{ config, pkgs, lib, ... }: {

  #sops.secrets.syncthing_cert = { };
  #sops.secrets.syncthing_key = { };

  services.syncthing = {
    enable = true;
    openDefaultPorts = false;
    user = "palo";
    dataDir = "/home/palo/.syncthing";
    configDir = "/home/palo/.syncthing";
    #cert = toString config.sops.secrets.syncthing_cert.path;
    #key = toString config.sops.secrets.syncthing_key.path;
    overrideFolders = true;
    folders = {

      # on encrypted drive
      # ------------------
      private = {
        enable = true;
        path = "/home/palo/private";
      };
      desktop = {
        enable = true;
        path = "/home/palo/desktop";
      };
      finance = {
        enable = true;
        path = "/home/palo/finance";
      };
      password-store = {
        enable = true;
        path = "/home/palo/.password-store";
      };
    };
  };

  services.permown."/home/palo/music-library" = {
    owner = "palo";
    group = "users";
  };
}