{
  flake.modules.nixos.gitea =
    { config, ... }:
    {
      services.gitea = {
        enable = true;

        settings = {
          server = {
            DOMAIN = "git.jelles.net";
            ROOT_URL = "https://git.jelles.net/";
            HTTP_PORT = 3001;
            HTTP_ADDR = "127.0.0.1";

            START_SSH_SERVER = false;
            SSH_PORT = 22;
          };

          service.DISABLE_REGISTRATION = true;
        };
      };

      services.openssh.settings.AllowUsers = [ "gitea" ];

      services.caddy.virtualHosts."git.jelles.net".extraConfig =
        "reverse_proxy :${toString config.services.gitea.settings.server.HTTP_PORT}";
    };
}