The server behind sync in Donut Browser. It authenticates devices, gives each account its own part of one S3-compatible bucket, and signs short-lived URLs, so profile files go directly between each device and storage.

To run your own server, use the Docker image donutbrowser/donut-sync. The self-hosting guide has the compose file and every environment variable.

Build and run

cargo build --release
SYNC_TOKEN=... S3_ENDPOINT=... S3_ACCESS_KEY_ID=... S3_SECRET_ACCESS_KEY=... \
  S3_BUCKET=... ./target/release/donut-sync

.env.example lists the variables. A .env file in the working directory is also read.

With SYNC_AT_REST_KEY set, the server encrypts every object it stores. Downloads and uploads from current apps go through it, large files in parts. Older apps still upload straight to storage, and the server encrypts those files minutes later. Objects stored before stay readable; donut-sync migrate-at-rest --help encrypts them in place, and donut-sync verify-at-rest checks that none is left in plaintext.

Test

The end-to-end tests run the binary against the S3 server in docker-compose.yml:

docker compose -f docker-compose.yml up -d --wait
cargo test
docker compose -f docker-compose.yml down -v