root
4d2f0b047b
Why: picking a winner is what a sync server does when it cannot read the file. Once it can, the right answer is the union of both edits. What: kdbx.Merge folds one database into another. Objects are matched by UUID; the most recently modified version of each wins and the loser is filed in the entry's history, so nothing is dropped. Deletions apply only when the deletion is newer than the other side's edit, otherwise the edit resurrects the object and the stale record is discarded. Groups keep their nesting, objects move when the other side moved them later, database settings follow Meta/SettingsChanged, and custom data and icons are unioned by key. Attachments are remapped from the incoming pool into the target's, since an entry that kept its old index would silently gain the wrong file. Proved: twelve tests over independent additions, both conflict directions with history, deletion, resurrection, nested groups, relocation, attachment remapping, idempotence, order independence and settings. The last one marshals a merged database and has keepassxc-cli decrypt an entry that only ever existed in the incoming copy.
KeepOrg
A synchronization adapter for KeePass. Your databases stay ordinary .kdbx
files that KeePassXC, KeePass2 or KeePassDX opens directly; a server keeps
them in step between everyone who has access.
The server never opens a database and cannot read one. Master passwords stay on the clients.
- Server (
keeporgd, Linux): hosts many KDBX databases, controls access with a tree of user groups, accepts registrations by invite link or OIDC, and pushes updates to connected clients. - Desktop client (
keeporg, Linux, macOS, Windows, BSD): mirrors every assigned database into one directory as a real file, pushes each save and applies what others push. - Android client: the same, published to every file picker as a storage provider.
No third-party dependencies, no cgo, no FUSE.
Quick start
make check # gofmt, vet, tests
make all # keeporgd and keeporg for this host
# a server for trying it out, on 127.0.0.1:8765
KEEPORG_ADMIN_PASSWORD=dev-password-1 make run-server
# in another shell
build/linux-arm64/keeporg login -server http://127.0.0.1:8765 -user admin
build/linux-arm64/keeporg groups
build/linux-arm64/keeporg db -create "Team Vault" -group <group-id>
build/linux-arm64/keeporg run
Then save a new KDBX database as Team Vault.kdbx in ~/KeepOrg from your
KeePass application. It becomes version 1 on the server, and every later save
is pushed automatically.
Packaging
make deb # Debian packages for the client and the server
make dmg # macOS disk image with an /Applications symlink (on macOS)
make windows # Windows zip with a Task Scheduler job
make android # unsigned release APK (needs the Android SDK)
make help # every target
Documentation
- docs/HANDOVER.md — architecture, the decisions behind it, operations, and what is left to do.
- docs/PROTOCOL.md — the HTTP API.
- android/README.md — the Android module.