diff --git a/caddy.nix b/caddy.nix
index 87cb43b..dc45810 100755
--- a/caddy.nix
+++ b/caddy.nix
@@ -33,6 +33,12 @@
       # }
       reverse_proxy 127.0.0.1:8081
     '';
+
+    # Forgejo — no Authelia forward-auth, since it would break git over HTTPS
+    # and the API. Forgejo handles its own logins.
+    virtualHosts."git.srazka.com".extraConfig = ''
+      reverse_proxy 127.0.0.1:14921
+    '';
   };
 
 }
diff --git a/flake.nix b/flake.nix
index e49794e..89ee6d6 100644
--- a/flake.nix
+++ b/flake.nix
@@ -35,6 +35,7 @@
           ./caddy.nix
           ./authelia.nix
           ./nextcloud.nix
+          ./forgejo.nix
           ./containers/hello.nix
           agenix.nixosModules.default
 
diff --git a/forgejo.nix b/forgejo.nix
new file mode 100644
index 0000000..47846df
--- /dev/null
+++ b/forgejo.nix
@@ -0,0 +1,42 @@
+{ config, ... }:
+let
+  domain = "git.srazka.com";
+  sshPort = 14922;
+in
+{
+  services.forgejo = {
+    enable = true;
+
+    # SQLite is plenty for a single-user VPS, same as Nextcloud/Authelia.
+    database.type = "sqlite3";
+
+    # Git LFS support for large files.
+    lfs.enable = true;
+
+    settings = {
+      server = {
+        DOMAIN = domain;
+        ROOT_URL = "https://${domain}/";
+
+        # Caddy terminates TLS and proxies to this; not reachable from outside.
+        HTTP_ADDR = "127.0.0.1";
+        HTTP_PORT = 14921;
+
+        # Forgejo's built-in SSH server, separate from the system sshd (which
+        # only allows 'reudy' on 14902). Clone URLs look like:
+        #   ssh://git@git.srazka.com:14922/<user>/<repo>.git
+        START_SSH_SERVER = true;
+        SSH_PORT = sshPort;
+        SSH_LISTEN_PORT = sshPort;
+        BUILTIN_SSH_SERVER_USER = "git";
+      };
+
+      # Private instance — create accounts with the admin CLI instead.
+      service.DISABLE_REGISTRATION = true;
+
+      session.COOKIE_SECURE = true;
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ sshPort ];
+}