{
  config,
  lib,
  ...
}:
let
  cfg = config.modules.services.gitea;
in
{
  options.modules.services.gitea = {
    enable = lib.mkEnableOption "Gitea";

    reverseProxyAddress = lib.mkOption {
      type = lib.types.str;
      description = "IP address of the reverse proxy trusted to forward client headers.";
    };
  };

  config = lib.mkMerge [
    {
      registry."stable-uid".${config.networking.hostName}.gitea = 20007;
    }

    (lib.mkIf cfg.enable {
      users.users.gitea = {
        isSystemUser = true;
        uid = config.registry."stable-uid".${config.networking.hostName}.gitea;
        group = "storage";
        home = "/var/lib/gitea";
      };

      networking.firewall.allowedTCPPorts = [
        2222
        3000
      ];

      services.gitea = {
        enable = true;
        user = "gitea";
        group = "storage";
        stateDir = "/var/lib/gitea";
        repositoryRoot = "/var/lib/gitea/repositories";
        lfs = {
          enable = true;
          contentDir = "/var/lib/gitea/data/lfs";
        };
        database.type = "sqlite3";
        settings = {
          server = {
            HTTP_ADDR = "0.0.0.0";
            HTTP_PORT = 3000;
            ROOT_URL = "https://git.alexion.dev/";
            SSH_DOMAIN = "git.alexion.dev";
            SSH_PORT = 22;
            START_SSH_SERVER = true;
            SSH_LISTEN_HOST = "0.0.0.0";
            SSH_LISTEN_PORT = 2222;
            REVERSE_PROXY_TRUSTED_PROXIES = "${cfg.reverseProxyAddress}/32";
          };
          service.DISABLE_REGISTRATION = true;
          # Direct bootstrap access uses HTTP until the public HTTPS route moves.
          session.COOKIE_SECURE = false;
        };
      };
    })
  ];
}