{
  config,
  lib,
  pkgs,
  self,
  ...
}: {
  age.secrets.gitea-database-password = {
    file = "${self}/secrets/gitea-database-password.age";
    mode = "600";
    owner = "gitea";
  };
  age.secrets.gitea-mailer-password = {
    file = "${self}/secrets/gitea-mailer-password.age";
    mode = "600";
    owner = "gitea";
  };

  # gitea
  services.gitea = {
    enable = true;
    appName = "pub.solar git server";
    database = {
      type = "postgres";
      passwordFile = config.age.secrets.gitea-database-password.path;
    };
    domain = "git.pub.solar";
    httpAddress = "127.0.0.1";
    httpPort = 3000;
    lfs.enable = true;
    mailerPasswordFile = config.age.secrets.gitea-mailer-password.path;
    rootUrl = "https://git.pub.solar";
    settings = {
      mailer = {
        ENABLED = true;
        MAILER_TYPE = "smtp";
        HOST = "mx2.greenbaum.cloud:465";
        FROM = ''"pub.solar git server" <gitea@pub.solar>'';
        USER = "admins@pub.solar";
      };
      # currently broken, gpg core dumps
      #"repository.signing" = {
      #  SIGNING_KEY = "default";
      #  MERGES = "always";
      #};
      openid = {
        ENABLE_OPENID_SIGNIN = true;
        ENABLE_OPENID_SIGNUP = true;
      };
      # uncomment after initial deployment, first user is admin user
      # required to setup SSO (oauth openid-connect, keycloak auth provider)
      service.ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
      session.COOKIE_SECURE = lib.mkForce true;
    };
  };

  # Required for gitea server side gpg signatures
  # configured / setup manually in
  # /var/lib/gitea/data/home/.gitconfig and
  # /var/lib/gitea/data/home/.gnupg/
  programs.gnupg.agent = {
    enable = true;
    pinentryFlavor = "curses";
  };
  # Required to make gpg work without a graphical environment?
  # otherwise generating a new gpg key fails with this error:
  # gpg: agent_genkey failed: No pinentry
  # see: https://github.com/NixOS/nixpkgs/issues/97861#issuecomment-827951675
  environment.variables = {
    GPG_TTY = "$(tty)";
  };
}