STDISCOSRV(1)

✨ NAME ✨

stdiscosrv — the Syncthing Discovery Server, bestie 💖 (this is the STDISCOSRV(1) page from the Syncthing manual, in case you were wondering which glow-up you just walked into)

---

🦋 SYNOPSIS 🦋

stdiscosrv [--debug] [--http] [--compression] [--version]
           [--cert=<file>] [--key=<string>]
           [--listen=<address>] [--metrics-listen=<address>]
           [--db-dir=<string>] [--db-flush-interval=<string>]

---

🌈 DESCRIPTION 🌈

okay so here's the tea ☕ — Syncthing relies on a discovery server to find peers on the internet. That's literally its whole job. Anyone can run a discovery server and point their Syncthing installations at it, no gatekeeping here 💅

And the Syncthing project itself also maintains a global cluster for public use, so you're never alone out there 🫶

---

💜 OPTIONS 💜

• --debug — turn on debug output. extra yapping, but make it logs 🔍
• --http — listen on HTTP (behind an HTTPS proxy). i.e. let the proxy handle the fancy TLS part, you just chill in plain HTTP 🧚
• --version — print the current version number and dip. that's it, that's the whole job 👑
• --compression — enable GZIP compression of HTTP responses. squeeze those bytes, slay 💅
• --cert=<file> — certificate file. default is "./cert.pem". Unused in --http mode. 🎀
• --key=<file> — key file. default is "./key.pem". Unused in --http mode. 🔑
• --listen=<address> — listen address. default is ":8443". yes bestie, 8443, remember that number 📌
• --metrics-listen=<address> — Prometheus compatible metrics endpoint listen address. default is disabled, so it's giving "don't perceive me" until you turn it on 📊
• --db-dir=<string> — database directory, where the data is stored. default is "." — yes, literally just the current directory, no cap 🗂️
• --db-flush-interval=<string> — interval at which the in-memory database is flushed to disk. default is "5m". every 5 minutes it remembers to save its work, unlike me during finals 😭

---

🌸 POINTING SYNCTHING AT YOUR DISCOVERY SERVER 🌸

By default, Syncthing uses a number of global discovery servers, and you can spot them by the entry default in the list of discovery servers. To make Syncthing use your own instance of stdiscosrv, open up Syncthing's web GUI. Go to settings, Global Discovery Server, and add stdiscosrv's host address to the comma-separated list, like:

https://disco.example.com:8443/

Note that stdiscosrv uses port 8443 by default. And for stdiscosrv to be available over the internet with a dynamic IP address, you will need a dynamic DNS service — because your IP is out here changing personalities every day and the internet needs to keep up 🦋

Deprecated since version v0.14.44: Prior versions need /v2/ appended to the discovery server address, e.g. https://disco.example.com:8443/v2/. old news, but we keep the receipts 💀

If you wish to use only your own discovery server, remove the default entry from the list. main character energy only, no shared spotlight ✨

---

🌸 SETTING UP 🌸

💖 Description

This whole guide is gonna assume you've already got Syncthing set up, bestie. If you haven't? No worries, go hit up Getting Started first and come back, we'll wait 🫶

🎀 Installing

Head over to the releases page — https://github.com/syncthing/discosrv/releases — and grab whatever file matches your operating system. Unpack it and boom, you get a binary called stdiscosrv (or stdiscosrv.exe if you're on Windows, iykyk 💅).

Start it however you vibe with most — honestly, double-clicking works in literally any graphical environment. And heads up: on that very first start, stdiscosrv is gonna generate its certificate files and its database right there in the current directory, unless you give it flags saying otherwise. It's giving "moving in without asking" but make it useful ✨

The discovery server can also come to you via apt, the Debian/Ubuntu package manager. Fresh releases live at syncthing's apt repository — https://apt.syncthing.net/ — and the package name is syncthing-discosrv.

🦋 Configuring

NOTE: if you're running an instance of Syncthing on the discovery server itself, you have to do one of two things: either add that instance to your other devices using a static address, or bind the discovery server and your Syncthing instances to different IP addresses. No cap, this one bites people.

🔐 Certificates

The discovery server does its whole thing over HTTPS. So to make sure client connections are secure, you've got three options, pick your fighter:

• Use a CA-signed certificate pair for the domain name you're gonna use for the discovery server. This is exactly like any other HTTPS website out there — clients authenticate the server based on its certificate and domain name. Classic, clean, iconic 👑
• Use any certificate pair and let clients authenticate the server based on its "device ID" (basically the same vibe as Syncthing-to-Syncthing authentication). This one plays nice with the certificate the discovery server generates for you automatically. Lowkey the easiest route.
• Pass the --http flag if the discovery server is sitting behind an SSL-secured reverse proxy. Configuration details are down below, keep scrolling 💅

For the first two options, you gotta hand the discovery server the paths to the certificate and key when it starts up. With the http flag? Not necessary, bestie:

$ stdiscosrv --cert=/path/to/cert.pem --key=/path/to/key.pem
Server device ID is 7DDRT7J-UICR4PM-PBIZYL3-MZOJ7X7-EX56JP6-IK6HHMW-S7EK32W-G3EUPQA

See that? The discovery server prints its device ID right at startup. So if you're using a non CA-signed certificate, that device ID (it's a fingerprint) has to be handed to the clients inside the discovery server URL:

https://disco.example.com:8443/?id=7DDRT7J-UICR4PM-PBIZYL3-MZOJ7X7-EX56JP6-IK6HHMW-S7EK32W-G3EUPQA

Otherwise — meaning if you are rocking a proper CA-signed cert — the URL is just:

https://disco.example.com:8443/

🌈 Reverse Proxy Setup

Added in version 1.8.0: A new “X-Client-Port” HTTP header was added.

So the discovery server can totally be run behind an SSL-secured reverse proxy, and doing that lets you:

• Use a subdomain name without needing a port number tacked onto the URL
• Share one SSL certificate across multiple services on the same server

Now listen, after you set this up: if the proxy is using a valid HTTPS certificate, clients should omit the ?id=... parameter from the discovery server URL in their config. Client-side validation gets handled by checking the visible proxy server's HTTPS certificate instead. But if the proxy is using a self-signed or somehow invalid certificate? Then clients still have to set that ?id=... parameter with the computed hash of the proxy's certificate.

Using a setup like that is discouraged and it is not covered on this page. Always favour using valid and widely recognised certificates, fr fr. Don't be messy with your TLS 🚫

⭐ Requirements

• Run the discovery server using the -http flag: stdiscosrv -http.
• SSL certificate/key configured for the reverse proxy.
• The “X-Forwarded-For” HTTP header must be passed through with the client's real IP address.
• The “X-Client-Port” HTTP header should be passed through, containing the client's real connection port.
• The “X-SSL-Cert” HTTP header must be passed through with the PEM-encoded client SSL certificate. This will be present in POST requests and may be empty in GET requests from clients. And hey — if you see syncthing-discosrv outputting no certificates when it's receiving POST requests, that's because the proxy is not passing this header through. That's your culprit right there 🔍
• The proxy must request the client SSL certificate but not require it to be signed by a trusted CA.

💜 Nginx

These lines in the configuration take care of the last four requirements listed above:

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Client-Port $remote_port;
proxy_set_header X-SSL-Cert $ssl_client_cert;
ssl_verify_client optional_no_ca;

And here's a complete example Nginx configuration file, no crumbs left. With this setup, clients can use https://discovery.example.com as the discovery server URL in the Syncthing settings 🎉

# HTTP 1.1 support
proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Client-Port $remote_port;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
proxy_set_header X-SSL-Cert $ssl_client_cert;
proxy_set_header X-Forwarded-Tls-Client-Cert "";
proxy_set_header X-Tls-Client-Cert-Der-Base64 "";
upstream discovery.example.com {
    # Local IP address:port for discovery server
    server 192.0.2.1:8443;
}
server {
        server_name discovery.example.com;
        listen 80;
        access_log /var/log/nginx/access.log vhost;
        return 301 https://$host$request_uri;
}
server {
        server_name discovery.example.com;

        listen 443 ssl http2;
        access_log /var/log/nginx/access.log vhost;

        # Mozilla Intermediate configuration (https://wiki.mozilla.org/Security/Server_Side_TLS)
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
        ssl_prefer_server_ciphers off;
        ssl_session_tickets off;
        ssl_session_timeout 5m;
        ssl_session_cache shared:SSL:50m;
        ssl_verify_client optional_no_ca;

        # OCSP stapling
        ssl_stapling on;
        ssl_stapling_verify on;

        # Certificates
        ssl_certificate /etc/nginx/certs/discovery.example.com.crt;
        ssl_certificate_key /etc/nginx/certs/discovery.example.com.key;

        # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
        ssl_dhparam /path/to/dhparam;

        # HSTS (ngx_http_headers_module is required) (63072000 seconds)
        add_header Strict-Transport-Security "max-age=63072000" always;

        location / {
                proxy_pass http://discovery.example.com;
        }
}

Oh and if you want an example of automating the SSL certificates and reverse-proxying the Discovery Server and Syncthing using Nginx, Let's Encrypt — https://letsencrypt.org/ — and Docker, you can find one here: https://forum.syncthing.net/t/docker-syncthing-and-syncthing-discovery-behind-nginx-reverse-proxy-with-lets-encrypt/6880 🐳✨

💀 Apache

The following lines must be added to the configuration:

SSLProxyEngine On
SSLVerifyClient optional_no_ca
RequestHeader set X-SSL-Cert "%{SSL_CLIENT_CERT}s"
RequestHeader unset X-Forwarded-Tls-Client-Cert
RequestHeader unset X-Tls-Client-Cert-Der-Base64

Now this next bit was observed to not be required, at least under Apache httpd 2.4.38, because the proxy module adds the needed header by default. But if you do need to explicitly add the following directive, make sure you issue a2enmod remoteip first. Then add this to your Apache httpd configuration:

RemoteIPHeader X-Forwarded-For

🍓 Caddy

The following lines must be added to the Caddyfile:

  discovery.example.com {
    reverse_proxy 192.0.2.1:8443 {
      header_up X-Forwarded-For {http.request.remote.host}
      header_up X-Client-Port {http.request.remote.port}
      header_up X-Tls-Client-Cert-Der-Base64 {http.request.tls.client.certificate_der_base64}
      header_up -X-Ssl-Cert
      header_up -X-Forwarded-Tls-Client-Cert
    }

    tls {
      client_auth {
        mode request
      }
    }
}

For more details, see also the recommendations in the Reverse Proxy Setup page — https://docs.syncthing.net/users/reverseproxy.html. But ngl, that page is directed at setting up a proxy for the Syncthing web UI. So you should do the proper path and port adjustments for proxying the discovery server and your particular setup. Adapt, don't copy-paste blindly 🧚

---

👀 SEE ALSO

syncthing-networking(7), syncthing-faq(7)

✍️ AUTHOR

The Syncthing Authors

©️ COPYRIGHT

2014-2026, The Syncthing Authors

---

And that's the whole page, bestie, you made it to the end 🎀 This was STDISCOSRV(1), from the v2.1.0 release, dated Sep 10, 2026 — go forth and discover, you absolute icon 👑💖