{ lib, pkgs, config, ... }:
let
  cfg = config.services.forgejo;
  srv = cfg.settings.server;
in
{
  sops.secrets.forgejo = {
    sopsFile = ../../secrets/forgejo.yaml;
    key="email_password";
    format = "yaml";
  };

  users.groups.forgejo = { };
  users.users.forgejo = {
    isSystemUser = true;
    group = "forgejo";
    extraGroups = [ "storage" ];
  };

  services.nginx = {
    virtualHosts."git.donsz.nl" = {
      forceSSL = true;
      enableACME = true;
      extraConfig = ''
        client_max_body_size 512M;
      '';
      locations."/".proxyPass = "http://[::1]:13121";
    };
  };

  services.forgejo = {
    enable = true;
    lfs.enable = true;
    user = "forgejo";
    group = "forgejo";
    repositoryRoot="/storage/storage/git";

    database = {
      type = "postgres";
      name = "forgejo";
      createDatabase = false;
    };

    settings = {
      DEFAULT = {
        APP_NAME="jana's git server";
        APP_SLOGAN="meow!";
      };
      server = {
        DOMAIN = "git.donsz.nl";
        ROOT_URL = "https://git.donsz.nl/";
        HTTP_PORT = 13121;
      };
      service = {
        DISABLE_REGISTRATION = true;
        ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
        SHOW_REGISTRATION_BUTTON = false;
        ENABLE_PASSWORD_SIGNIN_FORM = false;
      };
      actions = {
        ENABLED = true;
        DEFAULT_ACTIONS_URL = "github";
      };
      repository = {
        DEFAULT_PRIVATE="private";
      };
      mailer = {
        ENABLED = true;
        SMTP_ADDR = "smtp.fastmail.com";
        FROM = "git@donsz.nl";
        USER = "git@donsz.nl";
      };
    };
    mailerPasswordFile = config.sops.secrets.forgejo.path;
  };

  services.gitea-actions-runner = {
    package = pkgs.forgejo-runner;

    instances.fili = {
      enable = true;
      name = "forgejo-runner-01";
      token = "SutcrCJ3ULoE5LBj9Tm8zkvTRDEJCpbvpe7FEJHC";
      url = "https://git.donsz.nl/";
      labels = [
        "node-22:docker://node:22-bookworm"
        "nixos-latest:docker://nixos/nix"
      ];
      settings = {};
    };
  };

  virtualisation.docker = {
    daemon.settings = {
      fixed-cidr-v6 = "fd00::/80";
      ipv6 = true;
    };
  };
  networking.firewall.trustedInterfaces = [ "br-+" ];

}