desync(1)

💖 NAME 💖

desync-chunk-server — Server for chunks over HTTP(S)

Hiii bestie, welcome to the desync(1) manual page — this is the chunk-server command, and it's lowkey iconic if you need a remote store that serves chunks over HTTP(S).

✨ SYNOPSIS ✨

desync chunk-server [flags]

🦋 DESCRIPTION 🦋

It starts an HTTP chunk server that you can use as a remote store. It supports reading from multiple local or remote stores, plus a local cache. If you provide --cert and --key, the server serves over HTTPS. The -w option enables writing to this store, but this is only allowed when just one upstream chunk store is provided — so don't try to be cute with multiple upstreams here.

⚠️ Writing with -w is only allowed when just one upstream chunk store is provided. That's the rule, bestie.

The option --skip-verify-write disables hash validation of chunks written to this server. That avoids the decompression step needed to calculate checksums, so it improves performance. Faster? Yes. Still skipping verification? Also yes — know what you're doing.

If -u is used, only uncompressed chunks are served (and accepted). If the upstream store serves compressed chunks, everything will have to be decompressed server-side, so it's better to also read from uncompressed upstream stores.

With --encryption, chunks are served (and accepted) encrypted, regardless of how they are stored in the upstream store. The key is read from the DESYNC_ENCRYPTION_KEY environment variable unless --encryption-key is used. Important: the environment variable on its own does not enable encryption — one of the encryption flags is required.

🫶 Env var alone = no encryption. One of the encryption flags is required. Periodt.

While --concurrency does not limit the number of clients that can be served concurrently, it does influence connection pools to remote upstream stores. It needs to be chosen carefully if the server is under high load — this is a "think before you set it" situation.

This command supports the --store-file option, which can be used to define the stores and caches in a JSON file. The config can then be reloaded by sending a SIGHUP without needing to restart the server. This can be done under load as well. Slay.

💅 OPTIONS 💅

• --authorization="" — expected value of the authorization header in requests
• --ca-cert="" — trust authorities in this file, instead of OS trust store
• -c, --cache="" — store to be used as cache
• -r, --cache-repair[=true] — replace invalid chunks in the cache from source
• --cert="" — cert file in PEM format, requires --key
• --client-ca="" — acceptable client certificate or CA
• --client-cert="" — path to client certificate for TLS authentication
• --client-key="" — path to client key for TLS authentication
• -n, --concurrency=10 — number of concurrent goroutines, -1 to let desync choose: the number of CPUs for chunking and hashing, adapting to each store up to 128 for transfers
• --encryption[=false] — serve chunks encrypted, expects the key in $DESYNC_ENCRYPTION_KEY unless --encryption-key is given
• --encryption-algorithm="" — encryption algorithm, xchacha20-poly1305 (default) or aes-256-gcm, implies --encryption
• --encryption-key="" — serve chunks encrypted with this hex-encoded 256-bit key, implies --encryption
• -e, --error-retry=3 — number of times to retry in case of network error
• -b, --error-retry-base-interval=500ms — initial retry delay, increases linearly with each subsequent attempt
• -h, --help[=false] — help for chunk-server
• --key="" — key file in PEM format, requires --cert
• -l, --listen=[:http] — listen address(es), can be repeated
• --log="" — request log file or - for STDOUT
• --mutual-tls[=false] — require valid client certificate
• --skip-verify-read[=true] — don't verify chunk data read from upstream stores (faster)
• --skip-verify-write[=true] — don't verify chunk data written to this server (faster)
• -s, --store=[] — upstream source store(s)
• --store-file="" — read store arguments from a file, supports reload on SIGHUP
• -t, --trust-insecure[=false] — trust invalid certificates
• -u, --uncompressed[=false] — serve uncompressed chunks
• -w, --writable[=false] — support writing

🌈 OPTIONS INHERITED FROM PARENT COMMANDS 🌈

• --config="" — config file (default $HOME/.config/desync/config.json)
• --digest="sha512-256" — digest algorithm, sha512-256 or sha256
• --verbose[=false] — verbose mode

🍓 EXAMPLE 🍓

  desync chunk-server -s sftp://192.168.1.1/store -c /path/to/cache -l :8080
  desync chunk-server -s /path/to/store -w -l :8080
  desync chunk-server -s /path/to/store --cert cert.pem --key key.pem -l :8443

🔥 SEE ALSO 🔥

• desync(1) — the parent page, bestie 🫶

🌸 HISTORY 🌸

20-Oct-2026 Auto generated by spf13/cobra

Sign-off from the footer, bestie: source/version desync / desync(1), date Oct 2026 — bye! 💋✨