diff --git a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
index 1efce2db6704..2542f5762fcc 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@@ -993,6 +993,16 @@ signald -d /var/lib/signald/db \
longer accepted.
+
+
+ The Syncthing service now only allows absolute paths—starting
+ with / or ~/—for
+ services.syncthing.folders.<name>.path.
+ In a future release other paths will be allowed again and
+ interpreted relative to
+ services.syncthing.dataDir.
+
+
diff --git a/nixos/doc/manual/release-notes/rl-2211.section.md b/nixos/doc/manual/release-notes/rl-2211.section.md
index 10a1240ede03..c4bc7e7db09b 100644
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@@ -307,6 +307,11 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).
apply patches. This means that your hashes are out-of-date and the (previously required) attributes `name` and `version`
are no longer accepted.
+- The Syncthing service now only allows absolute paths---starting with `/` or
+ `~/`---for `services.syncthing.folders..path`.
+ In a future release other paths will be allowed again and interpreted
+ relative to `services.syncthing.dataDir`.
+
## Other Notable Changes {#sec-release-22.11-notable-changes}
diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index ea87e5695f87..adbb25ccb9b6 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -212,10 +212,18 @@ in {
};
path = mkOption {
- type = types.str;
+ # TODO for release 23.05: allow relative paths again and set
+ # working directory to cfg.dataDir
+ type = types.str // {
+ check = x: types.str.check x && (substring 0 1 x == "/" || substring 0 2 x == "~/");
+ description = types.str.description + " starting with / or ~/";
+ };
default = name;
description = lib.mdDoc ''
The path to the folder which should be shared.
+ Only absolute paths (starting with `/`) and paths relative to
+ the [user](#opt-services.syncthing.user)'s home directory
+ (starting with `~/`) are allowed.
'';
};
@@ -405,7 +413,8 @@ in {
example = "yourUser";
description = mdDoc ''
The user to run Syncthing as.
- By default, a user named `${defaultUser}` will be created.
+ By default, a user named `${defaultUser}` will be created whose home
+ directory is [dataDir](#opt-services.syncthing.dataDir).
'';
};