This repository has no description
1.5 kB
39 lines
1{ config, lib, pkgs, ... }: with lib;
2let
3 mk_peers = mapAttrs (n: v: { id = v.syncthing.id; });
4
5 all_peers = filterAttrs (n: v: v.syncthing.id != null) config.krebs.hosts;
6 used_peer_names = unique (filter isString (flatten (mapAttrsToList (n: v: v.devices) config.services.syncthing.folders)));
7 used_peers = filterAttrs (n: v: elem n used_peer_names) all_peers;
8in {
9 services.syncthing = {
10 enable = true;
11 group = "syncthing";
12 configDir = "/var/lib/syncthing";
13 key = "${config.krebs.secret.directory}/syncthing.key";
14 cert = "${config.krebs.secret.directory}/syncthing.cert";
15 # workaround for infinite recursion on unstable, remove in 23.11
16 settings.devices = mk_peers used_peers;
17 };
18
19 clanCore.secrets.syncthing = {
20 secrets."syncthing.key" = { };
21 secrets."syncthing.cert" = { };
22 facts."syncthing.pub" = { };
23 generator = ''
24 ${pkgs.syncthing}/bin/syncthing generate --config "$secrets"
25 mv "$secrets"/key.pem "$secrets"/syncthing.key
26 mv "$secrets"/cert.pem "$secrets"/syncthing.cert
27 cat "$secrets"/config.xml | ${pkgs.gnugrep}/bin/grep -oP '(?<=<device id=")[^"]+' | uniq > "$facts"/syncthing.pub
28 '';
29 };
30
31 boot.kernel.sysctl."fs.inotify.max_user_watches" = 524288;
32 krebs.iptables.tables.filter.INPUT.rules = [
33 { predicate = "-p tcp --dport 22000"; target = "ACCEPT";}
34 { predicate = "-p udp --dport 21027"; target = "ACCEPT";}
35 ];
36 system.activationScripts.syncthing-home = mkDefault ''
37 ${pkgs.coreutils}/bin/chmod a+x /home/lass
38 '';
39}