01 / Quickstart Guide
Synkk is a local-first, self-hostable sync server and Markdown workspace for Obsidian. Follow these steps to connect your first vault and device in under 2 minutes.
Create a Team & Vault
Log in to your Synkk web workspace. Navigate to Vaults and click Create Vault. Name your vault (for example, engineering-brain) and select your default access policy (Read-Write, Read-Only, or Restricted).
Generate a Scoped Device Token
Go to Devices & Tokens in your dashboard. Click Add Device Token, assign a label representing your physical hardware (e.g., MacBook Pro M3 or Work iPhone 15), and generate the secure key. The key will start with synkk_....
Security Best Practice
Always issue a unique token per device. If a device is ever lost or stolen, you can revoke its individual token from the dashboard without affecting your other devices.
Install the Obsidian Plugin
Download the latest release bundle (main.js, manifest.json, and styles.css) from the official GitHub releases page. Copy these three files into your vault's plugin directory:
<your-vault>/.obsidian/plugins/synkk-sync/
├── manifest.json
├── main.js
└── styles.css
Pair & Synchronize
Open Obsidian → Settings → Community Plugins → Enable Synkk Team Vault Sync. Open the plugin settings panel. You can connect automatically using Instant QR Quick Connect or enter your Server URL and Device Token manually.
02 / Plugin Installation & Setup
Synkk works across macOS, Windows, Linux, iOS, and Android. Because your vault remains standard Markdown files on disk, your files are never held hostage.
Desktop Setup (macOS, Windows, Linux)
On desktop operating systems, Obsidian stores vault configurations inside the hidden .obsidian folder inside your vault root. Simply ensure community plugins are enabled in Obsidian preferences before copying the plugin files.
Instant QR Pairing (Mobile & Tablets)
Typing long API tokens on mobile touchscreens is prone to typos. Synkk simplifies mobile setup with Instant QR Quick Connect.
- In your Synkk web dashboard, navigate to Devices & Tokens.
- Click Generate Mobile QR Code next to your device entry.
- In Obsidian Mobile on iOS or Android, open Synkk settings and tap Scan Pairing QR Code.
- Your server URL and token will automatically populate and test connection instantly.
Mobile Background Execution Note
iOS and Android aggressively suspend background network tasks when apps are minimized. Synkk performs an automatic sync pulse whenever Obsidian is launched or brought to the foreground, plus periodic sync checks while active.
03 / Core Architecture & Storage Engine
Synkk is built on a local-first foundation. Your notes are stored as plain UTF-8 Markdown text files both on your local file system and on the server.
Storage Directory Layout
On the server side (Laravel 12 + SQLite WAL), files are organized by tenant, team, and vault:
storage/app/private/
└── vaults/
└── {team_id}/
└── {vault_slug}/
├── 00-Inbox/
│ └── QuickNote.md
├── Projects/
│ └── ArchitectureSpec.md
└── .synkk/
└── snapshots/
Cryptographic SHA-256 Manifests
Every sync operation begins by comparing cryptographic state. When a device requests a sync, Synkk generates or evaluates a vault Manifest: a JSON mapping of every file path, its SHA-256 content checksum, file size in bytes, and last modification timestamp.
{
"vault": "engineering-brain",
"revision": 78,
"files": {
"Projects/Roadmap.md": {
"hash": "f2a8c1d7e3b9a04f21e5c89731d4e28a9b6e5f1a2b3c4d5e6f7a8b9c0d1e2f3a",
"size": 4210,
"mtime": 1725712400
}
}
}
Conflict Engine & Revision Control
If two devices modify the exact same note while offline and later attempt to sync, Synkk detects the revision mismatch using the client's base version header.
- Base Match: The edit is written as the new canonical file version.
- Stale Revision: The incoming upload is automatically preserved as a sibling conflict file:
Note.sync-conflict-[timestamp].md.
No Lost Edits
Synkk never silently overwrites concurrent edits. Both notes remain available in your vault so you can review differences and merge manually.
04 / Roles & Granular Path Permissions
Unlike traditional sync solutions that require all-or-nothing access to an entire vault, Synkk allows team leaders to enforce path-scoped boundary rules.
Member Roles & Capabilities
| Role | Read Files | Upload / Edit | Manage Members & Tokens |
|---|---|---|---|
| Admin | ✓ Full Access | ✓ Full Access | ✓ Full Access |
| Editor | ✓ Allowed | ✓ Allowed | ✗ Denied |
| Reader | ✓ Allowed | ✗ Denied (Pulls only) | ✗ Denied |
Granular Path-Based Access Rules
Path rules use glob syntax to define access per member or per device group:
/finance/* -> Admin Only (Hidden from general team)
/management/hr/* -> Admin Only (Hidden)
/engineering/* -> Editor (Team can read & edit)
/handbook/* -> Reader (Team can read, Admins edit)
Zero-Leak Architecture
When a device requests a vault manifest, the Synkk server filters out hidden paths before sending the JSON response. Untrusted devices cannot even discover the file names of restricted subdirectories.
Data Loss Prevention (DLP) & Secret Scanning
Accidental commits of API keys or credentials can compromise entire organizations. Synkk includes an active DLP scanner that intercepts note uploads containing credentials.
Scanned secret patterns include:
- AWS Access & Secret Keys (
AKIA...) - OpenAI & Anthropic API Keys (
sk-...) - Private SSH / RSA Keys (
-----BEGIN RSA PRIVATE KEY-----) - JSON Web Tokens (JWT) & Database Connection Strings
05 / Safety Shield & Data Loss Protection
Catastrophic data loss during sync usually happens when a script or device accidentally deletes hundreds of files and syncs that mass deletion across all devices.
The 10% Mass-Deletion Guard
Synkk introduces Safety Shield. If an incoming sync transaction attempts to delete more than 10% of the total notes in a vault, the server automatically halts the operation and places the transaction on hold.
Action Required on Deletion Guard Trigger
An administrator receives an immediate notification in the Synkk dashboard. The deletion remains blocked until manually authorized with a one-time override or rejected.
Pre-Mutation Snapshots & Rollback Engine
Before any file is modified or soft-deleted on the server, Synkk creates a local snapshot copy. You can review complete version histories and restore any file version with a single click.
06 / REST API Reference
Base API Endpoint: https://synkk.space/api/v1
All API requests require a valid Bearer token header: Authorization: Bearer synkk_....
Verifies device token authenticity and returns user, team, and device metadata.
curl -X GET "https://synkk.space/api/v1/auth/verify" \
-H "Authorization: Bearer synkk_token123" \
-H "Accept: application/json"
Lists all vaults accessible to the authenticated device token.
Returns the full cryptographic manifest (paths, SHA-256 hashes, sizes, and timestamps) for the specified vault.
Returns incremental file additions, modifications, and deletions recorded since vault version {v}.
Uploads a single note or asset using base64 encoded content and SHA-256 validation.
{
"path": "Projects/Architecture.md",
"content": "IyBBcmNoaXRlY3R1cmUgU3BlY2lmaWNhdGlvbg==",
"hash": "f2a8c1d7e3b9a04f21e5c89731d4e28a9b6e5f1a2b3c4d5e6f7a8b9c0d1e2f3a",
"base_version": 77
}
Executes multiple uploads and deletions in a single atomic database transaction.
Performs an algorithmic 3-way line diff (LCS) between canonical base note, local changes, and incoming remote conflict copy, returning structured hunks.
Applies user-selected resolutions across diff hunks, updates canonical note version, creates audit log, and deletes the conflict copy.
Dispatches character-level CRDT insertion and deletion deltas to the note room, updating presence and returning peer operations.
Fetches and streams full binary payload for a lightweight ghost file stub on-demand, marking the file as active.
Enables zero-knowledge encryption for the vault with client-provided PBKDF2 salt and verification cipher token.
Mobile client completes QR pairing handshake by exchanging a temporary session ID for a persistent device token.
Lightweight heartbeat endpoint returning vault revision number, active collaborator count, and E2EE state for mobile background polling.
Graph-augmented agentic query synthesizing accurate answers from vault chunks, traversing [[wikilinks]] backlinks, and returning exact note citations.
Dense vector cosine similarity and sparse lexical search returning ranked note snippets and similarity percentages.
Incrementally indexes markdown notes into 128-dimensional hyperspheres with SHA-256 caching and deleted file cleanup.
Returns vector indexing status, chunk counts, indexed files, embedding provider, and active local LLM health.
HTTP Status Code Reference
- 200 OK: Request succeeded cleanly.
- 401 Unauthorized: Invalid or expired device token.
- 403 Forbidden: Token lacks required path permission.
- 409 Conflict: Version collision detected (conflict copy generated).
- 410 Gone / Revoked: Device token was remotely wiped by admin.
- 422 Unprocessable Entity: SHA-256 checksum mismatch or DLP secret detected.
07 / Docker & Self-Hosting Guide
Synkk is designed for zero-fuss self-hosting on any Linux VPS, Home Lab server, or Raspberry Pi.
The production-ready docker-compose.yml includes the Nginx edge proxy, PHP 8.4-FPM runtime, PostgreSQL database, and Redis cache.
curl -fsSL https://synkk.it/install.sh | bash
Docker Compose Architecture
version: '3.8'
services:
app:
image: ghcr.io/tawandajosephmutsena/synkk:latest
restart: unless-stopped
environment:
APP_ENV: production
APP_KEY: base64:...
DB_CONNECTION: pgsql
DB_HOST: postgres
REDIS_HOST: redis
volumes:
- synkk-storage:/var/www/html/storage/app/vaults
depends_on:
- postgres
- redis
postgres:
image: postgres:16-alpine
restart: unless-stopped
environment:
POSTGRES_DB: synkk
POSTGRES_USER: synkk
POSTGRES_PASSWORD: ${DB_PASSWORD}
volumes:
- pgdata:/var/lib/postgresql/data
redis:
image: redis:alpine
restart: unless-stopped
volumes:
- redisdata:/data
volumes:
synkk-storage:
pgdata:
redisdata:
Environment Variables Checklist
| Variable | Default | Description |
|---|---|---|
| APP_KEY | - | 32-char encryption key generated with php artisan key:generate |
| SYNKK_STORAGE_DISK | local | Vault blob storage driver: local or s3 |
| DLP_ENABLED | true | Prevents accidental pushes of API keys and AWS secrets |
| RATE_LIMIT_PER_MINUTE | 120 | API throttle ceiling per device token |
08 / Ecosystem Roadmap
Foundation Release
Local-first Markdown sync engine, SHA-256 manifests, Instant QR pairing, Safety Shield 10% guard, path permissions, and Docker deployment.
Safety, Collab & Transport
3-way diff sandbox, CRDT multiplayer editing, zero-knowledge E2EE (AES-256-GCM), on-demand ghost files, and 2-second QR pairing.
Agentic Knowledge & RAG
Self-hosted vector embeddings, hybrid semantic search, [[wikilink]] graph traversal, and private local LLM copilots querying your vault with zero cloud leakage.
Autonomous Note Agents & Canvas
Autonomous background research agents synthesizing new notes, periodic health audits, and visual Obsidian .canvas synthesis.