{ config, pkgs-unstable, domain, ... }: 
{
  sops.secrets = {
    "postgres-pw" = { owner = "gitea"; };
  };

  services.gitea = {
    enable = true;
    package = pkgs-unstable.gitea;
    group = "gitea"; # default
    user = "gitea"; # default
    appName = "NxGit";
    stateDir = "/var/lib/gitea"; # default
    useWizard = false; # default
    # camoHmacKeyFile = ;
    customDir = "${config.services.gitea.stateDir}/custom"; # default
    database = {
      createDatabase = false; # default
      host = "127.0.0.1"; # default
      port = 5432;
      passwordFile = config.sops.secrets."postgres-pw".path;
      # path = "${config.services.gitea.stateDir}/data/gitea.db"; # default
      # socket = "/run/postgresql";
      socket = null;
      type = "postgres";
      name = "gitea"; # default
      user = "gitea"; # default
    };
    dump = {
      enable = true;
      backupDir = "${config.services.gitea.stateDir}/dump"; # default
      file = null; # default
      interval = "daily";
      type = "zip"; # default
    };
    extraConfig = null; # default
    lfs = {
      enable = false; # default
      contentDir = "${config.services.gitea.stateDir}/data/lfs"; # default
    };
    mailerPasswordFile = null; # default
    metricsTokenFile = null; # default
    repositoryRoot = "${config.services.gitea.stateDir}/repositories"; # default
    settings = {
      log = {
        LEVEL = "Info";
        # LEVEL = "Error";
        ROOT_PATH = "${config.services.gitea.stateDir}/log"; # default
      };
      i18n = {
        LANGS = "en-US";
      };
      server = {
        DISABLE_SSH = false; # default
        SSH_PORT = 20022;
        DOMAIN = "pw2.${domain}";
        HTTP_ADDR = "http://${config.services.gitea.settings.server.DOMAIN}:${toString config.services.gitea.settings.server.HTTP_PORT}/";
        HTTP_PORT = 3000; # default
        PROTOCOL = "http"; # default
        ROOT_URL = "https:pw2.${domain}/"; # default
        STATIC_ROOT_PATH = "${config.services.gitea.stateDir}/static";
      };
      session = {
        COOKIE_SECURE = true;
      };
      service = {
        DISABLE_REGISTRATION = true;
      };
    };
  };
}