{
  lib,
  me,
  config,
  ...
}:

let
  inherit (config.users.users) mel;

  defaultSyncthingPort = "8384";
in
{
  # server-side
  services.syncthing = {
    enable = true;
    # do not open any firewall ports,
    # we only want access through the tailnet
    openDefaultPorts = false;
    guiAddress = "${me.tailscale.ip}:${defaultSyncthingPort}";

    user = "mel";
    dataDir = "${mel.home}/sync";
    configDir = "${mel.home}/.config/syncthing";

    # only take declarative configuration below
    overrideDevices = true;
    overrideFolders = true;
    settings = {
      devices = {
        bismuth.id = "MXC4UQG-PRZESJ3-AQYGWNG-EMCI44Q-UC7YFNP-6ZDF3SA-NLZCVUH-FQAK6QK";
        graphite.id = "THWA2HN-BZ4URXS-P5PKAJY-YEBYQSH-2MUDKXC-CL3YQ2A-VHFUPCE-ROHQNQ7";
      };

      # TODO: these are duplciated from the client configuration.
      # maybe we should semi-merge the two??
      folders =
        let
          clientFolders = [
            "desktop"
            "documents"
            "pictures"
            "music"
            "videos"
            "thoughts"
            "code"
            "scripts"
            "projects"
          ];

          commonFolder = name: {
            path = "~/sync/${name}";
            type = "receiveonly";
            versioning = {
              type = "staggered";
              params = {
                cleanInterval = toString (60 * 60);
                maxAge = toString (14 * 24 * 60 * 60);
              };
            };
          };
        in
        lib.genAttrs clientFolders commonFolder;

      # no telemetry
      options.urAccepted = -1;
    };
  };
}