add headscale and syncthing

modules/syncthing/default.nix

@@ -0,0 +1,257 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.modules.syncthing;
+
+  # Helper function to create a serviceConfig entry if the condition is met
+  mkServiceConfigOption = name: value: mkIf (value != null) { "${name}" = value; };
+
+  # Construct the settings object for Syncthing
+  syncthingSettings = mkMerge [
+    # GUI configuration
+    (mkIf cfg.gui.enable {
+      gui = mkMerge [
+        (mkIf (cfg.gui.user != null) {
+          user = cfg.gui.user;
+        })
+      ];
+    })
+
+    # Devices configuration
+    (mkIf (cfg.devices != {}) {
+      devices = mapAttrs (name: device: {
+        id = device.id;
+      } // optionalAttrs (device.name != null) {
+        name = device.name;
+      } // optionalAttrs (device.addresses != []) {
+        addresses = device.addresses;
+      }) cfg.devices;
+    })
+
+    # Folders configuration
+    (mkIf (cfg.folders != {}) {
+      folders = mapAttrs (name: folder: {
+        path = folder.path;
+        devices = folder.devices;
+      } // optionalAttrs (folder.ignorePerms != null) {
+        ignorePerms = folder.ignorePerms;
+      } // optionalAttrs (folder.type != null) {
+        type = folder.type;
+      } // optionalAttrs (folder.rescanIntervalS != null) {
+        rescanIntervalS = folder.rescanIntervalS;
+      } // optionalAttrs (folder.versioning != null) {
+        versioning = folder.versioning;
+      }) cfg.folders;
+    })
+
+    # Extra options
+    cfg.extraOptions
+  ];
+in
+{
+  options = {
+    modules.syncthing = {
+      enable = mkEnableOption "Deploy syncthing";
+
+      openDefaultPorts = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Open ports in the firewall for Syncthing";
+      };
+
+      disableDefaultFolder = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Don't create default ~/Sync folder";
+      };
+
+      gui = {
+        enable = mkEnableOption "Enable GUI configuration";
+
+        user = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = "GUI username";
+          example = "myuser";
+        };
+
+        passwordFile = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          description = "Path to file containing GUI password";
+          example = "config.age.secrets.syncthing-gui-password.path";
+        };
+      };
+
+      identity = {
+        keyPath = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          description = "Path to Syncthing private key for stable device ID";
+          example = "config.age.secrets.syncthing-key.path";
+        };
+
+        certPath = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          description = "Path to Syncthing certificate for stable device ID";
+          example = "config.age.secrets.syncthing-cert.path";
+        };
+      };
+
+      devices = mkOption {
+        type = types.attrsOf (types.submodule {
+          options = {
+            id = mkOption {
+              type = types.str;
+              description = "Device ID";
+              example = "DMWVMM6-MKEQVB4-I4UZTRH-5A6E24O-XHQTL3K-AAI5R5L-MXNMUGX-QTGRHQ2";
+            };
+
+            name = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = "Device name (optional)";
+            };
+
+            addresses = mkOption {
+              type = types.listOf types.str;
+              default = [];
+              description = "Device addresses";
+              example = [ "tcp://192.168.1.100:22000" ];
+            };
+          };
+        });
+        default = {};
+        description = "Syncthing devices configuration";
+        example = {
+          "laptop" = {
+            id = "DMWVMM6-MKEQVB4-I4UZTRH-5A6E24O-XHQTL3K-AAI5R5L-MXNMUGX-QTGRHQ2";
+          };
+          "phone" = {
+            id = "ANOTHER-DEVICE-ID-GOES-HERE";
+            addresses = [ "tcp://192.168.1.101:22000" ];
+          };
+        };
+      };
+
+      folders = mkOption {
+        type = types.attrsOf (types.submodule {
+          options = {
+            path = mkOption {
+              type = types.str;
+              description = "Local folder path";
+              example = "/home/myuser/Documents";
+            };
+
+            devices = mkOption {
+              type = types.listOf (types.either types.str (types.submodule {
+                options = {
+                  name = mkOption {
+                    type = types.str;
+                    description = "Device name";
+                  };
+
+                  encryptionPasswordFile = mkOption {
+                    type = types.path;
+                    description = "Path to file containing encryption password";
+                  };
+                };
+              }));
+              default = [];
+              description = "List of devices that can access this folder";
+              example = [ "laptop" "phone" ];
+            };
+
+            ignorePerms = mkOption {
+              type = types.nullOr types.bool;
+              default = null;
+              description = "Whether to ignore file permissions";
+            };
+
+            type = mkOption {
+              type = types.nullOr (types.enum [ "sendreceive" "sendonly" "receiveonly" ]);
+              default = null;
+              description = "Folder type";
+            };
+
+            rescanIntervalS = mkOption {
+              type = types.nullOr types.int;
+              default = null;
+              description = "Rescan interval in seconds";
+            };
+
+            versioning = mkOption {
+              type = types.nullOr (types.submodule {
+                options = {
+                  type = mkOption {
+                    type = types.enum [ "external" "simple" "staggered" "trashcan" ];
+                    description = "Versioning type";
+                  };
+
+                  params = mkOption {
+                    type = types.attrsOf types.str;
+                    default = {};
+                    description = "Versioning parameters";
+                  };
+                };
+              });
+              default = null;
+              description = "Folder versioning configuration";
+            };
+          };
+        });
+        default = {};
+        description = "Syncthing folders configuration";
+        example = {
+          "Documents" = {
+            path = "/home/myuser/Documents";
+            devices = [ "laptop" "phone" ];
+            ignorePerms = false;
+          };
+          "Sensitive" = {
+            path = "/home/myuser/Sensitive";
+            devices = [
+              "laptop"
+              {
+                name = "phone";
+                encryptionPasswordFile = "/run/secrets/syncthing-sensitive-password";
+              }
+            ];
+          };
+        };
+      };
+
+      extraOptions = mkOption {
+        type = types.attrsOf types.anything;
+        default = {};
+        description = "Additional Syncthing configuration options";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.syncthing = {
+      enable = true;
+      openDefaultPorts = cfg.openDefaultPorts;
+      # Set stable identity if provided
+      key = mkIf (cfg.identity.keyPath != null) cfg.identity.keyPath;
+      cert = mkIf (cfg.identity.certPath != null) cfg.identity.certPath;
+      # Combine all settings
+      settings = syncthingSettings;
+    };
+
+    # Configure systemd service options collectively
+    systemd.services.syncthing = {
+      # Add environment variable to disable default folder creation
+      environment.STNODEFAULTFOLDER = mkIf cfg.disableDefaultFolder "true";
+
+      # Add supplementary groups for secret access
+      serviceConfig.SupplementaryGroups = [ "syncthing-secrets" ];
+    };
+
+    # Create a group for accessing secrets
+    users.groups.syncthing-secrets = {};
+  };
+}