{
  kubernetes.resources = {
    configMaps.syncthing.data = {
      PUID = "33";
      PGID = "33";
      TZ = "Europe/Amsterdam";
    };

    deployments.syncthing = {
      metadata.labels.app = "syncthing";

      spec = {
        selector.matchLabels.app = "syncthing";

        template = {
          metadata.labels.app = "syncthing";

          spec = {
            containers.syncthing = {
              image = "lscr.io/linuxserver/syncthing:1.23.6";
              envFrom = [{ configMapRef.name = "syncthing"; }];
              ports.web.containerPort = 8384;

              volumeMounts = [
                {
                  name = "config";
                  mountPath = "/config";
                }
                {
                  name = "nextcloud-data";
                  mountPath = "/data";
                }
              ];
            };

            volumes = {
              config.persistentVolumeClaim.claimName = "syncthing";
              nextcloud-data.persistentVolumeClaim.claimName = "nextcloud";
            };
          };
        };
      };
    };

    persistentVolumes.syncthing.spec = {
      capacity.storage = "1Mi";
      accessModes = [ "ReadWriteMany" ];

      nfs = {
        server = "lewis.dmz";
        path = "/mnt/data/nfs/syncthing/config";
      };
    };

    persistentVolumeClaims.syncthing.spec = {
      accessModes = [ "ReadWriteMany" ];
      storageClassName = "";
      resources.requests.storage = "1Mi";
      volumeName = "syncthing";
    };

    services.syncthing.spec = {
      selector.app = "syncthing";

      ports.web = {
        port = 80;
        targetPort = "web";
      };
    };

    ingresses.syncthing = {
      metadata.annotations = {
        "cert-manager.io/cluster-issuer" = "letsencrypt";
        "traefik.ingress.kubernetes.io/router.entrypoints" = "localsecure";
      };

      spec = {
        ingressClassName = "traefik";

        rules = [{
          host = "sync.kun.is";

          http.paths = [{
            path = "/";
            pathType = "Prefix";

            backend.service = {
              name = "syncthing";
              port.name = "web";
            };
          }];
        }];

        tls = [{
          secretName = "syncthing-tls";
          hosts = [ "sync.kun.is" ];
        }];
      };
    };
  };
}