{ ... }:

{
  services.gitea = {
    enable = true;
    settings = {
      server = {
        ROOT_URL = "https://git.mou.fo/";
        PROTOCOL = "http+unix";
        DISABLE_REGISTRATION = true;
      };
      session = {
        COOKIE_SECURE = true;
      };
    };
  };

  services.nginx.virtualHosts."git.mou.fo" = {
    enableACME = true;
    forceSSL = true;
    locations."/".proxyPass = "http://unix:/run/gitea/gitea.sock";
  };
}