Self-Host Syncthing on a VPS

Syncthing is the file-sync tool that respects your bandwidth, your storage, and your privacy — it talks peer-to-peer between your own devices with end-to-end encryption, no cloud middleman charging $9.99/month per 200 GB. The catch: it only syncs when devices are online together. Your laptop closes, your phone is off — sync stops. That's why an always-on Syncthing node on a VPS makes the whole system actually useful.

This guide installs Syncthing on a Linux VPS, configures the always-on relay role so your other devices can sync through it at any time, sets up the web GUI behind HTTPS, enables file versioning so you can roll back accidental deletions, and uses encrypted folders so the VPS holds only ciphertext if you want maximum privacy. By the end you'll have a self-hosted Dropbox replacement with no per-GB pricing and no third party in the sync chain.

1. Why an always-on Syncthing VPS

Syncthing's design is brilliant — every device holds a full copy, peers exchange changes directly, encryption is end-to-end. But the assumption is that devices overlap in availability. If your phone is the only thing with the latest photos, and your laptop is the only thing that should receive them, they have to be on at the same time. Often they aren't.

A VPS solves this trivially:

• Your phone uploads photos at 3 AM → VPS receives them while everyone else sleeps
• Your laptop wakes up at 9 AM → pulls from the VPS, not the (now-offline) phone
• You add a file from any device → propagates through the VPS to every peer
• A laptop goes missing → the VPS still has every byte. Restore on a new machine.

You're not using the VPS as cloud storage. You're using it as a perpetually-available peer in the mesh.

2. Prepare the VPS

apt update && apt upgrade -y
apt install -y curl ca-certificates apt-transport-https gnupg ufw

ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow 22000/tcp   # Syncthing protocol (TCP)
ufw allow 22000/udp   # Syncthing QUIC
ufw allow 21027/udp   # Local discovery broadcast (optional)
ufw --force enable

# Non-root user for Syncthing
adduser sync
usermod -aG sudo sync
rsync --archive --chown=sync:sync ~/.ssh /home/sync

3. Install Syncthing

Install from the official APT repo so updates flow naturally:

curl -L -o /usr/share/keyrings/syncthing-archive-keyring.gpg \
  https://syncthing.net/release-key.gpg

echo "deb [signed-by=/usr/share/keyrings/syncthing-archive-keyring.gpg] https://apt.syncthing.net/ syncthing stable" \
  | tee /etc/apt/sources.list.d/syncthing.list

apt update
apt install -y syncthing

Enable Syncthing as a user-mode systemd service running as the sync user:

systemctl enable --now syncthing@sync.service
systemctl status syncthing@sync.service

The first run creates /home/sync/.local/state/syncthing/config.xml with default settings, generates a TLS keypair for the device identity, and starts the GUI on 127.0.0.1:8384. It's bound to localhost only by default — we'll expose it through HTTPS in step 5.

4. First boot and device pairing

To access the GUI from your laptop, SSH-tunnel port 8384:

# Run this on your laptop:
ssh -L 8384:127.0.0.1:8384 sync@your-vps-ip

Then visit http://localhost:8384 in your browser. You'll get the Syncthing dashboard showing your VPS's device ID — a long string like BDQNS24-Q.... Save this device ID; you'll paste it on each of your other devices to pair them with the VPS.

Set a friendly device name (Settings → General). The default is the VPS hostname — change to something memorable like "VPS-Relay".

On each of your other devices (laptop, phone, desktop), install the Syncthing client:

• macOS: brew install syncthing or use Syncthing Tray
• Linux: same APT install as above, with systemctl --user enable --now syncthing
• Windows: SyncTrayzor (community wrapper) or Syncthing for Windows
• Android: Syncthing on F-Droid (preferred over Play Store version, which is unmaintained)
• iOS: Möbius Sync (third-party, paid; the only viable iOS option)

On each client, paste the VPS device ID under Add Remote Device. The VPS will get a notification asking to confirm the pairing — accept it. Now the devices know about each other.

5. HTTPS for the web GUI

SSH-tunneling works but isn't convenient long-term. Set up Nginx + Let's Encrypt so you can hit https://sync.example.com from anywhere:

sudo apt install -y nginx certbot python3-certbot-nginx

sudo tee /etc/nginx/sites-available/syncthing <<'EOF'
server {
    listen 80;
    server_name sync.example.com;

    client_max_body_size 0;   # Syncthing API has large requests

    location / {
        proxy_pass http://127.0.0.1:8384;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;

        # Required for Syncthing GUI
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}
EOF

sudo ln -s /etc/nginx/sites-available/syncthing /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx
sudo certbot --nginx -d sync.example.com

Set a strong GUI password inside Syncthing: Settings → GUI → GUI Authentication User. Once you turn on auth, the GUI is locked down. Restart Syncthing for the change to take effect.

6. Create your first sync folder

On the VPS, create a directory that'll hold synced content:

sudo -u sync mkdir -p /home/sync/synced/documents

In the Syncthing GUI: Add Folder. Folder Path: /home/sync/synced/documents. Folder Label: anything memorable (e.g. "Documents"). Save.

Now share that folder with your other devices: under the folder's Sharing tab, tick each remote device (phone, laptop, desktop). Each remote device will get a notification asking to accept the share — click accept, pick a local path on that device, save.

Drop a file into the folder on your laptop. Within ~30 seconds it shows up on the VPS, then propagates to every other device sharing the folder. Zero cloud middleman, zero per-byte cost.

7. File versioning and trash

Default Syncthing replicates deletes — delete a file on one device, it's gone everywhere. Versioning fixes that. Per-folder setting: Edit Folder → File Versioning.

Options:

• Trash Can — moved files go to .stversions/ and stay forever (or until you clean up). Simple, just works.
• Simple — keep N versions, oldest gets deleted
• Staggered — keep hourly versions for a day, daily for a week, weekly for a year (the smart default)
• External — run your own script. For nerds.

Enable Staggered on the VPS for any folder containing irreplaceable content. The .stversions directory eats disk over time, but it's worth it the day you accidentally rm -rf something important. Plan for ~30% versioning overhead on disk usage.

8. Encrypted folders (zero-knowledge mode)

Default Syncthing stores plaintext files on the VPS — fine if you trust your VPS host (and yourself). For maximum privacy, mark the VPS as an encrypted peer for a folder. The VPS receives encrypted blobs only; the keys live exclusively on your end-user devices.

On your laptop or any "real" peer: Edit Folder → Sharing tab → next to the VPS device, enable Encrypted and set a passphrase. Save. On the VPS, the same folder shows as "untrusted" — directory listings work but the file contents are ciphertext.

Trade-off: encrypted peers can't be used to bootstrap a new device. If you lose all "real" peers and only the encrypted VPS remains, you need the original passphrase to decrypt anything. Keep the passphrase somewhere safe (password manager — pair Syncthing with Vaultwarden for this kind of thing).

9. Reference: tuning, ports, scaling

Ports cheat sheet

Port	Protocol	Purpose	Public-facing?
22000	TCP/UDP	Syncthing protocol (BEP)	Yes — needed for peers to reach the VPS
21027	UDP	Local discovery broadcasts	No — only LAN
8384	TCP	Web GUI	No (bind to 127.0.0.1, expose via HTTPS reverse proxy)

Bandwidth limits

By default, Syncthing uses all available bandwidth. If your VPS plan has a monthly cap, set per-folder or global limits: Settings → Connections → Outgoing Rate Limit. KB/s, not Mbps. For a Starter plan with 1 TB/month, capping outgoing at 1000 KB/s caps monthly bandwidth at ~2.6 TB — too high. Cap at 300 KB/s for safety, raise during weekends.

Storage requirements per folder

Folder content	VPS disk needed
100 GB photos with Staggered versioning	~130 GB (30% overhead)
500 GB documents/code	~550 GB
1 TB media archive (no versioning)	~1 TB exactly

Multi-folder layout

Split into multiple folders by purpose: Documents (small, frequent changes, full versioning), Photos (large, append-only, light versioning), Code (mid-size, full versioning, frequent changes). Each folder syncs independently — a slow-syncing media folder doesn't block your urgent docs from propagating.

Acting as a public relay (optional)

If you want to contribute to the Syncthing relay network (other users' encrypted traffic transits your VPS), enable Settings → Relaying. Counts against your bandwidth but it's a nice contribution. Disabled by default.

Per-plan capacity guidance

Plan	Suitable for
Starter ($7.99, 1 TB BW, 100 GB)	Documents, code, small photo libraries
Pro ($15.99, 3 TB BW, 500 GB)	Family photo libraries, music collections
Premium ($35.99, 5 TB BW, 2 TB HDD)	Full media archives, multi-user setups

FAQ

Related posts

Tutorial

Self-Host Nextcloud on a VPS

Heavier alternative when you also need calendar, contacts, office docs.

Tutorial

Self-Host Vaultwarden

Store your Syncthing encryption passphrases in a self-hosted password manager.

Pillar

The Complete Self-Hosting Guide

Architecture and trade-offs for running your own infrastructure.