How to Install Syncthing on Ubuntu 24.04

Syncthing turns any pair of machines into their own private Dropbox — except nothing ever touches a third-party cloud. This guide walks you through installing Syncthing on an Ubuntu 24.04 VPS, pairing it with your laptop and phone, and hardening the web UI for production. By the end you will have an always-online relay peer on your VPS that keeps every other device in sync, even when they are offline from each other.

Skip the setup? Deploy Syncthing in one click with our pre-configured image. Launch a CloudCore Starter VPS and start syncing in under 60 seconds.

Table of Contents

What is Syncthing?

Syncthing is an open-source, continuous file synchronization program that replicates folders between two or more devices in real time. It is licensed under the Mozilla Public License 2.0, has more than 65,000 stars on GitHub, and has been actively developed since 2013. Unlike Dropbox, Google Drive, or OneDrive, Syncthing is purely peer-to-peer — your files go directly from one of your devices to another, never through a vendor's cloud.

Each Syncthing node has a unique cryptographic device ID. When two nodes share a folder, they authenticate via that ID, encrypt the transfer with TLS, and exchange only the blocks that have changed (rolling hash block exchange). There is no central server, no account, no subscription, and no data cap. Every node is equal, and you are free to run as many of them as you like across Linux, macOS, Windows, FreeBSD, Android, and Solaris.

Typical use cases include syncing a Documents folder between a desktop and a laptop, pushing phone camera photos to a home server, replicating a code repository between workstations, mirroring config dotfiles across multiple Linux boxes, and maintaining a warm off-site backup that updates continuously rather than on a nightly cron.

Syncthing vs Nextcloud vs Dropbox vs Resilio Sync

It is worth understanding where Syncthing sits in the file-sync landscape before you commit to it:

If your goal is "keep these folders identical on these devices, privately, forever, at zero cost" — Syncthing is the direct fit.

Why Run Syncthing on a VPS?

Syncthing works fine between two devices that are both online at the same time. The catch is that most people's laptops and phones are rarely online simultaneously — your laptop is closed at 2am when your phone uploads photos, and your desktop is off when you travel. When no node has the latest blocks, nothing syncs.

A VPS solves this. A Syncthing node running 24/7 on a VPS acts as an always-online relay peer. Your laptop uploads to the VPS while your phone is offline; as soon as your phone wakes up, it pulls the delta from the VPS. You effectively get Dropbox semantics — last-write-wins reachability from any device — without ever handing your files to a cloud provider.

Concrete benefits of running Syncthing on a VPS:

• Always-online peer — closes the sync gap when your local devices are on different schedules.
• Private — you control the hardware, the disk, and the backups.
• Cheap and flat-rate — a CloudCore Starter VPS is EUR 7.99/month and gives you unlimited sync volume.
• Works behind NAT — Syncthing's global discovery and relay servers handle NAT traversal out of the box.
• Optional encrypted-at-rest mode — if you treat the VPS as untrusted, you can use Receive Encrypted folders so the VPS only ever holds encrypted blobs.
• Combines well with snapshot backups — run Restic or Borg against the VPS filesystem for an immutable third-copy backup.

Prerequisites

Before you begin, make sure you have:

• A VPS running Ubuntu 24.04 LTS with root or sudo access.
• SSH access to the server.
• At least 1 GB of RAM (Syncthing itself uses ~100-300 MB; more helps with large indexes).
• Enough disk space to hold every folder you plan to sync on the VPS.
• TCP port 22000 and UDP port 22000 (QUIC) reachable from the internet, plus UDP 21027 for local discovery if you are on the same LAN.

Recommended Plan: CloudCore Starter

For a Syncthing relay peer with 100 GB of synced data, we recommend the CloudCore Starter plan:

- 2 vCPU cores

- 4 GB RAM

- 100 GB NVMe SSD

- Unmetered bandwidth

- EUR 7.99/month

If you plan to sync more than 100 GB, pick a plan with a larger SSD or attach block storage.

Connect to your server via SSH to get started:

ssh root@your-server-ip

Step 1: Update System Packages

Start by updating your package index and upgrading installed packages. This ensures you have the latest security patches and that the Syncthing repository signing works cleanly.

sudo apt update && sudo apt upgrade -y

Install the tools we will need to add the Syncthing repository:

sudo apt install -y curl gpg apt-transport-https

If your kernel was updated, reboot before continuing:

sudo reboot

Step 2: Create a Dedicated Syncthing User

Running Syncthing as root is a bad idea — the daemon has full filesystem access to every folder you add. Create a dedicated system user instead. All synced data will live under that user's home directory.

sudo useradd -m -s /bin/bash syncthing

The -m flag creates /home/syncthing, and -s /bin/bash assigns a login shell (useful for debugging, though you can set it to /usr/sbin/nologin later if you prefer).

Create the Sync folder that will hold shared data:

sudo -u syncthing mkdir -p /home/syncthing/Sync

Tip: If you already have a non-root user you prefer to sync under (for example, ubuntu), skip this step and use that username for the rest of the guide. The important thing is that Syncthing does not run as root.

Step 3: Add the Official Syncthing APT Repository

Ubuntu's default repositories ship an older Syncthing package. Use the upstream APT repository to get current stable releases and security fixes directly from the project maintainers.

Import the release signing key:

sudo mkdir -p /etc/apt/keyrings
sudo curl -fsSL https://syncthing.net/release-key.gpg -o /etc/apt/keyrings/syncthing-archive-keyring.gpg

Add the repository to your sources list:

echo "deb [signed-by=/etc/apt/keyrings/syncthing-archive-keyring.gpg] https://apt.syncthing.net/ syncthing stable" | sudo tee /etc/apt/sources.list.d/syncthing.list

Refresh the package index so APT picks up the new repository:

sudo apt update

Expected output (abbreviated):

Get:1 https://apt.syncthing.net syncthing InRelease
Hit:2 http://archive.ubuntu.com/ubuntu noble InRelease
Reading package lists... Done

Step 4: Install Syncthing

With the repository in place, installing Syncthing is a single command:

sudo apt install -y syncthing

Verify the installed version:

syncthing --version

Expected output:

syncthing v1.27.9 "Gold Grasshopper" (go1.22.2 linux-amd64) ...

At this point the binary is installed but no service is running yet. We will configure systemd next.

Step 5: Enable the systemd Service

Syncthing ships two kinds of systemd units out of the box:

• syncthing@<user>.service — a multi-user template unit that runs Syncthing as a specific system user. Use this on a VPS.
• syncthing.service (user unit) — runs under a logged-in user's systemd session. Handy on a desktop, not ideal on a headless VPS.

sudo systemctl enable [email protected]
sudo systemctl start [email protected]

Check that it is running:

sudo systemctl status [email protected]

Expected output:

● [email protected] - Syncthing - Open Source Continuous File Synchronization for syncthing
     Loaded: loaded (/usr/lib/systemd/system/[email protected]; enabled; preset: enabled)
     Active: active (running) since Wed 2026-04-16 10:00:00 UTC; 5s ago
   Main PID: 4321 (syncthing)
      Tasks: 12 (limit: 4915)
     Memory: 85.0M
        CPU: 0.642s
     CGroup: /system.slice/system-syncthing.slice/[email protected]
             └─4321 /usr/bin/syncthing serve --no-browser --no-restart --logflags=0

On first start, Syncthing generates a device ID, a TLS certificate, and an initial config at /home/syncthing/.config/syncthing/config.xml. It will also write a default GUI password to the logs — we will override it in the next step.

Step 6: Access the Web GUI Safely

By default, Syncthing binds the web GUI to 127.0.0.1:8384. That is good: the GUI is not reachable from the internet until you expose it on purpose. Never change the bind address to 0.0.0.0 without also setting a password and TLS.

The safest way to reach the GUI from your laptop is an SSH tunnel. From your local machine:

ssh -L 8384:localhost:8384 root@your-server-ip

Now open http://localhost:8384 in your browser. The request travels through the SSH tunnel, so the GUI never touches the public internet — no firewall changes, no password prompts over plaintext.

You should see the Syncthing dashboard with a warning at the top about the GUI being unprotected. Leave the tunnel open; we will fix that warning next.

Step 7: Set a GUI Password and Enable TLS

Even when bound to localhost, it is good hygiene to require a password and use HTTPS on the GUI. Otherwise, anyone with shell access to the VPS — or a forwarded tunnel — can take it over.

In the Syncthing GUI:

Syncthing will regenerate its cert and restart the GUI on https://localhost:8384. Reload the page and log in with the credentials you just set.

If you prefer to edit config.xml directly, stop the service and set the <gui> block:

sudo systemctl stop [email protected]
sudo -u syncthing nano /home/syncthing/.config/syncthing/config.xml

Look for the <gui enabled="true" tls="false"> element and change it to:

<gui enabled="true" tls="true" debugging="false">
    <address>127.0.0.1:8384</address>
    <user>admin</user>
    <password>$2a$10$...</password>  <!-- bcrypt hash, leave as-is or regenerate -->
</gui>

Generate a bcrypt hash for the password with:

sudo apt install -y apache2-utils
htpasswd -bnBC 10 "" "your-strong-password" | tr -d ':\n'

Restart Syncthing:

sudo systemctl start [email protected]

Step 8: Add Your First Folder

Syncthing is now running, secured, and reachable over your SSH tunnel. Time to add a folder.

The folder will appear in the GUI with state Idle and zero connected devices. That is expected — we have not paired anything with this node yet.

Step 9: Add and Pair a Device

To actually sync something, we need a second node. Install Syncthing on your laptop (macOS: brew install syncthing; Windows: SyncTrayzor; Linux: apt from the same repo you used on the VPS; Android: F-Droid).

On each node, open the GUI and find the local device ID:

• Actions > Show ID — this is the 56-character string that uniquely identifies that node.

Within 30 seconds, both nodes will show Up to Date and the folder will start replicating any existing files. Drop a test file into ~/Sync/Documents on your laptop — it should appear on the VPS within a few seconds.

Repeat the same process for your phone (scan the QR code instead of pasting the device ID), your desktop, your second laptop, and any other node you want to federate.

Step 10: Folder Types and Encrypted Folders

Syncthing exposes four folder types that change how a specific node participates in a folder:

To set it up:

This is a killer feature that no centralized cloud offers by default: you get the always-online relay without trusting the host.

Step 11: File Versioning

Syncthing deletes or overwrites files on peers to mirror the source. Without versioning, an accidental rm -rf on your laptop will propagate to every node. Turn on versioning per folder to keep recoverable copies.

Edit a folder, go to the File Versioning tab, and pick one of:

• Simple File Versioning — keep N versions of each deleted/changed file in .stversions. Simple and bounded.
• Staggered File Versioning — keep progressively older versions (hourly for a day, daily for a month, weekly forever). Recommended for most users.
• Trash Can File Versioning — keep deleted files for N days, then purge.
• External File Versioning — hand off versioning to your own script (useful for Restic/Borg integration).

Step 12: Ignore Patterns and Discovery

Ignore Patterns (.stignore)

You rarely want to sync node_modules, .git/objects, .DS_Store, or editor swap files. Syncthing reads a .stignore file at the root of each folder — same syntax as .gitignore with a few extras.

Create one on your laptop inside the folder root:

cat > ~/Sync/Documents/.stignore <<'EOF'
System noise
.DS_Store
Thumbs.db
desktop.ini
Developer noise
node_modules
__pycache__
*.pyc
.venv
Editor temp files
*.swp
*~
.#*
Syncthing itself
.stversions
EOF

.stignore itself is synced across devices, so you only have to write it once.

Discovery

Syncthing uses three mechanisms to find peers:

• Global discovery — Syncthing's public discovery servers map your device ID to a current IP/port. Traffic still goes peer-to-peer; only the lookup is centralized. Disable in Settings > Connections if you prefer strictly static addresses.
• Local discovery — mDNS on UDP 21027 for devices on the same LAN.
• Relaying — when two peers cannot open a direct connection (symmetric NAT, restrictive firewalls), traffic is forwarded through community relay servers. Payload remains end-to-end encrypted. You can run your own relay if you want a fully private stack.

Step 13: Firewall and Reverse Proxy

Open the Sync Ports with UFW

Syncthing uses a small fixed set of ports:

sudo ufw allow 22000/tcp
sudo ufw allow 22000/udp
sudo ufw enable
sudo ufw status

Do not open 8384 to the world. The GUI is a full admin surface — anyone who reaches it can add folders, read files, and pair new devices.

Optional: Expose the GUI Through Nginx with Auth

If SSH tunneling is too fiddly day-to-day, front the GUI with Nginx as a reverse proxy with HTTPS, Basic Auth, and an IP allowlist. Pair it with fail2ban to auto-ban brute-force attempts.

sudo apt install -y nginx apache2-utils certbot python3-certbot-nginx
sudo htpasswd -c /etc/nginx/.syncthing-htpasswd admin

Create /etc/nginx/sites-available/syncthing:

server {
    listen 443 ssl http2;
    server_name sync.yourdomain.com;
    ssl_certificate     /etc/letsencrypt/live/sync.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sync.yourdomain.com/privkey.pem;
    # IP allowlist — replace with your home/office IP
    allow 203.0.113.50;
    deny all;
    location / {
        auth_basic "Syncthing";
        auth_basic_user_file /etc/nginx/.syncthing-htpasswd;
        proxy_pass https://127.0.0.1:8384;
        proxy_ssl_verify off;  # self-signed cert on Syncthing side
        proxy_set_header Host localhost;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_read_timeout 600s;
    }
}
server {
    listen 80;
    server_name sync.yourdomain.com;
    return 301 https://$host$request_uri;
}

Enable the site and request a cert:

sudo ln -s /etc/nginx/sites-available/syncthing /etc/nginx/sites-enabled/
sudo certbot --nginx -d sync.yourdomain.com
sudo nginx -t && sudo systemctl reload nginx

You now have three layers in front of the Syncthing GUI: TLS, Basic Auth, IP allowlist. If you want a fourth, install fail2ban with a filter that bans IPs after repeated 401s.

Rate Limiting and CPU Priority

In Settings > Connections, set inbound/outbound rate limits if Syncthing is saturating your VPS uplink. In Settings > General, toggle Enable Relaying off if you do not want to contribute spare bandwidth to the community relay pool. You can also nice the process by adding Nice=10 under [Service] in a drop-in override if CPU contention matters.

Backups, Updates, and Maintenance

What to Back Up

The sync data itself is self-healing — every folder already lives on at least two devices. The one thing that is not replicated is Syncthing's own config, which encodes your device IDs, folder mappings, and passwords. Back it up:

sudo tar -czf /root/syncthing-config-$(date +%F).tgz /home/syncthing/.config/syncthing

For point-in-time snapshots of the actual folders, run Restic or Borg against /home/syncthing/Sync on a nightly schedule. That gives you an immutable third copy in addition to the live peers.

Updates

Because you installed from the upstream APT repo, updates flow through regular apt:

sudo apt update && sudo apt upgrade -y
sudo systemctl restart [email protected]

The Syncthing project guarantees stable-channel support through at least 2027 on Ubuntu 24.04. The in-GUI auto-upgrade prompt is disabled by APT-installed packages on purpose — let apt handle it so you get reproducible builds.

Monitoring

Syncthing exposes a REST API at /rest/ (same port as the GUI) that returns JSON for every folder's sync state. Point Uptime Kuma or Prometheus at it for alerts when a folder is stuck Out of Sync or a device has been Disconnected for more than an hour.

Troubleshooting

Viewing Logs

sudo journalctl -u [email protected] -f

Stream live logs. For the last 100 lines:

sudo journalctl -u [email protected] -n 100 --no-pager

FAQ

How does Syncthing compare to Dropbox?

Dropbox is a SaaS — you pay a subscription and your files live on Dropbox's servers. Syncthing is software you run on devices you already own, and your files never leave those devices (except through end-to-end-encrypted transfers between them). Dropbox has a polished web UI, public link sharing, and recovery tools that Syncthing does not; Syncthing has no per-GB cost, no third-party data access, and no vendor lock-in. For personal sync across your own hardware, Syncthing is a direct replacement. If you need public link sharing or a web UI for non-technical collaborators, pair Syncthing with Nextcloud or keep Dropbox for those specific flows.

How does Syncthing compare to Nextcloud?

Nextcloud is a centralized server with a web UI, calendars, contacts, office integration, and a mobile client. Syncthing is a decentralized file sync engine, nothing more. Nextcloud is the better fit if you want a self-hosted Google Workspace replacement; Syncthing is the better fit if you want "Dropbox semantics without Dropbox." They are not mutually exclusive — plenty of users run Nextcloud for collaboration and Syncthing for personal device sync.

How many devices can I connect?

There is no hard limit. The protocol scales to dozens of peers per folder. Practical bottlenecks are RAM (each connected device consumes a few MB of index state) and bandwidth during initial sync. 10-20 devices across a handful of users is routine.

Is there a file size limit?

No protocol-level limit. Files are transferred as 128 KB blocks (configurable), so there is no inherent maximum. In practice, very large files (several GB) sync fine; the bottleneck is your network and disk I/O.

What happens when two devices edit the same file?

Syncthing detects the conflict and keeps both copies. The later version wins, and the earlier version is renamed filename.sync-conflict-YYYYMMDD-HHMMSS-DEVICEID.ext. Nothing is lost — you just have to merge manually. For structured files (code, text), combine conflict detection with .stignore and a version-controlled workflow.

Is there a mobile app?

Yes for Android — the official Syncthing Android app on F-Droid and the Play Store. It runs as a background service and handles camera folder sync well. For iOS, there is Möbius Sync (formerly LiveDrive), a third-party client that speaks the Syncthing protocol. iOS's background execution model is restrictive, so expect sync to run mostly while the app is foregrounded.

How much bandwidth does Syncthing use?

Only what is needed for changes. After the initial sync, Syncthing transfers only block-level deltas, and compresses them in transit. You can cap upload/download rates in Settings > Connections if you need to stay under a monthly quota.

Can I run Syncthing inside Docker?

Yes. The official syncthing/syncthing image works fine. The apt-based install in this guide is simpler for a single-purpose VPS, but Docker makes sense if Syncthing is one of many services on the same host.

Next Steps

Now that Syncthing is running on your VPS, here are recommended follow-ups:

• Front the GUI with Nginx + fail2ban — see How to Install Nginx on Ubuntu 24.04 and How to Install fail2ban on Ubuntu 24.04 to add TLS, Basic Auth, and automatic IP banning to the web UI.

• Add Restic snapshots — point Restic at /home/syncthing/Sync and a cheap object-storage bucket for a nightly encrypted off-site backup. You will now have three independent copies: live peers, Syncthing versioning history, and immutable Restic snapshots.

• Enable monitoring with Uptime Kuma — watch Syncthing's REST API for Out of Sync folders and disconnected devices.

• Switch your desktop backup to Receive Encrypted — if your VPS provider is not in your trust boundary, flip the folder type on the VPS and enjoy encrypted-at-rest replication without changing anything on your laptop.

• Deploy your own relay server — if you want fully self-hosted discovery and relaying, run strelaysrv on a second VPS and point your devices at it.

Skip the Manual Install — Get Syncthing Pre-Installed

Our CloudCore Starter plan can deploy Syncthing pre-configured in 60 seconds, with systemd, a dedicated user, UFW rules, and the web GUI behind Nginx + Basic Auth ready out of the box.

- Syncthing installed from the upstream APT repo

- Dedicated syncthing system user with /home/syncthing/Sync

- systemd service enabled with [email protected]

- UFW pre-configured for TCP/UDP 22000

- Nginx reverse proxy with Let's Encrypt TLS

Deploy Your CloudCore Starter VPS Now — Plans start at EUR 7.99/month.