From c70164709ecf4dd9e3f06f85365020380a144ece Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Leonardo=20Eug=C3=AAnio?= <lelgenio@disroot.org>
Date: Sun, 22 Feb 2026 09:39:54 -0300
Subject: [PATCH] phantom: set default syncthing password

---
 hosts/phantom/syncthing.nix  | 10 ++++++++++
 secrets/phantom/default.yaml |  6 ++++--
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/hosts/phantom/syncthing.nix b/hosts/phantom/syncthing.nix
index abbda7d..5041b97 100644
--- a/hosts/phantom/syncthing.nix
+++ b/hosts/phantom/syncthing.nix
@@ -11,6 +11,10 @@
     dataDir = "/var/lib/syncthing-data";
     guiAddress = "0.0.0.0:8384";
     openDefaultPorts = true;
+    guiPasswordFile = config.sops.secrets."syncthing/password".path;
+    settings.gui = {
+      user = "lelgenio";
+    };
   };
 
   services.nginx.virtualHosts."syncthing.lelgenio.com" = {
@@ -26,4 +30,10 @@
           "proxy_pass_header Authorization;";
     };
   };
+
+  sops.secrets."syncthing/password" = {
+    mode = "400";
+    owner = "syncthing";
+    group = "syncthing";
+  };
 }
diff --git a/secrets/phantom/default.yaml b/secrets/phantom/default.yaml
index b953bfe..a1c2f34 100644
--- a/secrets/phantom/default.yaml
+++ b/secrets/phantom/default.yaml
@@ -18,6 +18,8 @@ nextcloud:
     default-password: ENC[AES256_GCM,data:mR0KRCheXh6NBVn+odK9Kx0e4njJDuZ6OS37Iw==,iv:PAb/sCt7hq5WKZwr4FMfiMqf7mGvpXQEnZcbzmDz9oI=,tag:ukBDHbFKrStXckzuE1TwJA==,type:str]
 writefreely:
     password: ENC[AES256_GCM,data:5hzvM8Aitvj4Hb/RgViV1QjsnpQqln0k1nZvEz8Y7vdZvcHo,iv:Wi+pKcGqi09050sitgxt/+hYGF2mlmYC0SDjmqSWPr4=,tag:V0KSBgIV4fgMbxuADVTxrA==,type:str]
+syncthing:
+    password: ENC[AES256_GCM,data:s3EMaGJGSwGxgajdHfWpblAU1Ows/h5JzS6PB9jU/BfmSMvG,iv:E2Exhs2f2v16iovexQGm9HUMxpLrY2uQ8OS/rOawj08=,tag:QXesaGB9v+yPnokZh6DMWA==,type:str]
 sops:
     age:
         - recipient: age1zrgu7w8059xydagm60phnffghvfe9h2ca58cx8qwagqpyfuvs9fqw79c8h
@@ -38,8 +40,8 @@ sops:
             RU1HSUhldHpzeURaUWQvcjBCQ3pMY2cKYL87Njs4e68zu5AXKNF/hxiB3HduS8wz
             o0kmGI58DZx17+Cdipw0ab9a9wiu9C9Fn+LaiCcdM/ESXtS79RzdbQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-15T06:46:07Z"
-    mac: ENC[AES256_GCM,data:lnvq80oOH2pO6AxBbnjNxvz0xcukTFowcxKf24RKFf/ZouRL6uCJEWJwNCoAKCGOHibrztsGHLDL/cgOffv9CTivIYmzbB+9q2MCQNGxrSL7CkWr/mK9xb5Yz1ASvvZxcGB7WmZNVZXvjIr6mdZy50UweHJoit+oDvE03cmG9Bw=,iv:CikhhcnCE9SXpRasZEImUR6vU5cauD4YIplxPYsPo4A=,tag:+QaBv8Nrk40UCYhUskepyw==,type:str]
+    lastmodified: "2026-02-22T12:00:25Z"
+    mac: ENC[AES256_GCM,data:AZm1yDw8whCTufBYbiug3i1e1YQRVprOMFTSR6GvvPDXD8ouvwSqoqYbmL7Cm1GxEG5WME1Z/tRzBzN2rU0gleGpXAXb/C+nF3R4PEHdPg25b0vfWAShZHb1YZGpMwkAd3H69y7yJclXeE2sFKx85DUGieYELelrzF9hT8jceHE=,iv:74M+68IAx0Kv7MCAe4Hsj/oTRJP6XOZNc2bxc1Ot5kI=,tag:XfocOwXlpM9WYHVHGs0MWg==,type:str]
     pgp:
         - created_at: "2025-03-07T22:49:19Z"
           enc: |-