Sync servers

What tagwerk needs from a server

The built-in sync speaks plain WebDAV. It needs no app, plug-in or account on the server beyond a user that may read and write one folder. This chapter is for whoever runs that server; how to set up the sync in the app is in Sync.

Beyond the methods:

• Conditional writes. A new file is sent with If-None-Match: *, a changed one with If-Match and the ETag tagwerk last saw. A server that holds something else has to answer 412 Precondition Failed; tagwerk then compares with what is really there instead of overwriting it. A weak ETag (W/"...") is accepted for comparing; a write based on it goes out without a condition, because If-Match cannot match a weak tag. A PUT answered without an ETag is fine too: tagwerk asks for it with a PROPFIND.
• Basic authentication on every request, the credentials encoded as UTF-8. No cookies and no session: each request carries its own credentials, so one account's session can never stand in for another's. Servers that accept only other methods (NTLM, OAuth or OpenID Connect tokens) cannot be used.
• HTTPS. http:// works and is warned about, because Basic authentication sends the password readable to anybody on the way. Certificates have to be valid for the name in the address; tagwerk has no way to accept a self-signed one.
• Redirects. A redirect within the same scheme, host and port is followed with the credentials. One to another host or from http:// to https:// is followed without them, and the app then names the address it was sent to. From https:// to http:// is not followed at all.
• Status codes tagwerk acts on. 401 is a rejected sign-in, 403 on a PUT a read-only folder, 507 a full quota, 412 a version that changed in between. 5xx, timeouts and lost connections are retried three times before they are reported.

tagwerk uses the system's proxy settings. HTTP/2 is used where the server offers it, HTTP/1.1 otherwise.

Which address to enter

The wizard needs the address of the account's WebDAV root. For Nextcloud and ownCloud it finds that itself; for every other server, enter it in full.

An address without a scheme gets https://. Unless the address already names a WebDAV path, tagwerk asks three candidates with PROPFIND and Depth: 0: first the derived Nextcloud path remote.php/dav/files/USER/, then remote.php/webdav/ - the same files for whoever signed in, which is what a Nextcloud answers when the sign-in name is an email address rather than the user id - then the address as entered. The first that answers 207 Multi-Status is used - any other answer, 200 and 405 included, does not count. When neither answers 207, the strongest refusal is reported: a rejected password before a forbidden path before a server error.

The folder on the server

In step 2 of the wizard the user picks or creates a folder below the WebDAV root. Below it, the sync writes:

Tagwerk/
  2026/
    10/
      2026-10-28.md
  templates/
    template.md
    template-monday.md
  settings/
    tagwerk.colors
    tagwerk.license

Tagwerk/ stands for the chosen folder. Day notes are filed by year and month, whatever layout the notes folder on the device has. The connection test writes .tagwerk-connection-test.txt into the folder and deletes it again. Any other file in the folder is left alone; conflict copies stay on the device that made them and are never uploaded.

A day note is only ever replaced, never deleted. What the sync carries and by which rule is in Sync.

Notes on particular servers

Most WebDAV servers need nothing beyond an address, a name and a password. The notes below are the places where a server behaves differently from what its address suggests - learnt on real accounts, dated where it matters. A server that is not listed here is not a server that will not work.

Nextcloud

• Enter the plain server address; the WebDAV path is derived.
• The browser sign-in (Sign in through the browser (Nextcloud)) uses Nextcloud's Login Flow v2: the server issues an app password for tagwerk, which appears under Settings → Security → Devices & sessions and can be revoked there. Tested against a real Nextcloud in September 2026.
• With two-factor authentication on the account, the account password fails at Sign-in accepted. Use the browser sign-in or an app password.
• Nextcloud refuses Depth: infinity by default. tagwerk then lists the folders one by one: one request for the folder, one per year, one per month.
• On some installations writing is many times slower than reading. Server speed in the app shows reads and writes apart, with a text to hand to the hosting provider.
• An app password without access to the file system, or a rule of the "Files access control" app, lets the sign-in through and keeps it from every folder. The app says The sign-in works, but the server keeps it away from the files.
• After several wrong passwords Nextcloud's brute-force protection delays its answers and may answer 423. Wait before trying again.
• A shared folder appears only after the account has accepted the share, inside the folder that account files received shares into.

ownCloud

• ownCloud Server takes the same address as Nextcloud; the path is derived the same way.
• The browser sign-in is Nextcloud's. With ownCloud, enter the account password or an app password.
• ownCloud Infinite Scale and OpenCloud sign in through OpenID Connect and serve WebDAV under other paths. tagwerk signs in with Basic authentication only and has not been tested against them.

Synology

• Install the WebDAV Server package in DSM and enable HTTPS there; its default HTTPS port is 5006 (5005 for HTTP).
• Enter the address with the port, for example https://nas.example.org:5006.
• A NAS usually starts with a self-signed certificate, which tagwerk does not accept: the test stops at Connection and encryption. Give the NAS a certificate from a public authority, for example Let's Encrypt in DSM, and use exactly the name it was issued for - not the IP address.
• Not yet tested against a real DiskStation.

HiDrive

• Enter the WebDAV address your provider gives in its help pages.
• The top level is read-only: creating folders or files there answers 403. Your own folder is /users/USER/; in step 2 of the wizard open users, then your account, and create or pick the notes folder there.
• HiDrive answers 403 rather than 404 for every path it does not have. tagwerk tries the next candidate and tries to create a missing folder before it believes a 403.
• WebDAV is not part of every plan. At IONOS the basic plans include it; at STRATO the private plans get it only with the protocol package. Without it the test fails although address and password are right. Tested with an IONOS account in August 2026.

Hetzner Storage Box

• Every sub-account has a host of its own: https://u123456-sub1.your-storagebox.de, not the box's https://u123456.your-storagebox.de. At the box's own name a sub-account is rejected with 401, which looks exactly like a wrong password. The app recognises the case and names the right address.
• Enter https://. With http:// the box redirects to https://, the credentials are dropped on the way, and the app reports the redirect.
• The box is Apache with mod_dav, so everything in the next section applies. Tested in August and September 2026, including two devices on one folder.

Apache with mod_dav, and nginx

• Apache marks the ETag of a file weak (W/"...") during the second it was written and strong afterwards. tagwerk compares the two spellings as one version, so a note it has just uploaded is not downloaded again.
• The Allow header of an OPTIONS answer may leave out PUT and MKCOL although both work. tagwerk does not read it.
• Depth: infinity may be refused with 403; tagwerk lists folder by folder instead.
• nginx's own WebDAV module answers neither PROPFIND nor OPTIONS; it needs the dav-ext module as well. Not yet tested.

Other servers

Not yet tested, and the next on the list: magentaCLOUD (Nextcloud-based, with an app password), Infomaniak kDrive and Koofr. Any server that speaks WebDAV with Basic authentication over HTTPS should work; the checklist below says within minutes whether it does.

Troubleshooting

The connection test (Test connection, and every step of the wizard) stops at the first stage that fails and shows its message. Behind a system proxy the stages Server name resolves and Connection and encryption are passed without a check, because the proxy makes the connection; problems there show at Sign-in accepted.

A 401 at the wrong host cannot be told apart from a wrong password by the answer alone. Before checking the password a third time, check the address - the host above all.

A checklist for admins

The requests the app makes can be repeated with curl, which prompts for the password. Replace the address with the WebDAV root and USER with the account.

1. The WebDAV root answers with a DAV header:

   curl -i -u USER -X OPTIONS https://dav.example.org/remote.php/dav/files/USER/

2. The root and the notes folder list themselves with 207 Multi-Status:

   curl -i -u USER -X PROPFIND -H "Depth: 0" https://dav.example.org/remote.php/dav/files/USER/Tagwerk/

3. A file can be written and deleted; the PUT answers 200, 201 or 204:

   curl -i -u USER -T test.md https://dav.example.org/remote.php/dav/files/USER/Tagwerk/test.md
   curl -i -u USER -X DELETE https://dav.example.org/remote.php/dav/files/USER/Tagwerk/test.md

4. Conditional writes are honoured: the second of these two must answer 412.

   curl -i -u USER -T test.md -H "If-None-Match: *" https://dav.example.org/remote.php/dav/files/USER/Tagwerk/test.md
   curl -i -u USER -T test.md -H "If-None-Match: *" https://dav.example.org/remote.php/dav/files/USER/Tagwerk/test.md

5. On a 401, run the same request against the other names the server has, and add -v to see whether the answer comes from the host that was asked or from one it redirected to.

6. Delete the test files afterwards.

Do not repeat a failed sign-in in quick succession: Nextcloud and Storage Boxes count failed attempts and slow down or lock the account. In the app, Settings → Help → Server speed gives the timings of every request type as text for a support request.

The alternative: a folder of your own

Without the built-in sync, the server needs nothing from tagwerk. The notes lie in a folder on the device (Settings → Storage → Choose folder...), and a program of your choice carries that folder: Syncthing, or a client that keeps a local folder in two-way sync with a server. tagwerk reads the files that program writes; if it writes the day you are typing in, that version is kept beside it as a conflict copy.

Conflicts follow the rules of that program. tagwerk recognises the copies these programs write and lists them under Days that exist twice, beside its own:

Copies of templates are recognised the same way, for example template-monday.sync-conflict-20261028-101010-ABCDEFG.md. How to settle a conflict is in Sync.