From Google Drive to Syncthing over Tailscale

My password manager is KeePass-based. I use KeePassXC on my laptop and KeePassium on my iPhone and iPad. Both open the same .kdbx file. The file is a single encrypted binary, written as a whole on every change and protected with a physical security key. I edit it on any device, sometimes offline. That’s the worst case for any sync tool.

In my original setting, Google Drive was the proxy between my laptop and my phone. I bought the KeePassium premium tier for its Google Drive integration. The setup was dead easy, and it worked. However, now and then, the copy on my iPhone stopped following the one on my laptop. The likely culprit is how KeePassXC saves: it writes a temporary file, deletes the original, and renames the temporary file to the original name. Google Drive tracks files by identifier, not by name, so the renamed file is new. KeePassium kept pointing to the deleted one. Either I accepted a stale database, or I pointed KeePassium to the new file. Re-adding a database means unlocking it from scratch, and mine is protected by the physical security key. Fetching the key every few weeks got old. I had to find a solution.

Drive also keeps every version of the file on Google’s servers. For documents I edit with other people, it’s a feature. For a file I’m the only one to edit, it’s a history of my password database that lives on Google’s servers. The underlying issue is not Google Drive per se.

For the record, moving away from Google also benefits my privacy.

Syncthing is a peer-to-peer file synchronization tool. Each device runs its own instance and has a unique identifier. You pair devices by exchanging identifiers. You then share folders with specific devices, one folder at a time. No server owns the data: every device holds a full copy of the folders it subscribes to. Nodes can be both send and receive, or receive only.

Syncthing works out of the box on the public Internet. To do that, it relies on infrastructure run by the Syncthing project: global discovery servers, where each device announces its current IP address, and relay servers, which forward encrypted traffic when two devices can’t reach each other directly. Traffic is encrypted end-to-end in both cases. Still, a third party knows my devices' addresses, and my encrypted traffic may go through its relays.

I already have a private network between all my devices, thanks to Tailscale. I described the setup in a previous post. Every device has a stable name and address on the mesh, wherever it is. With Tailscale, Syncthing needs neither discovery servers nor relays. I can switch them off and address the devices by name.

I’m fully aware that Tailscale is a third party too. Its coordination servers distribute the devices' public keys and know which device connects to which, and from where, though they never see the traffic.

However, Tailscale clients are Open Source, and Headscale is a self-hosted implementation of the coordination server that the official macOS, iOS, and Synology clients can log into. If I ever want out, I can move my four devices in an afternoon. It’s a real exit, albeit not a completely free one: every device gets a new key, a new address, and a new name, and relayed traffic still goes through Tailscale’s servers unless I run my own. For now, convenience wins.

The topology is a star. The NAS is always on, so every other device pairs with it only. The laptop, the iPhone, and the iPad never talk to each other. It makes the configuration simpler, at the cost of a single point of failure. I’ll get back to it. The NAS has no special role in the protocol. It’s the hub only because it never sleeps.

The following assumes Tailscale already runs on every device and that MagicDNS is enabled, so that each device has a name of the form <device>.<tailnet>.ts.net.

The setup has trade-offs, however.

Four devices, no server, and a file written as a whole on every change: conflicts are possible. If I edit the database on the phone while offline, then on the laptop, Syncthing keeps both and renames one .sync-conflict-*. KeePassXC can merge two databases, so recovery is a matter of minutes. It didn’t happen to me yet, but I know I’m covered in case.

Because of the iOS background restriction, the phone copy can lag. I need to open Sync Anything before KeePassium when I know I changed a password. It’s a habit, not a solution.

Also, the star topology means that when the NAS is down, nothing syncs. The laptop and phone each keep their last copy and carry on. It’s acceptable for me, since the NAS is the most reliable device in the house. Pairing the laptop directly with the phone would remove the issue, but Sync Anything’s free tier allows a single remote device.

Finally, I don’t run a database backup. It exists on four devices, but four copies that stay identical aren’t a backup: a deletion or a corrupted save would propagate to all four within seconds. That’s why the NAS keeps old versions. It covers potentially bad edits. The NAS itself isn’t backed up; if it dies, three current copies survive, but the history goes with it. I accept that. RAID 5 covers a dead disk, and the history is a convenience, not a necessity.

My password database forced me to question where my files live. The answer is on my machines, and only there. Syncthing does the synchronization, and Tailscale gives it a private network with stable names. I’m happy to move away from Google Drive, even if for one file.

Bit by bit, step by step. The next ones are files that I read often but don’t write often, and archive files.