Goal
End-to-end encrypted notes sync for Obsidian: keep the sync plane dumb storage so the operator's vault never leaves the client in plaintext, on the twin's own Cloudflare account.
Build
- Deploy of hjinco/synch (MIT) on Workers: encrypted blobs on R2, accounts and sync metadata on D1, realtime via Durable Object [s14].
- Signup locked to the operator email [s14].
- Generic OIDC SSO: admin API (/admin/v1/auth/sso, ADMIN_TOKEN bearer) saving provider config to app_config, conditional sign-in button, env fallback (SSO_* vars) [s44].
Verification
- OIDC SSO verified against the public test IdP demo.duendesoftware.com [s44].
- synch.khursani.dev serves 200; the s56 audit first caught the root at 404 before the paired lane restored it.