better syncthing setup

host/fw/default.nix

@@ -21,7 +21,6 @@
     inputs.lanzaboote.nixosModules.lanzaboote
     ./disko.nix
     ./hardware-configuration.nix
-    ./syncthing.nix
   ];
 
   # https://github.com/NixOS/nixos-hardware/issues/1603

host/fw/syncthing.nix

@@ -1,8 +0,0 @@
-{ ... }:
-{
-  services.syncthing = {
-    enable = true;
-    user = "hd";
-    configDir = "/home/hd/.config/syncthing";
-  };
-}

host/roam/syncthing.nix

@@ -6,6 +6,11 @@ in
   services.syncthing = {
     enable = true;
     inherit guiAddress;
+
+    settings.folders.sync = {
+      path = "/data/sync/documents-hd";
+      type = "receiveencrypted";
+    };
   };
 
   services.nginx = {

host/solo/default.nix

@@ -7,6 +7,12 @@
   };
   hd.desktop.enable = true;
 
+  services.syncthing = {
+    enable = true;
+    user = "hd";
+    configDir = "/home/hd/.config/syncthing";
+  };
+
   age.identityPaths = [
     "/root/.ssh/id_ed25519"
   ];

mod/desktop/default.nix

@@ -109,6 +109,7 @@ with lib;
     ./security.nix
     ./services.nix
     ./software
+    ./syncthing.nix
     ./window-manager.nix
   ];
 

mod/desktop/syncthing.nix

@@ -0,0 +1,29 @@
+{ lib, var, ... }:
+{
+  services.syncthing = {
+    enable = lib.mkDefault true;
+    user = "hd";
+    settings.folders = {
+      sync = {
+        path = "/home/hd/Sync";
+        type = "sendreceive";
+      };
+      supernote-note = rec {
+        id = "supernote-note";
+        path = "/home/hd/Sync/Dokumente/Supernote/Notizen";
+        type = "sendreceive";
+        devices = var.syncthing.device-names.desktops ++ [ "supernote" ];
+        versioning = {
+          type = "simple";
+          params.keep = "10";
+        };
+      };
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /home/hd/Sync 0755 hd users - -"
+    "L+ /home/hd/Documents - - - - /home/hd/Sync/Dokumente"
+    "L+ /home/hd/Desktop - - - - /home/hd/Sync/Desktop"
+  ];
+}

mod/syncthing.nix

@@ -12,20 +12,16 @@ let
   is-managed = var.syncthing.managed ? ${this};
   is-server = this == "roam";
 
-  devices = lib.attrNames var.syncthing.all;
+  folders = {
-  desktop-devices = (lib.intersectLists var.nixos-desktops devices);
+    sync = {
+      id = "documents-hd"; # don't change ID
+      path = lib.mkDefault (builtins.throw "You must set services.syncthing.folders.sync.path!!!");
+      type = lib.mkDefault (builtins.throw "You must set services.syncthing.folders.sync.type!!!");
 
-  folders = folders-all // (if config.hd.desktop.enable then folders-desktop else { });
-
-  folders-all = {
-    documents = {
-      id = "documents-hd";
-      path = if is-server then "/data/sync/documents-hd" else "/home/hd/Sync";
-      type = if is-server then "receiveencrypted" else "sendreceive";
       # all clients (desktops + servers) that have are a synthing peer but
       # with untrusted servers
       devices =
-        desktop-devices
+        var.syncthing.device-names.desktops
         ++ (
           if this != "roam" then
             [
@@ -43,19 +39,6 @@ let
       };
     };
   };
-
-  folders-desktop = {
-    supernote-note = rec {
-      id = "supernote-note";
-      path = if is-server then "/data/sync/${id}" else "/home/hd/Sync/Dokumente/Supernote/Notizen";
-      type = "sendreceive";
-      devices = desktop-devices ++ [ "supernote" ];
-      versioning = {
-        type = "simple";
-        params.keep = "10";
-      };
-    };
-  };
 in
 {
   age.secrets.syncthing-password = lib.mkIf (cfg.enable && !is-server) {
@@ -73,11 +56,12 @@ in
   };
 
   services.syncthing = lib.mkIf cfg.enable (
-    assert lib.assertMsg (builtins.elem this devices) "${this} is not in devices in mod/syncthing.nix";
+    assert lib.assertMsg (builtins.elem this var.syncthing.device-names.all)
+      "${this} is not in devices in mod/syncthing.nix";
     {
       settings = {
         inherit folders;
-        devices = var.syncthing.all;
+        devices = var.syncthing.devices;
       };
       key = lib.optionalAttrs is-managed config.age.secrets.syncthing-key.path;
       cert = lib.optionalAttrs is-managed "${../pki/syncthing + "/${this}.cert"}";

var/syncthing.nix

@@ -17,5 +17,10 @@ assert (
 );
 rec {
   managed = builtins.mapAttrs (_: v: { id = v; }) hashes;
-  all = unmanaged // managed;
+  devices = unmanaged // managed;
+
+  device-names = rec {
+    all = lib.attrNames devices;
+    desktops = (lib.intersectLists var.nixos-desktops all);
+  };
 }