desync(1)

NAME
desync-chunk-server - Server for chunks over HTTP(S)

SYNOPSIS
desync chunk-server [flags]

DESCRIPTION
Starts an HTTP chunk server that can be used as remote store. It supports reading from multiple local or remote stores as well as a local cache. If --cert and --key are provided, the server will serve over HTTPS. The -w option enables writing to this store, but this is only allowed when just one upstream chunk store is provided. The option --skip-verify-write disables hash validation of chunks written to this server, avoiding the decompression step needed to calculate checksums, to improve performance. If -u is used, only uncompressed chunks are served (and accepted). If the upstream store serves compressed chunks, everything will have to be decompressed server-side so it's better to also read from uncompressed upstream stores. With --encryption, chunks are served (and accepted) encrypted, regardless of how they are stored in the upstream store. The key is read from the DESYNC_ENCRYPTION_KEY environment variable unless --encryption-key is used. The environment variable on its own does not enable encryption, one of the encryption flags is required.

While --concurrency does not limit the number of clients that can be served concurrently, it does influence connection pools to remote upstream stores and needs to be chosen carefully if the server is under high load.

This command supports the --store-file option which can be used to define the stores and caches in a JSON file. The config can then be reloaded by sending a SIGHUP without needing to restart the server. This can be done under load as well.

OPTIONS
--authorization=""
    expected value of the authorization header in requests

--ca-cert=""
    trust authorities in this file, instead of OS trust store

-c, --cache=""
    store to be used as cache

-r, --cache-repair[=true]
    replace invalid chunks in the cache from source

--cert=""
    cert file in PEM format, requires --key

--client-ca=""
    acceptable client certificate or CA

--client-cert=""
    path to client certificate for TLS authentication

--client-key=""
    path to client key for TLS authentication

-n, --concurrency=10
    number of concurrent goroutines

--encryption[=false]
    serve chunks encrypted, expects the key in $DESYNC_ENCRYPTION_KEY unless --encryption-key is given

--encryption-algorithm=""
    encryption algorithm, xchacha20-poly1305 (default) or aes-256-gcm, implies --encryption

--encryption-key=""
    serve chunks encrypted with this hex-encoded 256-bit key, implies --encryption

-e, --error-retry=3
    number of times to retry in case of network error

-b, --error-retry-base-interval=500ms
    initial retry delay, increases linearly with each subsequent attempt

-h, --help[=false]
    help for chunk-server

--key=""
    key file in PEM format, requires --cert

-l, --listen=[:http]
    listen address(es), can be repeated

--log=""
    request log file or - for STDOUT

--mutual-tls[=false]
    require valid client certificate

--skip-verify-read[=true]
    don't verify chunk data read from upstream stores (faster)

--skip-verify-write[=true]
    don't verify chunk data written to this server (faster)

-s, --store=[]
    upstream source store(s)

--store-file=""
    read store arguments from a file, supports reload on SIGHUP

-t, --trust-insecure[=false]
    trust invalid certificates

-u, --uncompressed[=false]
    serve uncompressed chunks

-w, --writable[=false]
    support writing

OPTIONS INHERITED FROM PARENT COMMANDS
--config=""
    config file (default $HOME/.config/desync/config.json)

--digest="sha512-256"
    digest algorithm, sha512-256 or sha256

--verbose[=false]
    verbose mode

EXAMPLE
      desync chunk-server -s sftp://192.168.1.1/store -c /path/to/cache -l :8080
      desync chunk-server -s /path/to/store -w -l :8080
      desync chunk-server -s /path/to/store --cert cert.pem --key key.pem -l :8443

SEE ALSO
desync(1)

HISTORY
5-Sep-2026 Auto generated by spf13/cobra