Peer sync

Peer sync lets the devices of one user exchange changes directly. An edit on your laptop can reach your other laptop on the same network while the server is down. When the server is back, it gets all changes.

How it works

• Each peer has a static key. Your devices register their public keys at the server. The server gives each device the list of your peers.
• The devices talk over one UDP port with an encrypted channel (QUIC with TLS 1.3). A device accepts only peers that are in its list, and the list pins their keys.
• The port stays silent to strangers. A packet without a valid tag gets no answer.
• Devices find each other on the local network with beacons. Across networks, the server helps them to open a path (hole punching). This works for most home networks. It is best effort.
• If no direct path works and the server is reachable, the devices sync through the server as usual. There is no relay.
• Peers compare what they have and exchange only the missing changes. They also exchange the signed checkpoints of E2E folders, which helps to find a server that shows two devices different histories.

Which devices are peers

A device is a peer if you signed in with the master password, or with a device-code session that has write or full control access. A read-only session is not a peer. A scoped key is not a peer. A session with a folder scope only receives the changes of that scope.

See the state

lasbolt peer status

Peer sync:        running
This device key:  2B2F CF82 483C A319
Socket:           [::]:61851
Public address:   127.0.0.1:61851
Key registered:   yes
Server events:    yes
Settings:         networks any, beacons on, port auto, pinned peers off
Unsettled ops:    0
Waiting groups:   0
Peers: none

lasbolt peer list shows the peers with their key fingerprints. Each peer has a path: lan, direct or none.

Settings of a device

Pinned peers

The server vouches for the list of peers. A bad server could add a false peer. A false peer gets no secret that the server cannot get already, and it cannot sign E2E changes. If you want more, turn on pinned peers:

lasbolt peer set pinned on
lasbolt peer list
lasbolt peer confirm <device>

With pinned peers on, a device uses a new peer key only after you confirm its fingerprint on a device that is already a peer. Compare the fingerprint in lasbolt peer list on both devices.

For the operator

The server has these flags. See Configuration.

A device that the server removed stays a peer of a device that has not reached the server since then, until the list ends. Remove a lost device and give your devices time to reach the server.