{ config, pkgs, secrets, user, domain, ... }: 
let git-user = "git"; in
{
  sops.secrets = {
    "postgres-pw" = { owner = config.services.gitea.user; };
  };

  environment.systemPackages = with pkgs; [
    gitea
  ];
  users = {
    users = {
      "${user}".extraGroups = [ git-user ];
      "${git-user}" = {
        isSystemUser = true;
        group = git-user;
        useDefaultShell = true;
        home = config.services.gitea.stateDir;
        openssh.authorizedKeys.keys = config.users.users."${user}".openssh.authorizedKeys.keys;
      };
    };
    groups."${git-user}" = {};
  };

  services.gitea = {
    enable = true;
    package = pkgs.gitea;
    group = git-user;  
    user = git-user; 
    appName = "NxGit";
    stateDir = "/var/lib/gitea"; # default
    useWizard = false; # default
    # camoHmacKeyFile = ;
    database = {
      createDatabase = false; # default
      host = "127.0.0.1"; # default
      port = 5432;
      passwordFile = config.sops.secrets."postgres-pw".path;
      socket = null;
      type = "postgres";
      name = "gitea"; # default
      user = "gitea"; # default
    };
    dump = {
      enable = true;
      backupDir = "/var/backup/gitea";
      file = null; # default = chosen by gitea
      interval = "daily";
      type = "zip"; # default
    };
    # extraConfig = null; # default
    # lfs = {
    #   enable = false; # default
    #   contentDir = "${config.services.gitea.stateDir}/data/lfs"; # default
    # };
    # mailerPasswordFile = null; # default
    # metricsTokenFile = null; # default
    # repositoryRoot = "${config.services.gitea.stateDir}/repositories"; # default
    settings = {
      log = {
        LEVEL = "Info";
        # LEVEL = "Error";
      };
      server = {
        DISABLE_SSH = false; # default
        START_SSH_SERVER = false; # default
        SSH_LISTEN_HOST = "0.0.0.0";
        SSH_PORT = secrets.ssh.port;
        DOMAIN = "pw.${domain}";
        SSH_DOMAIN = "ssh.${domain}";
        # HTTP_ADDR = "${config.services.gitea.settings.server.DOMAIN}";
        # HTTP_PORT = 3000; # default
        # PROTOCOL = "http"; # default
        # ROOT_URL = "https:pw.${domain}/"; # default
      };
      session = {
        COOKIE_SECURE = true;
      };
      service = {
        DISABLE_REGISTRATION = true;
      };
    };
  };
}