The server behind sync in Donut Browser. It authenticates devices, gives each account its own part of one S3-compatible bucket, and signs short-lived URLs, so profile files go directly between each device and storage.

To run your own server, use the Docker image donutbrowser/donut-sync. The self-hosting guide has the compose file and every environment variable.

Build and run

cargo build --release
SYNC_TOKEN=... S3_ENDPOINT=... S3_ACCESS_KEY_ID=... S3_SECRET_ACCESS_KEY=... \
  S3_BUCKET=... ./target/release/donut-sync

.env.example lists the variables. A .env file in the working directory is also read.

With SYNC_AT_REST_KEY set, the server encrypts every object it stores, and transfers go through it instead of straight to storage. Objects stored before stay readable; donut-sync migrate-at-rest --help encrypts them in place.

Test

The end-to-end tests run the binary against the S3 server in docker-compose.yml:

docker compose -f docker-compose.yml up -d --wait
cargo test
docker compose -f docker-compose.yml down -v