
Security News
Node.js Drops Bug Bounty Rewards After Funding Dries Up
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.
An HTTP-proxy/gateway that automatically pause and restart Scalingo apps in case of inactivity
🚀 Optimize your PaaS experience.
Paastis helps development teams or workers that build and manage many PaaS applications with few usage (ex: demo, ephemeral or in-progress apps) to optimize their resource consumption.
Paastis automatically scales down (to-zero) and up (to-x) PaaS applications according to their idle time.
Rather than running apps with no trafic unnecessarily, Paastis automatically stops it after an optimized delay (configurable, for all apps or by app or group of apps).
If an app is requested, whether it is active or not, then Paastis acts as a proxy and forwards the request with all its attributes (headers, query and/or body params) to the upstream PaaS application (after eventually waking it up).
Paastis is a Node.js server app, library and CLI.
Paastis is open source, under license AGPL-3.0, hosted on GitHub.
Paastis is distributed on the npm Registry.
Paastis is aimed for development teams and workers that use PaaS and Cloud hosting services.
Thus, really great attention is paid to Developer Experience.
Paastis fits organizations with one or multiple applications with few usage:
Paastis currently works for users of the following Cloud hosting providers:
Other providers will be added in the future : render.com, Netlify, Kubernetes, Vercel, platform.sh, etc.
1/ Generate and get your target PaaS (Heroku, Scalingo, Clever Cloud) API key / token / credentials (with rights to scale up and down entities).
Resources:
2/ Use npx paastis to fetch and run an instance of Paastis.
# Heroku (default provider)
$ PROVIDER_HEROKU_API_TOKEN=tk-us-xxx npx paastis
# Scalingo
$ PROVIDER_NAME=scalingo PROVIDER_HEROKU_API_TOKEN=tk-us-xxx npx paastis
# Clever CLoud
$ PROVIDER_NAME=clever-cloud \
PROVIDER_CLEVER_OAUTH_CONSUMER_KEY=xxx \
PROVIDER_CLEVER_OAUTH_CONSUMER_SECRET=xxx \
PROVIDER_CLEVER_TOKEN=xxx \
PROVIDER_CLEVER_SECRET=xxx \
npx paastis
By default, the proxy listens on port 3000.
💡 You can add a
.envandpaastis.ymlfile(s) (cf. below) to configure your instance.
3/ Query your target app / dyno / pod resource with paastis URL (localhost:3000) including request header Host. Only the final subdomain (i.e. the first part of the URL) matters.
# for a PaaS app named "my-paas-app"
$ curl -v localhost:3000 -H "Host: my-paas-app.proxy.paastis.localhost"
# for the app resource /api/v1/products
$ curl -v localhost:3000/api/v1/products -H "Host: my-paas-app.proxy.paastis.localhost"
If the upstream exists:
… else an error will be thrown.

Scenario :
Paastis supports multiple PaaS providers (but not yet all their regions) :
It is also possible to define Shell commands (a.k.a. hooks) to be executed for each application on the following phases :
Sometimes, we do not want to monitor and manage some apps (for example, an instance of Paastis engine 😙).
We can exclude / ignore apps to me managed (with environment variable REGISTRY_IGNORED_APPS.
Paastis is composed of 3 main building blocks :
# 1/ Fetch sources
git clone git@github.com:paastis/paastis.git
# 2/ Enter project directory
cd paastis
# 3/ Generate and edit .env file (especially, define SCALINGO_API_TOKEN value with your own API key)
cp sample.env .env
# 4/ Install project dependencies
npm install
# 5/ Start project
npm start
# 6/ Enjoy
curl -v http://localhost:3000 -H Host:my-cloud-app.proxy.example.com
| Variable | Required | Type | Format | Default |
|---|---|---|---|---|
| HOST | false | String | IP or name | 0.0.0.0 |
| PORT | false | Number | Number | 3000 |
| REGISTRY_TYPE | false | String | "in-memory" or "redis" | in-memory |
| REGISTRY_IGNORED_APPS | false | String | List of strings, separated by a comma | - |
| REGISTRY_REDIS_URL | false | String | redis://: | - |
| START_AND_STOP_CHECKING_INTERVAL_CRON | false | String | CRON expression | * * * * * |
| START_AND_STOP_MAX_IDLE_TIME | false | Number | Number of minutes | 15 |
| PROVIDER_NAME | true | String | "scalingo" or "clever-cloud" | - |
| PROVIDER_REGION | false | String | "osc-fr1", "rbx", etc. | - |
| PROVIDER_SCALINGO_API_TOKEN | only if PROVIDER_NAME is "scalingo" | String | Token string | - |
| PROVIDER_SCALINGO_OPERATION_TIMEOUT | false | Number | Number of seconds | - |
| PROVIDER_HEROKU_API_TOKEN | only if PROVIDER_NAME is "heroku" | String | Token string | - |
| PROVIDER_HEROKU_OPERATION_TIMEOUT | false | Number | Number of seconds | - |
| PROVIDER_CLEVER_API_HOST | false | String | URL | https://api.clever-cloud.com |
| PROVIDER_CLEVER_OAUTH_CONSUMER_KEY | only if PROVIDER_NAME is "clever-cloud" | String | Token string | - |
| PROVIDER_CLEVER_OAUTH_CONSUMER_SECRET | only if PROVIDER_NAME is "clever-cloud" | String | Token string | - |
| PROVIDER_CLEVER_TOKEN | only if PROVIDER_NAME is "clever-cloud" | String | Token string | - |
| PROVIDER_CLEVER_SECRET | only if PROVIDER_NAME is "clever-cloud" | String | Token string | - |
| PROVIDER_CLEVER_OPERATION_TIMEOUT | false | Number | Number of seconds | 60 |
| HOOKS_BEFORE_START | false | String | Shell command(s) | - |
| HOOKS_AFTER_START | false | String | Shell command(s) | - |
| HOOKS_BEFORE_STOP | false | String | Shell command(s) | - |
| HOOKS_AFTER_STOP | false | String | Shell command(s) | - |
| ROUTING_SYSTEM_API_ENABLED | false | Boolean | false | |
| ROUTING_SYSTEM_API_TOKEN | false | String | xxx-yyy-zzz | - |
Declare a file paastis.yml (or copy and rename paastis.yml.sample).
You can set or edit the following RunningApp.js properties :
app_name → set RunningApp.nameapp_max_idle_time → set RunningApp.maxIdleTimelinked_apps → set (without any concatenation) RunningApp.linkedAppsrules:
- pattern: 'app-review-pr(\d+)-(back|front)'
linked_apps:
- 'app-review-pr$1-front'
- pattern: 'hello-fastify'
linked_apps:
- 'hellofastifydeux'
- pattern: 'hello-fastify-2'
app_name: 'hellofastifydeux'
- pattern: '.*fastify.*'
app_max_idle_time: 0
1/ Build the Docker image
$ docker build -t paastis .
💡 If you define a file
paastis.ymlit will be added to the image.
2/ Run a container
$ docker run \
-it --rm -p 3000:3000 \
--name paastis \
-e PROVIDER_SCALINGO_API_TOKEN=tk-us-xxx \
-e ROUTING_SYSTEM_API_ENABLED=true \
-e ROUTING_SYSTEM_API_TOKEN=abcd-1234-EFGH-5678 \
paastis
3/ Test
$ curl -v localhost:3000 -H "Host: my-app.proxy.example.net"
$ curl -v localhost:3000/apps -H "PaastisProxyTarget: system" -H "PaastisProxySystemApiToken: abcd-1234-EFGH-5678" | jq .
FAQs
An HTTP-proxy/gateway that automatically pause and restart Scalingo apps in case of inactivity
The npm package paastis receives a total of 7 weekly downloads. As such, paastis popularity was classified as not popular.
We found that paastis demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.