Sync

Sync

This page covers keeping the same sessions on every PC through a private git repository of your own: what travels, how it is encrypted, and what happens when two PCs changed the same item.

What syncs

Folders and their folder settings, sessions, macros, SSH tunnels, Proxmox servers, WireGuard networks, credential sources (their names, servers, accounts and options, never their secrets), browser profiles (their names, colours and notification choice, never their cookies), pinned sites, workspaces, container templates and the assistant's memory. The repository keeps the history of every change.

What never syncs

Passwords, private keys and token secrets: the logins kept on this PC, the Proxmox token secret, WireGuard private and preshared keys, the access token for the repository itself, and what a credential source keeps on this PC (vault keys, sign-in tokens) or hands out. They stay in your credential sources or encrypted on each PC. The assistant's AI hosts, trusted servers and the assistant's log also stay on the PC, and so do the cookies and logins of web tabs and where pass-cli is for a Proton Pass source.

Setting it up

Settings, Sync:

1. Git server: Gitea or Forgejo, GitHub, GitLab, or Find out from the address. For any other git server choose Any other git repository (uses git on this PC): Cablebag then uses the git program and the sign-in it already has (Git Credential Manager or an SSH key), and the repository has to exist.
2. Server address (for example https://gitea.example.com or https://github.com) and Repository as owner/cablebag-sessions. Cablebag creates it as a private repository when it does not exist. For plain git, give the Repository address instead.
3. Access token with read and write on repositories (GitHub: a fine-grained token with Contents; GitLab: the api scope): From a credential source (password = token), or Type it here, kept encrypted on this PC.
4. Encryption of the files in the repository, see below.
5. Sync by itself: when Cablebag starts, a few seconds after a change, and every five minutes, or sync by hand.
6. Save and sync now. Open the repository opens it in your browser.

Do the same on each PC, with the same repository and the same encryption choice.

Encryption

• Encrypted with a key from your vault: the key is derived from your Vaultwarden or Bitwarden account, so it is the same on every PC that unlocks that vault. The key never leaves Cablebag and the vault server does not know it. A Vaultwarden source has to be set up first; with more than one, The vault whose key it is (choose the same one on every PC) picks which.
• Encrypted with a passphrase: type the same passphrase (at least 8 characters) on every PC. Without it nobody can read the files, you neither, so keep it in the vault.
• Not encrypted: anyone who can read the repository sees your hosts, user names and folders.

With encryption, each item is encrypted on its own (AES-256-GCM); only random item ids stay readable, so the history still shows when something changed but not what.

Conflicts

A sync merges the repository with this PC's data against the state of the last sync, so a deletion on one PC carries over and changes on two PCs combine. When the same item changed on two PCs since the last sync, Settings, Sync lists it under the result of the last sync: the kind of item, its name and whose version was kept. Change the item again if the other one was right.

The last sync's time and outcome are shown on the page.