From d8b850d88f416c1d8da0ba6c194939fcf182695a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aurimas=20Bla=C5=BEulionis?= <0x60@pm.me>
Date: Sun, 15 Sep 2024 21:10:12 +0100
Subject: [PATCH] syncthing: expose encryptionPassword

- Change `folder.devices` type into `oneOf [(listOf str) (attrsOf
  (submodule { ... }))]`.
- Expose `encryptionPassord` within the attrSet of the devices option.

This allows the user to set the encrpyption password use to share the
folder's data with. We do this by file path, as opposed to string
literal, because we do not want to embed the encrpyption password into
the nix store.
---
 .../modules/services/networking/syncthing.nix | 45 ++++++++++++++++---
 1 file changed, 40 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index 6e3150891250..478882cd9b89 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -55,10 +55,21 @@ let
           were removed. Please use, respectively, {rescanIntervalS,fsWatcherEnabled,fsWatcherDelayS} instead.
         ''
         {
-          devices = map (
-            device:
-            if builtins.isString device then { deviceId = cfg.settings.devices.${device}.id; } else device
-          ) folder.devices;
+          devices =
+            let
+              folderDevices = folder.devices;
+            in
+            if builtins.isList folderDevices then
+              map (
+                device:
+                if builtins.isString device then { deviceId = cfg.settings.devices.${device}.id; } else device
+              ) folderDevices
+            else if builtins.isAttrs folderDevices then
+              mapAttrsToList (
+                deviceName: deviceValue: deviceValue // { deviceId = cfg.settings.devices.${deviceName}.id; }
+              ) folderDevices
+            else
+              throw "Invalid type for devices in folder '${folderName}'; expected list or attrset.";
         }
   ) (filterAttrs (_: folder: folder.enable) cfg.settings.folders);
 
@@ -502,11 +513,35 @@ in
                       };
 
                       devices = mkOption {
-                        type = types.listOf types.str;
+                        type = types.oneOf [
+                          (types.listOf types.str)
+                          (types.attrsOf (
+                            types.submodule (
+                              { name, ... }:
+                              {
+                                freeformType = settingsFormat.type;
+                                options = {
+                                  encryptionPassword = mkOption {
+                                    type = types.nullOr types.str;
+                                    default = null;
+                                    description = ''
+                                      Path to encryption password. If set, the file will be read during
+                                      service activation, without being embedded in derivation.
+                                    '';
+                                  };
+                                };
+                              }
+                            )
+                          ))
+                        ];
                         default = [ ];
                         description = ''
                           The devices this folder should be shared with. Each device must
                           be defined in the [devices](#opt-services.syncthing.settings.devices) option.
+
+                          Either a list of strings, or an attribute set, where keys are defined in the
+                          [devices](#opt-services.syncthing.settings.devices) option, and values are
+                          device configurations.
                         '';
                       };