{
  lib,
  pkgs,
  config,
  ...
}: let
  cfg = config.services.forgejo;
  srv = cfg.settings.server;
  domain = "git.procopius.dk";
  ssh_domain = "gitssh.procopius.dk";
in {
  users.users.plasmagoat.extraGroups = ["forgejo"];

  services.forgejo = {
    enable = true;
    user = "forgejo";
    group = "forgejo";
    stateDir = "/srv/forgejo";
    secrets = {
      mailer = {
        PASSWD = config.sops.secrets.forgejo-mailer-password.path;
      };
    };
    settings = {
      # https://forgejo.org/docs/latest/admin/config-cheat-sheet/
      server = {
        DOMAIN = domain;
        ROOT_URL = "https://${srv.DOMAIN}/";
        PROTOCOL = "http";
        HTTP_PORT = 3000;

        START_SSH_SERVER = true;
        SSH_PORT = 2222;
        SSH_DOMAIN = ssh_domain;
      };
      mailer = {
        ENABLED = true;
        FROM = "git@procopius.dk";

        PROTOCOL = "smtp+starttls";
        SMTP_ADDR = "mail.procopius.dk";
        USER = "git@procopius.dk";
      };
      database = {
        DB_TYPE = lib.mkForce "postgres";
        HOST = "/run/postgresql";
        NAME = "forgejo";
        USER = "forgejo";
      };
      service = {
        DISABLE_REGISTRATION = true;
        # ENABLE_INTERNAL_SIGNIN = false;
        ENABLE_NOTIFY_MAIL = true;
      };
      metrics = {
        ENABLED = true;
        ENABLED_ISSUE_BY_REPOSITORY = true;
        ENABLED_ISSUE_BY_LABEL = true;
      };
      actions = {
        ZOMBIE_TASK_TIMEOUT = "30m";
      };
      ldap = {
        AUTHORIZATION_NAME = "LLDAP";
        HOST = "auth.lab";
        PORT = 3890;
        ENABLE_TLS = false;
        USER_SEARCH_BASE = "ou=users,dc=example,dc=com";
        USER_FILTER = "(&(objectClass=user)(sAMAccountName=%[1]s))";
        USERNAME_ATTRIBUTE = "sAMAccountName";
        EMAIL_ATTRIBUTE = "mail";
        FIRST_NAME_ATTRIBUTE = "givenName";
        SURNAME_ATTRIBUTE = "sn";
        ADMIN_FILTER = "(&(objectClass=user)(memberOf=cn=admins,ou=groups,dc=example,dc=com))";
        SKIP_LOCAL_2FA = false;
        ALLOW_DEACTIVATE_ALL = false;
      };

      # oauth2 = {
      # };
      # oauth2_client = {
      #   ENABLE_AUTO_REGISTRATION = true;
      #   UPDATE_AVATAR = true;
      # };
      # log = {
      #   ROOT_PATH = "/var/log/forgejo";
      #   MODE = "file";
      #   LEVEL = "Info";
      # };

      security = {
        INSTALL_LOCK = true;
      };
    };
  };

  systemd.services.forgejo.preStart = let
    adminCmd = "${lib.getExe cfg.package} admin user";
    user = "plasmagoat"; # Note, Forgejo doesn't allow creation of an account named "admin"
    pwd = config.sops.secrets.forgejo-admin-password;
  in ''
    ${adminCmd} create --admin --email "root@localhost" --username ${user} --password "$(tr -d '\n' < ${pwd.path})" || true
    ## uncomment this line to change an admin user which was already created
    # ${adminCmd} change-password --username ${user} --password "$(tr -d '\n' < ${pwd.path})" || true
  '';

  # Optional: firewall
  networking.firewall.allowedTCPPorts = [3000 2222];
}