{ config, pkgs, lib, ... }:
{
  services.forgejo = {
    enable = true;
    package = pkgs.forgejo;
    useWizard = false;
    database = {
      type = "postgres";
      createDatabase = true;
    };
    lfs.enable = true;
    settings = {
      DEFAULT.APP_NAME = "0xa's compilable shitposts";
      actions.ENABLED = false;
      database.LOG_SQL = false;
      indexer.REPO_INDEXER_ENABLED = true;
      mailer.ENABLED = false;
      packages.ENABLED = false;
      session.COOKIE_SECURE = true;
      server = {
        DOMAIN = "git.oxapentane.com";
        SSH_DOMAIN = "git.oxapentane.com";
        ROOT_URL = "https://git.oxapentane.com/";
        PROTOCOL = "http";
        START_SSH_SERVER = true;
        BUILTIN_SSH_SERVER_USER = "git";
        SSH_LISTEN_PORT = 2222;
      };
      repository = {
        DEFAULT_REPO_UNITS="repo.code,repo.releases,repo.issues,repo.pulls";
        ENABLE_PUSH_CREATE_USER=true;
      };
      service = {
        REGISTER_EMAIL_CONFIRM = false;
        DISABLE_REGISTRATION = true;
      };
      oauth2_client = {
        ENABLE_AUTO_REGISTRATION = true;
        USERNAME = "nickname";
        ACCOUNT_LINKING = "login";
      };
    };
  };

  # expose forgejo cli
  environment.systemPackages = let
    cfg = config.services.forgejo;
    forgejo-cli = pkgs.writeScriptBin "forgejo-cli" ''
      #!${pkgs.runtimeShell}
      cd ${cfg.stateDir}
      sudo=exec
      if [[ "$USER" != forgejo ]]; then
        sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} -g ${cfg.group} --preserve-env=GITEA_WORK_DIR --preserve-env=GITEA_CUSTOM'
      fi
      # Note that these variable names will change
      export GITEA_WORK_DIR=${cfg.stateDir}
      export GITEA_CUSTOM=${cfg.customDir}
      $sudo ${lib.getExe cfg.package} "$@"
  ''; in [
    forgejo-cli
  ];
}