How do I run Syncthing on a storage VPS as an always-on node?

Why run Syncthing on a VPS?

Because Syncthing syncs only between devices that are online at the same moment, and a VPS is online all the time. Without one, a laptop that is closed while your phone is out never exchanges changes with it. With a VPS in the middle, each device syncs with the VPS whenever it comes online, and the VPS passes changes on. Its public address also lets your devices connect to it directly instead of waiting for a relay.

Sync is not backup. A file you delete or a folder ransomware encrypts on one device is deleted or encrypted on the others within seconds, the VPS included. Sync copies your mistakes as faithfully as your files, so keep a versioned copy elsewhere, as How do I use a VPS for off-site backups? describes.

Should Syncthing run as a systemd system service or a user service?

On a server, Syncthing's documentation recommends the system service syncthing@USER, which starts at boot without anyone logged in; a user service works too once lingering is enabled. The user service syncthing.service normally starts only after its user logs in, which never happens on a headless VPS. loginctl enable-linger changes that: the user's systemd instance starts at boot and takes the service with it. The Debian 13 package installs both unit files, so neither needs copying.

Run Syncthing under its own unprivileged account, with its home on the storage disk so the synced folders land there. The steps for preparing that disk are in How do I mount and format the storage disk on a Linux VPS?.

apt install syncthing
useradd --create-home --home-dir /srv/data/sync --shell /usr/sbin/nologin syncer

# Option A: system service, the one Syncthing documents for servers
systemctl enable --now [email protected]

# Option B: user service, started at boot by lingering
loginctl enable-linger syncer
systemctl --user -M syncer@ enable --now syncthing.service

How do I open the Syncthing GUI on a VPS without exposing it?

Leave the GUI on its default address, 127.0.0.1:8384, and forward a local port to it over SSH. Syncthing's FAQ gives exactly this method for reaching the GUI from another computer. The tunnel uses your existing SSH login, so the GUI never listens on a public address. If you ever bind it to 0.0.0.0 instead, the same FAQ tells you to set a password and turn on HTTPS. Set a GUI user and password in any case: every account on the VPS can reach 127.0.0.1.

ssh -N -L 9090:127.0.0.1:8384 [email protected]

How do I make the VPS an untrusted (encrypted) device?

Share each folder with the VPS from a trusted device with an encryption password, and accept it on the VPS as a "Receive Encrypted" folder. The password is set per device, in the folder's sharing settings, and only for the untrusted one; your own laptops and phones share with each other without it. Data is encrypted with keys derived from that password and the folder ID through scrypt, using XChaCha20-Poly1305 and AES-SIV. In the VPS's device settings on your trusted machines, also tick "Untrusted" under Advanced: Syncthing then blocks the connection if any folder shared with it lacks a password.

Two limits come from the documentation. The feature "should still be considered beta / testing only", so keep another copy of anything that matters. And because encrypted blocks cannot be reused between files, renaming a large file can make the VPS drop the old one and download the data again; edits inside a file still move only the changed blocks. An untrusted node is a vault that cannot read its own contents.

Which ports and discovery settings does an always-on node need?

Open port 22000 for TCP and UDP; the GUI port 8384 stays closed. Syncthing uses 22000/TCP for its TCP sync protocol and 22000/UDP for QUIC. Port 21027/UDP carries local discovery, which only finds devices on the same LAN, so a VPS gains nothing from it.

With 22000 reachable on a public address, your devices connect straight to the VPS. You can then type the VPS address, tcp://203.0.113.10:22000, into each device's settings instead of relying on global discovery. Relays become a fallback rather than a need, and Syncthing's FAQ notes that relays cannot see the data passing through them anyway.

ufw allow 22000/tcp
ufw allow 22000/udp

What does an always-on Syncthing node cost?

According to Coffervale's survey of 2 November 2026, storage VPS plans from hosts that take crypto without an ID document cost a median $4.00 per TB a month, from $2.22 at the least expensive. Size the plan on the folders you sync plus room to grow: To grow, order a larger plan and copy your data across with rsync or zfs send; resizing a running server in place is not offered at launch. Sync traffic counts toward the monthly quota, 4 TB a month on the 1 TB Clay plan; Each server has one IPv4 address and an IPv6 /64 on a 1 Gbit/s port, with a monthly traffic quota of 2 TB plus 2 TB per TB stored: 3 TB for Silt, 4 TB for Clay, 6 TB for Shale, 10 TB for Granite, 18 TB for Bedrock. Past the quota the port runs at 100 Mbit/s until the next period begins; nothing extra is billed. The 1 TB plan is described in Where can I get a VPS with 1 TB of storage?. If you also want a web interface, calendars or sharing links, compare the two server options in Nextcloud or Seafile on a small storage VPS?.