Comment by bowel

You can always turn off NAT, LAN announcement, Relays and STUN -- and run SyncThing behind WireGuard. I use Tailscale and it works like a charm.