Your notes, plain files, on the web and in your pocket.

Mnemos opens a folder of text files - for example the vault you already use in Obsidian - in your browser and on your Android phone. Write markdown with a live preview, edit CSV as a real table, search everything from one box, and settle Syncthing conflicts side by side. Nothing is locked in: every note stays an ordinary file.

Just curious? The sign-in page has a read-only demo with a sample vault - type, tick and preview freely; nothing is saved.

---
status: open
tags: [garden, home]
---
# Balcony garden

Basil and mint by the window;
chillies need **more sun**.

- [x] Repot the mint
- [ ] Order coco peat

git clone https://gitlab.com/niharokz/mnemos.git
cd mnemos/android
./build.sh keystore   # once: creates the signing key
./build.sh            # → dist/mnemos-<version>.apk
./build.sh install    # optional: adb install over USB

What it is not

Mnemos is an editor for your files, not an Obsidian clone. On purpose, it has no:

• wikilinks, backlinks, graph view, embeds or callouts - use Obsidian for those, on the same files;
• sync of its own - pair it with Syncthing, git or whatever already moves your notes;
• plugins, accounts for other people, or a database.

Markdown it shows

Raw HTML inside notes is not rendered, so a note can never run code in your browser.

Host the web app

You need a Linux box with Docker, your notes in a folder on it, and a reverse proxy that serves HTTPS (Caddy, Traefik, nginx, or a Cloudflare tunnel).

1. Get the code

   git clone https://gitlab.com/niharokz/mnemos.git
   cd mnemos
   cp .env.example .env

2. Set your login

   Build the image, then create a password hash and a secret key and paste both into .env (the hash in single quotes):

   docker compose build
   read -rs PW && printf '%s' "$PW" | docker run --rm -i mnemos:local hash-password
   openssl rand -hex 32        # → MNEMOS_SECRET

   Also set MNEMOS_USER, NOTE_PATH (your notes folder), TZ, PUID/PGID (from id -u / id -g) and MNEMOS_NETWORK (the Docker network your proxy is on).

3. Check and start

   docker compose run --rm mnemos check   # settings + any note or folder it could not write
   docker compose up -d
   docker logs mnemos                     # "mnemos … listening on :8080"

   If check lists folders owned by another user (often root, created by another container), give them back to you: sudo chown -R "$(id -u):$(id -g)" /path/to/notes.

4. Put it behind HTTPS

   notes.example.com {
       reverse_proxy mnemos:8080
   }

   Open the site, sign in, then use your browser's Install / Add to Home Screen.

5. Update later

   git pull && docker compose up -d --build

No Docker? With Go 1.23+: go build ./cmd/mnemos, then MNEMOS_NOTES=~/notes MNEMOS_PASSWORD=… ./mnemos serves http://localhost:8080. Coming from Samanote? Your SAMANOTE_* settings keep working; rename them when convenient.

Configure

Keyboard

On a Mac, ⌘ works instead of Ctrl.

Security

• Passwords can be stored as bcrypt hashes; every sign-in check takes the same time whether the user exists or not.
• The demo user is read-only on the server, not just in the page: every change it sends is refused, and it sees only its own sample vault.
• HMAC-signed, HttpOnly, Secure, SameSite cookie (__Host- prefixed). Changing a password or the secret signs that account out everywhere.
• Five wrong passwords lock that IP out for 15 minutes; the real client IP is read safely behind Cloudflare and proxies.
• Every change must be a same-origin JSON request with a custom header - cross-site forms and requests are refused.
• Paths are locked inside your notes folder: no .., no symlinks pointing out, hidden folders stay hidden.
• Strict Content-Security-Policy, HSTS, no framing, no third-party scripts, fonts or analytics. Files served raw are sandboxed.
• Runs as your user in an empty, read-only container with no capabilities; it can only write to your notes folder.