{ ... }:
let
  domain = "code.randogoth.com";
  port = 3000; # localhost-only HTTP backend, proxied by Caddy
in
{
  services.forgejo = {
    enable = true;
    database.type = "sqlite3"; # default; explicit for clarity
    lfs.enable = true; # git-LFS support
    settings = {
      server = {
        DOMAIN = domain;
        ROOT_URL = "https://${domain}/";
        HTTP_ADDR = "127.0.0.1";
        HTTP_PORT = port;
        # Git-over-SSH via Forgejo's built-in server on a dedicated port.
        START_SSH_SERVER = true;
        SSH_PORT = 2222; # advertised in clone URLs
        SSH_LISTEN_PORT = 2222; # built-in server listen port
        # SSH_DOMAIN defaults to DOMAIN (code.randogoth.com)
      };
      service = {
        DISABLE_REGISTRATION = true; # admin creates accounts
      };
      # Quiet, sane defaults for a private instance.
      "repository".DEFAULT_PRIVATE = "private";
      session.COOKIE_SECURE = true;
      log.LEVEL = "Info";
    };
  };

  # System-wide SSH client config so root (the nix daemon) can fetch the private
  # Forgejo flake inputs, mirroring the Codeberg block in webhook-deploy.nix.
  # Reuses the existing /etc/ssh/codeberg_id_ed25519 deploy key (its public half
  # is registered on the randogoth Forgejo account).
  programs.ssh.extraConfig = ''
    Host ${domain}
      Port 2222
      IdentityFile /etc/ssh/codeberg_id_ed25519
      StrictHostKeyChecking accept-new
  '';

  # Caddy reverse proxy fragment — picked up via the glob import in caddy.nix.
  environment.etc."caddy/Caddyfile.d/forgejo.caddyfile".text = ''
    ${domain} {
      reverse_proxy localhost:${toString port}
    }
  '';
}