{ config, pkgs, lib, ... }:
{

  test.services.syncthing = {
    enable = true;
    openDefaultPorts = true;
    declarative = {
      cert = toString <secrets/syncthing/cert.pem>;
      key = toString <secrets/syncthing/key.pem>;
      overrideFolders = true;
      folders = {
        # on encrypted device
        # -------------------
        desktop.path = "/var/lib/syncthing/desktop";
        finance.path = "/var/lib/syncthing/finance";
        lost-fotos.path = "/var/lib/syncthing/lost-fotos.ct";

        # on media hard drive (not encrypted)
        # -----------------------------------
        movies.path = "/media/movies";
        music-library.path = "/media/music-library";
        podcasts.path = "/media/podcasts";
        series.path = "/media/series";
      };
    };
  };

  systemd.services."permown._media" = {
    bindsTo = [ "media.mount" ];
    after = [ "media.mount" ];
  };
  system.permown."/media" = {
    owner = "syncthing";
    group = "syncthing";
    umask = "0007";
  };
  systemd.services."syncthing" = {
    bindsTo = [ "media.mount" ];
    after = [ "media.mount" ];
  };

  users.groups."syncthing".members = [ "mpd" "syncthing" "kodi" "palo" ];

  backup.all.restic.dirs = ["/var/lib/syncthing/finance"];

}