{
  config,
  lib,
  pkgs,
  ...
}:

{
  sops = {
    defaultSopsFile = ../secrets/forgejo.yaml;
    validateSopsFiles = false;
    age = {
      keyFile = "/var/lib/sops-nix/key.txt";
      generateKey = true;
    };
    secrets = {
      "forgejo/server_lfs_jwt_secret" = {
        owner = "forgejo";
        group = "forgejo";
        restartUnits = [ "forgejo.service" ];
      };
      "forgejo/security_internal_token" = {
        owner = "forgejo";
        group = "forgejo";
        restartUnits = [ "forgejo.service" ];
      };
      "forgejo/oauth2_jwt_secret" = {
        owner = "forgejo";
        group = "forgejo";
        restartUnits = [ "forgejo.service" ];
      };
      "forgejo/mailer_passwd" = {
        owner = "forgejo";
        group = "forgejo";
        restartUnits = [ "forgejo.service" ];
      };
    };
  };

  services.forgejo = {
    enable = true;
    package = pkgs.forgejo;

    database = {
      type = "postgres";
      createDatabase = true;
      host = "/run/postgresql/";
      name = "forgejo";
      user = "forgejo";
    };

    settings = {
      DEFAULT = {
        APP_NAME = "git.mizuki.guru";
        APP_SLOGAN = "with 🎀";
        RUN_MODE = "prod";
      };

      federation = {
        ENABLED = true;
      };

      server = {
        DOMAIN = "git.mizuki.guru";
        SSH_DOMAIN = "mizuki.guru";
        HTTP_PORT = 3000;
        ROOT_URL = "https://git.mizuki.guru/";
        DISABLE_SSH = false;
        SSH_PORT = 22;
        LFS_START_SERVER = true;
        OFFLINE_MODE = false;
      };

      security = {
        INSTALL_LOCK = true;
        PASSWORD_HASH_ALGO = "pbkdf2_hi";
      };

      service = {
        REGISTER_EMAIL_CONFIRM = true;
        ENABLE_NOTIFY_MAIL = true;
        DISABLE_REGISTRATION = false;
        ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
        ENABLE_CAPTCHA = false;
        REQUIRE_SIGNIN_VIEW = false;
        DEFAULT_KEEP_EMAIL_PRIVATE = false;
        DEFAULT_ALLOW_CREATE_ORGANIZATION = true;
        DEFAULT_ENABLE_TIMETRACKING = true;
        NO_REPLY_ADDRESS = "noreply.relay.imnya.ng";
      };

      mailer = {
        ENABLED = true;
        SMTP_ADDR = "mail.mizuki.guru";
        SMTP_PORT = 587;
        FROM = "systemmail@mizuki.guru";
        USER = "systemmail@mizuki.guru";
      };

      oauth2 = {
        ENABLED = true;
      };

      actions = {
        ENABLED = false;
      };

      ui = {
        THEMES = "dark,light,auto,forgejo-auto,forgejo-light,forgejo-dark";
        DEFAULT_THEME = "auto";
      };

      repository = {
        ROOT = "/var/lib/forgejo/repositories";
      };
      "repository.pull-request".DEFAULT_MERGE_STYLE = "merge";
      "repository.signing".DEFAULT_TRUST_MODEL = "committer";
      "cron.update_checker".ENABLED = true;
      session.PROVIDER = "file";
      oauth2_client.ENABLE_AUTO_REGISTRATION = true;
    };

    secrets = {
      server.LFS_JWT_SECRET = lib.mkForce config.sops.secrets."forgejo/server_lfs_jwt_secret".path;
      security.INTERNAL_TOKEN = lib.mkForce config.sops.secrets."forgejo/security_internal_token".path;
      oauth2.JWT_SECRET = lib.mkForce config.sops.secrets."forgejo/oauth2_jwt_secret".path;
      mailer.PASSWD = lib.mkForce config.sops.secrets."forgejo/mailer_passwd".path;
    };
  };
}