Install Syncthing on your VPS
Infraa installs Syncthing on your VPS as a single pinned binary: continuous, encrypted, peer-to-peer file synchronization between your server and your other devices, with no cloud provider in the middle. The binary (2.1.2) is verified against upstream's signed SHA-256 checksums and runs as a dedicated non-root system user. The web GUI stays on localhost; the sync protocol listens publicly so your remote devices can connect.
- Versions
- Syncthing 2.1.2, a pinned single-binary release verified by SHA-256
- Works on
- Ubuntu 22.04, Ubuntu 24.04, and Debian 12
- Package source
- Pinned binary release
What does the Syncthing install do?
- Creates a dedicated, non-login system user (infraa-syncthing) — Syncthing never runs as root.
- Downloads the pinned Syncthing binary, verifying it against a SHA-256 checksum from the reviewed catalog before it's moved into place.
- Installs a systemd unit (infraa-syncthing.service) with the web GUI bound to 127.0.0.1 on your chosen port (8384 by default) and synced folders in /var/lib/infraa-syncthing.
- Enables and starts the service, then verifies the GUI is listening.
How do I install Syncthing with Infraa?
Connect your server
Run the Infraa install one-liner (curl install.infraa.sh | sh) on your VPS. The agent registers over an outbound connection in about 30 seconds — no inbound ports, no SSH keys to share.
Pick the service
Choose it from the one-click catalog in the dashboard, or just ask in chat. Infraa turns your request into a concrete, reviewable plan.
Review and approve
Read exactly what will run, then approve. The agent executes only the approved, cryptographically signed steps and streams progress live.
What happens after the install?
Infraa checks Syncthing every 60 seconds — the service unit and the GUI port. Reach the GUI over an SSH tunnel (or an nginx vhost) to pair your devices; syncing itself runs over Syncthing's encrypted protocol on port 22000, device-to-device.
Syncthing on Infraa — common questions
01Which ports does Syncthing open to the internet?
The sync protocol listens publicly on port 22000 (TCP and QUIC) plus local-discovery broadcasts on UDP 21027 — that's how your devices connect, and every connection is TLS-encrypted and mutually authenticated by device ID. The web GUI stays on 127.0.0.1.
02Is my data encrypted in transit?
Yes. Syncthing connections are TLS-encrypted between devices that have explicitly paired by device ID — no third party, no relay account, no cloud storage involved unless you opt into relays.
03Why is this module marked medium risk?
Because the sync protocol deliberately listens on a public port — that's the point of the tool — Infraa classifies it like nginx rather than the localhost-only modules. The GUI and your files still require device pairing and stay otherwise private.
Connect a server in 30 seconds, then install Syncthing from the catalog or just ask in chat.
