Fix /srv/syncthing ACLs

Disable home directory creation, which clobbers directory permissions.
Interestingly, after the ACLs are added the classic directory
permissions appear as 770; but happily it works fine.

Tip off was from https://discourse.nixos.org/t/home-facl-is-always-reset-in-21-05/13408

Also tried setting the ACL mask which wasn't the issue.

1 files changed, 11 insertions, 5 deletions

diff --git a/hostnix/elmo/syncthing.nix b/hostnix/elmo/syncthing.nix
index 664179b..357179a 100644
--- a/hostnix/elmo/syncthing.nix
+++ b/hostnix/elmo/syncthing.nix
@@ -1,4 +1,6 @@
-{ ... }:
+{ lib, ... }:
+
+# TODO iCloud bridge
 
 let
   staggeredVersioning = {
@@ -15,16 +17,20 @@ in
   # difficult to grant granular access with classic permissions.
   systemd.tmpfiles.rules = let
     acls = builtins.concatStringsSep "," [
-      "d:u:joe:rwX"
-      "u:joe:rwX"
-      "d:u:nginx:rX"
-      "u:nginx:rX"
+      "user:joe:rwX"
+      "default:user:joe:rwX"
+      "user:nginx:rX"
+      "default:user:nginx:rX"
     ];
   in
   [
+    "d /srv/syncthing 0700 syncthing syncthing"
     "A /srv/syncthing - - - - ${acls}"
   ];
 
+  # Disable Syncthing service home creation which clobbers above permissions.
+  users.users.syncthing.createHome = lib.mkForce false;
+
   services.syncthing = {
     enable = true;
     openDefaultPorts = true;