syncthing

Syncthing is designed with a “Zero-Trust” philosophy.

The Device ID is just a key: Device ID lets you knock on the door, but it doesn’t let you in.

The Handshake is the Lock: Syncthing requires a human on both sides to say “Yes, I know this person and I want their files to land in this specific folder.”

Integration with OCI

Here are the steps carried out for the integration of syncthing running on Alpine Linux with oci .

Installation & Optimization

The following steps ensured Syncthing was stable on the 1GB RAM AMD oci instance.

Installed syncthing from official package repositories. Limited the syncthing memory usage to prevent the OCI instance from crashing.

prabu@alpine-x86 ~ > cat /etc/conf.d/syncthing
# Use the names the init script is looking for
SYNCTHING_USER="syncthing:lighttpd"
SYNCTHING_ARGS="--no-browser --no-restart --home=/var/lib/syncthing"

# Memory Optimization
export GOMEMLIMIT=150MiB
export GOGC=20
# Fix file ownership
umask 002

Added the syncthing user to the lighttpd group so it could legally touch WebDAV files.

doas addgroup syncthing lighttpd

The following changes were made on the homepc2:

prabu@homepc2 ~> cat /etc/conf.d/syncthing
SYNCTHING_USER="prabu"
SYNCTHING_ARGS="--no-browser --no-restart"

# Enable the below only when debugging
# export STTRACE="watchaggregator"
# The below creates may create a flood of entries.
# export STTRACE="watchaggregator,scanner,fs"

# Overwrites the logger command
output_log="/var/log/syncthing-debug.log"
error_log="/var/log/syncthing-debug.log"

The necessary debug file was created and permissions granted:

doas touch /var/log/syncthing-debug.log
doas chown prabu:prabu /var/log/syncthing-debug.log

Connectivity & Handshake

Establishing the “trust” between your HomePC and the Cloud.

Most of these were done on the homepc2

• Copied Device ID from the GUI.
• Created an encrypted tunnel to access the OCI Syncthing GUI locally by the following command.

  ssh -L 9999:127.0.0.1:8384 prabu@140.245.241.34
  

• The previous ssh tunneling step required the below step on oci instance. Permitted the tunnel to pass through the SSH daemon.

  prabu@alpine-x86 ~> grep AllowTcpForwarding /etc/ssh/sshd_config
  AllowTcpForwarding yes
  #	AllowTcpForwarding no
  

• Accepted the Device ID from HomePC2 and accepted the Folder Share, all through the OCI syncthing GUI tunneled on homepc2 itself on the URL http://127.0.0.1:9999/ ↗
• Once the GUI configuration is finished, the management tunnel can be closed by changing AllowTcpForwarding back to no in sshd_config.

Silent tunnel for syncthing gui management

To use a “Silent Tunnel” Command:

ssh -N -f -L 9999:127.0.0.1:8384 prabu@140.245.241.34

To identify and kill any open tunnels, issue the command on homepc2:

pgrep -fa ssh | grep 9999
pkill -f "9999:127.0.0.1:8384"

Folder & Permission Alignment

• Pointed the incoming HomePC sync to the WebDAV root.(/var/www/webdav)
• Set the base owner to the sync engine and group to the web server for both Initial ownershipt and Inheritance using setgid(2775)

  doas chown -R syncthing:lighttpd /var/www/webdav
  doas chmod 2775 /var/www/webdav
  

• Alternately, the “Magic” Step of Setting the SetGID bit ensures any NEW file created in this folder inherits the group. To turn on the SGID feature on an existing directory without changing its current read/write permissions.(unlike 2775 above).

  chmod g+s /path/to/files
  

• To fix File and directory permissions so both Syncthing and Orgzly can Read/Write.

  doas find /var/www/webdav -type f -exec chmod 664 {} +
  doas find /var/www/webdav -type d -exec chmod 2775 {} +
  

Conflict Resolution & Cleanup

Removed duplicate files created when HomePC and OCI versions diverged.

rm /var/www/webdav/*.sync-conflict-*

Performance tuning

A few parameters were modified in the file /etc/sysctl.conf to increase watch limits as syncthing did not synchronize perfectly, when hugo_watcher service was added as mentioned in hugo_server page.

prabu@homepc2 ~> cat /etc/sysctl.conf
# content of this file will override /etc/sysctl.d/*
fs.inotify.max_user_watches=524288
fs.inotify.max_user_instances=1024
fs.inotify.max_queued_events=524288

To reload and verify the changes here are the steps:

prabu@homepc2 ~> doas sysctl -p
prabu@homepc2 ~> cat /proc/sys/fs/inotify/max_user_watches
524288

Even after the above steps, there were syncrhonisation issues as html changes by hugo were not picked up, whereas md file creation by ox-hugo was picked up. Gemini suggested this might be due to rapid deletion and creation of files/directories by hugo.

Fs Watcher Delay setting was changed from 10 to 60 for this folder alone Click Actions (top right) -> Advanced. The synchronisation issue seems to be resolved based on this.

While troubleshooting the following command was run to see the internal working. Stopped the syncthing service and ran this.

$ STTRACE="watchaggregator,scanner,fs" syncthing

The above Environment variable STTRACE is telling the Syncthing binary to “un-mute” its internal debug logs for the filesystem module.

Public relay for handling NAT

Syncthing prefers a direct connection between your devices. However, if both devices are behind firewalls or NAT (Network Address Translation) that prevent them from “seeing” each other directly, Syncthing uses a public relay to pass the data through. In the above example, 85.121.244.57 is the public relay. If Relaying is disabled in Syncthing, wait about 60 seconds and check the Remote Devices list in the Syncthing GUI. It should say TCP Direct or QUIC instead of Relay-TRS or Relay-CV.

CLI based workflow

Here is how to perform the “Accept” handshake without ever touching a browser.

Accept the HomePC2 Device

On your OCI instance, run this to see the “Pending” device request from your HomePC:

doas -u syncthing syncthing cli show pending devices

You will see your HomePC’s ID. To accept it:

doas -u syncthing syncthing cli config devices add --device-id [HOMEPC_ID] --name HomePC2

Accept the Shared Folder

First, find the Folder ID being offered (it’s usually a random string like abc12-xyz or the folder name):

doas -u syncthing syncthing cli show pending folders

Once you have the ID, run this to link it to your WebDAV directory:

doas -u syncthing syncthing cli config folders add --id [FOLDER_ID] --path /var/www/webdav --label [NAME]

When handling more clients and don’t want to do this every time, you can set your OCI server to “Auto-Accept” everything from your HomePC:

doas -u syncthing syncthing cli config devices [HOMEPC_ID] auto-accept-folders set true

Now, any new folder you share from your HomePC will automatically appear on the OCI server without you needing to run another command.

Syncthing on Android

The android application name is Syncthing-Fork, a wrapper for syncthing application. Following safety measures can be taken when using Syncthing in android .

The familiar Web GUI of syncthing desktop can be used as it is more featureful than the default android menu. Always Click ‘Exit’ to exit the app. Ensure that ‘Expert mode’ is checked under User Interface.

To disable accidental usage of mobile data for syncing files, it is always better to sync with a local desktop/laptop. If this is the case the following changes needs to be made:

• Uncheck the options ‘Global Discovery’ and ‘Enable Relaying’ under Settings->Syncthing Options.
• Ensure that except ‘Run on Wi-Fi’ and ‘Respect Android battery saving setting’, all other options are unchecked in Settings->Run Conditions.
• For extra safety disable ‘Mobile data’ in the Data Usage and verify that ‘Battery Saver’ is enabled in Battery option in the Settings->App Info->Syncthing-Fork.

Previous attemps

The below steps was used in mid'2020 Installation on Linux Mint

Add source: https://apt.syncthing.net/ ↗ ↗

$ sudo curl -s -o /usr/share/keyrings/syncthing-archive-keyring.gpg
https://syncthing.net/release-key.gpg*

$ echo "deb [signed-by=/usr/share/keyrings/syncthing-archive-keyring.gpg]
https://apt.syncthing.net/ syncthing stable" | sudo tee
/etc/apt/sources.list.d/syncthing.list*

Update and install syncthing:

$ sudo apt-get update
$ sudo apt-get install syncthing

Running syncthing as systemd user service

Executed the following commands on both the computers.

$ sudo systemctl enable syncthing@aniruth.service
$ sudo systemctl start syncthing@aniruth.service

Then shared the folders /data/docs/Aniruth and /home/aniruth/Downloads on both the machines. In the Actions->Advanced Menu, enabled Junctions As Dirs option for the folder /data/docs/Aniruth to ensure that the Downloads are synced and backed up in the /data/docs folder.

Multiple instance of Syncthing

https://www.linuxbabe.com/ubuntu/install-syncthing-ubuntu-desktop-server ↗

If you have multiple shared folders that belong to different users, it’s a good idea to run multiple instances of Syncthing for each user.

sudo systemctl start syncthing@user1.service sudo systemctl start syncthing@user2.service

If you run Syncthing as user1 and share folders belonging to user2, you are going to have out-of-sync/permission denied problems, because Syncthing will create the files with the user it runs as.

Each instance needs to have a unique GUI port and sync port, which can be configured in the user’s syncthing configuration file under the home directory.

nano ~/.config/syncthing/config.xml

GUI port configuration is

<address>127.0.0.1:8384</address>

The default sync port configuration is

<listenAddress>default</listenAddress>

You can change it to

<listenAddress>tcp://0.0.0.0:22001</listenAddress>

So after making the above changes, configuration details as follows

prabu@homepc-lm:~$ sudo ss -lnpt | grep syncthing

LISTEN0 4096 192.168.0.199:8390 0.0.0.0:* ..

LISTEN0 4096 127.0.0.1:8380 0.0.0.0:* ..

LISTEN0 4096 :22000 *: ..

LISTEN0 4096 :22001 *: ..

Removed due to excessive memory usage

Around late ‘20, decided to remove syncthing due to excessive memory usage on the linux pc’s. Earlier removed the android version, due to excess battery usage.