Sempere
Guide contents

Advanced

WebDAV and NAS setups

Which servers work, how a WebDAV server becomes a sync target in the app, what the CLI does, and setups that combine them.

WebDAV is a standard way to share files over HTTPS. Most NAS systems offer it, as do Nextcloud, Apache, nginx and rclone serve webdav. Sempere needs nothing special from the server: it lists folders, reads and writes files, and never relies on server-side code. Your server only ever stores encrypted files.

In the app

A WebDAV server is a sync target like a folder: each device syncs its own copy of the vault with it, both ways.

Sync through a sync target Sempere on the iPad and Sempere on the Mac each read and write a complete copy of the vault kept inside the app, which works offline. Each device syncs its copy both ways with the same sync target: a folder in iCloud Drive, another folder, or a WebDAV server. Every file that arrives is checked before it is placed. Sempere only adds new files with unique names, so the target never has two versions of a note file to choose between. iPadSempereMacSemperereads, writesMy Notes.sempereinside the app onthe iPad; offline tooMy Notes.sempereinside the app onthe Mac; offline tootwo-way syncSync targeta folder in iCloud Drive, another folder, or WebDAVNew, uniquely named files, each checked on arrival.
Each device works on its own complete copy, inside the app, and syncs it both ways with a sync target.

Put a vault on a server: open the vault, then Sync Targets… ▸ Add WebDAV Server…. The Server Folder URL must be an empty or new folder (the first sync creates it and uploads the vault), or one that already holds this vault. Add This Server.

Open a vault from a server on another device: Open from WebDAV… on the welcome screen, then Test Connection and the vault’s Download and Open. The server folder can be the vault’s folder or the folder above your vaults. If this device already has the vault, the server is added as one more target.

Both ask for:

  • Server Folder URL, which must be https:// (plain http only for a server on the same device), without a user name or password in it;
  • User Name and Password. The password is kept in this device’s Keychain only.

If the server uses a self-signed certificate, Test Connection shows its fingerprint in a red box. Compare it with the fingerprint your server shows, then Trust This Certificate…. From then on only that exact certificate is accepted; if it changes, sync stops until you trust the new one. Server Settings… (in the sync bar’s menu) changes the password or Stop Trusting This Certificate.

How it behaves:

  • A large vault opens in seconds on a new device: the list comes from the server’s encrypted note summaries, and the notes, then the attachments, download in the background. A note you open first is fetched on its own.
  • Offline, the vault works as usual; WebDAV targets wait and sync when the network is back. The bar says “Offline. Changes are kept on this device and sync when the server can be reached.”
  • Several devices can use the same server folder; their changes merge.
  • Every file that arrives is checked before it is placed; one that fails is kept aside, never placed (Details and Repair).
  • Remove from This Device… on the welcome screen, for a vault still downloading, deletes the copy, this device’s key for it and the saved password; the server is not changed. Remove in Sync Targets stops syncing with the server and deletes nothing there.

With the CLI

sempere sync webdav syncs a local vault folder two ways with a WebDAV folder:

export SEMPERE_WEBDAV_PASSWORD='…'       # or --password-env NAME; never on the command line
sempere webdav check https://nas.example.org/dav/ --user me      # test, and list vaults
sempere sync webdav https://nas.example.org/dav/notes.sempere/ \
  --vault ~/Notes.sempere --user me
sempere sync webdav … --push-only        # a one-way mirror
sempere sync webdav … --dry-run          # show what would change
Two-way sync with the CLI A local vault folder on a computer and a WebDAV share or another folder, connected by sempere sync webdav or sempere sync folder, which copies new files in both directions and checks each one before placing it. ~/Notes.semperea local vault on your computersempere sync webdavsempere sync folderWebDAV share or folderwhat is new on either side is copied
The CLI syncs two ways: what is new on either side is copied to the other.

Every file that comes down is checked before it is placed; one that fails goes to a quarantine folder. With the vault unlocked (this machine’s device key, once it has joined), the checks are complete, settings merge and deletions from compaction follow; without a key, the run copies new files and leaves the rest alone. It trusts the system’s certificate store only: for a self-signed server, add its certificate (or your own CA) to the system’s trust store.

The CLI can also keep vaults and their targets the way the app does, in a store folder:

sempere store import ~/Notes.sempere
sempere store target add Notes --webdav https://nas.example.org/dav/notes.sempere/ --user me
sempere store sync Notes

Setups that work

  • iPad and iPhone, a NAS. Add the NAS as a WebDAV target on the iPad, open it from WebDAV on the iPhone, and join. Both work offline and sync when they reach the NAS. Back up the NAS folder as you back up anything else.
  • iCloud Drive and a NAS. Give the vault both targets on one device, say the Mac. Your Apple devices sync through iCloud Drive, and the Mac carries every change to the NAS as well.
  • A Linux machine. Join it with sempere device init, then sempere sync webdav or sempere sync folder keeps a local copy current, for scripts and exports.
  • The web viewer on your NAS. Serve the viewer next to the vault’s folder. See The web viewer.

Step by step: A vault on a NAS over WebDAV.