{
  lib,
  pkgs,
  config,
  ...
}:
let
  cfg = config.services.forgejo;
  srv = cfg.settings.server;
in
{
  sops.secrets.forgejo = {
    sopsFile = ../../secrets/forgejo.yaml;
    key = "email_password";
    format = "yaml";
  };

  users.groups.forgejo = { };
  users.users.forgejo = {
    isSystemUser = true;
    group = "forgejo";
    extraGroups = [ "storage" ];
  };

  services.nginx = {
    virtualHosts."git.donsz.nl" = {
      forceSSL = true;
      enableACME = true;
      extraConfig = ''
        client_max_body_size 512M;
      '';
      locations."/".proxyPass = "http://[::1]:13121";
    };
  };

  services.forgejo = {
    enable = true;
    lfs.enable = true;
    user = "forgejo";
    group = "forgejo";
    repositoryRoot = "/storage/storage/git";

    database = {
      type = "postgres";
      name = "forgejo";
      createDatabase = false;
    };

    settings = {
      DEFAULT = {
        APP_NAME = "jana's git server";
        APP_SLOGAN = "meow!";
      };
      server = {
        DOMAIN = "git.donsz.nl";
        ROOT_URL = "https://git.donsz.nl/";
        HTTP_PORT = 13121;
      };
      service = {
        DISABLE_REGISTRATION = true;
        ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
        SHOW_REGISTRATION_BUTTON = false;
        ENABLE_PASSWORD_SIGNIN_FORM = false;
      };
      actions = {
        ENABLED = true;
        DEFAULT_ACTIONS_URL = "github";
      };
      repository = {
        DEFAULT_PRIVATE = "private";
      };
      mailer = {
        ENABLED = true;
        SMTP_ADDR = "smtp.fastmail.com";
        FROM = "git@donsz.nl";
        USER = "git@donsz.nl";
      };
    };
    mailerPasswordFile = config.sops.secrets.forgejo.path;
  };

  users.groups.forgejo-runner = { };
  users.users.forgejo-runner = {
    isSystemUser = true;
    group = "forgejo-runner";
  };

  sops.secrets.forgejo-runner = {
    sopsFile = ../../secrets/forgejo-runner.env;
  };

  services.gitea-actions-runner = {
    package = pkgs.forgejo-runner;

    instances.fili = {
      enable = true;
      name = "forgejo-runner-01";
      tokenFile = config.sops.secrets.forgejo-runner.path;
      url = "https://git.donsz.nl/";
      labels = [
        "nix:host"
        "docker:docker://node:16-bullseye"
        "ubuntu-latest:docker://node:16-bullseye"
      ];
      settings = { };

      hostPackages = with pkgs; [
        # default ones
        bash
        coreutils
        curl
        gawk
        gitMinimal
        gnused
        nodejs
        wget

        # used in deployments
        lix
        openssh
      ];
    };
  };

  virtualisation.docker = {
    daemon.settings = {
      fixed-cidr-v6 = "fd00::/80";
      ipv6 = true;
    };
  };
  networking.firewall.trustedInterfaces = [ "br-+" ];

}