Syncthing — Hot Spare / Secondary Node
🟪 tests
currently in testing with real data
A hot spare is a machine that holds a full, readable mirror of all source folders. It can take over if the source is lost or unavailable.
When to use
- You need a local readable copy (fast restore, no decryption needed)
- You want a failover option without manual intervention
Reference setup
| Property | Value |
|---|---|
| Host | secondary-host |
| Local IP | <secondary-ip> (home) / <secondary-ip> (other location) |
| Folder mode | receiveonly for all shared folders |
| Mirror path | ~/mirror/<original-relative-path> |
| Device ID | BRKXCVM-74J5YZW-626KTHZ-TUMUT2Z-W2XTMMM-POB6GXY-4ECPP6T-ZZIM2QQ |
Setup steps
1. Install Syncthing
Install Syncthing on the secondary (same as source — see Syncthing overview).
Run as a user service: systemctl --user enable --now syncthing.
2. Accept folders from source
On the source node, share each folder with the secondary device (no encryption password — secondary gets plaintext).
On the secondary: accept each share and set folder type to Receive Only.
Mirror path convention used here: ~/mirror/<original-relative-path>
3. Staggered versioning (optional but recommended)
Enable staggered file versioning on the secondary to retain deleted/overwritten files.
Syncthing GUI → folder → Edit → File Versioning → Staggered
Recommended parameters:
| Parameter | Value | Effect |
|---|---|---|
| Keep versions for | 365 days | Deleted/overwritten files recoverable for one year |
| Clean interval | 3600 s | Housekeeping runs hourly |
| Max age | 365 days | Versions older than this are removed |
4. Failover script
st-failover.sh is a full-machine failover script. Run it on the secondary when the source is lost:
- Restores the source's
cert.pem+key.pem(identity) from the config backup mirror - Merges the source's
config.xml(device list + folder encryption passwords) into the secondary's config - Moves
~/mirror/*back to original~/paths — data accessible at expected locations - Restarts Syncthing — secondary now appears to peers as the original source
# Dry-run first (no changes):
./st-failover.sh --dry-run
# Live run — prompts "type 'failover' to proceed":
./st-failover.sh
Prerequisites:
- Config backup must be synced to
~/mirror/.local/state/syncthing-export/(see Config backup) - Run after source is confirmed offline
Verification
- Confirm all folders sync to
~/mirror/on the secondary - Run a dry-run of
st-failover.shand verify output - Test restore: copy a file from mirror back to a test location
Known hosts
TARGET_KNOWN_HOSTS="<secondary-ip> <secondary-ip>" # home first, other location second
← Syncthing — Encrypted Relay Node · Kubernetes →