Skip to content

Syncthing — Encrypted Relay Node

🟪 tests

long term testing, seems to work

An encrypted relay is a cloud node that stores data without being able to read it. The source encrypts each folder with a per-folder password before sending.

When to use

  • You need an off-site copy but do not trust the host (rented VPS, shared server)
  • You want cloud redundancy without exposing plaintext data

Reference setup

Property Value
Host Hetzner VPS (<relay-ip>)
Run mode Docker (/opt/syncthing-intermediate/)
Data volume 200 GB at /mnt/st-data
Folder mode receiveencrypted for all shared folders
Device ID U2J25J6-FNFGAST-NMNXP4X-DGRRM5L-NSM35EX-75XCFAY-5YOK2DP-TEJC5QX

Setup steps

1. Run Syncthing in Docker

# /opt/syncthing-intermediate/docker-compose.yml
services:
  syncthing:
    image: syncthing/syncthing:latest
    container_name: syncthing
    hostname: st-intermediate
    restart: unless-stopped
    environment:
      - PUID=0
      - PGID=0
    ports:
      - "22000:22000/tcp"
      - "22000:22000/udp"
      - "21027:21027/udp"
      - "127.0.0.1:8384:8384"
    volumes:
      - /mnt/st-data:/var/syncthing

2. Mount data volume

# Attach the Hetzner block volume in Hetzner Cloud Console, then:
# Find the device: lsblk
# Format (first time only): mkfs.ext4 /dev/sdb
# Mount:
mount /dev/sdb /mnt/st-data

# Add to /etc/fstab for persistence:
echo "/dev/sdb  /mnt/st-data  ext4  defaults,nofail  0  2" >> /etc/fstab

3. Share folders from source

On the source node, for each folder to be relayed:

  1. Open Syncthing GUI → select folder → Edit → Sharing
  2. Add the relay device
  3. Set an Encryption Password (this is what keeps data unreadable on the relay)
  4. Save

On the relay node, accept the share — the folder type will be Receive Encrypted automatically.

4. Bulk wiring (many folders)

If you have many folders, use a script to wire them all at once.

Verification

  • On relay: confirm folders show type Receive Encrypted in GUI
  • On relay: confirm you cannot browse file contents (only encrypted blobs visible)
  • On source: confirm sync completes without errors

Notes

  • The relay Device ID must be added to the source before sharing folders
  • Encryption password is per-folder — use a password manager
  • The relay cannot initiate a restore; only the source (with the password) can decrypt

← Syncthing — Config Backup · Syncthing — Hot Spare / Secondary Node →

tf5-7hi · v2026-05-16 · Export created: 2026-06-11 15:08 UTC