cassiozen / notesd

notesd 
 Self-hosted notes 
 Single-binary, lightweight server (you can drop onto a Raspberry Pi or a cheap VPS). 
 Native mobile apps that works fully
offline and syncs your notes whenever a connection is available. 
## Features
- **Full-text Search** across titles and bodies.
- **Organize with tags.** Add tags like `#work` and `#reading` anyewhere in your note. The sidebar lists all your tags, so you can browse by topic. Tags can be nested with `/` (`#home/garden`).
- **Spaces.** Create new spaces to keep separate contexts apart.
- **Locked notes.** You can secure notes with end-to-end encryption (AES-256-GCM). The server only stores ciphertext. Unlock with a password, a passkey (web) or biometrics (Android and iOS). 
 See Security for more details.
- **Markdown under the hood.** Notes are stored as Markdown, and you can take them out at any time. 
 See Your data for more details.
## Get started
1. **Host the server.** Run it with Docker (`ghcr.io/cassiozen/notesd`) or download the single binary for your machine. See docs/hosting.md.
2. **Create your account.** Open the server in a browser and create your
 account. Do this before exposing it to the internet; see
 docs/hosting.md.
3. **Install the Android app.** Download the APK from
 Releases and connect it to
 your server. See docs/android.md.
## Your data
All data is stored in SQLite, with WAL mode and FTS5. Everything runs in-process, with no database server to manage.
Notes are stored as Markdown, but using a database instead of individual files gives us fast queries, indexed full-text search, and reliable transactions.
You can export notes as individual markdown files with:
 [code] 
Locked notes are left out unless you add `--include-locked`. The command only reads the
database, so it's safe to run while the server is up.
## Security
Regular notes are stored unencrypted. Use disk encryption if that
matters to you, and HTTPS for anything reachable from the internet.
(The Android app won't send your password over plain HTTP outside your local network.)
**Locked notes** have their body and images encrypted. Be aware that:
- The server still sees the titles, and locked notes can't be searched by their text or emailed.
- **Text from before locking.** When you lock a note, the server scrubs the
 previous text from its database. Backups made earlier still hold it.
- **Images.** A locked note's images are encrypted too. Their plain copies
 from before locking, like images you remove from any note, stay on the
 server for 30 days after the last note showing them stops, then they're
 deleted. A copy another note still shows stays.
- **Forgotten passwords.** If you forget the lock password and have no
 passkey or fingerprint set up, those notes can't be recovered.
The full threat model is in
docs/architecture.md §10.1.
## How it's built
| Part | Stack |
| --- | --- |
| Server | Go, `net/http`, SQLite with WAL and FTS5 |
| Web | React, TypeScript, Tiptap/ProseMirror, Vite; embedded in the server binar