{ pkgs, ... }:

{
  users.users.git = {
    isSystemUser = true;
    group = "git";
    home = "/srv/git";
    createHome = true;
    homeMode = "755"; # allow nginx (and world) to read
    shell = "${pkgs.git}/bin/git-shell";
    openssh.authorizedKeys.keys = [
      "restrict ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDHcqQDnH0LcUWFV+cd9aABfM55+72UAn1ZY5x5bHwPL4IEgT1nagbi1X3FwCJkh2rEcDsHl4FflcNfh+IyU2VyuQfRIXl7CKP040ovXmPVzgU8JiEDrrRebpZ7aHCKk+4Q6cJ8dzAI1sRogVyYrV0hLB4yeMnVexkIcsQMt5pXQ1zodlzHfW1W7OWQDbKjIyh4pv1KJ/IIjiBIt7l+OCqi7wZK4ubmxyMhmZx1xpRC5mz2/29Mpt+1VgCmxC7Hv1SG7yu+U0s4eJ3kbzFKNcZ/bCYqFxK48dT66qhS3qZFg09omumG8IbEUcx+WqM1V7WhiJYig9x5ovmMToQXTJ5uxLtcovnxO/53IgwV7INvmr8+NhD+LlkQfSjjUAW09bhVj9sKIW2bbrIxlOT8z6CQY9zGXNXi8u1oxPt3Q7d3rMxoWhWnr2l3Ok7OIkWooOK3e0NdhgIAxZKlYJAmIYaX391sGTyiuwUy96mg5JcYsLYMfkEg/Sv+2vQp8kkvB0E= joe@sparky"
      "restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIvvJXGg1HVDU2z2osjq5FEAcwte8ZybuYj1wpTtwr1m joe@doughboy"
      "restrict ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHbrW/EovRZGOjOS1sGx2jgNpvtfevFnKApwhYdB9gZl joe@mojo.local"
    ];
  };

  users.groups.git = { };

  services.cgit."git.mou.fo" = {
    enable = true;
    scanPath = "/srv/git";
    gitHttpBackend.checkExportOkFiles = false;
    settings = {
      section-from-path = -1;
      clone-url = "git@git.mou.fo:$CGIT_REPO_URL";
      about-filter = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh";
      source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
    };
  };

  services.nginx.virtualHosts."git.mou.fo" = {
    enableACME = true;
    forceSSL = true;
  };

  services.oauth2-proxy.nginx.virtualHosts."git.mou.fo" = { };
}