This repository has no description
2.5 kB
98 lines
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7let
8
9 shares = {
10 "/home/lass/sync" = [
11 "mors"
12 "green"
13 "coaxmetal"
14 "ignavia"
15 ]; # TODO add aergia
16 "/home/lass/tmp/the_playlist" = [
17 "mors"
18 "prism"
19 "radio"
20 ];
21 # "/home/lass/.weechat" = [ "green" "mors" ];
22 "/home/lass/decsync" = [
23 "mors"
24 "green"
25 "massulus"
26 "massulus2"
27 ];
28 };
29
30 machine_peers = lib.foldr (
31 host: acc:
32 if builtins.pathExists ../machines/${host}/facts/syncthing.pub then
33 acc
34 // {
35 ${host}.id = lib.removeSuffix "\n" (builtins.readFile ../machines/${host}/facts/syncthing.pub);
36 }
37 else
38 acc
39 ) { } (lib.attrNames (builtins.readDir ../machines));
40
41 all_peers = machine_peers // {
42 "massulus".id = "R2EGJ5S-PQMETUP-C2UGXQG-A6VP7TB-NGSN3MV-C7OGSWT-SZ34L3X-H6IF6AQ";
43 "massulus2".id = "OTJBJNO-VHBCVDL-QSELUS7-S6JDMYR-7WLE36A-6XSRSLP-VKYOYJJ-AHFGZAG";
44 };
45
46 used_peer_names = lib.unique (
47 lib.filter lib.isString (
48 lib.flatten (lib.mapAttrsToList (_n: v: v.devices) config.services.syncthing.settings.folders)
49 )
50 );
51 used_peers = lib.filterAttrs (n: _v: lib.elem n used_peer_names) all_peers;
52in
53{
54 services.syncthing = {
55 enable = true;
56 group = "syncthing";
57 configDir = "/var/lib/syncthing";
58 key = "${config.krebs.secret.directory}/syncthing.key";
59 cert = "${config.krebs.secret.directory}/syncthing.cert";
60 settings.devices = used_peers;
61 settings.folders = lib.mapAttrs (share: devices: {
62 enable = lib.elem config.networking.hostName devices;
63 path = share;
64 ignorePerms = false;
65 versioning = {
66 type = "trashcan";
67 params = {
68 cleanoutDays = "30";
69 };
70 };
71 devices = devices;
72 }) shares;
73 user = "lass";
74 };
75
76 clanCore.facts.services.syncthing = {
77 secret."syncthing.key" = { };
78 secret."syncthing.cert" = { };
79 public."syncthing.pub" = { };
80 generator.path = with pkgs; [
81 coreutils
82 gnugrep
83 syncthing
84 ];
85 generator.script = ''
86 syncthing generate --config "$secrets"
87 mv "$secrets"/key.pem "$secrets"/syncthing.key
88 mv "$secrets"/cert.pem "$secrets"/syncthing.cert
89 cat "$secrets"/config.xml | grep -oP '(?<=<device id=")[^"]+' | uniq > "$facts"/syncthing.pub
90 '';
91 };
92
93 boot.kernel.sysctl."fs.inotify.max_user_watches" = 524288;
94 networking.firewall = {
95 allowedTCPPorts = [ 22000 ];
96 allowedUDPPorts = [ 21027 ];
97 };
98}