Syncstorage-rs

Syncstorage-rs is the open source sync storage server maintained by Mozilla Services. It holds the data the Firefox web browser synchronises between a person's devices: bookmarks, browsing history, open tabs, saved logins, add-ons and preferences. Point Firefox at this instance and that data lives on infrastructure you control instead of a hosted service.

Your sync data is encrypted by the browser before it leaves the device. Firefox derives an encryption key from the account passphrase, encrypts every record locally and uploads only ciphertext. The key is never sent to any server. This server therefore holds ciphertext only and cannot read a saved login or a browsing history, and neither can anyone who gains access to it. That is equally true of the hosted service. What self hosting changes is who holds the encrypted copy: with this image, you do, in a region you choose, under your own retention and backup policy. That makes it a practical answer to data residency requirements as well as a privacy preference.

Sign in still uses a Mozilla account. Identity and storage are deliberately separate concerns: the browser authenticates against the hosted accounts service and this server verifies that token before allocating storage. Only the storage moves to your instance. The account server never sees the password or the sync encryption key, so it cannot read what this server holds either. There is no separate account to create here and no administrative console to sign in to.

No shared secret ships in the image. Every client of a sync server authenticates with a token derived from one master secret, so a secret baked into a published image would let anyone who deployed it mint valid tokens against every other deployment. This image ships that secret empty and mints a unique one, along with the metrics hash secret and the database password, on your instance before the service is allowed to start. The application and the database are both bound to the loopback interface, reached only through the web front end.

Proof it works, without a browser. A built in self test mints its own token from the instance's master secret, writes a record, reads it back and compares the payload byte for byte, so an operator can confirm the whole storage path end to end at any time. A browsable API explorer ships alongside it, pointed at your own instance.

Syncstorage-rs is distributed under the Mozilla Public License 2.0, free and open source with no per deployment fee; the licence text ships in the image. cloudimg provides packaging, the secure by default configuration, per instance secret automation, security patching, and 24/7 support with a guaranteed 24 hour response SLA. Firefox is a trademark of the Mozilla Foundation in the U.S. and other countries. cloudimg is not affiliated with or endorsed by the Mozilla Foundation.