Is TLS required for a local-only server on my RasPi5?

[LorenAmelang]

I apologize if I'm missing something obvious here, but I can't get this to work.

I want to set up a Trilium sync server on my local RasPi5.
Linux raspberrypi 6.12.87+rpt-rpi-2712 #1 SMP PREEMPT Debian 1:6.12.87-1+rpt1~bookworm (2026-05-12) aarch64

I tried:
Recommended: Docker Installation - Available for AMD64 and ARM architectures.

I think it is installed:

Details

pi@raspberrypi:~/builds/trilium $ ls -al total 13148 drwxr-xr-x 9 pi pi 4096 Jun 11 18:31 . drwxr-xr-x 6 pi pi 4096 Jun 11 18:28 .. drwxr-xr-x 8 pi pi 4096 Jun 11 18:31 assets -rw-r--r-- 1 pi pi 17062 May 13 12:56 ckeditor5-content.css -rw-r--r-- 1 pi pi 296027 May 13 12:56 docker_healthcheck.cjs -rw-r--r-- 1 pi pi 11796331 May 13 12:56 main.cjs -rw-r--r-- 1 pi pi 1305312 May 13 12:56 meta.json drwxr-xr-x 6 pi pi 4096 Jun 11 18:31 node drwxr-xr-x 11 pi pi 4096 Jun 11 18:31 node_modules drwxr-xr-x 4 pi pi 4096 Jun 11 18:31 pdfjs-viewer drwxr-xr-x 8 pi pi 4096 Jun 11 18:31 public drwxr-xr-x 4 pi pi 4096 Jun 11 18:31 share-theme drwxr-xr-x 8 pi pi 4096 Jun 11 18:30 TriliumNotes-Server-0.103.0-linux-arm64 -rwxr-xr-x 1 pi pi 40 May 13 12:56 trilium.sh pi@raspberrypi:~/builds/trilium $

pi@raspberrypi:/builds/trilium $ cat trilium.sh
#!/bin/sh
exec ./node/bin/node main.cjs
pi@raspberrypi:/builds/trilium $

pi@raspberrypi:/builds/trilium $ ls -al public
total 80
drwxr-xr-x 8 pi pi 4096 Jun 11 18:31 .
drwxr-xr-x 9 pi pi 4096 Jun 11 18:31 ..
drwxr-xr-x 2 pi pi 4096 Jun 11 18:31 assets
drwxr-xr-x 3 pi pi 4096 Jun 11 18:31 fonts
-rw-r--r-- 1 pi pi 1594 May 13 12:56 index.html
drwxr-xr-x 3 pi pi 4096 Jun 11 18:31 node_modules
drwxr-xr-x 2 pi pi 49152 Jun 11 18:31 src
drwxr-xr-x 3 pi pi 4096 Jun 11 18:31 stylesheets
drwxr-xr-x 40 pi pi 4096 Jun 11 18:31 translations
pi@raspberrypi:/builds/trilium $

pi@raspberrypi:/builds/trilium $ ls -al assets
total 260
drwxr-xr-x 8 pi pi 4096 Jun 11 18:31 .
drwxr-xr-x 9 pi pi 4096 Jun 11 18:31 ..
-rw-r--r-- 1 pi pi 3086 May 13 12:56 config-sample.ini
drwxr-xr-x 2 pi pi 4096 Jun 11 18:31 db
drwxr-xr-x 4 pi pi 4096 Jun 11 18:31 doc_notes
-rw-r--r-- 1 pi pi 114668 May 13 12:56 icon-dev.ico
-rw-r--r-- 1 pi pi 114244 May 13 12:56 icon.ico
drwxr-xr-x 2 pi pi 4096 Jun 11 18:31 images
drwxr-xr-x 4 pi pi 4096 Jun 11 18:31 llm
drwxr-xr-x 40 pi pi 4096 Jun 11 18:31 translations
drwxr-xr-x 2 pi pi 4096 Jun 11 18:31 views
pi@raspberrypi:/builds/trilium $

I followed the instructions to run it:

pi@raspberrypi:~/builds/trilium $ ./trilium.sh
Generated session secret
Language option not found, falling back to en.

📦 Versions: app=0.103.0 db=238 sync=39 clipper=1.0
🔧 Build: 2026-05-13 19:56:19 (44f5be8)
📂 Data dir: /home/pi/.local/share/trilium-data
⏰ UTC time: 2026-06-19 22:26:02
💻 CPU: Cortex-A76 (4-core @ 2400 Mhz)
💾 DB size: 4 KiB

DB not initialized, please visit setup page - http://[your-server-host]:8080 to see instructions on how to initialize Trilium.
MCP server registered at /mcp (localhost only)
Trusted reverse proxy: false
App HTTP server starting up at port 8080
Listening on port 8080

The Setup Page:
==> Setup instructions (can't copy text).pdf

Short notes from Setup Page:
Trilium app -> Options -> Sync
Set address http://10.1.1.65:8080
Click Save
--> There is no "Save" anywhere on that page, at least in dark mode!
Test sync
--> Error popups...

I opened my Trilium on my System76 Meerkat with Pop!_OS 24.04 and Cosmic .16, and went to Sync:

Got a variety of errors...

With noproxy:
Screenshot noproxy error 2026-06-19_15-40-04.png

With proxy blank:

Sync handshake failed, SSL error:
Screenshot SSL error 2026-06-19_16-07-41.png

Screenshot Trilium app no connection 2026-06-19_16-10-35.png

--> I noticed this in the non-Docker instructions. Do I need to have TLS ???
TLS#
Don't forget to configure TLS which is required for secure usage!

The RasPi5 and all sync instances are on my local network. How would I setup TLS there? Is it really required?

--> My config.ini seems to have TLS disabled:

pi@raspberrypi:~/builds/trilium $ cat /home/pi/.local/share/trilium-data/config.ini

[Network]
true for TLS/SSL/HTTPS (secure), false for HTTP (insecure).
https=false
path to certificate (run "bash bin/generate-cert.sh" to generate self-signed certificate). Relevant only if https=true
certPath=
keyPath=

--> Should that work without TLS?

--> "you may want to enable TLS" (but maybe not?):

https://docs.triliumnotes.org/user-guide/setup/server
After setting up your server installation, you may want to configure settings such as the port or enable TLS. Configuration is managed via the Trilium config.ini file, which is located in the data directory by default.

--> I Edited my config.ini:

Details

pi@raspberrypi:~/.local/share/trilium-data $ sudo nano config.ini pi@raspberrypi:~/.local/share/trilium-data $ cat config.ini

[General]

Instance name can be used to distinguish between different instances using backend api.getInstanceName()

instanceName=

set to true to allow using Trilium without authentication (makes sense for server build only, desktop build doesn't need password)

noAuthentication=true

set to true to disable backups (e.g. because of limited space on server)

noBackup=false

[Network]

host setting is relevant only for web deployments - set the host on which the server will listen

host=10.1.1.65

port setting is relevant only for web deployments, desktop builds run on a fixed port (changeable with TRILIUM_PORT environment variable)

port=8080

true for TLS/SSL/HTTPS (secure), false for HTTP (insecure).

https=false

path to certificate (run "bash bin/generate-cert.sh" to generate self-signed certificate). Relevant only if https=true

certPath=
keyPath=

setting to give trust to reverse proxies, a comma-separated list of trusted rev. proxy IPs can be specified (CIDR notation is permitted),

alternatively 'true' will make use of the leftmost IP in X-Forwarded-For, ultimately an integer can be used to tell about the number of hops between

Trilium (which is hop 0) and the first trusted rev. proxy.

once set, expressjs will use the X-Forwarded-For header set by the rev. proxy to determinate the real IPs of clients.

expressjs shortcuts are supported: loopback(127.0.0.1/8, ::1/128), linklocal(169.254.0.0/16, fe80::/10), uniquelocal(10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7)

trustedReverseProxy=false

setting the CORS headers for cross-origin requests

corsAllowOrigin='*'

corsAllowMethods='GET,POST,PUT,DELETE,PATCH'

corsAllowHeaders='Content-Type,Authorization'

[Session]

Use this setting to set a custom value for the "Max-Age" Attribute of the session cookie.

This controls how long your session will be valid, before it expires and you need to log in again, when you use the "Remember Me" option.

Value needs to be entered in Seconds.

Default value is 1814400 Seconds, which is 21 Days.

cookieMaxAge=1814400

[Sync]
syncServerHost=10.1.1.65:8080
#syncServerTimeout=
#syncServerProxy=

[MultiFactorAuthentication]

Set the base URL for OAuth/OpenID authentication

This is the URL of the service that will be used to verify the user's identity

oauthBaseUrl=

Set the client ID for OAuth/OpenID authentication

This is the ID of the client that will be used to verify the user's identity

oauthClientId=

Set the client secret for OAuth/OpenID authentication

This is the secret of the client that will be used to verify the user's identity

oauthClientSecret=

Set the issuer base URL for OAuth/OpenID authentication

This is the base URL of the service that will be used to verify the user's identity

oauthIssuerBaseUrl=

Set the issuer name for OAuth/OpenID authentication

This is the name of the service that will be used to verify the user's identity

oauthIssuerName=

Set the issuer icon for OAuth/OpenID authentication

This is the icon of the service that will be used to verify the user's identity

oauthIssuerIcon=
pi@raspberrypi:~/.local/share/trilium-data $

--> Same SSL and other errors.

What am I doing wrong?

[dosubot[bot]]

No, TLS is not required for a local-only sync server. HTTP sync works fine on local networks with https=false [1].

Your issue is almost certainly the sync server URL format in your desktop client. You must include the http:// protocol prefix explicitly. The sync client does not default to either protocol — if you enter just 10.1.1.65:8080 without the prefix, it will fail with protocol/SSL errors [2].

In your desktop client's Options → Sync, set the server address to:

http://10.1.1.65:8080

Also, two other things from your post:

1. No Save button — this is expected. The sync settings auto-save when you click outside the input field (on blur). Just enter the URL, click elsewhere, then use "Test" to verify [3].

2. Your server-side config.ini has syncServerHost=10.1.1.65:8080 in the [Sync] section — that setting is for when the server itself is a sync client to another server. If this Pi is your sync server (not a client), you can leave that blank. The important part is the [Network] section with host, port, and https=false, which you already have correct.

So in summary: add http:// to the address in your desktop client's sync settings and it should connect.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[krotname]

TLS is not required for the local HTTP listener itself. With your current config:

[Network]
https=false
host=10.1.1.65
port=8080

the working URL should be http://10.1.1.65:8080, and https://10.1.1.65:8080 is expected to fail.

The thing I would fix first is the sync URL. In the config you pasted it is:

syncServerHost=10.1.1.65:8080

For Trilium this should be a full URL, including the scheme:

syncServerHost=http://10.1.1.65:8080

Same for the desktop Options -> Sync “Server instance address”: enter http://10.1.1.65:8080, not just 10.1.1.65:8080.

Also, for the “existing desktop -> empty server” setup, the important value is on the desktop instance. The Pi server just needs to be running and reachable while still uninitialized. A quick sanity check from the desktop machine is:

curl http://10.1.1.65:8080/api/setup/status

If that works, leave TLS off for the LAN test and get sync working first. After that, add TLS via a reverse proxy if you decide to expose it outside your trusted LAN.

[LorenAmelang]

Thank you both so much!

I guess i'm so used to browsers filling in the http:// part it never occurred to me that it might be essential here. I did fix the other things you mentioned.

Sync and web access both work now!

I wasted a lot of time learning about nohup...

Trying to start it from ~ didn't work:

pi@raspberrypi:~ $ nohup ~/builds/trilium/trilium.sh &
[1] 24254
pi@raspberrypi:~ $ nohup: ignoring input and appending output to 'nohup.out'

--> Reasonable output, but sync fails!

--> Error:

pi@raspberrypi:~ $ ~/builds/trilium/trilium.sh  
/home/pi/builds/trilium/trilium.sh: 2: exec: ./node/bin/node: not found
pi@raspberrypi:~ $ 

So:
At pi@raspberrypi:~ $
cd builds/trilium
nohup ./trilium.sh &
[2] 24354
[1] Exit 127 nohup trilium.sh
pi@raspberrypi:~/builds/trilium $ nohup: ignoring input and appending output to 'nohup.out'

--> The & is required
--> No need to enter the Exit command manually!
--> May need another command like date before showing normal prompt.
--> Can close terminal, sync stays active!

So nice to have a working server again! Apparently the trilium.cc service is just gone.

Thanks again for the help,

Loren

[LorenAmelang]

That sync session was usable for the rest of the evening, but was gone the next morning.

That first start responded with an automatic
[2] 24354
[1] Exit 127

Seemed no need for manually typing exit:

At pi@raspberrypi:~ $
cd builds/trilium:

nohup ./trilium.sh &
[2] 24354
[1]   Exit 127                nohup trilium.sh
pi@raspberrypi:~/builds/trilium $ nohup: ignoring input and appending output to 'nohup.out'

But it didn't stay active overnight...

The redo only gave one response:
[1] 26251
no automatic exit...

nohup ./trilium.sh &
[1] 26251
pi@raspberrypi: ~/builds/trilium $ nohup: ignoring input and appending output to 'nohup.out'

exit (typed manually)

logout  (apparently from nohup after manual exit, not from closing Tabby logs)

Can someone please explain this? The second one is still working days later.

The log file
/home/pi/builds/trilium/nohup.out
/home/pi/nohup.out
does not include any date/time, so it isn't very helpful in understanding this.
And the nohup activity doesn't appear in the system journal.
Am I missing something?

Trilium server tests:

curl http://10.1.1.65:8080/api/setup/status
Not running:
curl: (7) Failed to connect to 10.1.1.65 port 8080 after 8 ms: Couldn't connect to server
Running:
{"isInitialized":true,"schemaExists":true,"syncVersion":39}

pi@raspberrypi:~ $ ps aux | grep node
root 1705 0.0 0.0 2320 1600 ? Ss Jun11 0:00 pi 3020 0.0 1.5 34086064 126800 ? Sl Jun11 0:20 /pi 24288 1.6 3.2 1442768 272032 pts/2 Sl+ 14:57 0:11 ./node/bin/node main.cjs

pi@raspberrypi:~ $ ps aux | grep cjs
pi 24354 1.2 3.2 1466848 266352 pts/3 Sl 15:21 0:15 ./node/bin/node main.cjs
pi 24408 0.0 0.0 6848 1968 pts/1 S+ 15:41 0:00 grep --color=auto cjs

I'd appreciate any clues!

Loren

[krotname]

The [1] Exit 127 line is the shell reporting that an older background job failed with exit code 127. In your earlier test that is consistent with starting trilium.sh from ~: the script uses ./node/bin/node, so from the wrong working directory ./node/bin/node is not found. It is not nohup logging out, and it does not mean the new [2] 24354 job failed.

The line nohup: ignoring input... is normal. The reliable test is the one you already used: curl .../api/setup/status plus checking for the main.cjs process.

For anything you want to survive reboots or be diagnosable tomorrow, I would move this out of interactive nohup and into a small systemd user/service unit with WorkingDirectory=/home/pi/builds/trilium and ExecStart=/home/pi/builds/trilium/trilium.sh. Then logs go to journalctl with timestamps and restart behavior is explicit.