OpenVireo Sync Server

A small REST server that stores OpenVireo databases so several devices can stay in sync. It runs on your own machine or server (self-hosted, with a token per device), or as the storage behind OpenVireo accounts (hosted, with access tokens from the account server).

The server only ever sees the encrypted .kdbx file. OpenVireo downloads it, decrypts and merges it locally, then uploads the merged result. Your master password and keys never leave the client.

The client side lives in OpenVireo (src/gui/remote/), the web app and the SDK. OpenVireo is a fork of KeePassXC; this server is not part of or endorsed by the KeePassXC project.

How sync works

1. A device downloads the server’s copy with GET, together with its ETag (the SHA-256 of the file).
2. It merges that copy into its local database (the same merge as Merge from Database) and saves locally.
3. It uploads the result with If-Match: "<etag>". If another device uploaded in the meantime, the server answers 412 and the device starts again at step 1, so two devices can never overwrite each other.
4. The server keeps the previous versions, and tells every other connected device about the new one over a server-sent events stream, so they sync right away instead of waiting for their next poll.

The server never parses the database beyond checking its file signature. It can’t read entries or merge anything itself.

Quick start

The server is written in C++17 on Drogon.

brew install drogon sqlite     # or: apt install libdrogon-dev libsqlite3-dev, vcpkg install drogon sqlite3, …
cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build
./build/openvireo-sync-server users add alice laptop   # prints laptop's access token, shown only once
./build/openvireo-sync-server                          # http://127.0.0.1:8787

Or with Docker, see Installing and deploying.

Then in OpenVireo:

1. Open your database and go to Database → Database Settings → Remote Sync.
2. Enter a name, set Type to OpenVireo Sync Server, and fill in:
   • Server URL: http://127.0.0.1:8787, or your https:// URL
   • Database ID: any name, e.g. personal
   • Access token: the token printed for this device. It is kept on this device only (in the Keychain on macOS, the Credential Manager on Windows, the desktop keyring on Linux), not in the database
3. Click Test Connection, then Save, then OK.
4. Use Database → Remote Sync → <name> to sync.

The first sync uploads your local database. Later syncs download the server copy, merge it with your local database, save it locally, and upload the result. Other devices use the same Database ID; see Users and devices for adding them.

Contents

• Installing and deploying: from source, Docker and GHCR images, DigitalOcean, HTTPS
• Configuration: every SYNC_* variable, and the two storage backends
• Users and devices: the command line, pairing, revoking a lost device
• Accounts and vaults: running the server behind an OpenVireo account server
• HTTP API: routes, concurrency, history, events, CORS and errors, with the OpenAPI description
• Operations: backups, upgrades, scaling, monitoring
• Development: building, tests, releases

License

See LICENSE.

The Sync Server docs cover OpenVireo Sync Server, develop (0d4f752), last updated 26 October 2026. Found a mistake? Edit this page on GitHub.