vitapavlik/keepass-server
Watch
1
0
Fork
You've already forked keepass-server
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
File server for Keepass client written in Flask
21 commits 1 branch 0 tags 48 KiB
  • Python 98.8%
  • Shell 1.2%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Vít Pavlík 0d9b56d799
 update for Keepass2Android 1.15-r3 
it changed the webdav mechanism and it didn't work anymore with this server. it started PUTting /passwords-personal.tmp.31562347.kdbx instead of /passwords-personal.kdbx.tmp.31562347, got HTTP 404, but the app reported success anyway, even though nothing was synchronized. this commit fixes that
2026-09-18 09:06:21 +02:00
.gitignore
backup.py
config.py
gunicorn-config.py
kpserver-template.service
main.py update for Keepass2Android 1.15-r3 2026-09-18 09:06:21 +02:00
README.md update for Keepass2Android 1.15-r3 2026-09-18 09:06:21 +02:00
requirements.txt
start.sh
sync.py
wsgi.py

README.md

HTTP server for a keepass database

This server is a simple file server for one file (the keepass password database).

Keepass 2.59 windows client saves the database over HTTP(S) like this:

GET    /passwords-personal.kdbx HTTP/1.1" 200 -
PUT    /passwords-personal.kdbx.tmp HTTP/1.1" 200 -
GET    /passwords-personal.kdbx HTTP/1.1" 200 -
DELETE /passwords-personal.kdbx HTTP/1.1" 200 -
MOVE   /passwords-personal.kdbx.tmp HTTP/1.1" 200 -
GET    /passwords-personal.kdbx HTTP/1.1" 200 -

On the other hand, Keepass2Android 1.15-r3 does:

GET      /passwords-personal.kdbx              HTTP/1.0" 200 -
PUT      /passwords-personal.tmp.12533843.kdbx HTTP/1.0" 200 -
PROPFIND /passwords-personal.kdbx              HTTP/1.0" 405 -
DELETE   /passwords-personal.kdbx              HTTP/1.0" 200 -
MOVE     /passwords-personal.tmp.12533843.kdbx HTTP/1.0" 200 -

PROPFIND is currently not supported, but K2A client doesn't seem to mind.

This server works for both Keepass windows client and Keepass2Android.

Note

The MOVE method is part of WebDAV (HTTP extension for file management). It includes a Location header that specifies the destionation to move to.

This server is made to fulfill these requests made by a Keepass client but nothing more. Any unexpeced filenames/paths, methods, or functional WebDAV headers result in an error.

Features

There are callbacks for

  • backing up the database before overwriting
  • synchronization with external location (like rclone-mounted google drive location)

Deployment

  • Adjust the filenames and locations in config.py.
  • Start the server by running start.sh.
    • You're going to need Python3.12 or newer with packages flask and gunicorn.
  • Configure reverse proxy with nginx or a web server of your choice.

Caution

When exposing this server to the internet, make sure to setup a reverse proxy to protect the access with HTTP Auth (nginx auth_basic directive) and TLS (certbot)!

When is this useful?

Imagine you're unable to install google drive software to your company laptop. This is where it's beneficial to have the database accessible by HTTPS (with authentication, of course - this is within Keepass capabilities). On your server, the database can be synchronized back to google drive with rclone.