End-to-end encryption between multiple Obsidian applications/profiles on different devices on a shared LAN.

[dazinger]

Little side tidbit: I want to add that the way DANGER_HttpHost is implemented right now, the "Started non-localhost HTTP server at port" message does not appear. That is due to the AND condition implemented for the message logic. (Needless to say, there isn't a proper setting for turning off localhost-only in Obsidian, and you have to alter the typescript manually to allow it.)

If you set it to your LAN IP, most firewalls/routers will ban access to the port due to its obscure port number. I learned this when I used to host DOOM servers in my hay-day. That said, it's always good to add redundancy by blocking the port from anywhere but LAN.

Ideally, of course, what would be best is to do all that with end-to-end encryption. Hence, the title of this discussion! :)

Albeit, having Obsidian open is mandatory for this to work, and I suppose if I were to run end-to-end encryption, I would want it between Obsidian programs on two separate devices with separate profiles. I run around my apartment with a few old laptops that are terribly inefficient due to HDD's, low RAM capacity, low-end CPUs, etc. So, having a stripped-down version of Obsidian on those devices means I can rely on Omnisearch to run the searches on my more decent host computer.

With the current version of Omnisearch, I run a simple PowerShell script on my laptop to extract and parse the JSON data without issue. I typically pair this with the LAN functionality of Html Server (currently version 1.0.8), which allows me to put any one note on my laptop. Typically, it's a page full of quiz flashcards, stripped of plugins, and read-only. Very simple but very effective! In the end, all I'm really doing is using these tools to write notes down by hand, but if Omnisearch were able to run a client-server setup between two Obsidian programs on LAN, I would be able to stop taking hand-written notes and just put them on my laptop.

And yes, I know this was intended for third-party plugins, so it's unorthodox for me to use it wily-nilly with PowrShell. I suppose I am a bit too old-fashioned, so I am open to ideas or suggestions. However, I would also be open to assisting with this feature. I am new to the FOSS community, and I think it would be a fine first feature issue to work on.

[scambier]

I want to add that the way DANGER_HttpHost is implemented right now, the "Started non-localhost HTTP server at port" message does not appear.

It works, but you have to close Obsidian, change the setting value, and re-open Obsidian. Otherwise the setting change isn't read or is overwritten.

And yes, I know this was intended for third-party plugins

Actually, the HTTP server was specifically intended to be used by 3rd-party tools, so you're using it right 😄 I developed this feature solely to inject Omnisearch results into web search engines. Other Obsidian plugins can rely on Omnisearch through a direct API without using the HTTP server.

---

So, if I understand well, what you're asking would be a client-server connection between 2 Obsidian instances? Like, you're making an Omnisearch request on "Client Obsidian", the request is forwarded to "Server Obsidian", which answers back?

In that case, it would probably be simpler and cleaner to develop your own plugin that mimics Omnisearch's UI, but just queries the HTTP server, than implement it into Omnisearch.

[dazinger]

The TamperMonkey idea looks fantastic and easy to use. In fact, it would be much easier than me fiddling around with PowerShell!

I forgot you can supply an empty IP address to get it to run as a LAN server. I was tinkering with the idea in dnsmasq as a DHCP server, so I know it works. I just literally put my current LAN address in it instead, so I suspect that is why it acted differently. Albeit, null != 0, so would that be the single change you'd have to do, correct?

Making my own plugin could make implementing it much cleaner and far less bloated, but I also wonder if some users would want Omnisearch to fill in search information bidirectionally. If that is the case, then having the necessary libraries to traverse through Obsidian already exists in Omnisearch, so I think in that situation it would be counterintuitive to run the feature outside of Omnisearch, but I could be wrong about that. Unidirectionally, it would be very easy to do as a separate plugin.

Omnisearch could provide an API key for the server. Wouldn't that be the bare minimum for end-to-end encryption to function securely?

[scambier]

So, there are actually 2 points to this discussion.

1) Allowing Omnisearch to be a thin client that queries another Omnisearch instance on a network

That would require to develop and maintain a whole new flow for what is, in my opinion, a super niche use-case. I understand your need, but I won't implement that in Omnisearch, nor will I accept a PR for that, sorry.

If that is the case, then having the necessary libraries to traverse through Obsidian already exists in Omnisearch

There's nothing really specific. Besides the UI, it's basically the same HTTP query you're already doing, and a call to Obsidian's API to open the selected file. If you look at the TamperMonkey script, it opens the note directly with an obsidian:// URI call.

All the tools are at your disposal to (relatively) easily hack your own workflow, or even develop a simple plugin 👍

2) The security implications and e2e encryption

The DANGER_HttpHost setting is named like that and is undocumented because of the security implications, and I, as Omnisearch's owner and main developer, don't want to be responsible of your notes' security. If you open that door, you're on your own. I don't plan to develop any security measures like an API key or built-in encryption.

If you need to query Omnisearch outside of your local network, solutions like Tailscale are secure (from what I understand) and easy to setup.

---

I hope this answers your questions :)