{
  pkgs,
  config,
  lib,
  ...
}:
let
  domain = "gitea.${config.services.nginx.domain}";
in
{
  services.forgejo = {
    enable = true;
    database.type = "postgres";

    settings = {
      server = {
        DOMAIN = domain;
        HTTP_ADDR = "127.0.0.1";
        ROOT_URL = "https://${domain}/";
        SSH_PORT = 2222;
      };

      metrics = {
        ENABLED = true;
        TOKEN = "#metricstoken#";
      };
      service.DISABLE_REGISTRATION = true;
      session.COOKIE_SECURE = true;
    };
  };

  systemd.services.forgejo.serviceConfig.ExecStartPre =
    let
      replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
      secretPath = config.sops.secrets."forgejo/metrics-token".path;
      runConfig = "${config.services.forgejo.customDir}/conf/app.ini";
    in
    [ "+${replaceSecretBin} '#metricstoken#' '${secretPath}' '${runConfig}'" ];

  # Set up SSL
  services.nginx.virtualHosts."${domain}" =
    let
      httpAddress = config.services.forgejo.settings.server.HTTP_ADDR;
      httpPort = config.services.forgejo.settings.server.HTTP_PORT;
    in
    {
      forceSSL = true;
      useACMEHost = "tlater.net";
      enableHSTS = true;

      locations."/".proxyPass = "http://${httpAddress}:${toString httpPort}";
      locations."/metrics" = {
        extraConfig = ''
          access_log off;
          allow 127.0.0.1;
          ${lib.optionalString config.networking.enableIPv6 "allow ::1;"}
          deny all;
        '';
      };
    };

  # Block repeated failed login attempts
  #
  # TODO(tlater): Update this - we switched to forgejo, who knows what
  # the new matches are.
  # environment.etc = {
  #   "fail2ban/filter.d/gitea.conf".text = ''
  #     [Definition]
  #     failregex = .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>
  #     journalmatch = _SYSTEMD_UNIT=forgejo.service + _COMM=forgejo + SYSLOG_IDENTIFIER=forgejo
  #   '';
  # };

  # services.fail2ban.jails = {
  #   gitea = ''
  #     enabled = true
  #   '';
  # };

  services.backups.forgejo = {
    user = "forgejo";
    paths = [
      "/var/lib/forgejo/forgejo-db.sql"
      "/var/lib/forgejo/repositories/"
      "/var/lib/forgejo/data/"
      "/var/lib/forgejo/custom/"
      # Conf is backed up via nix
    ];
    preparation = {
      packages = [ config.services.postgresql.package ];
      text = "pg_dump ${config.services.forgejo.database.name} --file=/var/lib/forgejo/forgejo-db.sql";
    };
    cleanup = {
      packages = [ pkgs.coreutils ];
      text = "rm /var/lib/forgejo/forgejo-db.sql";
    };
    pauseServices = [ "forgejo.service" ];
  };
}