VPS for Syncthing: an always-on encrypted peer

Syncthing has one annoying habit: two devices only sync while both are online. Your laptop sleeps, your phone is in your pocket on mobile data, the desktop at home is off — and files wait for a moment when two of them happen to be awake together. A peer that's online around the clock fixes that. Everything syncs through the server, whenever each device shows up.

The usual objection is "then my files sit on a VPS". Syncthing has an answer for that too: share a folder with the server as an untrusted device, and it stores only encrypted data it can't read.

Which plan

Syncthing itself is tiny — about 25–30 MB of RAM in our test. What you're really buying is disk, because the server keeps a full copy of every folder you share with it.

Go with a plan that has its own IPv4. Your devices need to reach the server on port 22000; on a NAT plan only SSH gets through, and Syncthing falls back to public relays — slower, and through infrastructure you don't control. Pick Germany or Finland, whichever is closer to you and available at checkout. You can pay for the server in crypto, no KYC.

Install

As root on Ubuntu 24.04 or Debian 12, from Syncthing's official repository (stable v2 channel):

mkdir -p /etc/apt/keyrings
curl -L -o /etc/apt/keyrings/syncthing-archive-keyring.gpg https://syncthing.net/release-key.gpg
echo "deb [signed-by=/etc/apt/keyrings/syncthing-archive-keyring.gpg] https://apt.syncthing.net/ syncthing stable-v2" > /etc/apt/sources.list.d/syncthing.list
apt update && apt install -y syncthing

Run it as its own user under systemd:

useradd -m -s /bin/bash syncthing
systemctl enable --now syncthing@syncthing
ufw allow 22/tcp && ufw allow 22000/tcp && ufw allow 22000/udp && ufw enable

Don't call the user sync. That name already belongs to a system account with /bin as its home, and syncthing@sync fails with a read-only filesystem error — we tripped over it ourselves.

Get the server's device ID — you'll paste it into your other devices:

runuser -u syncthing -- syncthing device-id

The web interface listens only on 127.0.0.1:8384, which is what you want. Reach it through an SSH tunnel from your computer:

ssh -L 8384:127.0.0.1:8384 root@YOUR_SERVER_IP

Open http://127.0.0.1:8384 and set a GUI password under Settings → GUI first thing.

Share a folder so the server can't read it

On your laptop (or any trusted device):

1. Add the server as a remote device using its device ID.
2. Open the folder you want to sync → Sharing, tick the server and enter an encryption password next to it. Store that password in your password manager: without it the data on the server is just noise.
3. On the server's web UI, accept the folder and choose the folder type Receive Encrypted.

That's it. Look at what actually landed on the server:

find /home/syncthing -path '*syncthing-enc*' -type f | head

You'll see paths like …/I.syncthing-enc/C8/PICA7BFKFPSGQ06C4D4SQ50GB6E151QUNF1EOBK instead of your file names. In our test we searched the server for a phrase from the synced file — nothing.

Your other devices share the same folder normally, between themselves, and with the server using the same encryption password. Any trusted device that knows the password can sync from the server, including a new laptop after the old one dies.

The honest part

• Sync isn't backup. Deletions and accidental overwrites sync too. Turn on file versioning on a trusted device, or keep a separate backup somewhere else.
• Encryption hides contents and names, not everything. File sizes and when things change can still be worked out on the server. For most people that's a fine trade; if it isn't, this setup isn't for you.
• The password is the key. Lose it and the encrypted copy on the server is useless. That's the point, and also the risk.
• Phones. There's no official mobile app any more: Android has a community-maintained one, iOS only third-party clients. Check yours before you plan around it.

If you want a full web interface with calendars, contacts and sharing links instead of quiet background sync, look at Nextcloud. If you only want your files to be everywhere and readable nowhere but your own devices, this is the lighter tool.

Related

• Self-host Nextcloud on a VPS — a full private cloud with a web UI
• VPS for Vaultwarden — passwords, self-hosted
• VPS for encrypted storage — LUKS, and what encryption on a server can and can't do
• How to set up SSH key authentication
• How to configure a ufw firewall