{"id":28391240,"url":"https://github.com/threatpatrols/docker-cfwarp-syncthing","last_synced_at":"2026-04-25T21:31:08.973Z","repository":{"id":248369584,"uuid":"822054985","full_name":"threatpatrols/docker-cfwarp-syncthing","owner":"threatpatrols","description":"Run an instance of Syncthing in Docker with traffic via Cloudflare WARP","archived":false,"fork":false,"pushed_at":"2025-05-30T10:21:38.000Z","size":23,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-06-25T16:42:38.753Z","etag":null,"topics":["cfwarp","cloudflare","syncthing"],"latest_commit_sha":null,"homepage":"https://hub.docker.com/r/threatpatrols/cfwarp-syncthing","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/threatpatrols.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2024-06-30T07:21:51.000Z","updated_at":"2025-05-30T10:21:42.000Z","dependencies_parsed_at":"2024-07-14T12:27:39.296Z","dependency_job_id":"39c022fa-b991-4641-8cfc-ae741f1d0468","html_url":"https://github.com/threatpatrols/docker-cfwarp-syncthing","commit_stats":null,"previous_names":["threatpatrols/docker-cfwarp-syncthing"],"tags_count":8,"template":false,"template_full_name":null,"purl":"pkg:github/threatpatrols/docker-cfwarp-syncthing","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/threatpatrols%2Fdocker-cfwarp-syncthing","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/threatpatrols%2Fdocker-cfwarp-syncthing/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/threatpatrols%2Fdocker-cfwarp-syncthing/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/threatpatrols%2Fdocker-cfwarp-syncthing/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/threatpatrols","download_url":"https://codeload.github.com/threatpatrols/docker-cfwarp-syncthing/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/threatpatrols%2Fdocker-cfwarp-syncthing/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32278249,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-25T18:29:39.964Z","status":"ssl_error","status_checked_at":"2026-04-25T18:29:32.149Z","response_time":59,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cfwarp","cloudflare","syncthing"],"created_at":"2025-05-31T08:39:53.489Z","updated_at":"2026-04-25T21:31:08.957Z","avatar_url":"https://github.com/threatpatrols.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Syncthing via Cloudflare WARP on Docker\n\n## Usage\n\nRun an instance of [Syncthing](https://syncthing.net/) in Docker with traffic via Cloudflare WARP\nusing a `docker-compose.yml` similar to the one provided below.\n\n```yaml\nservices:\n  syncthing:\n    image: threatpatrols/cfwarp-syncthing:latest\n    \n    hostname: example01\n    container_name: syncthing-example01\n\n    privileged: true  # required for Cloudflare WARP\n\n    ports:\n      # Make \u003e\u003eVERY\u003c\u003c sure this binding is via 127.0.0.1 as shown else you will expose the Syncthing GUI interface \n      - 127.0.0.1:8384:8384\n\n    volumes:\n      # Required: Mount /var/syncthing to some local path that suits\n      - /some/local/path:/var/syncthing\n      # Optional: Mount /var/lib/cloudflare-warp so  allowing Cloudflare WARP to maintain device-account between restarts \n      - var-lib-cloudflare-warp:/var/lib/cloudflare-warp\n\nvolumes:\n  var-lib-cloudflare-warp:\n\n```\n\nBring it up with a standard `docker-compose up` command.\n\n### Docker run\n```shell\ndocker run --rm -it --privileged -p 127.0.0.1:8384:8384 threatpatrols/cfwarp-syncthing:latest\n```\n\n### Notes\n- Recent cloudflare warp versions (2024.11.309.0) now requires the use of the `--privileged` flag to handle the `tun` interface, would much prefer an explicit approach.\n- This sample `docker-compose.yml` should be modified to suit your situation, in particular the `/some/local/path` mount. \n- The container requires root privileges to enable the creation of a tunnel-interface (`/dev/net/tun`) required for Cloudflare WARP to bind to.\n- The container does not confirm to the do-one-thing doctrine since it starts both a Cloudflare WARP daemon and a Syncthing process, this is managed using a HEALTHCHECK to test for health of the Cloudflare WARP tunnel with an `exit 1` if down; together with loop that checks for the existence of `syncthing` that terminates when missing.\n- The Syncthing process is started as a regular unprivileged user, adjust the `STUID` and `STGID` to adjust the apparent user. \n- The container enforces the Syncthing option `local-ann-enabled=false` that prevents local network discovery, all connections therefore occur via external relay server(s) via the Cloudflare WARP tunnel.  \n- DNS is also tunneled to prevent local DNS query traffic leaks.\n\n\n## Configuration\n\nThe following environment variables are available for configuration:\n\n- `STUID`: user-id to run the Syncthing process (default: 1000); legacy variable-name `PUID` is still supported.\n\n- `STGID`: group-id to run the Syncthing process (default: 1000); legacy variable-name `PGID` is still supported.\n  \n- `STBASEDIR`: Base directory for the Syncthing directory paths, by default `/var/syncthing`; this is the path you should volume-mount; this is __not__ a standard Syncthing variable.\n\n- `STDATADIR`: Path for Syncthing data files, by default `${STBASEDIR}/data`; this is a standard Syncthing variable.\n\n- `STSHARESDIR`: Path for Syncthing shares, by default `${STSHARESDIR}/shares`; this is __not__ a standard Syncthing variable.\n\n- `STCONFDIR`: Path for Syncthing config files, by default `${STSHARESDIR}/config`; this is a standard Syncthing variable.\n\n- `STGUIADDRESS`: IP-address and port for Syncthing to listen, by default `0.0.0.0:8384`; this is a standard Syncthing variable; Pay special attention to ensure any port-binding to expose this is via `127.0.0.1` else you will expose the Syncthing GUI interface which will have very negative security outcomes. \n\n- `WARP_START_DELAY`: the delay time between starting the cloudflare-service and calling the cloudflare-cli to cause a connection (default: 5) seconds.\n\n- `WARP_CONNECT_RETRY_MAX`: the number of attempts that will be made to create a cloudflare-warp connection before aborting (default: 20).\n\n- `WARP_CONNECT_RETRY_SLEEP`: The delay time in-between connection retry attempts (default: 30) seconds.\n\n\n## Repos\n* Github: https://github.com/threatpatrols/docker-cfwarp-syncthing\n* DockerHub: https://hub.docker.com/r/threatpatrols/cfwarp-syncthing\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthreatpatrols%2Fdocker-cfwarp-syncthing","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fthreatpatrols%2Fdocker-cfwarp-syncthing","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthreatpatrols%2Fdocker-cfwarp-syncthing/lists"}