Run your own sync server

You can sync MorphGate through a server you run, for free. The reference server is a single program with a SQLite database. It speaks the same vault-sync/v1 protocol as morphgate.com, and the app treats both the same way.

The reference server is open source under AGPL-3.0, in the server/ folder of the MorphGate repository. Like morphgate.com, it stores only ciphertext, wrapped keys, public keys and a slow hash of each account's password proof. It never sees a master password, a hostname or a private key.

Run it

With Rust installed, from a checkout of the repository:

cargo run --release -p vault-sync-server -- --listen 127.0.0.1:8443 --db /var/lib/vault-sync/db.sqlite3

Or with Docker, from the repository root:

docker build -f server/Dockerfile -t vault-sync-server .
docker run -d -p 127.0.0.1:8443:8443 -v vault-sync:/data vault-sync-server

Options

--listen (VAULT_SYNC_LISTEN)
Address and port to listen on. Default 127.0.0.1:8443.
--db (VAULT_SYNC_DB)
The SQLite database file. Default vault-sync.sqlite3.
--registration open|closed (VAULT_SYNC_REGISTRATION)
Whether new accounts can be created. Default open.
--blob-quota-mb (VAULT_SYNC_BLOB_QUOTA_MB)
Storage for attachments and session logs, per account's personal vaults and per team. Default 1024.
--public-url (VAULT_SYNC_PUBLIC_URL)
The server's public HTTPS address, needed for single sign-on and SCIM.

Put it behind HTTPS

The server speaks plain HTTP. Put it behind a TLS reverse proxy. With Caddy, for example:

sync.example.com {
    reverse_proxy 127.0.0.1:8443
}

The app warns if you enter a plain http:// address for anything but your own computer.

Close registration

Create your account first, then restart the server with --registration closed. On a closed server nobody can create an account, people you invite included, so let them create theirs before you close it, or open it again while they join.

Connect the app

  1. Open Sync in the sidebar and choose Your own server.
  2. Enter the address, for example https://sync.example.com, and choose Check. The app shows the server's version and whether it accepts new accounts.
  3. Enter your email and master password, and choose Enable sync.

On other devices, choose Your own server on the sign-in screen. See How sync works.

What it supports

  • Sync of your vault across devices, password change and recovery, the device list and signing devices out.
  • Teams: organizations, invites, shared vaults, access levels, key rotation, ownership transfer and the activity log, with CSV and JSON lines download.
  • Device approval, set from the team's policies in the app.
  • Attachments and session logs, stored in the database, up to 25 MiB each, with the team's session log retention.
  • OpenID Connect single sign-on and SCIM provisioning, set up from the command line (below).
  • The account data download.

There are no plans, trials or billing: everything it supports is available to every account.

What it doesn't do yet

  • Two-step verification and email verification.
  • Sending email. Creating an invite shows the invite code in the app, to pass on yourself.
  • Instant change notifications; apps check every minute.
  • SAML single sign-on.
  • Rate limiting and purging old deletion markers.

Single sign-on

Register <public URL>/sso/callback as the redirect URI with your OpenID Connect provider, then:

vault-sync-server sso --db /var/lib/vault-sync/db.sqlite3 --org "Acme Ops" --issuer https://login.example.com --client-id morphgate --client-secret … --require

--org takes the team's id or name. --session-hours (default 12) is how long a device's sign-in lasts. --remove removes it. The client secret is stored in the database as given, so protect the database. See Single sign-on.

SCIM provisioning

vault-sync-server scim --db /var/lib/vault-sync/db.sqlite3 --org "Acme Ops" --public-url https://sync.example.com

This prints a token once; running it again replaces it, and --revoke stops it. Give your identity provider the base URL <public URL>/scim/v2/<team id>, the token as a bearer token, and map userName to the email address. Because this server sends no email, a provisioned person can't join on their own: the invite shows in the team's invites in the app, and an admin invites the address again there to get a code to pass on. See SCIM provisioning.

Back up

Everything is in the database file, attachments and session logs included. Back it up like any SQLite database. It holds ciphertext, but also the hashes and single sign-on secrets above, so keep the backups private.

Moving between servers

To move from morphgate.com to your own server, or back:

  1. On one device, choose Disconnect this device in the Sync panel, then turn sync on again with the other server. Your personal vault uploads there in full.
  2. On each other device, the app can't merge its own vault into the account that now exists on the new server. Reset MorphGate there by deleting vault.sqlite3 (see Install and update), then choose Already use MorphGate sync? Sign in with the new server. Your vault downloads from it.

Your account on the old server stays until you delete it. Team vaults don't move by themselves: a team on the new server starts empty, and its items have to be created there again.

Check a server

The server's tests drive the real app code and run against any server address, so you can check that a server behaves before you trust it with your vault. See The open protocol.