0.4.3

vault-sync is a self-hosted replacement for Obsidian Sync. It has two parts: an Obsidian plugin, and a sync server that stores its data in PostgreSQL and S3. This release makes escrow safer. Escrow lets the admin's backup read an encrypted vault. Your devices now remember the escrow key of the server, and they show you its fingerprint. A fingerprint is a short code that identifies a key. If the escrow key changes without a signature from the old key, the plugin asks you before it uses the new key. The release also rewrites the documentation in plain English, with separate pages for users, admins and developers. It also fixes one sync defect with folder renames. To install it, use the server image ghcr.io/soliddowant/vault-sync:0.4.3 or the Helm chart oci://ghcr.io/soliddowant/charts/vault-sync (version 0.4.3). Install the plugin with BRAT from the GitHub releases of this repository. You can upgrade a 0.4.2 server one replica at a time. Upgrade the server before the plugin.

Upgrade notes for admins

• Remove config.export.escrow.signingKeysKey from your Helm values before you upgrade the chart. The chart no longer has this value, and the chart refuses to render when it is set. The escrow signing key must stay offline, not in a Secret on the cluster. Devices trust a new escrow key only when the old signing key signed the change, so a signing key on the cluster gives less protection. The chart now also refuses to render when a controller gets VAULT_SYNC_ESCROW_SIGNING_KEY_FILE or runs export rotate-escrow. Run a rotation from your own machine or as a one-off pod. The admin guide gives the commands for both. (#1419)
• Upgrade every server replica and the plugin on every device to 0.4.3 before you run export reset-escrow. A 0.4.2 server does not start on an escrow chain with a reset point. A 0.4.2 plugin cannot read the membership log of a vault after an owner accepts a reset. (#1442, #1454)
• The new migration 0029 adds one column to the escrow chain table and replaces one check on it. A 0.4.2 replica keeps working during the rollout.

Security

• The plugin shows the escrow fingerprint under the Escrow toggle when you create a vault, and in the Fingerprints line of the Sharing section of a vault with escrow. Your device remembers the escrow key that it saw first on the server, and shows the fingerprint of that key. Compare it with the fingerprint that your admin publishes before you turn on escrow. (#1429)
• Admins print the escrow fingerprint with the new command vault-sync-server escrow fingerprint. The command needs no database, no network and no private key. (#1420)
• If the escrow key changes and the old key did not sign the change, the plugin opens the window The server's escrow key changed. The window shows the previous and the new fingerprint. To accept, you type the last four characters of the new fingerprint. If you decline, escrow keeps the previous key and your notes keep syncing. You cannot create a vault with escrow until you accept. (#1433)
• When an owner accepts a new escrow key, the device of the owner moves each vault that the owner owns to the new key at its next sync. Other members see the notice "An owner of this vault accepted a new escrow key", with the name of the owner and both fingerprints. (#1456, #1454)
• Admins can start the escrow chain again from a new key with the new command vault-sync-server export reset-escrow. Use it only when you lost the old signing key, or when somebody stole it. Devices do not accept a reset on their own: each user must accept it in the plugin. (#1442)

Server and deployment

• The documentation has new pages for each reader. The user guide is in docs/user/, the admin guide is in docs/admin/, and the developer pages are in docs/dev/. The admin guide adds pages for install, backup and restore, encryption, history and retention, monitoring, security and troubleshooting, and a glossary. The metrics reference, the configuration reference and the chart values page are now made from the code, so they always match the release. The old pages, for example docs/deployment.md, now only link to the new pages. (#1424, #1425, #1426, #1427, #1431, #1436, #1448, #1451, #1452, #1453, #1455, #1459)
• The links to the alert runbooks in the chart's alerting rules point to the new page docs/admin/alerts.md. (#1424)
• SPEC.md is rewritten in plain English. No rule of sync, storage or encryption changed. (#1457, #1460, #1461, #1462, #1463, #1464, #1465)

Fixes

• A folder rename no longer leaves the old folder behind. Before, a device sometimes received the rename of a folder before the moves of the files in it. Then that device kept the old folder and sent it back to the server, so every device had both folders. Now the old folder goes away when its last file moves out. (#1443)

Internal work: CI checks the links in the documentation and checks that the generated reference pages are current, make lint reports every failure at once, an end-to-end test covers the escrow reset, the design pages were shortened, and the agent instructions were updated (#1421, #1422, #1428, #1432, #1435, #1437, #1441, #1444, #1445, #1446, #1447, #1449, #1450, #1458, #1459).

Known issues

• None known. No bug is open, and no item of this release was deferred.