Collaboration

Open Collaboration, start a room, and send the edit link. Canvas content and presence are encrypted in each browser before reaching the CharDesk relay. The room key stays in the link fragment and is not sent to the server.

Someone with a local copy must be online when a new device joins. When the last participant leaves, the relay deletes the room; each participant keeps their own browser copy.

Deployment

Production uses the managed endpoint wss://sync.chardesk.com. Override it at build time only when hosting a separate relay:

VITE_COLLABORATION_ENDPOINT=wss://sync.chardesk.com npm run build:app

Run the relay locally with npm run dev:sync; application development defaults to ws://127.0.0.1:1234. The production container is owned by apps/sync-server/Dockerfile. apps/sync-server/deploy/compose.yaml keeps the relay on a private Docker network and publishes it through a remotely managed Cloudflare Tunnel. Configure ALLOWED_ORIGINS with the deployed CharDesk origins and keep the tunnel token outside the repository.

The public hostname is the migration boundary. Keep sync.chardesk.com stable when moving the relay from a VPS to another runtime.

Security boundary

The relay can see IP addresses, origins, room identifiers, connection timing, and encrypted frame sizes. It cannot decrypt Canvas content, selections, or presence. Anyone holding the complete edit link has the room key and can edit.