I got a new laptop and moved my syncthing config in a new module modules/syncthing.nix · d5ba6488d717792eece9afc61a8b752c28a9b1e3 · Florian Engel / nixosconfiguration · GitLab . After that syncthing always creates a new key at the service start
[root@nixosFramework:~]# sha256sum /run/agenix/syncthingCert
395347bb81fa80997e26bbf4c17ef6413b2ada8dcae9f11d87dbb557a8da51ff /run/agenix/syncthingCert
[root@nixosFramework:~]# sha256sum /home/florian/.syncthing/.config/syncthing/key.pem
28b520410b2216adb83c906d1f885742fbf4430201cb32df564576a43e32eac0 /home/florian/.syncthing/.config/syncthing/key.pem
[root@nixosFramework:~]# systemctl restart syncthing
[root@nixosFramework:~]# sha256sum /home/florian/.syncthing/.config/syncthing/key.pem
a15870665120b451112360ffaf60bf91d936db44e249828e6cf6a36913d46f1e /home/florian/.syncthing/.config/syncthing/key.pem
[root@nixosFramework:~]# systemctl restart syncthing
[root@nixosFramework:~]# sha256sum /home/florian/.syncthing/.config/syncthing/key.pem
d380edad5edad9828abd5216a209bdd4a5f51c983586f937a99afbc9e9f24931 /home/florian/.syncthing/.config/syncthing/key.pem
The service should copy the keys from my agenix. But either it doesnt do that or the keys get overriden
[root@nixosFramework:~]# systemctl cat syncthing
# /etc/systemd/system/syncthing.service → /nix/store/45a3d6a98dgapdgpn7nkfc42k2pf4k9j-unit-syncthing.service/syncthing.service
[Unit]
After=network.target
Description=Syncthing service
[Service]
Environment=“LOCALE_ARCHIVE=/nix/store/rld0mdg91pdf2p7v43lqqz31sq98gq5v-glibc-locales-2.42-61/lib/locale/locale-archive”
Environment="PATH=/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin:/nix/store/c1cjgg6p8m8fssivzrc2p13mwwml3p3v-findutils-4.10.0/bin:/nix/store/gn94gpcp5q08x4v6g8mvw8v4r65rcjzk-gnugrep-3.12/bin:/nix/store/kgxafhycw2kybbqih759ykc2043qyi5j-gnused-4.9/bin:/nix/store/a8avqfxd649rfgfpqldja6v38ljb8fj5-systemd-260.1/bin:/nix/store/9ypz3flqsrl5xl495mm8h645g>
Environment=“STNORESTART=yes”
Environment=“STNOUPGRADE=yes”
Environment=“TZDIR=/nix/store/v2hsfkf03b3l79rhcxw4nq7w79kr3qkw-tzdata-2026b/share/zoneinfo”
CapabilityBoundingSet=~CAP_SYS_PTRACE
CapabilityBoundingSet=~CAP_SYS_ADMIN
CapabilityBoundingSet=~CAP_SETGID
CapabilityBoundingSet=~CAP_SETUID
CapabilityBoundingSet=~CAP_SETPCAP
CapabilityBoundingSet=~CAP_SYS_TIME
CapabilityBoundingSet=~CAP_KILL
ExecStart=/nix/store/z72fv35x1ncllg2p4dy5fn2gyc5x9c7q-syncthing-2.0.15/bin/syncthing ‘–config=/home/florian/.syncthing/.config/syncthing’ ‘–data=/home/florian/.syncthing/.config/syncthing’ ‘–gui-address=127.0.0.1:8384’ --no-browser
ExecStartPre=+/nix/store/rdfic4adl2fap9zydr9yqxf6mrxk3cmm-syncthing-copy-keys
Group=syncthing
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateMounts=true
PrivateTmp=true
PrivateUsers=true
ProtectControlGroups=true
ProtectHostname=true
ProtectKernelModules=true
ProtectKernelTunables=true
Restart=on-failure
RestartForceExitStatus=3 4
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
RuntimeDirectory=syncthing
SuccessExitStatus=3 4
User=florian
[Install]
WantedBy=multi-user.target
[root@nixosFramework:~]# cat /nix/store/rdfic4adl2fap9zydr9yqxf6mrxk3cmm-syncthing-copy-keys
#! /nix/store/gik3rh1vz2jlgnifb9dh6vc6sxwwz9jj-bash-5.3p9/bin/bash
install -dm700 -o florian -g syncthing /home/florian/.syncthing/.config/syncthing
install -Dm644 -o florian -g syncthing /run/agenix/syncthingKey /home/florian/.syncthing/.config/syncthing/cert.pem
install -Dm600 -o florian -g syncthing /run/agenix/syncthingCert /home/florian/.syncthing/.config/syncthing/key.pem