Deployment guide

Syncthing

Overview

Syncthing is an open-source, continuous file synchronization program. It synchronizes files between two or more devices peer-to-peer over an encrypted, authenticated connection, with no central server. It is a privacy-respecting alternative to hosted file sync, and here it runs as an always-on sync node you control.

The SecureAnyCloud image installs Syncthing 2.1 as a single Go binary and serves the web GUI through an nginx reverse proxy on TCP 80. It keeps all sync data on a dedicated Azure data disk and generates a unique device identity, GUI password and API key on the first boot of every VM.

What you get:

Syncthing 2.1 (MPL-2.0) at /usr/local/bin/syncthing
An nginx reverse proxy on :80 in front of the Syncthing GUI and REST API, which are bound to loopback :8384
A dedicated Azure data disk at /var/lib/syncthing holding the configuration, device certificate, index database and default synced folder, separate from the OS disk and re-provisioned with every VM
A per-VM device identity, administrator GUI password and API key, generated at first boot and stored in a root-only file
syncthing.service and nginx.service as systemd units, enabled and active
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point. Scale up for many folders or large indexes.

Configure the NSG inbound rules as follows:

22/tcp from your management network
80/tcp for the web GUI. For public exposure, front it with TLS (see Enabling HTTPS).
22000/tcp from the devices that will sync with this node. This is the sync protocol port.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Syncthing by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create. After deployment, add an NSG rule for 22000/tcp so other devices can reach the sync protocol.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:syncthing-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name syncthing \
  --image sac1647283583153:syncthing-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name syncthing --port 80 --priority 1010
az vm open-port --resource-group <your-rg> --name syncthing --port 22000 --priority 1020

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active syncthing.service nginx.service curl -s http://127.0.0.1/rest/noauth/health

Both services report active, and the health endpoint returns {"status": "OK"}.

Step 5 - Retrieve your credentials

First boot generates the administrator GUI password, the REST API key and this node's Device ID. They are unique to your VM and are written to a root-only file. Read it with sudo:

sudo cat /root/syncthing-credentials.txt

Step 6 - Sign in to the web GUI

Browse to http://<vm-public-ip>/ and sign in with the username admin and the password from Step 5.

The dashboard shows this device, its folders, remote devices and transfer rates.

Step 7 - Pair another device

Every Syncthing node is identified by its Device ID, a fingerprint of the device certificate generated on first boot. Show this node's Device ID:

sudo grep '^syncthing.device_id=' /root/syncthing-credentials.txt

In the GUI, choose Add Remote Device and paste the other device's ID. You find that ID in its GUI under Actions > Show ID. Then share a folder with it.

Install the Syncthing app on your other machines and accept the pairing there. Syncthing then keeps the shared folders in sync automatically over an encrypted connection on port 22000.

Step 8 - Use the REST API

The REST API is served through nginx on port 80 and authenticated with the per-VM API key:

KEY=$(sudo grep '^syncthing.apikey=' /root/syncthing-credentials.txt | cut -d= -f2-)
curl -s -H "X-API-Key: $KEY" http://127.0.0.1/rest/system/version | jq -r '.version'

Step 9 - Confirm the data disk

The configuration, device certificate, index database and default synced folder live on a dedicated Azure data disk, independent of the OS disk:

findmnt -no SOURCE,SIZE,FSTYPE,TARGET /var/lib/syncthing

Enabling HTTPS

For production, terminate TLS at nginx with a real domain that points at the VM's public IP. Install certbot and request a certificate. Replace the domain with your own:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Backup and maintenance

All Syncthing state lives on the dedicated data disk at /var/lib/syncthing. That includes the configuration, device certificate, index database and synced folders. Snapshot that disk in Azure to back up your sync node.

Keep the OS patched with sudo apt update && sudo apt upgrade. Restart the service with sudo systemctl restart syncthing.

Support

This image comes with 24/7 SecureAnyCloud support. Contact us by email or chat for help with deployment, upgrades, device pairing, TLS termination and storage.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Syncthing on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

This image runs Syncthing on AWS. A single Go binary serves the GUI and REST API behind nginx as a reverse proxy.

What you get:

The sync protocol listening on port 22000
The GUI listening on 127.0.0.1:8384, reached through nginx on port 80 (and 443 once you add TLS)
A one-shot first-boot service that regenerates the device certificate (a fresh Device ID), the API key and the administrator GUI password, all unique to that instance
The login and API key written to /root/syncthing-credentials.txt with mode 0600

Prerequisites

Before you deploy this image, you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network, inbound ports 80 and 443 from the networks you reach the GUI on, and inbound TCP 22000 from the devices you want to sync with
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Launch the instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Syncthing. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of t3.small or larger. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network, ports 80 and 443 from the networks you use, and TCP 22000 for the sync protocol. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialization takes under a minute after the instance state becomes Running and the status checks pass.

Launch the instance from the AWS CLI

The following command launches an instance from the SecureAnyCloud Syncthing Marketplace AMI into an existing subnet and security group. Replace the values in angle brackets:

<ami-id>: the AMI ID shown on the Marketplace listing
<key-name>: your EC2 key pair name
<subnet-id>: your subnet ID
<security-group-id>: a security group that opens ports 22, 80, 443 and 22000, as described above

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.small \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=syncthing-01}]'

On success, the command prints a JSON document. Note the instance ID. When the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect and retrieve the login

Connect over SSH with the key pair you selected and the public IP address from Step 2. The SSH login user depends on the operating system of the AMI variant you launched:

AMI variant SSH login user

Syncthing 2.1 on Ubuntu 24.04 ubuntu

The first-boot service runs before the SSH daemon becomes ready, so the credentials file is always in place when you first log in.

ssh <login-user>@<public-ip>
sudo cat /root/syncthing-credentials.txt

The plain-text file contains the GUI URL, the username (admin), the password, the API key and this node's Device ID.

From the same SSH session, confirm that the deployment is healthy. The health endpoint is open:

curl -fsS http://127.0.0.1/rest/noauth/health

{"status":"OK"}

A "status":"OK" response confirms that the full stack, nginx and the Syncthing server, is serving.

Sign in for the first time

Open a web browser and go to http://<public-ip>/. Syncthing presents an Authentication Required page. Enter the username admin and the password from /root/syncthing-credentials.txt, then select Log In.

A per-instance administrator password protects the GUI sign-in.

Explore the dashboard

After you sign in, the dashboard shows This Device (transfer rates, listeners, discovery, uptime, the version and this node's Device ID). Your Folders are on the left, and Remote Devices are on the right.

The dashboard summarizes this device, its folders, its remote devices and transfer rates.

Add a folder and pair a device

Syncthing syncs a folder between devices that have added each other by Device ID. To sync this node with your laptop or another server:

Select Add Folder, give it a label and a path (for example a directory on the /var/lib/syncthing volume), and save.
On your other machine, install Syncthing and copy its Device ID.
Here, select Add Remote Device, paste that Device ID, and share the folder with it. Accept the reciprocal request on the other machine.

Syncthing then keeps the folder in sync automatically, in both directions, over an encrypted connection.

Use the REST API

Every action is available through the REST API. Authenticate with the API key from the credentials file:

curl -fsS -H "X-API-Key: <api-key>" http://<public-ip>/rest/system/status

The interactive API and its configuration are documented at https://docs.syncthing.net/dev/rest.html.

Enable HTTPS with Let's Encrypt

For any production deployment, serve the GUI over HTTPS so that the login and API key cannot be intercepted. The image ships with nginx, which certbot can configure automatically.

These commands assume that a DNS record points your fully qualified domain name at the instance's public IP address.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d sync.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

Back up and maintain the node

Syncthing keeps its configuration, device certificate, index database and synced folders under /var/lib/syncthing. Back it up regularly:

sudo systemctl stop syncthing
sudo tar czf <backup-dir>/syncthing-data-$(date +%F).tgz -C /var/lib/syncthing .
sudo systemctl start syncthing

Ship the archive to an Amazon S3 bucket or another object store. The data directory is on its own EBS volume, so you can also take coordinated EBS snapshots.

Keep the device certificate (cert.pem/key.pem). It is this node's identity, and restoring it preserves the Device ID your peers trust.

To upgrade Syncthing, replace /usr/local/bin/syncthing with a newer release and restart the service. See https://docs.syncthing.net/.

Scale and operate

Attach a larger or additional EBS volume for /var/lib/syncthing as your synced data grows
Use the REST API to automate folder and device management
Restrict the GUI to your network, and expose only port 22000 publicly for the sync protocol

The official Syncthing documentation at https://docs.syncthing.net/ covers each of these.

Support

SecureAnyCloud provides 24/7/365 expert technical support for this image, with a guaranteed response within 24 hours and a one-hour average for critical issues. Contact sales@secureanycloud.com.

For general Syncthing questions, consult the documentation at https://docs.syncthing.net/. Syncthing is a trademark of its respective owner; use here is nominative and does not imply affiliation or endorsement.

Deploy on AWS

Launch Syncthing on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS