{
  domainName,
  config,
  pkgs,
  ...
}:
{
  services = {
    forgejo = {
      enable = true;
      settings = {
        server = {
          ROOT_URL = "https://git.${domainName}/";
          PROTOCOL = "http";
          HTTP_ADDR = "127.0.0.1";
          HTTP_PORT = 3000;
          DOMAIN = "git.${domainName}";
          SSH_PORT = 2222;
          START_SSH_SERVER = true;
        };
        session.COOKIE_SECURE = true;
        service.DISABLE_REGISTRATION = true;
        mailer = {
          ENABLED = true;
          SMTP_ADDR = "in-v3.mailjet.com";
          SMTP_PORT = 587;
          FROM = "me@${domainName}";
          # USER and PASSWD come from secrets below
        };
      };
      secrets.mailer.USER = config.sops.secrets."forgejo-mailer-user".path;
      secrets.mailer.PASSWD = config.sops.secrets."forgejo-mailer-passwd".path;
    };
    nginx.virtualHosts."git.${domainName}" = {
      forceSSL = true;
      enableACME = true;
      extraConfig = ''
          client_max_body_size 512M;
        '';
      locations = {
        "/" = {
          proxyPass = "http://127.0.0.1:3000";
          recommendedProxySettings = false;
          extraConfig = ''
              proxy_set_header Host $host;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $scheme;
            '';
        };
      };
    };
    borgbackup.jobs.forgejo = {
      paths = [ config.services.forgejo.stateDir ];
      repo = "ssh://n5lniyfd@n5lniyfd.repo.borgbase.com/./repo";
      user = "root";
      group = "root";
      encryption = {
        mode = "repokey-blake2";
        passCommand = "${pkgs.coreutils}/bin/cat ${config.sops.secrets."borg-passphrase".path}";
      };
      doInit = true;
      compression = "auto,zstd";
      startAt = "*-*-* 03:15:00";
      persistentTimer = true;
      prune.keep = {
        daily = 7;
        weekly = 4;
        monthly = 6;
      };
      environment.BORG_RSH = "ssh -i ${config.sops.secrets."borg-private-key".path} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.config/borg/known_hosts";
      preHook = ''
        forgejoWasActive=/root/.cache/borg/forgejo-was-active
        if ${pkgs.systemd}/bin/systemctl is-active --quiet forgejo.service; then
          touch "$forgejoWasActive"
          ${pkgs.systemd}/bin/systemctl stop forgejo.service
        else
          rm -f "$forgejoWasActive"
        fi
      '';
      postHook = ''
        forgejoWasActive=/root/.cache/borg/forgejo-was-active
        if [ -e "$forgejoWasActive" ]; then
          ${pkgs.systemd}/bin/systemctl start forgejo.service
          rm -f "$forgejoWasActive"
        fi
      '';
    };
  };

  systemd.services.borgbackup-job-forgejo = {
    after = [
      "sops-install-secrets.service"
      "network-online.target"
    ];
    wants = [ "network-online.target" ];
  };

  sops.secrets."forgejo-mailer-user" = {
    sopsFile = ./secrets/forgejo.yaml;
    mode = "0400";
  };
  sops.secrets."forgejo-mailer-passwd" = {
    sopsFile = ./secrets/forgejo.yaml;
    mode = "0400";
  };
  sops.secrets."borg-private-key" = {
    sopsFile = ./secrets/borgbackup.yaml;
    mode = "0400";
    key = "private-key";
    owner = "root";
    group = "root";
  };
  sops.secrets."borg-passphrase" = {
    sopsFile = ./secrets/borgbackup.yaml;
    mode = "0400";
    key = "passphrase";
    owner = "root";
    group = "root";
  };
}