Desktop/syncthing: run as a user service managed by home-manager

roles/desktop/services/syncthing.nix

@@ -1,23 +1,54 @@
 {config, ...}: {
   services.syncthing = {
-    enable = true;
-    user = "toast";
-    group = "users";
-    dataDir = config.users.users.toast.home;
+    # enable = true;
+    # user = "toast";
+    # group = "users";
+    # dataDir = config.users.users.toast.home;
     settings.folders."passwords".path = "~/Documents/Passwords";
   };
-  # Allow regular users to stop syncthing
-  # https://stackoverflow.com/questions/61480914/using-policykit-to-allow-non-root-users-to-start-and-stop-a-service
-  security.polkit.extraConfig = ''
-    polkit.addRule(function(action, subject) {
-    	if (
-    		action.id == "org.freedesktop.systemd1.manage-units" &&
-    		action.lookup("unit") == "syncthing.service" &&
-    		subject.user == "${config.services.syncthing.user}"
-    	)
-    	{
-    		return polkit.Result.YES;
-    	}
-    })
-  '';
+  age.secrets = {
+    syncthingCert = {
+      owner = "toast";
+      group = "users";
+    };
+    syncthingKey = {
+      owner = "toast";
+      group = "users";
+    };
+  };
+  home-manager.users.toast = {
+    osConfig,
+    lib,
+    ...
+  }: let
+    systemConfig = osConfig.services.syncthing;
+    missingOptions = [
+      "all_proxy"
+      "configDir"
+      "dataDir"
+      "databaseDir"
+      "declarative"
+      "devices"
+      "folders"
+      "extraFlags"
+      "user"
+      "group"
+      "systemService"
+      "openDefaultPorts"
+      "options"
+      "relay"
+      "useInotify"
+    ];
+    removeMissingOptions = rawOptions: (
+      # lib.attrsets.filterAttrs (n: v: n == "all_proxy") rawOptions
+      builtins.removeAttrs rawOptions missingOptions
+    );
+  in {
+    services.syncthing = removeMissingOptions systemConfig // {
+      enable = true;
+      # Renamed options
+      allProxy = systemConfig.all_proxy;
+      extraOptions = systemConfig.extraFlags;
+    };
+  };
 }