{ config, ... }:
{
  services.gitea = {
    enable = true;
    stateDir = "/media/nas/ssd/nix-app-data/gitea";
    useWizard = false;
    mailerPasswordFile = config.sops.secrets."jallen-nas/gitea/mail-key".path;
    metricsTokenFile = config.sops.secrets."jallen-nas/gitea/metrics-key".path;
    settings = {
      server = {
        DOMAIN = "jallen-nas";
        HTTP_ADDR = "0.0.0.0";
        HTTP_PORT = 3000;
        PROTOCOL = "http";
        ROOT_URL = "https://gitea.mjallen.dev/";
        SSH_PORT = 2222;
      };
      service = {
        REGISTER_EMAIL_CONFIRM = false;
        ENABLE_CAPTCHA = false;
        DISABLE_REGISTRATION = true;
        ENABLE_OPENID_SIGNIN = false;
        ENABLE_LDAP_SIGNIN = false;
        ENABLE_SSH_SIGNIN = true;
        ENABLE_BUILTIN_SSH_SERVER = true;
        ENABLE_REVERSE_PROXY_AUTHENTICATION = true;
      };
    };
  };
}