{ den, ... }:
{
  lux.services._.gitea = den.lib.take.exactly (
    { host }:
    {
      nixos =
        { config, ... }:
        {
          services.gitea = {
            enable = true;

            settings = {
              server = {
                DOMAIN = "git.${host.domain}";
                ROOT_URL = "https://git.${host.domain}/";
                HTTP_PORT = 3001;
                HTTP_ADDR = "127.0.0.1";

                START_SSH_SERVER = false;
                SSH_PORT = 22;
              };

              service = {
                DISABLE_REGISTRATION = true;
              };
            };
          };

          services.openssh.settings.AllowUsers = [ "gitea" ];

          services.caddy.virtualHosts."git.${host.domain}".extraConfig =
            "reverse_proxy :${toString config.services.gitea.settings.server.HTTP_PORT}";
        };
    }
  );
}