{ config, lib, pkgs, options, ... }:

with lib;
let
  cfg = config.modules.services.forgejo;
in {
  options.modules.services.forgejo = {
    enable = mkOption {
      type = types.bool;
      default = false;
    };
    domain = mkOption {
      type = types.str;
      default = "git.reidlab.online";
    };
    port = mkOption {
      type = types.int;
      default = 3000;
    };
    package = mkOption {
      type = types.package;
      default = pkgs.forgejo;
    };
  };

  config = mkIf cfg.enable {
    services = {
      gitea = {
        enable = true;
        package = cfg.package;
        stateDir = "/var/lib/${cfg.domain}";
        appName = "reidlab's git instance";
        database = {
          type = "postgres";
          name = "gitea";
        };
        settings = {
          "security" = {
            INSTALL_LOCK = true;
            PASSWORD_HASH_ALGO = "argon2";
            PASSWORD_CHECK_PWN = true;
          };
          "ui.meta" = {
            AUTHOR = "reidlab";
            DESCRIPTION = "reidlab's git instance";
          };
          "server" = {
            DOMAIN = cfg.domain;
            HTTP_PORT = cfg.port;
            ROOT_URL = "https://${cfg.domain}/";
          };
          "repository" = {
            DEFAULT_BRANCH = "main";
          };
          "picture" = {
            DISABLE_GRAVATAR = false;
            ENABLE_FEDERATED_AVATAR = true;
          };
          "service" = {
            ENABLE_CAPTCHA = false;
            REGISTER_EMAIL_CONFIRM = false;
            DEFAULT_KEEP_EMAIL_PRIVATE = true;
            DEFAULT_ENABLE_TIMETRACING = true;
            DISABLE_REGISTRATION = true;
          };
          "federation" = {
            ENABLED = true;
          };
        };
      };

      nginx.virtualHosts."${cfg.domain}" = {
        forceSSL = true;
        enableACME = true;
        locations."/".extraConfig = ''
          proxy_pass http://127.0.0.1:${toString cfg.port};
        '';
      };
    };
  };
}