Poeschl/Hassio-Addons

[syncthing] Mount only `/media`, `/share` and `/backups`

Closed this issue · 10 comments

salim-b commented

I was wondering whether we should limit the mounts (map in config.yaml) by

  • mounting ssl read-only, i.e. remove the :rw, or even completely removing ssl. Why does Syncthing need access to custom certs in the first place? We have Ingress for that, no?
  • removing addons:rw. What is the use case for Syncthing having access to local add-ons? Not even the official File editor add-on has access to addons since it's deemed confusing for non-developers.
salim-b commented

We should reconsider this since people actually like to sync HA-internal files, it appears. So maybe even do the opposite of the above and expose all_addon_configs:rw and homeassistant_config:rw, too?

  • 👍3
Poeschl commented

I would suggest that we enable the mount but add a warning in the addon Readme about the security risk.

jwinston100 commented

I would just like to second the idea of allowing exposure to /config perhaps with a warning, as I personally have been using Syncthing to edit files in /config via other devices.

  • 👍2
salim-b commented

I would suggest that we enable the mount but add a warning in the addon Readme about the security risk.

That sounds reasonable.

I think that people could generally use some guidance with the different persistent directories available to Syncthing. Maybe we should just include a table similar to this one with a short explanation of each dir? Unfortunately, the official documentation about these dirs (documented under the map key) is very sparse, so just linking to it is not really an option.

Poeschl commented

@salim-b The table is a nice idea. That would be a great thing to have.

MJeka commented

How to sync /config folder? I have several redundant servers that need to have up-to-date information with automatic synchronization of configuration files

alucryd commented

Being able to sync /config would be great indeed, that was the sole reason I looked into a syncthing add-on in the first place.

  • 👍3
jwinston100 commented

I agree with @alucryd. I had mentioned this issue before. The /config directory is the only one I have ever used, as it lets me edit automations.yaml, configuration.yaml, etc. on other devices. I had to roll back to a previous version and turn off auto-update. I hope a future version allows us to access that directory.

salim-b commented

@salim-b The table is a nice idea. That would be a great thing to have.

See #467.

jwinston100 commented

Thank you @salim-b for helping to fix this issue!