Self-hosted LiveSync

Last reviewed Aug 26, 2026 · 854 words

Obsidian Sync costs about $4 a month on the annual plan at last check, which is the number to keep in view. Self-hosted LiveSync replaces it with one CouchDB container, a community plugin, and roughly an hour of one-time setup, and it is the only practical way to get an Obsidian vault syncing to an iPhone without paying Obsidian. Notes are encrypted end to end with a passphrase you choose, so the server sees chunks of ciphertext. If your vault only moves between two desktops, Syncthing is simpler and you can stop reading; LiveSync earns its 512 MB and its setup hour on mobile and on real-time merging of edits made on 2 devices at once.

CouchDB is the entire backend

The plugin talks directly to CouchDB's HTTP API; there is no LiveSync server process. What the container needs is a handful of settings the CouchDB defaults get wrong for this use:

services:
  couchdb:
    image: couchdb:3
    environment:
      COUCHDB_USER: obsidian
      COUCHDB_PASSWORD: change-me
    volumes:
      - ./data:/opt/couchdb/data
      - ./local.ini:/opt/couchdb/etc/local.d/local.ini
    ports:
      - "5984:5984"
    restart: unless-stopped

And local.ini, which is the part people miss:

[couchdb]
single_node = true
max_document_size = 50000000

[chttpd]
require_valid_user = true
max_http_request_size = 4294967296
enable_cors = true

[chttpd_auth]
require_valid_user = true
authentication_redirect = /_utils/session.html

[httpd]
WWW-Authenticate = Basic realm="couchdb"
enable_cors = true

[cors]
origins = app://obsidian.md, capacitor://localhost, http://localhost
credentials = true
headers = accept, authorization, content-type, origin, referer
methods = GET,PUT,POST,HEAD,DELETE
max_age = 3600

The CORS origins are the 3 schemes Obsidian's desktop and mobile apps use, and require_valid_user closes the database to anonymous access, which matters because a CouchDB with open admin has been the classic way to lose a vault to a crypto-mining script. single_node stops CouchDB waiting for a cluster that never arrives.

Phones need HTTPS, full stop

The iOS and Android apps refuse plain HTTP connections, so http://192.168.1.10:5984 works from a laptop and silently fails on a phone. Two clean fixes: put Caddy in front with a real certificate on a subdomain, or run everything over Tailscale and use its certificate feature for the tailnet hostname. I prefer the Tailscale route because the vault database is then reachable from nowhere on the public internet, and sync still runs whenever the phone has the VPN up, which for most people is always.

Setup on the first device, then a URI for the rest

Install "Self-hosted LiveSync" from community plugins, run its setup wizard, enter the CouchDB URL and credentials, and set an end-to-end encryption passphrase before the first sync; turning encryption on later means a full rebuild. Once the first device is happy, the plugin can generate a setup URI: an encrypted string containing all the connection settings that you paste into the plugin on every other device, so the phone setup is 30 seconds. On a second device with an existing copy of the vault, choose to fetch from remote rather than merging both ways, or you get duplicate conflict files for every note.

The sync mode named LiveSync is continuous, pushing keystrokes within seconds; periodic sync every few minutes uses far less battery on a phone and is what I run on mobile. Conflicts between simultaneous edits open a side-by-side diff in Obsidian instead of silently picking a winner, which is the feature Syncthing users miss most.

The database grows, and 2 things break it

CouchDB keeps every revision until compaction, so a vault of 50 MB of markdown can be a 1 GB database after a year. Run compaction from the plugin's maintenance section or with a POST to /obsidian/_compact every few months, and back up the data directory as an ordinary file copy, since the encrypted chunks are useless without your passphrase anyway.

The first thing that breaks installs is running Syncthing or a cloud-drive folder on the same vault at the same time; two sync engines fighting over .obsidian produces conflicts for weeks. Pick one. The second is large attachments: set the plugin's file size limit and keep PDFs and videos out of the vault, or in a folder the plugin ignores. Newer plugin versions also offer an S3-compatible bucket as the backend instead of CouchDB, which suits people who already run object storage, though CouchDB remains the well-trodden path.

What I'd do

CouchDB 3 in Docker with the local.ini above, on a box reachable only over Tailscale, with the tailnet certificate so phones connect. Encryption passphrase set on day 1 and stored in your password manager, LiveSync mode on desktops, periodic on the phone, compaction quarterly, and no other sync tool touching the vault. That gives you the Obsidian Sync experience, mobile included, for the cost of 512 MB on a machine you already run. The broader case for self-hosting notes at all is made in notes apps you own, and the honest trade-offs against Obsidian's own service are in the Obsidian alternatives page.