Feat/sops: add syncthing with sops-managed GUI password

.sops.yaml

@@ -0,0 +1,8 @@
+keys:
+  - &ariz age125jaxrvms0c7vqw9gdqj7wf937v24jay2te5aflpuxfy7z3yhqrsy29r8r
+
+creation_rules:
+  - path_regex: secrets.yaml$
+    key_groups:
+      - age:
+          - *ariz

home/home-manager.nix

@@ -5,6 +5,7 @@
     ./dev/git.nix
     ./tty/shells/fish.nix
     ./tty/starship.nix
+    ./syncthing.nix
   ];
   home.username = "ariz";
   home.homeDirectory = lib.mkForce "/Users/ariz";

home/syncthing.nix

@@ -0,0 +1,84 @@
+{syncthingGuiPasswordFile, ...}: {
+  services.syncthing = {
+    enable = true;
+
+    guiAddress = "127.0.0.1:8384";
+    guiCredentials = {
+      username = "ariz";
+      passwordFile = syncthingGuiPasswordFile;
+    };
+
+    overrideDevices = true;
+    overrideFolders = true;
+
+    settings = {
+      devices = {
+        m1 = {
+          id = "TMDXC4A-4JE25JA-QD3EX7V-OHTMQI5-4RCWPDP-BBJZZ6P-VX3F3MU-BA56UQ4";
+          name = "m1";
+          addresses = ["dynamic"];
+          compression = "metadata";
+          introducer = false;
+          autoAcceptFolders = false;
+        };
+      };
+
+      folders = {
+        SecondBrain = {
+          id = "kwtog-xward";
+          label = "SecondBrain";
+          path = "/Users/ariz/SecondBrain";
+          type = "sendreceive";
+          devices = ["m1"];
+          rescanIntervalS = 3600;
+          fsWatcherEnabled = true;
+          fsWatcherDelayS = 10;
+          fsWatcherTimeoutS = 0;
+          ignorePerms = false;
+          autoNormalize = true;
+          minDiskFree = {
+            unit = "%";
+            value = 1;
+          };
+          maxConflicts = 10;
+          markerName = ".stfolder";
+          maxConcurrentWrites = 16;
+        };
+      };
+
+      gui = {
+        tls = false;
+        theme = "default";
+      };
+
+      options = {
+        listenAddresses = ["default"];
+        globalAnnounceServers = ["default"];
+        globalAnnounceEnabled = true;
+        localAnnounceEnabled = true;
+        localAnnouncePort = 21027;
+        localAnnounceMCAddr = "[ff12::8384]:21027";
+        relaysEnabled = true;
+        natEnabled = true;
+        urAccepted = 3;
+        urSeen = 3;
+        urUniqueID = "dQqZX7jq";
+        urURL = "https://data.syncthing.net/newdata";
+        urInitialDelayS = 1800;
+        autoUpgradeIntervalH = 12;
+        keepTemporariesH = 24;
+        progressUpdateIntervalS = 5;
+        minHomeDiskFree = {
+          unit = "%";
+          value = 1;
+        };
+        releasesURL = "https://upgrades.syncthing.net/meta.json";
+        setLowPriority = true;
+        crashReportingURL = "https://crash.syncthing.net/newcrash";
+        crashReportingEnabled = true;
+        stunServer = "default";
+        announceLANAddresses = true;
+      };
+    };
+  };
+}

hosts/M4/darwin.nix

@@ -16,5 +16,17 @@
   nixpkgs.hostPlatform = "aarch64-darwin";
   system.primaryUser = "ariz";
 
+  sops = {
+    defaultSopsFile = ../../secrets.yaml;
+    defaultSopsFormat = "yaml";
+
+    age.keyFile = "/Users/ariz/.config/sops/age/keys.txt";
+
+    secrets."syncthing/guiPassword" = {
+      owner = "ariz";
+      mode = "0400";
+    };
+  };
+
   system.stateVersion = 6;
 }

secrets.yaml

@@ -0,0 +1,17 @@
+syncthing:
+    guiPassword: ENC[AES256_GCM,data:ii3r8ygf,iv:NXHT1FCLBW/bJ/oDx4rM4UohEC/rXNZDWUEijp7QJoA=,tag:m3a9ADa+bMVuwxQNeUqDpw==,type:str]
+sops:
+    age:
+        - recipient: age125jaxrvms0c7vqw9gdqj7wf937v24jay2te5aflpuxfy7z3yhqrsy29r8r
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0ajM2QmN1dWVQV0NKc1ZI
+            OEVNTFRqaG5RWjdhSWlsQkk4ZkxOZ3ExK3lzCk9KODFHQnFlRERORVJXdlVaOTIv
+            bWEzM3VTbGpsYlJRQ3QvY1BjYXZXUHMKLS0tIFliYWttOW8xQjZIQkU2RVlEejFX
+            WjZvdmJTRFVxcjFmM0NyS3NtbXVXUjgKUzwUJZ0DPyXfNy73YF5pkCkPf+HXCIYD
+            AGXvU9dKPs0ajZ8zuWaBMfr78a2D2BJ8zZonce+YzZshFjSqOqTV0g==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-10T05:47:11Z"
+    mac: ENC[AES256_GCM,data:fbAXrr2BIsOF2QENn5Uk+3m7Z9EiksEEAimApKU9GR2UZzxne8r/BwyTV/en1cSXMJ2XpJhOw6vkDNSFmYOqxbmQTD1JITC55cKFQIQc2S7xFqPwcAkty8gcKRIa9Vz32VgURqMTWNdmV+U55ZRxOmbQbtNBFW2xIOYrLUZOo1M=,iv:wcX8Jx8NtNcrZtvBWcbj2HrCB1ZqiUBAlbFxSRGwmFU=,tag:o8nH//bmK9agTKV1wp4r/w==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0