From c5309311319388a3af5581998e05cc6b0daa9935 Mon Sep 17 00:00:00 2001 From: hxsnaatdev Date: Fri, 10 Jul 2026 11:50:26 +0530 Subject: [PATCH 1/5] feat(sops): public age key for validation --- .sops.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 .sops.yaml diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 0000000..fd855f3 --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,8 @@ +keys: + - &ariz age125jaxrvms0c7vqw9gdqj7wf937v24jay2te5aflpuxfy7z3yhqrsy29r8r + +creation_rules: + - path_regex: secrets.yaml$ + key_groups: + - age: + - *ariz From 999102168993cf9a77d0b5f60746b44e09c7bc40 Mon Sep 17 00:00:00 2001 From: hxsnaatdev Date: Fri, 10 Jul 2026 11:52:39 +0530 Subject: [PATCH 2/5] feat(secret): add scynthing sops-managed gui password --- hosts/M4/darwin.nix | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/hosts/M4/darwin.nix b/hosts/M4/darwin.nix index 1963228..1777f4d 100644 --- a/hosts/M4/darwin.nix +++ b/hosts/M4/darwin.nix @@ -16,5 +16,17 @@ nixpkgs.hostPlatform = "aarch64-darwin"; system.primaryUser = "ariz"; + sops = { + defaultSopsFile = ../../secrets.yaml; + defaultSopsFormat = "yaml"; + + age.keyFile = "/Users/ariz/.config/sops/age/keys.txt"; + + secrets."syncthing/guiPassword" = { + owner = "ariz"; + mode = "0400"; + }; + }; + system.stateVersion = 6; } From c1725fccad932b567c8f00b087dfa596475ff5db Mon Sep 17 00:00:00 2001 From: hxsnaatdev Date: Fri, 10 Jul 2026 11:53:11 +0530 Subject: [PATCH 3/5] feat(syncthing) : import syncthing as a hm module --- home/home-manager.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/home/home-manager.nix b/home/home-manager.nix index 972c6a7..a17fcbd 100644 --- a/home/home-manager.nix +++ b/home/home-manager.nix @@ -5,6 +5,7 @@ ./dev/git.nix ./tty/shells/fish.nix ./tty/starship.nix + ./syncthing.nix ]; home.username = "ariz"; home.homeDirectory = lib.mkForce "/Users/ariz"; From f76e1694361075ac88f79d355dd2a7bc6870cc02 Mon Sep 17 00:00:00 2001 From: hxsnaatdev Date: Fri, 10 Jul 2026 11:54:10 +0530 Subject: [PATCH 4/5] feat: decalare syncthing gui password and secret --- secrets.yaml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 secrets.yaml diff --git a/secrets.yaml b/secrets.yaml new file mode 100644 index 0000000..1d78516 --- /dev/null +++ b/secrets.yaml @@ -0,0 +1,17 @@ +syncthing: + guiPassword: ENC[AES256_GCM,data:ii3r8ygf,iv:NXHT1FCLBW/bJ/oDx4rM4UohEC/rXNZDWUEijp7QJoA=,tag:m3a9ADa+bMVuwxQNeUqDpw==,type:str] +sops: + age: + - recipient: age125jaxrvms0c7vqw9gdqj7wf937v24jay2te5aflpuxfy7z3yhqrsy29r8r + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0ajM2QmN1dWVQV0NKc1ZI + OEVNTFRqaG5RWjdhSWlsQkk4ZkxOZ3ExK3lzCk9KODFHQnFlRERORVJXdlVaOTIv + bWEzM3VTbGpsYlJRQ3QvY1BjYXZXUHMKLS0tIFliYWttOW8xQjZIQkU2RVlEejFX + WjZvdmJTRFVxcjFmM0NyS3NtbXVXUjgKUzwUJZ0DPyXfNy73YF5pkCkPf+HXCIYD + AGXvU9dKPs0ajZ8zuWaBMfr78a2D2BJ8zZonce+YzZshFjSqOqTV0g== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-07-10T05:47:11Z" + mac: ENC[AES256_GCM,data:fbAXrr2BIsOF2QENn5Uk+3m7Z9EiksEEAimApKU9GR2UZzxne8r/BwyTV/en1cSXMJ2XpJhOw6vkDNSFmYOqxbmQTD1JITC55cKFQIQc2S7xFqPwcAkty8gcKRIa9Vz32VgURqMTWNdmV+U55ZRxOmbQbtNBFW2xIOYrLUZOo1M=,iv:wcX8Jx8NtNcrZtvBWcbj2HrCB1ZqiUBAlbFxSRGwmFU=,tag:o8nH//bmK9agTKV1wp4r/w==,type:str] + unencrypted_suffix: _unencrypted + version: 3.11.0 From 08539b6d86ebc2ee5884db5f1ee571a4c59d4685 Mon Sep 17 00:00:00 2001 From: hxsnaatdev Date: Fri, 10 Jul 2026 11:54:58 +0530 Subject: [PATCH 5/5] feat: syncthing service via hm --- home/syncthing.nix | 84 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 84 insertions(+) create mode 100644 home/syncthing.nix diff --git a/home/syncthing.nix b/home/syncthing.nix new file mode 100644 index 0000000..e793fb4 --- /dev/null +++ b/home/syncthing.nix @@ -0,0 +1,84 @@ +{syncthingGuiPasswordFile, ...}: { + services.syncthing = { + enable = true; + + guiAddress = "127.0.0.1:8384"; + guiCredentials = { + username = "ariz"; + passwordFile = syncthingGuiPasswordFile; + }; + + overrideDevices = true; + overrideFolders = true; + + settings = { + devices = { + m1 = { + id = "TMDXC4A-4JE25JA-QD3EX7V-OHTMQI5-4RCWPDP-BBJZZ6P-VX3F3MU-BA56UQ4"; + name = "m1"; + addresses = ["dynamic"]; + compression = "metadata"; + introducer = false; + autoAcceptFolders = false; + }; + }; + + folders = { + SecondBrain = { + id = "kwtog-xward"; + label = "SecondBrain"; + path = "/Users/ariz/SecondBrain"; + type = "sendreceive"; + devices = ["m1"]; + rescanIntervalS = 3600; + fsWatcherEnabled = true; + fsWatcherDelayS = 10; + fsWatcherTimeoutS = 0; + ignorePerms = false; + autoNormalize = true; + minDiskFree = { + unit = "%"; + value = 1; + }; + maxConflicts = 10; + markerName = ".stfolder"; + maxConcurrentWrites = 16; + }; + }; + + gui = { + tls = false; + theme = "default"; + }; + + options = { + listenAddresses = ["default"]; + globalAnnounceServers = ["default"]; + globalAnnounceEnabled = true; + localAnnounceEnabled = true; + localAnnouncePort = 21027; + localAnnounceMCAddr = "[ff12::8384]:21027"; + relaysEnabled = true; + natEnabled = true; + urAccepted = 3; + urSeen = 3; + urUniqueID = "dQqZX7jq"; + urURL = "https://data.syncthing.net/newdata"; + urInitialDelayS = 1800; + autoUpgradeIntervalH = 12; + keepTemporariesH = 24; + progressUpdateIntervalS = 5; + minHomeDiskFree = { + unit = "%"; + value = 1; + }; + releasesURL = "https://upgrades.syncthing.net/meta.json"; + setLowPriority = true; + crashReportingURL = "https://crash.syncthing.net/newcrash"; + crashReportingEnabled = true; + stunServer = "default"; + announceLANAddresses = true; + }; + }; + }; +}