Services: tweak and cleanup Syncthing config

hosts/Hevana/default.nix

@@ -229,6 +229,11 @@ in
         syncthing = {
           enable = true;
           home = "${services-root}/syncthing/aires";
+          web = {
+            enable = true;
+            port = 8080;
+            public = true;
+          };
         };
       };
     };

hosts/Khanda/default.nix

@@ -83,7 +83,14 @@ in
 
     users.aires = {
       enable = true;
-      services.syncthing.enable = true;
+      services.syncthing = {
+        enable = true;
+        enableTray = true;
+        web = {
+          enable = true;
+          port = 8080;
+        };
+      };
     };
   };
 }

hosts/Shura/default.nix

@@ -108,16 +108,14 @@ in
         services.syncthing = {
           enable = true;
           enableTray = true;
-        };
+          web = {
-      };
-      gremlin = {
             enable = true;
-        services.syncthing = {
+            port = 8080;
-          enable = true;
-          enableTray = true;
           };
         };
       };
+      gremlin.enable = true;
+    };
   };
 
   # Move files into target system

modules/users/aires/default.nix

@@ -23,6 +23,15 @@ in
           type = lib.types.str;
           description = "Where to store Syncthing's configuration files";
         };
+        web = {
+          enable = lib.mkEnableOption "Enables the Syncthing web UI.";
+          port = lib.mkOption {
+            type = lib.types.int;
+            default = 8384;
+            description = "The port to host Syncthing web on.";
+          };
+          public = lib.mkEnableOption "Whether to expose the Syncthing web UI to the network.";
+        };
       };
     };
   };
@@ -120,7 +129,7 @@ in
         };
       })
 
-      # Enable Syncthing
+      # Configure Syncthing
       (lib.mkIf cfg.services.syncthing.enable {
         users.users.aires.packages = [ pkgs.syncthing ];
 
@@ -128,15 +137,22 @@ in
           config.aux.system.ui.flatpak.enable && cfg.services.syncthing.enableTray
         ) [ "io.github.martchus.syncthingtray" ];
 
-        # Open port 8080
+        # If the web UI is public, open the port in the firewall
-        networking.firewall.allowedTCPPorts = [ 8080 ];
+        networking.firewall.allowedTCPPorts =
+          with cfg.services.syncthing.web;
+          lib.mkIf (enable && public) [ port ];
 
         home-manager.users.aires = {
-          # Syncthing options
           services.syncthing = {
             enable = true;
-            extraOptions = [
+            extraOptions =
-              "--gui-address=0.0.0.0:8080"
+              let
+                listenAddress =
+                  with cfg.services.syncthing.web;
+                  (if (enable && public) then "0.0.0.0" else "127.0.0.1");
+              in
+              [
+                "--gui-address=${listenAddress}:${builtins.toString cfg.services.syncthing.web.port}"
                 "--home=${cfg.services.syncthing.home}"
                 "--no-default-folder"
               ];

modules/users/gremlin/default.nix

@@ -13,16 +13,6 @@ in
   options = {
     aux.system.users.gremlin = {
       enable = lib.mkEnableOption "Enables gremlin user account";
-
-      services.syncthing = {
-        enable = lib.mkEnableOption "Enables Syncthing";
-        enableTray = lib.mkEnableOption "Enables the Syncthing Tray application";
-        home = lib.mkOption {
-          default = "${config.users.users.gremlin.home}/.config/syncthing";
-          type = lib.types.str;
-          description = "Where to store Syncthing's configuration files";
-        };
-      };
     };
   };
 
@@ -100,28 +90,5 @@ in
         };
       };
     })
-
-    # Enable Syncthing
-    (lib.mkIf cfg.services.syncthing.enable {
-      users.users.gremlin.packages = [ pkgs.syncthing ];
-
-      services.flatpak.packages = lib.mkIf (
-        config.aux.system.ui.flatpak.enable && cfg.services.syncthing.enableTray
-      ) [ "io.github.martchus.syncthingtray" ];
-
-      home-manager.users.gremlin = {
-        # Syncthing options
-        services.syncthing = {
-          enable = true;
-          extraOptions = [
-            "--gui-address=0.0.0.0:8081"
-            "--home=${cfg.services.syncthing.home}"
-            "--no-default-folder"
-          ];
-        };
-
-        systemd.user.services."syncthing".Unit.RequiresMountsFor = cfg.services.syncthing.home;
-      };
-    })
   ];
 }