syncthing: Connect devices over nebula instead of tailscale

I'm not sure if this is actually doing anything

modules/system/services/nebula/dns.nix

@@ -29,13 +29,18 @@ in
               |> lib.map (node: "\"${node.name}.${nebulaCfg.network.domain}. A ${node.address}\"");
           };
 
-          forward-zone = lib.singleton {
-            name = ".";
-            forward-addr = [
-              "1.1.1.1"
-              "8.8.8.8"
-            ];
-          };
+          forward-zone =
+            (lib.singleton {
+              name = ".";
+              forward-addr = [
+                "1.1.1.1"
+                "8.8.8.8"
+              ];
+            })
+            ++ lib.optional config.custom.services.tailscale.enable {
+              name = "${config.custom.services.tailscale.domain}";
+              forward-addr = [ "100.100.100.100" ];
+            };
         };
       };
 

modules/system/services/syncthing.nix

@@ -51,8 +51,8 @@ in
   config = lib.mkIf cfg.enable {
     assertions = [
       {
-        assertion = config.custom.services.tailscale.enable;
-        message = "Syncthing requires tailscale";
+        assertion = config.custom.services.nebula.node.enable;
+        message = "Syncthing requires nebula";
       }
       {
         assertion = cfg.isServer -> (cfg.gui.domain != null);
@@ -86,48 +86,61 @@ in
       };
     };
 
-    services.syncthing = {
-      enable = true;
+    services = {
+      syncthing = {
+        enable = true;
 
-      user = lib.mkIf (!cfg.isServer) "seb";
-      group = lib.mkIf (!cfg.isServer) "users";
-      dataDir = lib.mkIf (!cfg.isServer) "/home/seb";
+        user = lib.mkIf (!cfg.isServer) "seb";
+        group = lib.mkIf (!cfg.isServer) "users";
+        dataDir = lib.mkIf (!cfg.isServer) "/home/seb";
 
-      guiAddress = "localhost:${toString cfg.gui.port}";
+        guiAddress = "localhost:${toString cfg.gui.port}";
 
-      cert = lib.mkIf useSopsSecrets config.sops.secrets."syncthing/cert".path;
-      key = lib.mkIf useSopsSecrets config.sops.secrets."syncthing/key".path;
+        cert = lib.mkIf useSopsSecrets config.sops.secrets."syncthing/cert".path;
+        key = lib.mkIf useSopsSecrets config.sops.secrets."syncthing/key".path;
 
-      settings = {
-        # Get the devices and their ids from the configs of the other hosts
-        devices =
-          self.nixosConfigurations
-          |> lib.filterAttrs (name: _: name != config.networking.hostName)
-          |> lib.filterAttrs (_: value: value.config.custom.services.syncthing.enable)
-          |> lib.mapAttrs (
-            name: value: {
-              id = value.config.custom.services.syncthing.deviceId;
-              addresses = [ "tcp://${name}.${config.custom.services.tailscale.domain}:${toString cfg.syncPort}" ];
-            }
-          );
+        settings = {
+          # Get the devices and their ids from the configs of the other hosts
+          devices =
+            self.nixosConfigurations
+            |> lib.filterAttrs (name: _: name != config.networking.hostName)
+            |> lib.filterAttrs (_: value: value.config.custom.services.syncthing.enable)
+            |> lib.mapAttrs (
+              _: value: {
+                id = value.config.custom.services.syncthing.deviceId;
+                addresses = [
+                  "tcp://${value.config.custom.services.nebula.node.address}:${toString cfg.syncPort}"
+                ];
+              }
+            );
 
-        folders =
-          cfg.folders
-          |> lib'.genAttrs (name: {
-            path = "${dataDir}/${name}";
-            devices = config.services.syncthing.settings.devices |> lib.attrNames;
-          });
+          folders =
+            cfg.folders
+            |> lib'.genAttrs (name: {
+              path = "${dataDir}/${name}";
+              devices = config.services.syncthing.settings.devices |> lib.attrNames;
+            });
 
-        options = {
-          listenAddress = "tcp://0.0.0.0:${toString cfg.syncPort}";
-          globalAnnounceEnabled = false;
-          localAnnounceEnabled = false;
-          relaysEnabled = false;
-          natEnabled = false;
-          urAccepted = -1;
-          autoUpgradeIntervalH = 0;
+          options = {
+            listenAddress = "tcp://${config.custom.services.nebula.node.address}:${toString cfg.syncPort}";
+            globalAnnounceEnabled = false;
+            localAnnounceEnabled = false;
+            relaysEnabled = false;
+            natEnabled = false;
+            urAccepted = -1;
+            autoUpgradeIntervalH = 0;
+          };
         };
       };
+
+      nebula.networks.mesh.firewall.inbound =
+        config.services.syncthing.settings.devices
+        |> lib.attrNames
+        |> lib.map (name: {
+          port = cfg.syncPort;
+          proto = "tcp";
+          host = name;
+        });
     };
 
     custom = {

modules/system/services/tailscale.nix

@@ -35,13 +35,5 @@ in
     systemd.services.tailscaled-set.after = [ "tailscaled-autoconnect.service" ];
 
     custom.persistence.directories = [ "/var/lib/tailscale" ];
-
-    # Disable search domain when nebula is in use
-    systemd.network.networks."50-tailscale" = lib.mkIf config.custom.services.nebula.node.enable {
-      matchConfig.Name = config.services.tailscale.interfaceName;
-      linkConfig.Unmanaged = lib.mkForce false;
-      dns = [ "100.100.100.100" ];
-      domains = [ ];
-    };
   };
 }