{ ... }:

# Gitea — self-hosted git. stateDir/repositories were migrated from the old
# ZimaOS docker instance straight into stateDir's default layout, so no
# import step is needed — just chown it to the gitea user after first deploy
# (currently darman:users from the CIFS copy):
#   chown -R gitea:gitea /mnt/data/AppData/gitea
#
# HTTP is reverse-proxied through Caddy (hosts/jupiter/configuration.nix).
# SSH uses gitea's own built-in server on :2222 (not the host's :22, and not
# :222 — the unpriv gitea user can't bind <1024).
{
  services.gitea = {
    enable = true;
    stateDir = "/mnt/data/AppData/gitea";
    lfs.enable = true;

    settings = {
      repository = {
        DEFAULT_BRANCH = "master";
      };
      server = {
        DOMAIN = "git.mgaction.town";
        SSH_DOMAIN = "git.mgaction.town";
        # https, not http: neptun's Caddy terminates TLS for this name. Gitea
        # builds its absolute URLs (clone buttons, redirects, webhooks) from
        # ROOT_URL, so an http:// value hands out downgraded links.
        ROOT_URL = "https://git.mgaction.town/";
        HTTP_PORT = 3000;
        START_SSH_SERVER = true;
        SSH_PORT = 2222;
        SSH_LISTEN_PORT = 2222;
      };
      service = {
        DISABLE_REGISTRATION = true;
      };
    };
  };

  networking.firewall.allowedTCPPorts = [ 2222 ];

  users.users.gitea.extraGroups = [ "users" ];
}