[syncthing] Mount only /media, /share and /backups

[salim-b]

I was wondering whether we should limit the mounts (map in config.yaml) by

• mounting ssl read-only, i.e. remove the :rw, or even completely removing ssl. Why does Syncthing need access to custom certs in the first place? We have Ingress for that, no?
• removing addons:rw. What is the use case for Syncthing having access to local add-ons? Not even the official File editor add-on has access to addons since it's deemed confusing for non-developers.

[salim-b]

We should reconsider this since people actually like to sync HA-internal files, it appears. So maybe even do the opposite of the above and expose all_addon_configs:rw and homeassistant_config:rw, too?

[Poeschl]

I would suggest that we enable the mount but add a warning in the addon Readme about the security risk.

[jwinston100]

I would just like to second the idea of allowing exposure to /config perhaps with a warning, as I personally have been using Syncthing to edit files in /config via other devices.

[salim-b]

I would suggest that we enable the mount but add a warning in the addon Readme about the security risk.

That sounds reasonable.

I think that people could generally use some guidance with the different persistent directories available to Syncthing. Maybe we should just include a table similar to this one with a short explanation of each dir? Unfortunately, the official documentation about these dirs (documented under the map key) is very sparse, so just linking to it is not really an option.

[Poeschl]

@salim-b The table is a nice idea. That would be a great thing to have.

[MJeka]

How to sync /config folder? I have several redundant servers that need to have up-to-date information with automatic synchronization of configuration files

[alucryd]

Being able to sync /config would be great indeed, that was the sole reason I looked into a syncthing add-on in the first place.

[jwinston100]

I agree with @alucryd. I had mentioned this issue before. The /config directory is the only one I have ever used, as it lets me edit automations.yaml, configuration.yaml, etc. on other devices. I had to roll back to a previous version and turn off auto-update. I hope a future version allows us to access that directory.

[salim-b]

@salim-b The table is a nice idea. That would be a great thing to have.

See #467.

[jwinston100]

Thank you @salim-b for helping to fix this issue!