{ config, lib, pkgs, ... }:

{
  sops = {
    defaultSopsFile = ./secrets.yaml;
    defaultSopsFormat = "yaml";
    age.keyFile = "/var/lib/sops-nix/key.txt";

    secrets.gitea_database_password = {
      owner = "gitea";
    };
  };

  services.postgresql = {
    enable = true;
    ensureDatabases = [ "gitea" ];
    ensureUsers = [{
      name = "gitea";
      ensureDBOwnership = true;
    }];
  };

  services.gitea = {
    enable = true;
    appName = "Lilac's Code";
    database = {
      type = "postgres";
      host = "/run/postgres";
      name = "gitea";
      user = "gitea";
      passwordFile = config.sops.secrets.gitea_database_password.path;
    };
  };

  services.caddy = {
    enable = true;
	virtualHosts."code.grasswren.net".extraConfig = ''
	  reverse_proxy localhost:3000
	'';
  };

  networking.firewall.allowedTCPPorts = [ 3000 ];
}