Storage and sync

A vault is a folder of encrypted files. dotsafe never runs a sync server: you choose where the vault lives, and whatever stores it only ever sees ciphertext. Changes made on two Macs at once are merged, not overwritten.

A synced folder

The default is iCloud Drive/dotsafe. Any folder that syncs works: Google Drive, Dropbox, OneDrive, Syncthing.

dotsafe init --path ~/Dropbox/dotsafe

An S3-compatible bucket

Cloudflare R2, AWS S3, Backblaze B2 and MinIO all work. Each Mac keeps an encrypted copy, so dotsafe works offline and syncs when it's back online. The app syncs in the background, and dotsafe sync syncs now.

dotsafe init --bucket my-vaults --endpoint https://<account>.r2.cloudflarestorage.comdotsafe init --bucket my-vaults --endpoint https://s3.us-east-1.amazonaws.com --region us-east-1dotsafe sync                  # exchange changes now

The access key is kept in the macOS keychain, never in a config file. For CI, set DOTSAFE_S3_ACCESS_KEY_ID and DOTSAFE_S3_SECRET_ACCESS_KEY instead.

WebDAV

For Nextcloud, ownCloud or a NAS:

dotsafe init --webdav https://cloud.example.com/remote.php/dav/files/me/dotsafe/ --user me

The password is asked for and kept in the keychain, or read from DOTSAFE_WEBDAV_PASSWORD.

Backups

dotsafe backup --to ~/Backups/dotsafe

A backup is a dated, still-encrypted copy of the vault. The folder is remembered for next time, and the last 10 backups are kept.

Moving the vault

dotsafe move --path ~/Dropbox/dotsafedotsafe move --bucket my-vaults --endpoint https://<account>.r2.cloudflarestorage.com

The vault is copied and this Mac switches to it. The old copy stays until you delete it. Other Macs connect to the new location with dotsafe init.