Verified on Debian 13 arm64 with Cinnamon: the .deb installs, the tray
registers and renders its menu, and pull and push sync end to end.
- Packages ship 0755 directories whatever the builder's umask, name the
native changelog changelog.gz, and override lintian for the static
binary and the 0640 server config; prerm uses deb-systemd-invoke.
- The tray item is titled KeepOrg for StatusNotifierItem hosts.
- Event log lines omit empty fields.
- -reset-admin help no longer says to stop the server.
Client 0.6.1 (Linux, macOS, Windows, BSD), server 0.12.1.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Storage. The server keeps its data in SQLite (a file in the data
directory, the default) or PostgreSQL (database, KEEPORG_DATABASE_URL or
-database). Every row, the KDBX versions included, is sealed with
AES-256-GCM under a key derived from the master key and named by an HMAC.
The master key is required to start and a different one is refused. A data
directory from 0.10 or earlier is imported on first start. Several servers
may share one PostgreSQL database. Go goes to 1.26 for the pure-Go
drivers (modernc.org/sqlite, jackc/pgx).
Hardening, after an audit of the server, both clients and the deployment:
- Single sign-on approves a device only after an explicit Approve in the
browser that started it, bound by a cookie and PKCE; identities are never
linked by username, by verified email only when allowed, never to admins.
- Sign-in attempts are limited per address and per account, passwords are
checked outside the store lock with uniform timing, one-time codes work
once, and starting two-factor needs the password.
- Merge vaults bound KDF parameters, payload size and XML shape, check
pushes before storing them, and run at most two merges at once. A version
is written in the same transaction as its metadata.
- Tokens in URLs only on the event stream, which ends on revocation; CSP,
frame-ancestors, no-store and HSTS; sign-in CSRF; 404 for databases
without access; new trusted_proxies.
- Clients open only the server's approval page, keep case-variant and
retired file names apart, never overwrite a save made during a pull,
require https except locally, send the stream token in a header, bound
their reads and escape notifications and terminal output.
- The .deb creates the master key, systemd is sandboxed further, nginx sets
modern TLS and HSTS, and CI deploys from main only.
Server 0.12.0, desktop 0.6.0, Android 0.4.0 (versionCode 4).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Started without a command, keeporg now shows a padlock in the system tray
with a menu like midi-webhook's: a status line, the mirror folder, each
database with its state, Sync Now, browser sign-in and sign-out, the web
interface, the configuration, the log, Start at Login, About and Quit. The
commands are unchanged.
config.json now carries every client setting (device_label,
request_timeout_seconds, ca_file, log_file, notifications), is written in
full on first start and is reloaded by the tray when saved.
A lock in the mirror directory admits one agent at a time, since the tray,
`keeporg run` and a service unit could otherwise race each other.
The tray uses fyne.io/systray: pure Go on Linux, BSD and Windows, cgo on
macOS only. The server keeps no third-party dependencies.
Desktop versions go to 0.5.0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Why: the point of a sync server is that two people can work at once. Picking
a winner was all this one could do while it could not read a vault.
What, end to end:
- A vault is created at /web or with `keeporg vault -create`: the server
builds an empty KDBX 4 file, encrypts it with the password from the form,
and stores it as version 1. An existing database can adopt a stored key
with `keeporg db -id <id> -store-password`, which is verified against the
stored file before it is accepted.
- A stale push to a `merge` vault is no longer refused. The server opens the
stored version and the pushed one in memory, folds them together, and
stores the re-encrypted result. Clients push as usual and pull what comes
back. Any failure answers 409 merge_failed and the client keeps its copy
aside, so a failed merge still loses nothing.
- At rest: vault contents stay KDBX-encrypted as always. A merge vault's
password is kept AES-256-GCM-wrapped under a master key that lives outside
the data directory, bound to the vault id, never returned by the API. A
stolen data directory is ciphertext; a stolen data directory plus the
master key is not. The server runs without a master key and simply refuses
to create or merge vaults.
This moves the server inside the trust boundary for vaults it can merge,
which is inherent to merging and is stated plainly in the README, the
handover notes and the web form itself. Key-less strategies are unchanged and
remain the default for a database created without a password.
Proved: two clients editing the same version are merged rather than refused,
the newer edit of one entry wins, a merge failure leaves the stored vault
untouched, `merge` is refused without a stored key, the wrapped key never
appears in state.json or the API, and the web interface rejects a form
without its CSRF token, withholds its cookie over plain http, and only offers
groups the user administers. Checked by hand against the real thing: a vault
created in a browser, edited by keepassxc-cli on two sides from the same
version, merged by the server, and both entries read back out with
keepassxc-cli. make check, make test-race, android lint and both .deb builds
are clean.
Why: a KeePass application must see an ordinary .kdbx file. A mirror
directory of real files gives that on every desktop platform without FUSE,
WinFsp or macFUSE, and without cgo.
What: internal/client holds the API wrapper, an SSE reader, and a mirror
agent whose entire policy is one pure decide() table: adopt, pull, push,
force-push, server-wins, restore or manual. Saves are detected by rescan,
remote changes arrive over the event stream, and every overwrite of local
bytes leaves a conflict copy. cmd/keeporg drives it: login (password, TOTP or
browser/OIDC device flow), run, sync, status, plus the group, grant, database
and invite administration.
Proved: go test ./internal/client covers the decision table and runs a real
server in-process for adopt, follow, server-wins, client-wins, manual,
read-only restore, server-side rename and event-driven update. Also smoke
tested live: built both binaries, bootstrapped a server, logged in, created a
database and adopted a local file.
root