{
  pkgs,
  config,
  lib,
  ...
}: let
  service = "syncthing";
  cfg = config.holocron.${service};
  sec = config.sops.secrets;
  url = "syncthing.${config.networking.hostName}.holocron.blue";
  homelab = config.homelab;
in {
  options.holocron.${service} = {
    enable = lib.mkEnableOption "enables syncthing";
  };

  config = lib.mkIf cfg.enable {
    services.syncthing = {
      enable = true;
      user = "blake";
      group = "blake";
      dataDir = "/var/lib/syncthing";
      guiAddress = "0.0.0.0:2222";
      openDefaultPorts = true;
      #extraFlags = ["--no-default-folder"];
      key = sec."${service}/lumiose/key".path;
      cert = sec."${service}/lumiose/cert".path;
      settings = {
        devices = {
          "piplup" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
          "zygarde" = {id = "UYLTF52-VVKUR7F-JN33HQZ-RFNWGL3-JER52LA-GZD2LPJ-QIFEE7K-MNMZRQ5";};
          "yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";};
          "CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";};
          "CEN-IT-00007" = {id = "UEWNSUZ-AX75M5Y-OA4FURY-ORMEXFA-XUXU4LU-LEUYKVW-IDM2GQC-4UR4YAL";};
        };
        folders = {
          "holocron" = {
            path = "/holocron/users/blake/holocron";
            devices = ["piplup" "zygarde" "CEN-IT-07" "CEN-IT-00007" "yveltal"];
            id = "5voxg-c3he2";
            #            versioning = {
            #              type = "staggered";
            #              fsPath = "/holocron/users/blake/holocron/.stversions";
            #              params = {
            #                cleanInterval = "3600";
            #                maxAge = "0";
            #              };
            #            };
          };
        };
        options = {
          urAccepted = -1;
        };
      };
    };

    sops.secrets = {
      "${service}/lumiose/key" = {
        owner = "blake";
        group = "blake";
      };
      "${service}/lumiose/cert" = {
        owner = "blake";
        group = "blake";
      };
    };
    homelab.backups.baks = {
      ${service} = {paths = [config.services.syncthing.dataDir];};
    };

    services.caddy.virtualHosts."${url}" = {
      extraConfig = ''
        tls internal
        reverse_proxy 127.0.0.1:2222
      '';
    };

    # add to glance (local service)
    homelab.glance.links.system = [
      {
        title = service;
        url = "https://${url}";
        error-url = "http://${homelab.host_ip}:2222";
        check-url = "http://${homelab.host_ip}:2222";
        icon = "di:${service}";
      }
    ];
  };
}