Collaboration
Share an encrypted live Canvas.
HEAD a63778e| Read this page when | You need to explain or operate live Canvas collaboration. |
|---|---|
| First answer | Collaboration shares an encrypted room link; the room key stays in the URL fragment and is not sent to the relay. |
| Boundary | This page describes the user workflow; room transport and persistence implementation belong to the Collaboration domain. |
| Follow-up | Open Collaboration, start a room, and send the edit link; use the deployment section for environment-specific behavior. |
Open Collaboration, start a room, and send the edit link. Canvas content and presence are encrypted in each browser before reaching the CharDesk relay. The room key stays in the link fragment and is not sent to the server.
Someone with a local copy must be online when a new device joins. When the last participant leaves, the relay deletes the room; each participant keeps their own browser copy.
Deployment
Production uses the managed endpoint wss://sync.chardesk.com. Override it at
build time only when hosting a separate relay:
VITE_COLLABORATION_ENDPOINT=wss://sync.chardesk.com npm run build:appRun the relay locally with npm run dev:sync; application development defaults
to ws://127.0.0.1:1234. The production container is owned by
apps/sync-server/Dockerfile. apps/sync-server/deploy/compose.yaml keeps the relay on a
private Docker network and publishes it through a remotely managed Cloudflare
Tunnel. Configure ALLOWED_ORIGINS with the deployed CharDesk origins and keep
the tunnel token outside the repository.
The public hostname is the migration boundary. Keep sync.chardesk.com stable
when moving the relay from a VPS to another runtime.
Security boundary
The relay can see IP addresses, origins, room identifiers, connection timing, and encrypted frame sizes. It cannot decrypt Canvas content, selections, or presence. Anyone holding the complete edit link has the room key and can edit.