{
  config,
  lib,
  ...
}: let
  cfg = config.pim.syncthing;
in {
  options.pim.syncthing.enable = lib.mkEnableOption "syncthing";

  config = lib.mkIf cfg.enable {
    services.syncthing.enable = true;

    sops.secrets = {
      "syncthing/key".path = "${config.xdg.configHome}/syncthing/key.pem";
      "syncthing/cert".path = "${config.xdg.configHome}/syncthing/cert.pem";
    };
  };
}