{ config, ...}:
{
  # Forgejo's embedded SSH server, reached over loopback by the auto-pull
  # checkouts under /var/www/ (website, dashboard). Declared so a fresh
  # `drone` home doesn't need an imperative accept-on-first-use step.
  programs.ssh.knownHosts.forgejo-loopback = {
    hostNames = [ "[127.0.0.1]:2222" ];
    publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCtkarE/dXAdrXkPhYIl+takKG1YPtAOYwLlD1YIB/Dep7LSvpyWv8pyC5bXajuIzjEjXl5e8/XtJhROH9X5OwqBZygwiDjOaZR7IWu2qAHQBeQSIP2hLCm5LndCsnYgfCaIZe0ZhFqC7byiZlPH3hLYm7aYNeQiJy9eBh9PLdyfcW2oxhq9Fc8PXfpfTbPUgkCDWn0MYEfiRT2+839xYSHdIeAFSmLohaV6ptXjCLAes32HFZE13CadmhfEXY4DMi3V7RUTQeUTuOohjZFFE1RvKGEpaxIRU/Kf1tDK5rRrbCFdQCjMzDwndKewpujSIBVe0emjHv/hiIacHduYz3GrqQia95biFilDJuvKbUlr9nVQor6GD4+yK0Uy2BraFLUA6akp8M7Ma9Zi4gK+UjLIpDKxwfncpLCk4KcGbwsz5acxL8bpTqGw4yZU87tKRxN9NOThHROGqZfMHLfyFH0uXalwHNAqx6dcv706+LAkCR17F8lZ69NRW8Jj7WbPoCRgIl1Ea8D4ce/Hf6enEm8d3CGK3HE+EcN8OUnhLuh4XcrSqmMtBIiW9iu7okD7a6wsOautZzioRuXt/ZS92fPe6CpaQZCWtxr2gr9HtGGn9zrY6spNM5nIf597jaYMyET1EPyPdNyJuVEnJHkILend4xVnWTIyS2mx1QKOuAdCQ==";
  };

  services.forgejo= {
    enable = true;
    lfs.enable = true;
    dump.enable = true;
    settings = {
      service = {
       ENABLE_INTERNAL_SIGNIN = true;
       DISABLE_REGISTRATION = false;
       ALLOW_ONLY_INTERNAL_REGISTRATION = false;
       ENABLE_REGISTRATION = true;
       ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
       #ENABLE_AUTO_REGISTRATION=true;
      };
      log.level = "Debug";
      repository = {
        ENABLE_PUSH_CREATE_USER = true;
      };
      pwa = {
        ENABLE_STANDALONE = true;
      };
      server = {
	START_SSH_SERVER = true;
	SSH_PORT = 2222;
	HTTP_ADDR = "0.0.0.0";
	HTTP_PORT = 3000;
        DOMAIN = "git.${config.domain}";
	ROOT_URL = "https://git.${config.domain}/"; # can i have two ROOT_URL ?
#	PROTOCOL = "http";
	TRUSTED_PROXIES = config.tailnetIPs.blunix;
	LANDING_PAGE = "login";
      };	
      session = {
	PROVIDER = "file";
        COOKIE_SECURE = true;
	};
      security = {
        LOGIN_REMEMBER_DAYS = 10;
        REVERSE_PROXY_TRUSTED_PROXIES = config.tailnetIPs.blunix;
      };
      webhook.ALLOWED_HOST_LIST = "external,127.0.0.1";
      oauth2_client = {
        # Never use auto account linking with this, otherwise users cannot change
        # their new user name and they could potentially overtake other users accounts
        # by setting their email address to an existing account.
        # With "login" linking the user must choose a non-existing username first or login
        # with the existing account to link.
        ACCOUNT_LINKING = "login";
        USERNAME = "nickname";
        # This does not mean that you cannot register via oauth, but just that there should
        # be a confirmation dialog shown to the user before the account is actually created.
        # This dialog allows changing user name and email address before creating the account.
        ENABLE_AUTO_REGISTRATION = false;
        REGISTER_EMAIL_CONFIRM = false;
        UPDATE_AVATAR = true;
      };
    };
  };	
}