Virtual Calzone Relay for Obsidian

Live collaboration and web publishing for Obsidian vaults, served by our own relay: shared folders, real-time cursors, CRDT documents, and a published web view — with no vendor account and no data leaving our infrastructure.

Endpoint	URL
Control plane	obsidian-cp.virtualcalz.one
CRDT relay	obsidian-relay.virtualcalz.one
Plugin id	evc-team-relay

What syncs

Content	How
Markdown (.md)	CRDT document — concurrent edits merge
Canvas (.canvas)	CRDT document, when the canvas toggle is on
Bases (.base)	whole-file sync (last writer wins — it does not merge), when Other files is on for that share
Images, audio, video, PDF	attachments, per-type toggles
Everything else	Other files, per share

Install

macOS and Linux (bash, curl, python3):

U=https://git.psn.virtualcalz.one/virtualcalzone/evc-team-relay-plugin/raw/branch/main/scripts/update-plugin.sh
curl -fsSL "$U" | bash -s -- --check            # show what is installed; writes nothing
curl -fsSL "$U" | bash -s -- --install --all    # install/update every registered vault
# one vault only:  … | bash -s -- --install --vault ~/Documents/Work

Windows (PowerShell):

$u = 'https://git.psn.virtualcalz.one/virtualcalzone/evc-team-relay-plugin/raw/branch/main/scripts/update-plugin.ps1'
irm $u -OutFile update-plugin.ps1
powershell -ExecutionPolicy Bypass -File .\update-plugin.ps1 -Check
powershell -ExecutionPolicy Bypass -File .\update-plugin.ps1 -Install -All
# one vault only:  .\update-plugin.ps1 -Install -Vault C:\Users\me\Obsidian\Work

--install needs a target on purpose: with several vaults registered, an implicit install would guess where to write. --all covers every registered vault, --vault <path> one of them.

Then enable it in Obsidian: Settings → Community plugins → turn Restricted Mode off → enable Virtual Calzone Relay.

A fresh vault does not bind any share on its own — a share is only connected once its folder exists in the vault. To create the folders and update the plugin in one step:

# one share path per line in the file; '#' starts a comment
curl -fsSL https://git.psn.virtualcalz.one/virtualcalzone/evc-team-relay-plugin/raw/branch/main/scripts/setup-vault.sh \
  | bash -s -- --vault ~/Documents/Work --shares-file ~/relay-shares.txt

On Windows: setup-vault.ps1 -Vault C:\Users\me\Obsidian\Work -Shares 'Personal,RatPG'.

Sign in to the relay once per vault. The token is kept in the vault's local storage by design, so it is never written to the repository or to this plugin's folder.

Update, pin, roll back

Goal	Command
Update (vaults that already have the plugin)	... | bash -s
Install into every registered vault	... | bash -s -- --install --all
Install into one vault	... | bash -s -- --install --vault <path>
Pin a release	... | bash -s -- --ref <tag>
Undo the last update	... | bash -s -- --rollback
Update while Obsidian is running	add --force

Without --ref the updater installs the newest published release and prints which one. PowerShell spellings are -All, -Vault, -Ref, -Rollback, -Force.

Every run reports the installed version and the bundle's sha256 before and after, and keeps a per-vault backup it can roll back to.

Troubleshooting

What you see	What it usually is
A share shows no files and never moves	Its folder does not exist in the vault yet — run setup-vault.sh (or create the folder), then sign in
An update reports success but Obsidian still shows the old version	Obsidian was running during the write (use --force), or the plugin is disabled in Restricted Mode
.base or other non-note files do not appear on another device	Other files is off for that share — it is a per-share toggle
A file is stuck as a sync conflict	Command palette → Team Relay: Show sync conflicts → take the server or the local version
--check cannot reach the relay	Check that obsidian-cp.virtualcalz.one resolves and that your clock is correct (the relay tokens are short-lived)

Security

Shares are private by default: only their members can read them, the relay refuses anonymous API callers, writes always require a signed-in account, and every relay token is issued only after a share-membership check. Publishing a share to the web, or changing its visibility, is an explicit action with an explicit warning.

Fetching this plugin proves nothing about access: the bundle and its updater are public, while using the relay needs an account that a maintainer has admitted to the relay, and then membership of the specific share. Report vulnerabilities privately — see SECURITY.md.

This is a fork

Virtual Calzone's fork of Team Relay. What we changed, what upstream offers that we do not, and how to merge a future upstream snapshot: FORK.md. Upstream's hosted service, documentation and support channels do not apply here — this plugin talks only to our relay, and the updater refuses a bundle that references the vendor control plane.

Licence

Upstream's licence is retained. See LICENSE and FORK.md for attribution.