Skip to content
Synkk — Obsidian everywhere

Technical Reference & Setup Guide

v1.1 Foundation Release Obsidian Plugin v1.0.0

Mastering Synkk. Step by step.

Complete documentation for setting up local-first Obsidian sync, configuring path permissions, deploying with Docker, utilizing the REST API, and relying on Safety Shield.

01 / Quickstart Guide

Synkk is a local-first, self-hostable sync server and Markdown workspace for Obsidian. Follow these steps to connect your first vault and device in under 2 minutes.

1

Create a Team & Vault

Log in to your Synkk web workspace. Navigate to Vaults and click Create Vault. Name your vault (for example, engineering-brain) and select your default access policy (Read-Write, Read-Only, or Restricted).

2

Generate a Scoped Device Token

Go to Devices & Tokens in your dashboard. Click Add Device Token, assign a label representing your physical hardware (e.g., MacBook Pro M3 or Work iPhone 15), and generate the secure key. The key will start with synkk_....

💡

Security Best Practice

Always issue a unique token per device. If a device is ever lost or stolen, you can revoke its individual token from the dashboard without affecting your other devices.

3

Install the Obsidian Plugin

Download the latest release bundle (main.js, manifest.json, and styles.css) from the official GitHub releases page. Copy these three files into your vault's plugin directory:

Directory Structure
<your-vault>/.obsidian/plugins/synkk-sync/
├── manifest.json
├── main.js
└── styles.css
4

Pair & Synchronize

Open Obsidian → Settings → Community Plugins → Enable Synkk Team Vault Sync. Open the plugin settings panel. You can connect automatically using Instant QR Quick Connect or enter your Server URL and Device Token manually.

02 / Plugin Installation & Setup

Synkk works across macOS, Windows, Linux, iOS, and Android. Because your vault remains standard Markdown files on disk, your files are never held hostage.

Desktop Setup (macOS, Windows, Linux)

On desktop operating systems, Obsidian stores vault configurations inside the hidden .obsidian folder inside your vault root. Simply ensure community plugins are enabled in Obsidian preferences before copying the plugin files.

Instant QR Pairing (Mobile & Tablets)

Typing long API tokens on mobile touchscreens is prone to typos. Synkk simplifies mobile setup with Instant QR Quick Connect.

  1. In your Synkk web dashboard, navigate to Devices & Tokens.
  2. Click Generate Mobile QR Code next to your device entry.
  3. In Obsidian Mobile on iOS or Android, open Synkk settings and tap Scan Pairing QR Code.
  4. Your server URL and token will automatically populate and test connection instantly.
ℹ️

Mobile Background Execution Note

iOS and Android aggressively suspend background network tasks when apps are minimized. Synkk performs an automatic sync pulse whenever Obsidian is launched or brought to the foreground, plus periodic sync checks while active.

03 / Core Architecture & Storage Engine

Synkk is built on a local-first foundation. Your notes are stored as plain UTF-8 Markdown text files both on your local file system and on the server.

Storage Directory Layout

On the server side (Laravel 12 + SQLite WAL), files are organized by tenant, team, and vault:

Server Storage Hierarchy
storage/app/private/
└── vaults/
    └── {team_id}/
        └── {vault_slug}/
            ├── 00-Inbox/
            │   └── QuickNote.md
            ├── Projects/
            │   └── ArchitectureSpec.md
            └── .synkk/
                └── snapshots/

Cryptographic SHA-256 Manifests

Every sync operation begins by comparing cryptographic state. When a device requests a sync, Synkk generates or evaluates a vault Manifest: a JSON mapping of every file path, its SHA-256 content checksum, file size in bytes, and last modification timestamp.

Example Manifest JSON Payload
{
  "vault": "engineering-brain",
  "revision": 78,
  "files": {
    "Projects/Roadmap.md": {
      "hash": "f2a8c1d7e3b9a04f21e5c89731d4e28a9b6e5f1a2b3c4d5e6f7a8b9c0d1e2f3a",
      "size": 4210,
      "mtime": 1725712400
    }
  }
}

Conflict Engine & Revision Control

If two devices modify the exact same note while offline and later attempt to sync, Synkk detects the revision mismatch using the client's base version header.

  • Base Match: The edit is written as the new canonical file version.
  • Stale Revision: The incoming upload is automatically preserved as a sibling conflict file: Note.sync-conflict-[timestamp].md.
🛡️

No Lost Edits

Synkk never silently overwrites concurrent edits. Both notes remain available in your vault so you can review differences and merge manually.

04 / Roles & Granular Path Permissions

Unlike traditional sync solutions that require all-or-nothing access to an entire vault, Synkk allows team leaders to enforce path-scoped boundary rules.

Member Roles & Capabilities

Role Read Files Upload / Edit Manage Members & Tokens
Admin ✓ Full Access ✓ Full Access ✓ Full Access
Editor ✓ Allowed ✓ Allowed ✗ Denied
Reader ✓ Allowed ✗ Denied (Pulls only) ✗ Denied

Granular Path-Based Access Rules

Path rules use glob syntax to define access per member or per device group:

Example Path Rule Configuration
/finance/*          -> Admin Only (Hidden from general team)
/management/hr/*    -> Admin Only (Hidden)
/engineering/*      -> Editor (Team can read & edit)
/handbook/*         -> Reader (Team can read, Admins edit)
🔒

Zero-Leak Architecture

When a device requests a vault manifest, the Synkk server filters out hidden paths before sending the JSON response. Untrusted devices cannot even discover the file names of restricted subdirectories.

Data Loss Prevention (DLP) & Secret Scanning

Accidental commits of API keys or credentials can compromise entire organizations. Synkk includes an active DLP scanner that intercepts note uploads containing credentials.

Scanned secret patterns include:

  • AWS Access & Secret Keys (AKIA...)
  • OpenAI & Anthropic API Keys (sk-...)
  • Private SSH / RSA Keys (-----BEGIN RSA PRIVATE KEY-----)
  • JSON Web Tokens (JWT) & Database Connection Strings

05 / Safety Shield & Data Loss Protection

Catastrophic data loss during sync usually happens when a script or device accidentally deletes hundreds of files and syncs that mass deletion across all devices.

The 10% Mass-Deletion Guard

Synkk introduces Safety Shield. If an incoming sync transaction attempts to delete more than 10% of the total notes in a vault, the server automatically halts the operation and places the transaction on hold.

⚠️

Action Required on Deletion Guard Trigger

An administrator receives an immediate notification in the Synkk dashboard. The deletion remains blocked until manually authorized with a one-time override or rejected.

Pre-Mutation Snapshots & Rollback Engine

Before any file is modified or soft-deleted on the server, Synkk creates a local snapshot copy. You can review complete version histories and restore any file version with a single click.

06 / REST API Reference

Base API Endpoint: https://www.synkk.space/api/v1

All API requests require a valid Bearer token header: Authorization: Bearer synkk_....

GET /auth/verify

Verifies device token authenticity and returns user, team, and device metadata.

curl example
curl -X GET "https://www.synkk.space/api/v1/auth/verify" \
  -H "Authorization: Bearer synkk_token123" \
  -H "Accept: application/json"
GET /vaults

Lists all vaults accessible to the authenticated device token.

GET /vaults/{slug}/manifest

Returns the full cryptographic manifest (paths, SHA-256 hashes, sizes, and timestamps) for the specified vault.

GET /vaults/{slug}/changes?since_version={v}

Returns incremental file additions, modifications, and deletions recorded since vault version {v}.

POST /vaults/{slug}/upload

Uploads a single note or asset using base64 encoded content and SHA-256 validation.

JSON Request Payload
{
  "path": "Projects/Architecture.md",
  "content": "IyBBcmNoaXRlY3R1cmUgU3BlY2lmaWNhdGlvbg==",
  "hash": "f2a8c1d7e3b9a04f21e5c89731d4e28a9b6e5f1a2b3c4d5e6f7a8b9c0d1e2f3a",
  "base_version": 77
}
POST /vaults/{slug}/batch-sync

Executes multiple uploads and deletions in a single atomic database transaction.

POST /vaults/{slug}/conflicts/diff

Performs an algorithmic 3-way line diff (LCS) between canonical base note, local changes, and incoming remote conflict copy, returning structured hunks.

POST /vaults/{slug}/conflicts/resolve

Applies user-selected resolutions across diff hunks, updates canonical note version, creates audit log, and deletes the conflict copy.

POST /vaults/{slug}/collab/sync

Dispatches character-level CRDT insertion and deletion deltas to the note room, updating presence and returning peer operations.

POST /vaults/{slug}/files/hydrate

Fetches and streams full binary payload for a lightweight ghost file stub on-demand, marking the file as active.

POST /vaults/{slug}/e2ee/enable

Enables zero-knowledge encryption for the vault with client-provided PBKDF2 salt and verification cipher token.

POST /pairing/exchange

Mobile client completes QR pairing handshake by exchanging a temporary session ID for a persistent device token.

GET /vaults/{slug}/transport/status

Lightweight heartbeat endpoint returning vault revision number, active collaborator count, and E2EE state for mobile background polling.

POST /vaults/{slug}/rag/query

Graph-augmented agentic query synthesizing accurate answers from vault chunks, traversing [[wikilinks]] backlinks, and returning exact note citations.

POST /vaults/{slug}/rag/search

Dense vector cosine similarity and sparse lexical search returning ranked note snippets and similarity percentages.

POST /vaults/{slug}/rag/index

Incrementally indexes markdown notes into 128-dimensional hyperspheres with SHA-256 caching and deleted file cleanup.

GET /vaults/{slug}/rag/status

Returns vector indexing status, chunk counts, indexed files, embedding provider, and active local LLM health.

HTTP Status Code Reference

  • 200 OK: Request succeeded cleanly.
  • 401 Unauthorized: Invalid or expired device token.
  • 403 Forbidden: Token lacks required path permission.
  • 409 Conflict: Version collision detected (conflict copy generated).
  • 410 Gone / Revoked: Device token was remotely wiped by admin.
  • 422 Unprocessable Entity: SHA-256 checksum mismatch or DLP secret detected.

07 / Docker & Self-Hosting Guide

Synkk is designed for zero-fuss self-hosting on any Linux VPS, Home Lab server, or Raspberry Pi.

The production-ready docker-compose.yml includes the Nginx edge proxy, PHP 8.4-FPM runtime, PostgreSQL database, and Redis cache.

1-Line Quick Deploy
curl -fsSL https://synkk.it/install.sh | bash

Docker Compose Architecture

docker-compose.yml
version: '3.8'

services:
  app:
    image: ghcr.io/tawandajosephmutsena/synkk:latest
    restart: unless-stopped
    environment:
      APP_ENV: production
      APP_KEY: base64:...
      DB_CONNECTION: pgsql
      DB_HOST: postgres
      REDIS_HOST: redis
    volumes:
      - synkk-storage:/var/www/html/storage/app/vaults
    depends_on:
      - postgres
      - redis

  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: synkk
      POSTGRES_USER: synkk
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - pgdata:/var/lib/postgresql/data

  redis:
    image: redis:alpine
    restart: unless-stopped
    volumes:
      - redisdata:/data

volumes:
  synkk-storage:
  pgdata:
  redisdata:

Environment Variables Checklist

Variable Default Description
APP_KEY - 32-char encryption key generated with php artisan key:generate
SYNKK_STORAGE_DISK local Vault blob storage driver: local or s3
DLP_ENABLED true Prevents accidental pushes of API keys and AWS secrets
RATE_LIMIT_PER_MINUTE 120 API throttle ceiling per device token

08 / Ecosystem Roadmap

Phase 1 · Live

Foundation Release

Local-first Markdown sync engine, SHA-256 manifests, Instant QR pairing, Safety Shield 10% guard, path permissions, and Docker deployment.

Phase 2 · Live

Safety, Collab & Transport

3-way diff sandbox, CRDT multiplayer editing, zero-knowledge E2EE (AES-256-GCM), on-demand ghost files, and 2-second QR pairing.

Phase 3 · Live

Agentic Knowledge & RAG

Self-hosted vector embeddings, hybrid semantic search, [[wikilink]] graph traversal, and private local LLM copilots querying your vault with zero cloud leakage.

Phase 4 · Next Up

Autonomous Note Agents & Canvas

Autonomous background research agents synthesizing new notes, periodic health audits, and visual Obsidian .canvas synthesis.