diff --git a/Caddyfile b/Caddyfile
index 8a63e72..1fdc4ec 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -1,7 +1,11 @@
 personaledson.com.br, app.personaledson.com.br, api.personaledson.com.br, www.personaledson.com.br {
-    reverse_proxy bigode-gateway-1:80
+	reverse_proxy bigode-gateway-1:80
 }
 
 www.nazareonline.com.br, nazareonline.com.br {
-    reverse_proxy nazareonline-web-1:80
+	reverse_proxy nazareonline-web-1:80
+}
+
+sync.waldson.com.br {
+	reverse_proxy syncthing-syncthing-1:8384
 }
diff --git a/README.md b/README.md
index 3896d78..fe5519b 100644
--- a/README.md
+++ b/README.md
@@ -18,6 +18,8 @@ compose.yaml   the Caddy service: publishes 80/443, joins proxy_net,
                bind-mounts the Caddyfile, persists certs in caddy_data
 Caddyfile      one site block per app; each reverse_proxies to a container
                reachable by name on proxy_net
+syncthing/     the Syncthing stack (own compose file); GUI behind Caddy,
+               sync protocol published on 22000
 ```
 
 ## Prerequisites
@@ -71,6 +73,66 @@ Bring the proxy up (or recreate it after a compose change) from that directory:
 docker compose up -d
 ```
 
+## Syncthing stack
+
+An always-on Syncthing peer for the owner's folders, giving devices somewhere
+to sync when no two of them are online together and keeping an off-site copy on
+the droplet. It lives in `syncthing/` and deploys to
+`/home/waldson/central-proxy/syncthing` on the droplet.
+
+Only the sync protocol is published on the host (`22000/tcp` and `22000/udp`),
+so devices connect directly instead of through community relays. The web GUI
+(`8384`) is **not** published; it is reached only through Caddy at
+`sync.waldson.com.br`, guarded by Syncthing's own username/password. The
+central `Caddyfile` already carries the `sync.waldson.com.br` block. Binding the
+GUI to a non-loopback address (`STGUIADDRESS=0.0.0.0:8384`, required so Caddy in
+its own container can reach it) also turns off Syncthing's DNS-rebinding host
+check, so a plain `reverse_proxy` needs no `Host`-header rewrite.
+
+### Where data lives
+
+Config (device keys, the folder list) and every synced folder live under the
+host bind mount `syncthing/data` (mounted at `/var/syncthing` in the container),
+so state survives container recreation and is inspectable over plain SSH. The
+directory is git-ignored. `PUID`/`PGID` default to `1000`; if the droplet's
+deploy user has a different id, adjust them in `compose.yaml` so the synced
+files stay owned by that user.
+
+### Deploy
+
+From `syncthing/` on the droplet:
+
+```sh
+docker compose up -d
+```
+
+The container comes up as `syncthing-syncthing-1` on `proxy_net`, which is the
+name Caddy reverse-proxies to. A restart preserves config and pairings:
+
+```sh
+docker compose restart
+```
+
+### Upgrade
+
+The image is `syncthing/syncthing:latest` (Syncthing publishes no rolling major
+tag; pin a specific version here if you want reproducible upgrades). To update:
+
+```sh
+docker compose pull && docker compose up -d
+```
+
+### First-run setup (interactive, in the GUI)
+
+These steps are done once by the owner at `https://sync.waldson.com.br`:
+
+1. Set the GUI username and password (Actions -> Settings -> GUI).
+2. Add the droplet as a device on each personal device (and vice versa), using
+   the device IDs shown under Actions -> Show ID.
+3. Share all five folders (Sync, phone-photos, comprovantes, notes,
+   torque-data) with the droplet and accept them on the droplet, pointing each
+   folder path under `/var/syncthing` so the data lands in the bind mount.
+
 ## Droplet groundwork
 
 Baseline host configuration for the droplet (`wloud`, 174.138.36.232,
diff --git a/syncthing/compose.yaml b/syncthing/compose.yaml
new file mode 100644
index 0000000..b7c102b
--- /dev/null
+++ b/syncthing/compose.yaml
@@ -0,0 +1,40 @@
+name: syncthing
+
+# Always-on Syncthing peer and off-site copy for the owner's folders. The web
+# GUI is reachable only through the central Caddy proxy on proxy_net (the GUI
+# port is never published); the sync protocol is published directly on host
+# 22000 so devices connect to the droplet without going through relays. See
+# README.md for the deploy, upgrade, and pairing runbook.
+
+services:
+  syncthing:
+    image: syncthing/syncthing:latest
+    restart: unless-stopped
+    hostname: droplet
+    environment:
+      # Own the bind-mounted files as the droplet's deploy user so synced data
+      # is inspectable and manageable over plain SSH.
+      PUID: "1000"
+      PGID: "1000"
+      # Bind the GUI to all interfaces inside the container so Caddy can reach
+      # it over proxy_net. The port is deliberately not published to the host;
+      # Syncthing's own credentials are the only thing guarding this surface.
+      STGUIADDRESS: "0.0.0.0:8384"
+    volumes:
+      # Config (device keys, folder list) and all folder data live here, on a
+      # host bind mount, so everything survives recreation and is visible over
+      # SSH. Git-ignored via the repo's data/ rule.
+      - ./data:/var/syncthing
+    ports:
+      # Sync protocol only. Device IDs authenticate the protocol, so exposing
+      # this publicly is safe by design. No local-discovery port (21027/udp) is
+      # published: it is useless on a public server with no LAN peers.
+      - "22000:22000/tcp"
+      - "22000:22000/udp"
+    mem_limit: 512m
+    networks:
+      - proxy_net
+
+networks:
+  proxy_net:
+    external: true