From ae381a3ddecfcf28284be2afa009adbab4ca934f Mon Sep 17 00:00:00 2001
From: Joe Mou <dev@mou.fo>
Date: Tue, 15 Apr 2025 16:52:42 -0400
Subject: Use ACLs to grant user access to /src/syncthing

---
 hostnix/elmo/configuration.nix |  2 +-
 hostnix/elmo/syncthing.nix     | 20 ++++++++++++++------
 hostnix/elmo/web.nix           |  5 +----
 3 files changed, 16 insertions(+), 11 deletions(-)

(limited to 'hostnix')

diff --git a/hostnix/elmo/configuration.nix b/hostnix/elmo/configuration.nix
index b68ed67..9218996 100644
--- a/hostnix/elmo/configuration.nix
+++ b/hostnix/elmo/configuration.nix
@@ -28,7 +28,7 @@
   users.users.joe = {
     isNormalUser = true;
     description = "Joe Mou";
-    extraGroups = [ "networkmanager" "wheel" "syncthing" ];
+    extraGroups = [ "networkmanager" "wheel" ];
     packages = with pkgs; [
       jq
       sqlite-interactive
diff --git a/hostnix/elmo/syncthing.nix b/hostnix/elmo/syncthing.nix
index 5767fd7..77da89e 100644
--- a/hostnix/elmo/syncthing.nix
+++ b/hostnix/elmo/syncthing.nix
@@ -10,12 +10,20 @@ let
   };
 in
 {
-  users.users.syncthing.homeMode = "0750";
-
-  # May be of limited usefulness because Syncthing generally ignores umask.
-  systemd.services.syncthing = {
-    serviceConfig.UMask = "0002";
-  };
+  # Syncthing generally ignores umask and makes it hard to set permission bits
+  # by default, so use ACLs to grant access. Also nginx is particularly
+  # difficult to grant granular access with classic permissions.
+  systemd.tmpfiles.rules = let
+    acls = builtins.concatStringsSep "," [
+      "d:u:joe:rwX"
+      "u:joe:rwX"
+      "d:u:nginx:rX"
+      "u:nginx:rX"
+    ];
+  in
+  [
+    "A /srv/syncthing - - - - ${acls}"
+  ];
 
   services.syncthing = {
     enable = true;
diff --git a/hostnix/elmo/web.nix b/hostnix/elmo/web.nix
index e63d336..09aa588 100644
--- a/hostnix/elmo/web.nix
+++ b/hostnix/elmo/web.nix
@@ -3,12 +3,9 @@
 # TODO serve /srv behind authentication
 
 {
+  # Assumes proper permissions set by syncthing.nix
   systemd.tmpfiles.rules = [
     "L /home/joe/Public - - - - /srv/syncthing/Public/"
-    # It's quite hard to allow granular access to nginx using classic UNIX
-    # permissions, so use ACLs instead.
-    "A+ /srv/syncthing - - - - d:u:nginx:rX"
-    "A+ /srv/syncthing - - - - u:nginx:rX"
   ];
 
   services.nginx = {
-- 
cgit v1.3.1