{
  pkgs,
  lib,
  config,
  service_configs,
  username,
  ...
}:
{
  imports = [
    (lib.serviceMountDeps "gitea" [ config.services.gitea.stateDir ])
    (lib.serviceDependZpool "gitea" service_configs.zpool_ssds)
  ];

  services.gitea = {
    enable = true;
    appName = "Simon Gardling's Gitea instance";
    stateDir = service_configs.gitea.dir;
    database = {
      type = "postgres";
      socket = service_configs.postgres.socket;
    };

    settings = {
      server = {
        SSH_USER = "gitea";
        DOMAIN = service_configs.gitea.domain;
        ROOT_URL = "https://" + config.services.gitea.settings.server.DOMAIN;
        HTTP_PORT = service_configs.ports.gitea;
        LANDING_PAGE = "/explore/repos";
        DISABLE_HTTP_GIT = true;
      };
      session = {
        # https cookies or smth
        COOKIE_SECURE = true;
      };
      # only I shall use gitea
      service.DISABLE_REGISTRATION = true;
    };
  };

  services.caddy.virtualHosts."${service_configs.gitea.domain}".extraConfig = ''
    reverse_proxy :${builtins.toString config.services.gitea.settings.server.HTTP_PORT}
  '';

  systemd.tmpfiles.rules = [
    # 0700 for ssh permission reasons
    "d ${config.services.gitea.stateDir} 0700 ${config.services.gitea.user} ${config.services.gitea.group}"
  ];

  services.postgresql = {
    ensureDatabases = [ config.services.gitea.user ];
    ensureUsers = [
      {
        name = config.services.gitea.database.user;
        ensureDBOwnership = true;
        ensureClauses.login = true;
      }
    ];
  };

  services.openssh.settings.AllowUsers = [ config.services.gitea.user ];

  users.users.${username}.extraGroups = [
    config.services.gitea.group
  ];
}