43 lines
1.3 KiB
Nix
43 lines
1.3 KiB
Nix
|
{ pkgs, lib, config, ... }:
|
||
|
|
let
|
||
|
|
cfg = config.services.syncthing;
|
||
|
|
service = "syncthing";
|
||
|
|
secretsDir = "/etc/secrets/${service}";
|
||
|
|
password = {
|
||
|
|
path = "syncthing/${config.networking.hostName}";
|
||
|
|
selector = "@";
|
||
|
|
generator = ''(t="$(mktemp -d)" && ${lib.getExe pkgs.syncthing} generate --home="$t" &> /dev/null && cat "$t"/{cert,key}.pem && rm -rf "$t")'';
|
||
|
|
};
|
||
|
|
in
|
||
|
|
{
|
||
|
|
config = lib.mkIf cfg.enable {
|
||
|
|
services.${service} = {
|
||
|
|
guiAddress = "127.0.0.1:8385"; # DEBUG
|
||
|
|
|
||
|
|
openDefaultPorts = true;
|
||
|
|
configDir = "/var/lib/${service}";
|
||
|
|
databaseDir = "/var/cache/${service}";
|
||
|
|
dataDir = cfg.databaseDir; # Don't really care
|
||
|
|
|
||
|
|
key = "${secretsDir}/key.pem";
|
||
|
|
cert = "${secretsDir}/cert.pem";
|
||
|
|
};
|
||
|
|
systemd.services.${service} = {
|
||
|
|
serviceConfig.ExecStartPre = [
|
||
|
|
"+${pkgs.writeShellScript "syncthing-create-folders" ''
|
||
|
|
install -Dm700 -o ${cfg.user} -g ${cfg.group} -d ${cfg.configDir}
|
||
|
|
install -Dm700 -o ${cfg.user} -g ${cfg.group} -d ${cfg.databaseDir}
|
||
|
|
''}"
|
||
|
|
];
|
||
|
|
};
|
||
|
|
vivarium.passwordFiles = {
|
||
|
|
${cfg.key}.password = password // {
|
||
|
|
transform = "${lib.getExe pkgs.openssl} pkey";
|
||
|
|
};
|
||
|
|
${cfg.cert}.password = password // {
|
||
|
|
transform = "${lib.getExe pkgs.openssl} x509";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
}
|