{ config, pkgs, lib, ... }:
{

 test.services.syncthing = {
   enable = true;
   openDefaultPorts = false;
   dataDir = "/home/syncthing";
   configDir = "/home/syncthing";
   declarative = {
     cert = toString <secrets/syncthing/cert.pem>;
     key = toString <secrets/syncthing/key.pem>;
     overrideFolders = true;

     folders = {

       # todo add podcast here

       # on encrypted hard drive
       # -----------------------
       desktop-encrypted.path = "/home/syncthing/.desktop.ct";
       finance-encrypted.path = "/home/syncthing/.finance.ct";
       fotos-encrypted.path = "/home/syncthing/private/.fotos.ct";
       music-projects.path = "/home/syncthing/music-projects";
       video-material.path = "/home/syncthing/video-material";

       # on media hard drive (not encrypted)
       # -----------------------------------
       music-library-free.path = "/media/syncthing/music-library-free";
       samples.path = "/media/syncthing/samples";
       movies.path = "/media/syncthing/movies";
       music-library.path = "/media/syncthing/music-library";
       podcasts.path = "/media/syncthing/podcasts";
       series.path = "/media/syncthing/series";

     };
   };
 };

  systemd.services."permown._media_syncthing" = {
    bindsTo = [ "media.mount" ];
    after = [ "media.mount" ];
  };
  system.permown."/media/syncthing" = {
    owner = "syncthing";
    group = "syncthing";
    umask = "0007";
  };
  systemd.services."syncthing" = {
    bindsTo = [ "media.mount" ];
    after = [ "media.mount" ];
  };

}