This repository has no description
2.0 kB
57 lines
1{ config, lib, pkgs, ... }:
2let
3
4 shares = {
5 "/home/lass/sync" = [ "mors" "xerxes" "green" "blue" "coaxmetal" "aergia" "ignavia" ];
6 "/home/lass/tmp/the_playlist" = [ "mors" "phone" "prism" "omo" "radio" ];
7 # "/home/lass/.weechat" = [ "green" "mors" ];
8 "/home/lass/decsync" = [ "mors" "blue" "green" "phone" "massulus" ];
9 };
10
11 mk_peers = lib.mapAttrs (n: v: { id = v.syncthing.id; });
12
13 all_peers = lib.filterAttrs (n: v: v.syncthing.id != null) config.krebs.hosts;
14 used_peer_names = lib.unique (lib.filter lib.isString (lib.flatten (lib.mapAttrsToList (n: v: v.devices) config.services.syncthing.folders)));
15 used_peers = lib.filterAttrs (n: v: lib.elem n used_peer_names) all_peers;
16in {
17 services.syncthing = {
18 enable = true;
19 group = "syncthing";
20 configDir = "/var/lib/syncthing";
21 key = "${config.krebs.secret.directory}/syncthing.key";
22 cert = "${config.krebs.secret.directory}/syncthing.cert";
23 # workaround for infinite recursion on unstable, remove in 23.11
24 settings.devices = mk_peers used_peers;
25 settings.folders = lib.mapAttrs (share: devices: {
26 enable = lib.elem config.networking.hostName devices;
27 path = share;
28 ignorePerms = false;
29 versioning = {
30 type = "trashcan";
31 params = {
32 cleanoutDays = "30";
33 };
34 };
35 devices = devices;
36 }) shares;
37 user = "lass";
38 };
39
40 clanCore.secrets.syncthing = {
41 secrets."syncthing.key" = { };
42 secrets."syncthing.cert" = { };
43 facts."syncthing.pub" = { };
44 generator.script = ''
45 ${pkgs.syncthing}/bin/syncthing generate --config "$secrets"
46 mv "$secrets"/key.pem "$secrets"/syncthing.key
47 mv "$secrets"/cert.pem "$secrets"/syncthing.cert
48 cat "$secrets"/config.xml | ${pkgs.gnugrep}/bin/grep -oP '(?<=<device id=")[^"]+' | uniq > "$facts"/syncthing.pub
49 '';
50 };
51
52 boot.kernel.sysctl."fs.inotify.max_user_watches" = 524288;
53 networking.firewall = {
54 allowedTCPPorts = [ 22000 ];
55 allowedUDPPorts = [ 21027 ];
56 };
57}