Alexandria
Alexandria
Alexandria sync keeps a workspace available on multiple devices. It is end-to-end encrypted and zero-knowledge: the server stores ciphertext, an encrypted manifest, and a non-reversible token hash. Your passphrase and keys never leave your devices.
Sync v1 is file-level blob sync for a single user on a trusted LAN or self-hosted network. Conflicts use last-write-wins by modification time.
Run akb-sync-server on an always-on machine:
akb-sync-server --bind 0.0.0.0:4000 --data-dir /var/lib/akb-sync
The server stores encrypted workspace data under the data directory. It does not store plaintext notes, file names, keys, passphrases, or raw tokens.
If the server's data volume fills up, Alexandria reports sync server storage is full. Free space on that volume, then retry the sync.
On the first device, create the vault and register the workspace:
akb --root ~/akb/mykb sync clone mykb http://HOST:4000
Sync takes its key from the vault, so encryption comes first. On the first device:
akb --root ~/akb/mykb vault create --name mykb
akb --root ~/akb/mykb sync clone mykb http://HOST:4000
Use a strong passphrase. On every other device, use the same vault name (mykb) and the same passphrase:
akb --root ~/akb/mykb vault create --name mykb
akb --root ~/akb/mykb sync clone mykb http://HOST:4000
The key is derived locally from the vault name and the passphrase, so every device reaches the same key without ever sending it anywhere.
Push local changes and pull remote changes:
akb --root ~/akb/mykb sync
Continuously sync on changes and poll for remote changes:
akb --root ~/akb/mykb sync watch
Preview what sync would do without transferring data:
akb --root ~/akb/mykb sync status
List configured workspaces and what sync would do for each:
akb sync list
Encryption is a separate feature and works without a server: akb vault create,
unlock, lock and status manage it, and the desktop app exposes the same
thing under Settings, Encryption. Sync simply borrows the key from the unlocked
vault, which is why the vault name must match the workspace name you sync under.
The passphrase is the only secret you share between your own devices. Unlocking
caches the key for five days so repeated syncs do not prompt every time; after
that, or after an explicit lock, enter the passphrase again. Change how long with
akb vault ttl 12h, or in Settings → Encryption — it is stored per workspace and
syncs to every device. While the vault is locked sync refuses to run rather than
falling back to anything weaker.
Sync transfers only the workspace layout: regular files under notes/, media/, and trash/, any relative in-workspace symlinks within those trees, and the top-level preferences.json and secrets.akb (the encrypted vault envelope, so secrets follow you to every device). Caches (including the derived index/), .git/, dotfiles, and stray files are ignored.
akb vault ttl); OS keychain storage is planned.