{config, ...}: {
  services = {
    # Gitea
    gitea = {
      enable = true;
      database = {
        type = "sqlite3";
        passwordFile = "${config.age.secrets.gitea-db.path}";
      };
      settings = {
        server = {
          DOMAIN = "git.nicknase27.com";
          ROOT_URL = "https://git.nicknase27.com";
        };
        service = {
          DISABLE_REGISTRATION = true;
        };
      };
    };

    # Runner
    # gitea-actions-runner = {
    #   instances.default = {
    #     enable = true;
    #     name = "hermes";
    #     url = "https://git.nicknase27.com";
    #     tokenFile = config.age.secrets.gitea-runner.path;
    #     labels = [
    #       "ubuntu-latest:docker://node:20-bookworm"
    #     ];
    #   };
    # };
  };

  age.secrets = {
    gitea-db = {
      file = ../../secrets/gitea-db.age;
      path = "/run/secrets/gitea-db";
      owner = "gitea";
      group = "gitea";
    };
    # gitea-runner = {
    #   file = ../../secrets/gitea-runner.age;
    #   path = "/run/secrets/gitea-runner";
    #   owner = "gitea-runner";
    #   group = "gitea-runner";
    # };
  };
  networking.firewall = {
    allowedTCPPorts = [3000];
  };
}