{ ... }:

{
  services.syncthing = {
    enable = true;
    openDefaultPorts = true;
    guiAddress = "[::1]:8384";
    devices = {
      "sparky" = {
        id = "FE43LDI-33WS467-LIGFWCC-5PPSKN6-GYODEWJ-KLQZLN7-H3GYGLG-IJ2JGQW";
        introducer = true;
        autoAcceptFolders = true;
      };
      "Joes-iPhone-6" = {
        id = "F5APH5K-XXO454B-6YU4BTT-YPHF4KT-OD7YF5Y-JTWJRSU-UNJ2KZK-IVJZNQT";
        autoAcceptFolders = true;
      };
      "iPad" = {
        id = "U7D7667-RFEFHXX-TUJGGII-CE62S6P-YC6MWNV-4LBJ4YJ-5ZUZVPT-GBC5PQH";
        autoAcceptFolders = true;
      };
    };
    folders = {
      "Sync" = {
        id = "7thks-5badk";
        path = "/var/lib/syncthing/Sync";
        versioning = {
          type = "staggered";
          params = {
            cleanInterval = "3600";
            maxAge = "31536000";
          };
        };
        devices = [ "sparky" "Joes-iPhone-6" "iPad" ];
      };
    };
  };

  services.nginx.virtualHosts."st.weebnix.mou.fo" = {
    enableACME = true;
    forceSSL = true;
    locations."/" = {
      proxyPass = "http://[::1]:8384";
      # https://docs.syncthing.net/users/faq.html#why-do-i-get-host-check-error-in-the-gui-api
      recommendedProxySettings = false;
    };
  };

  services.oauth2_proxy.nginx.virtualHosts = [ "st.weebnix.mou.fo" ];
}