Build · 02 Case study
My Obsidian second brain: synced everywhere, agent-accessible, backed up off-site
One vault on four layers: Obsidian, Tailscale, Syncthing, and hourly encrypted snapshots to Backblaze B2. My agents read and write the same files I do.
// Problem
I keep notes in Obsidian because they are plain Markdown on my own disk and no vendor can lock them away. Then I got a second device, and I had two copies drifting apart.
Each of the usual fixes costs something. Obsidian Sync works well and pays the developers, and it is a subscription that routes my notes through someone else's servers. iCloud and Drive sync partial files and race on open ones, which corrupts .obsidian state. Git is built for commits I make on purpose, not for a vault that autosaves images every few seconds across a phone and a laptop.
// What I built
Four layers, each solving one problem and each swappable without touching the others.
The vault. Plain Markdown in ~/Notes/obsidian, with a layout I hold the line on: daily notes as the capture inbox, one evergreen idea per file in Notes/, active work in Projects/, and [[wikilinks]] tying them together. The filename is the primary key both I and an agent search on.
The private network. Tailscale gives every device a stable address on a WireGuard mesh, so nothing needs an open port or a static IP.
Sync. Syncthing runs on every device in a hub-and-spoke shape. The VPS is always on and holds the canonical copy; each other device pairs with the hub and never with another device, so adding a machine is one link instead of a link to every existing one. My phone and my Mac are rarely awake together, and the hub is what keeps them in sync anyway. Only the hub keeps staggered file versioning, so a year of overwritten and deleted files sits in one place.
Backup. Syncthing replicates a bad delete as fast as it replicates a fix, so the safety net has to be a separate system on its own schedule. Cron runs restic hourly against a Backblaze B2 bucket. restic encrypts on the VPS before anything leaves it, so B2 stores ciphertext and never sees a note. Retention keeps every hour for a week, every day for a month, and every week for three months, then prunes.
The agents. A CLAUDE.md at the vault root teaches Claude Code the layout and the filing rules, so it puts a new note where I would. OpenClaw works the same files from the VPS. A note an agent writes on the server is on my Mac a minute later and in the next hourly snapshot.
// Result
One set of notes that survives a lost phone, a bad delete, and a dead VPS. I have run the restore drill rather than assumed it: restic restore latest into a scratch directory, then diff -r against the live vault. A backup I have never restored is a rumour.
Running cost is the box and nothing else, because a text vault with a year of hourly history fits inside B2's free 10 GB.
// Proof
I wrote the build up as a guide anyone can follow from an empty folder, with the config files, the scripts, and the failure modes. Each section below documents one layer above.