{config, ...}: {
  services = {
    # Gitea
    gitea = {
      enable = true;
      database = {
        type = "sqlite3";
        passwordFile = "${config.age.secrets.gitea-db.path}";
      };
      settings = {
        server = {
          DOMAIN = "git.nicknase27.com";
          ROOT_URL = "https://git.nicknase27.com";
        };
        service = {
          DISABLE_REGISTRATION = true;
        };
      };
    };

    # Runner
    gitea-actions-runner = {
      instances.default = {
        enable = true;
        name = "hermes";
        url = "https://git.nicknase27.com";
        tokenFile = config.age.secrets.gitea-runner.path;
        labels = [
          "ubuntu-latest:docker://node:20-bookworm"
        ];
      };
    };
  };

  age.secrets = {
    gitea-db = {
      file = ../../secrets/gitea-db.age;
      path = "/run/secrets/gitea-db";
      owner = "gitea";
      group = "gitea";
    };
    gitea-runner = {
      file = ../../secrets/gitea-runner.age;
      path = "/run/secrets/gitea-runner";
      owner = "gitea-runner";
      group = "gitea-runner";
    };
  };
}