{ ... }:
let
  domain = "code.randogoth.com";
  port = 3000; # localhost-only HTTP backend, proxied by Caddy
in
{
  services.forgejo = {
    enable = true;
    database.type = "sqlite3"; # default; explicit for clarity
    lfs.enable = true; # git-LFS support
    settings = {
      server = {
        DOMAIN = domain;
        ROOT_URL = "https://${domain}/";
        HTTP_ADDR = "127.0.0.1";
        HTTP_PORT = port;
        DISABLE_SSH = true; # HTTPS-only git access
      };
      service = {
        DISABLE_REGISTRATION = true; # admin creates accounts
      };
      # Quiet, sane defaults for a private instance.
      "repository".DEFAULT_PRIVATE = "private";
      session.COOKIE_SECURE = true;
      log.LEVEL = "Info";
    };
  };

  # Caddy reverse proxy fragment — picked up via the glob import in caddy.nix.
  environment.etc."caddy/Caddyfile.d/forgejo.caddyfile".text = ''
    ${domain} {
      reverse_proxy localhost:${toString port}
    }
  '';
}