1 files changed, 193 insertions, 0 deletions
diff --git a/hostnix/elmo/syncthing.nix b/hostnix/elmo/syncthing.nix
new file mode 100644
index 0000000..2bb3425
--- /dev/null
+++ b/hostnix/elmo/syncthing.nix
@@ -0,0 +1,193 @@
+{ lib, ... }:
+
+# TODO iCloud bridge
+
+let
+  staggeredVersioning = {
+    type = "staggered";
+    params = {
+      cleanInterval = "3600";
+      maxAge = "31536000";
+    };
+  };
+in
+{
+  # Syncthing generally ignores umask and makes it hard to set permission bits
+  # by default, so use ACLs to grant access. Also nginx is particularly
+  # difficult to grant granular access with classic permissions.
+  systemd.tmpfiles.rules =
+    let
+      acls = builtins.concatStringsSep "," [
+        "user:joe:rwX"
+        "default:user:joe:rwX"
+        "user:nginx:rX"
+        "default:user:nginx:rX"
+      ];
+    in
+    [
+      "d /srv/syncthing 0700 syncthing syncthing"
+      "A /srv/syncthing - - - - ${acls}"
+    ];
+
+  # Disable Syncthing service home creation which clobbers above permissions.
+  users.users.syncthing.createHome = lib.mkForce false;
+
+  services.syncthing = {
+    enable = true;
+    openDefaultPorts = true;
+    # Syncthing supports named sockets but the NixOS module assumes network.
+    guiAddress = "[::1]:8384";
+    dataDir = "/srv/syncthing";
+    settings = {
+      devices = {
+        "Asus Nexus 7" = {
+          id = "BVZARYC-2D56A6I-V6L2VQF-MU7IVCT-ITJTCGQ-IGMZG2W-RZRCTOT-K4GDHAY";
+        };
+        "DESKTOP-SFVBFBU" = {
+          id = "T547Y5S-HUO5WIC-DM3Z7LS-UG647YR-ZQAMZHU-LIZHDY5-Q5WQLXL-RNH2GAV";
+          autoAcceptFolders = true;
+        };
+        "Joe's iPad" = {
+          id = "Z34UWON-Y3H7CR6-XAMRQ6L-CZ4UQY7-ELOE44T-O6T6OYV-VHJSVTS-TIERJQX";
+          autoAcceptFolders = true;
+        };
+        "Joes-iPhone" = {
+          id = "P25LZDL-ZCHYEB3-FE3W4WW-YMMPWWF-27VY7DR-7Y25WNI-NJN7FXX-5PZZTQ5";
+          autoAcceptFolders = true;
+        };
+        "Joes-Mac-mini.local" = {
+          id = "K532ULN-SMFZDJR-U2NSGTY-HY35MXX-6POK7KI-CETEKLV-RMCGRHL-DVROHAF";
+          autoAcceptFolders = true;
+        };
+        "doughboy" = {
+          id = "BI3SWOB-NHPQBVW-XM46DB6-BQBO2PP-DI2OVAS-WBVX24P-WM7CZ3U-NXMBGAV";
+          autoAcceptFolders = true;
+        };
+        "penguin" = {
+          id = "5BEB6SZ-YAPV3CC-54RZF3V-HQXXP3Y-TTVDWDU-SHHNVCH-IXKZ3O2-6RXG6QL";
+          autoAcceptFolders = true;
+        };
+        "sparky" = {
+          id = "FE43LDI-33WS467-LIGFWCC-5PPSKN6-GYODEWJ-KLQZLN7-H3GYGLG-IJ2JGQW";
+          autoAcceptFolders = true;
+        };
+        "sparky-win" = {
+          id = "UWA5IFV-CKFMLRS-CUMUB7X-LABLQST-QK2ULLM-BUVW6CW-PBT5AQX-AUNPBAK";
+        };
+        "steamdeck" = {
+          id = "SCUAABL-XU6AS5H-IZZE4PN-LY5J4LH-OYZMXTU-2UMTVUL-I7B7QKE-ZBPSAQ5";
+          autoAcceptFolders = true;
+        };
+      };
+      folders = {
+        "Deck/Documents" = {
+          id = "mwxed-yy9gn";
+          path = "~/Deck/Documents";
+          versioning = staggeredVersioning;
+          devices = [ "steamdeck" ];
+        };
+        "Deck/extra" = {
+          id = "jzncl-7nkcq";
+          path = "~/Deck/extra";
+          versioning = staggeredVersioning;
+          devices = [ "steamdeck" ];
+        };
+        "Documents" = {
+          id = "bhemx-9nh3v";
+          path = "~/Documents";
+          versioning = staggeredVersioning;
+          devices = [
+            "doughboy"
+            "sparky"
+          ];
+        };
+        "Downloads" = {
+          id = "kvq6q-axjhu";
+          path = "~/Downloads";
+          versioning = staggeredVersioning;
+          devices = [
+            "doughboy"
+            "sparky"
+            "Joe's iPad"
+          ];
+        };
+        "Game/Epic Games/TheTalosPrinciple/UserData" = {
+          id = "vek7u-iausx";
+          path = "~/Game/Epic Games/TheTalosPrinciple/UserData";
+          versioning = staggeredVersioning;
+          devices = [
+            "DESKTOP-SFVBFBU"
+            "steamdeck"
+          ];
+        };
+        "Game/PCSX2" = {
+          id = "chxsg-hpqgm";
+          path = "~/Game/PCSX2";
+          versioning = staggeredVersioning;
+          devices = [ "steamdeck" ];
+        };
+        "Pictures" = {
+          id = "vfjsd-4fczh";
+          path = "~/Pictures";
+          versioning = staggeredVersioning;
+          devices = [
+            "doughboy"
+            "sparky"
+          ];
+        };
+        "Public" = {
+          id = "f6iys-eunyf";
+          path = "~/Public";
+          versioning = staggeredVersioning;
+          devices = [
+            "doughboy"
+            "sparky"
+          ];
+        };
+        "Sync" = {
+          id = "7thks-5badk";
+          path = "~/Sync";
+          versioning = staggeredVersioning;
+          devices = [
+            "Asus Nexus 7"
+            "DESKTOP-SFVBFBU"
+            "Joe's iPad"
+            "Joes-iPhone"
+            "doughboy"
+            "penguin"
+            "sparky"
+            "sparky-win"
+          ];
+        };
+        "Windows" = {
+          id = "gjcn7-qrsjr";
+          path = "~/Windows";
+          versioning = staggeredVersioning;
+          devices = [
+            "DESKTOP-SFVBFBU"
+            "sparky-win"
+          ];
+        };
+        "iPad" = {
+          id = "qtzmu-fqdrs";
+          path = "~/iPad";
+          devices = [
+            "Joe's iPad"
+          ];
+        };
+      };
+    };
+  };
+
+  services.nginx.virtualHosts."st.mou.fo" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://[::1]:8384";
+      # https://docs.syncthing.net/users/faq.html#why-do-i-get-host-check-error-in-the-gui-api
+      recommendedProxySettings = false;
+    };
+  };
+
+  services.oauth2-proxy.nginx.virtualHosts."st.mou.fo" = { };
+}