Run, move and restore the server

Run a serverCopy Anchor Link

Use the Docker setup or let laptop setup install a login service. To run it in the foreground:

envden serve --data-dir /path/to/data

The server listens on localhost behind tailscale serve. Its first-start output includes a setup token. Devices use the token's fingerprint to pin the server key before creating a vault. Store files on your devices keep working if the server goes offline.

Moving the serverCopy Anchor Link

Start the destination server and read its setup token. From an existing member device, run:

envden server move https://new-envden.your-tailnet.ts.net

Enter the destination setup token and master password when prompted. You can pass the token with --setup-token <token>.

The move freezes the old server, copies and verifies the vault, registers your password on the destination, and records a signed move. The old server becomes read-only. Success prints Move complete.

Resume an interrupted move or abort before the final switch:

envden server move --resume
envden server move --abort

A member device can resume a move if the device that started it is lost. Devices follow the signed move on sync and won't accept the old server again.

If the old server is unreachable, point a device at the destination:

envden server switch https://new-envden.your-tailnet.ts.net

switch verifies the signed move before saving the address. It prints Server switched. It doesn't authorize an arbitrary replacement server.

BackupsCopy Anchor Link

Back up the server data volume. It contains ciphertext and the server's password record. Someone with that record can test password guesses offline, so protect the backup like a password database. A password guess alone doesn't decrypt the recovery envelope; it also needs the recovery secret key.

Keep device checkpoint state separate from store backups. Rolling back a device's checkpoints would remove its record of accepted history.

The server retains every file version for 90 days and at least 20 versions per file. Deletion records survive pruning.

Restore a backupCopy Anchor Link

Stop the normal server before starting the restored data. Run restored mode once by hand:

envden serve --data-dir /path/to/restored-data --restored

It prints a repair token for each vault and accepts repair operations only. With the Docker image, arguments after the image name are passed to envden serve.

Don't add --restored to a service definition. Running it again creates new tokens and invalidates reports uploaded with the old ones.

On each member device, run:

envden server repair

Enter the repair token. The device uploads its signed history and cached ciphertext for the repos it uses. Success prints Repair material uploaded. You can also pass --repair-token <token>.

When every device has uploaded, finish from one device:

envden server repair --finish

Enter the repair token and master password. The finishing device verifies the signed reports itself. It stops if a member hasn't repaired or if the newest version of a file is unavailable.

Drop an unavailable deviceCopy Anchor Link

envden server repair --finish --without old-laptop

You can list several names or IDs after --without. Dropped devices keep their local files and must rejoin as new devices.

Accept a missing file versionCopy Anchor Link

envden server repair --finish --accept-lost

This accepts the newest verified older version, or marks the file lost if none is available. Every device reports the loss. Review the named files before accepting it.