{ ... }:

# Gitea — self-hosted git. stateDir/repositories were migrated from the old
# ZimaOS docker instance (single user/org "darman", sqlite db, 4 repos, no
# LFS objects yet) into stateDir's default layout (data/gitea.db,
# data/{indexers,avatars,sessions,...}, repositories/), so no import step is
# needed on first boot — NixOS just needs to chown it to the gitea user
# (see below).
#
# HTTP is reverse-proxied through Caddy (see hosts/jupiter/configuration.nix
# for the vhost). SSH clone/push uses gitea's own built-in SSH server on
# :2222, kept separate from the host's OpenSSH on :22. NOT :222 (the old
# docker setup's external port) — gitea runs as the unpriv "gitea" user with
# an empty capability set, so it can't bind <1024: "listen tcp :222: bind:
# permission denied".
#
# After first deploy, fix ownership of the migrated data (it currently
# belongs to darman:users from the CIFS copy):
#   chown -R gitea:gitea /mnt/data/AppData/gitea
{
  services.gitea = {
    enable = true;
    stateDir = "/mnt/data/AppData/gitea";
    lfs.enable = true;

    settings = {
      repository = {
        DEFAULT_BRANCH = "master";
      };
      server = {
        DOMAIN = "git.mgaction.town";
        SSH_DOMAIN = "git.mgaction.town";
        ROOT_URL = "http://git.mgaction.town/";
        HTTP_PORT = 3000;
        START_SSH_SERVER = true;
        SSH_PORT = 2222;
        SSH_LISTEN_PORT = 2222;
      };
      service = {
        DISABLE_REGISTRATION = true;
      };
    };
  };

  networking.firewall.allowedTCPPorts = [ 2222 ];

  users.users.gitea.extraGroups = [ "users" ];
}