{ config, ... }:
let
  service = config.facts.services.gitea;
  nixosModules = config.flake.modules.nixos;
in
{
  flake.modules.nixos.gitea = {
    imports = [
      nixosModules.caddy
      nixosModules.openssh
    ];

    services.gitea = {
      enable = true;

      settings = {
        server = {
          ROOT_URL = "${service.origin}/";
          HTTP_PORT = 3001;
          HTTP_ADDR = "127.0.0.1";
        };

        service.DISABLE_REGISTRATION = true;
      };
    };

    services.openssh.settings.AllowUsers = [ "gitea" ];

    services.caddy.virtualHosts.${service.domain}.extraConfig = "reverse_proxy 127.0.0.1:3001";
  };
}