Hosting Syncthing on your own VPS

Syncthing is a decentralized file synchronization tool: each device talks directly to the others, with no central server or copy held by a provider. The problem with pure peer-to-peer is that your machines aren't always on at the same time — your laptop is off when your desktop wants to sync. A VPS solves exactly this: it acts as a permanent node available 24/7, present on the Internet with a stable public IP, toward which all your devices converge. Files transit encrypted (TLS) and the VPS holds a synchronized copy that also serves as an off-site backup. Unlike shared hosting, a VPS allows opening the transfer ports and keeping a Syncthing daemon running permanently.

Syncthing is remarkably frugal in CPU and RAM, but it's the disk that sizes the server: you need as much space as the volume of data to synchronize. Plan for 1 vCPU and 1 GB of RAM, plus the storage suited to your folders (20, 50 GB or more depending on your needs). On the network side, two ports must be reachable: 22000 (TCP/UDP, data transfer) and 21027 (UDP, local discovery, optional on a remote VPS). The admin interface runs on port 8384 and must absolutely stay protected. Docker and Docker Compose are enough; a sync.yourdomain.com subdomain is useful to access the interface over HTTPS via a reverse proxy.

Once the basic deployment is working, open the GUI (via sync.yourdomain.com) to fine-tune each folder. For each shared folder, set the type: Send-Receive (bidirectional), Send Only (the VPS cannot modify your files) or Receive Only (the VPS archives without overwriting). The Folder ID field in the configuration — visible in config.xml under /opt/syncthing/config/ — must be identical on all devices sharing the same folder: it's what ties the nodes together. For storage-side encryption, Syncthing has supported the Encrypted mode since version 1.15: the VPS never sees your data in clear text, it only stores encrypted blobs. Enable it in the Sharing tab of a folder, Encrypted option for the VPS device. Sharing ACLs are managed per device: in each folder, select which devices are allowed to access it — a device not listed receives nothing even if it knows your Device ID.

The power of the VPS as a central hub becomes clear when you connect a full ecosystem. On Android, install Syncthing via F-Droid (the official app, free, no Google telemetry) — the Play Store version has been deprecated since 2024. Open Syncthing on the phone, copy its Device ID, and add it on the VPS side via "Add Device". Reciprocally, add the VPS on the phone with its Device ID and the explicit address tcp://VPS_IP:22000 in the Addresses field. On a laptop, the process is identical: install syncthing via the package manager (apt install syncthing or official binary), start it with systemctl --user enable --now syncthing, and pair it to the VPS the same way. For a Synology or TrueNAS NAS, Syncthing is available as an official package or Docker container — configure the same Device ID and shared folders. Disable public relay servers in advanced preferences (relays disabled) and declare tcp://VPS_IP:22000 as a static address on each node for direct, fast connections without depending on Syncthing Foundation services.

Exposing port 8384 directly on the Internet is a critical mistake: anyone can attempt to connect. Best practice is to bind Syncthing to 127.0.0.1:8384 in the config (GUI Settings > GUI Listen Address: 127.0.0.1:8384) and front it with nginx or Caddy over HTTPS. With nginx, create a vhost in /etc/nginx/sites-available/sync: define a server block on port 443 with your Let's Encrypt certificate, a location / with proxy_pass http://127.0.0.1:8384 and the X-Real-IP, X-Forwarded-For headers. Add HTTP basic authentication (auth_basic, htpasswd) as an additional layer: even if someone finds the URL, they must pass two barriers — nginx and the Syncthing GUI password. In config.xml, ensure <insecureAdminAccess>false</insecureAdminAccess>. Finally, back up /opt/syncthing/config/ regularly — this folder contains the node's TLS keys, folder configuration and paired Device IDs: losing it means reconfiguring all devices from scratch.

Syncthing exposes a full REST API at http://127.0.0.1:8384/rest/. The API token is found in the GUI under Settings > GUI > API Key. Some useful queries from the VPS: curl -H 'X-API-Key: YOUR_KEY' http://127.0.0.1:8384/rest/db/status?folder=FOLDER_ID returns the sync state of a folder (keys: globalFiles, localFiles, needFiles, state). The idle state confirms everything is synced; syncing means a sync is in progress; error signals a problem to investigate in the logs. For real-time event monitoring: GET /rest/events?since=0 returns the event stream (connections, transfers, errors). For minimal production monitoring, add a cron job or Uptime-Kuma check that polls /rest/noauth/health — this endpoint requires no API key and returns {"status":"OK"} if Syncthing is running.

Port 22000 unreachable. Remote devices appear as "Disconnected" even though Syncthing is running. Verify that ufw allow 22000/tcp and ufw allow 22000/udp were applied (ufw status). Also check that the compose maps 22000:22000/tcp and 22000:22000/udp — missing the UDP mapping blocks discovery. Confirm with nc -zv VPS_IP 22000 from a remote machine. Device not found. If auto-discovery fails, declare the VPS address manually in each client's config: Devices tab > Addresses > tcp://VPS_IP:22000. Version conflict. Two devices modified the same file while offline. Syncthing creates a .sync-conflict-YYYYMMDD-HHMMSS-DEVICEID file next to the original — intentional, no data is lost. Review both versions and delete the one you don't need. Insufficient disk space. Syncthing stops syncing and enters error state if available space drops below the configured threshold (default: 1% of disk). Free up space or expand the VPS disk; also check that staggered versioning isn't keeping years of revisions — limit the retention period in the folder settings.