Setting up OUIBO's extra features

Self-hosted sync server

OUIBO's sync server is a small, dependency-free PHP application — no framework, no Composer packages, no external services to configure. This first release handles device pairing; bookmark, history, and password-vault sync build on the same foundation as they ship.

Storage

Everything is stored in a single SQLite file, storage/sync.sqlite, created automatically on the server's first request. There's no separate database server to install or manage.

Project layout

public/index.php              Front controller — point your web server's document root here
src/Db.php                    Shared DB helper
src/Auth.php                  Shared auth helper
src/Response.php              Shared response helper
src/controllers/              One file per resource
bin/create-setup-secret.php   Run once after deploy — generates the code that pairs your first device
storage/                      Holds sync.sqlite — must be writable by the web server's PHP-FPM user

Deploying to a VPS or dedicated server

It needs very little in the way of resources — a small VPS is plenty. The exact steps depend on your hosting control panel, since nginx, PHP-FPM, and SSL conventions vary between providers; adapt this to whatever site-creation flow yours expects rather than hand-writing vhost files. The rough shape:

1. Create the subdomain site in your hosting control panel (or confirm it already exists from your DNS/subdomain setup).
2. Set the site's web root to this project's public/ directory, with the rest of the repo deployed alongside it — e.g. server/ next to server/public/.
3. Confirm the site's PHP-FPM pool has the pdo_sqlite and sqlite3 extensions enabled.
4. Confirm the Authorization header reaches PHP as $_SERVER['HTTP_AUTHORIZATION'] — some proxies and control panels strip it by default, and may need an explicit pass-through rule.
5. Issue an SSL certificate for your domain — most control panels have a one-click Let's Encrypt option.
6. Confirm it's live:

   curl https://your-domain.com/health
   → {"status":"ok",...}

7. Run the setup script once, on the server, to generate the code for pairing OUIBO's first device:

   php bin/create-setup-secret.php

Pairing a device

Adding a device to sync is a short two-sided handshake — a code from one device, entered into the other.

1. On a device that's already connected to sync, open the Sync panel and click Pair a new device. A short code appears with a 10-minute countdown.
2. On the new device you want to add, open its Sync panel and fill in the connect form: the Server URL (the same sync server the first device uses), the code you just generated in Setup key or pairing code, and optionally a Device name. Click Connect.
3. The new device is now paired — it shows up in the device list on every other connected device, each with a "last seen" time and a way to revoke it later if needed. The code is single-use and expires after 10 minutes, so a fresh one is needed for each device you add.

Password vault sync

The vault syncs separately from everything else, unlocked with its own passphrase rather than your device password or any saved login.

1. In the Sync panel (once connected), find the Vault sync section and enter a Sync passphrase — a separate secret you choose yourself. Click Unlock.
2. Enter that exact same passphrase on every other device you want your saved passwords to sync across — they all need to match, since it's what derives the shared encryption key.
3. Click Sync now as usual — once unlocked, passwords sync alongside bookmarks, history, and tabs automatically.

Note: this passphrase is never transmitted anywhere and isn't stored on disk — it's only kept in memory while the app is open, so it needs entering again after a restart. If it's ever forgotten, synced passwords can't be recovered — though local passwords on each device are completely unaffected either way.

Safe Browsing

OUIBO checks pages against Google's Safe Browsing list before it lets you land on them. It needs an API key from a Google Cloud project of your own — free, and a few minutes to set up.

1. Open the Google Cloud Console and create a new project, or pick an existing one.
2. Go to APIs & Services → Library, search for Safe Browsing API, and enable it.
3. Go to APIs & Services → Credentials → Create Credentials → API key.
4. Restrict the key: under API restrictions, limit it to the Safe Browsing API only, so it's harmless if it ever leaks.
5. Make sure billing is enabled on the project — Safe Browsing has a generous free quota, but Google won't respond to requests from a project without an active billing account attached.
6. Copy the key, then click the Protect icon in the address bar — the same panel the ad blocker lives in — and paste it into Safe Browsing, then switch it on.

Note: this isn't a per-visit call to Google. OUIBO downloads Google's list of unsafe-site signatures and checks each page you visit against that local copy — no URL, page, or browsing detail is ever sent to Google or anyone else.

Microsoft Teams

The docked sidebar signs in through a Microsoft Entra app registration of your own, so chat, people search, and presence run under permissions your organization controls.

Register the app

1. In the Microsoft Entra admin center, go to Identity → Applications → App registrations, then New registration.
2. Give it a name (e.g. "OUIBO Teams Sidebar"), choose the account type for your organization, and set the redirect URI shown on OUIBO's Teams setup screen.
3. Under API permissions, add these delegated Microsoft Graph permissions: Chat.Read, ChatMessage.Send, People.Read, Presence.Read, User.Read.
4. Click Grant admin consent for your organization — presence and chat won't work for anyone else until this is done.

Connect it to OUIBO

1. On the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID.
2. In OUIBO, open the Teams panel with Ctrl+Shift+T and paste both values into its setup fields.
3. Sign in when prompted — chat, people search, and presence go live in the sidebar.