and `compose.yml` is provided in this repo, just run `docker-compose up` or `podman-compose up` to start the server at port 3000. For manual setup without containers just follow the setup done in `Containerfile`
## Configuration
ZBin is configured through environment variables (all optional):

| Variable                   | Default               | Description                                                                                                                                                                                                                                                      |
|----------------------------|-----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `MAX_UPLOAD_BYTES`         | `104857600` (100 MiB) | Hard cap on a single upload.                                                                                                                                                                                                                                     |
| `MAX_TOTAL_BYTES`          | unlimited             | Cap on total stored content across all files. When set, an upload that would push the total over the cap is rejected (`507`).                                                                                                                                    |
| `MAX_AGE_MINUTES`          | unlimited             | Maximum retention. When set, every upload is deleted after at most this many minutes (a longer requested `delete_in_minutes` is clamped down).                                                                                                                   |
| `UPLOAD_COOLDOWN_SECONDS`  | `0` (off)             | Minimum seconds between uploads from the same client IP.                                                                                                                                                                                                         |
| `DECRYPT_COOLDOWN_SECONDS` | `0` (off)             | Minimum seconds between server-side decryption attempts from the same client IP. Bounds the PBKDF2 CPU cost an attacker who knows a file's URL can force by repeatedly requesting it with password cookies.                                                      |
| `BEHIND_PROXY`             | `false`               | Set to `true` (or `1`) when running behind a trusted TLS-terminating reverse proxy (the usual production setup). Reads `X-Forwarded-For` / `X-Real-IP` for the client IP **and** adds the `Secure` flag to the password cookie. Leave off for direct/local HTTP. |

> Passwords for server-side decryption travel in a cookie, so ZBin should always be
> served over HTTPS behind a reverse proxy (with `BEHIND_PROXY=true`) in any real deployment.

## Screenshot
![screenshot](screenshot.png)