hosts/alyssum: add syncthing

hosts/alyssum/default.nix

@@ -1,4 +1,4 @@
-{ inputs, modules, modulesPath, ... }: {
+{ inputs, lib, modules, modulesPath, ... }: {
   networking.hostName = "alyssum";
   system.stateVersion = "25.11";
   time.timeZone = "Australia/Melbourne";
@@ -24,6 +24,7 @@
     tailscale
 
     modules.services.nginx
+    modules.services.syncthing
 
     inputs.c-garnet.nixosModule
 
@@ -35,4 +36,5 @@
   ];
 
   me.environment = "headless";
+  services.syncthing.user = lib.mkForce "hana";
 }

modules/services/syncthing.nix

@@ -1,7 +1,7 @@
 { config, ... }:
 let
   dir = "/persist/shared/.syncthing";
-  uid = toString config.users.users.rin.uid;
+  uid = toString config.services.syncthing.user;
   gid = toString config.users.groups.users.gid;
 in
 {

modules/system/tailscale.nix

@@ -1,6 +1,7 @@
 { config, ... }: {
   age.secrets.tailscale_auth.file = ../../secrets/tailscale_auth.age;
   me.binds."/var/lib/tailscale" = "tailscale";
+  networking.firewall.trustedInterfaces = [ "tailscale0" ];
   services.tailscale = {
     enable = true;
     authKeyFile = config.age.secrets.tailscale_auth.path;