{ config, ... }:
let
  domain = "git.reudy.net";
  sshPort = 14922;
in
{
  services.forgejo = {
    enable = true;

    # SQLite is plenty for a single-user VPS, same as Nextcloud/Authelia.
    database.type = "sqlite3";

    # Git LFS support for large files.
    lfs.enable = true;

    settings = {
      server = {
        DOMAIN = domain;
        ROOT_URL = "https://${domain}/";

        # Caddy terminates TLS and proxies to this; not reachable from outside.
        HTTP_ADDR = "127.0.0.1";
        HTTP_PORT = 14921;

        # Forgejo's built-in SSH server, separate from the system sshd (which
        # only allows 'reudy' on 14902). Clone URLs look like:
        #   ssh://git@git.reudy.net:14922/<user>/<repo>.git
        START_SSH_SERVER = true;
        SSH_PORT = sshPort;
        SSH_LISTEN_PORT = sshPort;
        BUILTIN_SSH_SERVER_USER = "git";
      };

      # Private instance — create accounts with the admin CLI instead.
      service.DISABLE_REGISTRATION = true;

      session.COOKIE_SECURE = true;
    };
  };

  networking.firewall.allowedTCPPorts = [ sshPort ];
}