{
  config,
  pkgs,
  lib,
  unstablePkgs,
  ...
}: {
  services.postgresql = {
    enable = true;
    package = pkgs.postgresql_14;
    ensureDatabases = ["gitea"];
    ensureUsers = [
      {
        name = "gitea";
        ensureDBOwnership = true;
      }
    ];
  };

  # Gitea connects to local Postgres via Unix socket (peer auth).
  # No password needed — the socket is at /run/postgresql by default.
  # createDatabase = true ensures the DB + user are set up automatically.
  services.gitea = {
    enable = true;
    package = unstablePkgs.gitea;
    database.type = "postgres";
    database.name = "gitea";
    database.user = "gitea";
    appName = "Jory's Git";
    lfs.enable = true;
    settings = {
      server = {
        DOMAIN = "git.severijnse.eu";
        ROOT_URL = "https://git.severijnse.eu/";
        HTTP_PORT = 3000;
        SSH_PORT = 222;
        SSH_LISTEN_PORT = 2222;
        START_SSH_SERVER = true;
        SSH_USER = "git";
        BUILTIN_SSH_SERVER_USER = "git";
        LANDING_PAGE = "explore";
      };
      service = {
        DISABLE_REGISTRATION = true;
        REQUIRE_SIGNIN_VIEW = false;
      };
      repository = {
        DEFAULT_BRANCH = "main";
      };
    };
  };

  # Gitea built-in SSH server: listens on high port 2222 (no privileged-cap needed),
  # while clone URLs advertise port 222. Firewall redirects 222 -> 2222.
  networking.firewall.allowedTCPPorts = [222 2222];

  # Redirect external git SSH (222) to Gitea's internal listener (2222)
  networking.firewall.extraCommands = ''
    ${pkgs.nftables}/bin/nft add table inet gitea-redirect 2>/dev/null || true
    ${pkgs.nftables}/bin/nft flush chain inet gitea-redirect prerouting 2>/dev/null || true
    ${pkgs.nftables}/bin/nft add chain inet gitea-redirect prerouting '{ type nat hook prerouting priority dstnat; }' 2>/dev/null || true
    ${pkgs.nftables}/bin/nft add rule inet gitea-redirect prerouting tcp dport 222 redirect to :2222 2>/dev/null || true
  '';
}