let
	publicUrl = "git.tjkeller.xyz";
	rootTitle = "git.TJKeller.xyz";
	rootDesc = "TJK's git repositories, served by cgit";
	scanPath = "/srv/git";
	sectionFromStartpath = 0;
	maxRepoCount = 100;
in {

	containers.cgit = {
		autoStart = true;
		privateNetwork = true;
		ephemeral = true;
		hostBridge = "br-lan1";
		localMacAddress = "02:00:00:00:77:08";

		bindMounts = {
			${scanPath} = {
				hostPath = "/nix/persist/cgit/srv/git";
				isReadOnly = false;
			};
		};

		config = { pkgs, lib, config, ... }: {
			# Networking
			networking.interfaces.eth0.useDHCP = true;
			networking.firewall.allowedTCPPorts = [ 80 22 9418 ];  # nginx, ssh, git-daemon

			# Enable ssh service
			services.openssh.enable = true;

			# Create git user for ssh access
			# git user and group are uid/gid 41 as defined by gitDaemon & nixpkgs/nixos/modules/misc/ids.nix
			users.users.git = {
				isSystemUser = true;
				group = "git";
				home = scanPath;  # Serve from git user's home to allow cloning git@cgit:repo
				createHome = true;
				homeMode = "750";  # Allow read permissions for group members
				shell = pkgs.bash;
				#openssh = { inherit authorizedKeys; };
			};
			users.groups.git.members = [ "nginx" ];  # Create the git group and add nginx user as a member so scanPath can be served by cgit

			# Enable cgit service
			services.cgit.main = {
				enable = true;
				inherit scanPath;
				nginx.virtualHost = "cgit";
				user = "git";
				group = "git";
				gitHttpBackend.checkExportOkFiles = true;  # only serve repos containing git-daemon-export-ok
				settings = {
					# Based on joseluisq/alpine-cgit
					root-title = rootTitle;
					root-desc = rootDesc;

					source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
					about-filter  = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh";

					readme = [ ":README" ":README.html" ":README.md" ":README.txt" ];

					# Cache
					#cache-root=/var/cache/cgit
					#cache-size=2000

					enable-index-links = 1;
					enable-index-owner = 0;
					enable-remote-branches = 1;
					enable-log-filecount = 1;
					enable-log-linecount = 1;
					enable-git-config = 1;
					snapshots = "tar.xz zip";

					robots = "noindex, nofollow";

					scan-path = scanPath;
					virtual-root = "/";
					section-from-path = sectionFromStartpath;
					max-repo-count = maxRepoCount;

					clone-prefix = "https://${publicUrl} git://${publicUrl}";
					max-stats = "month";

					enable-http-clone = false;  # optional: let git-http-backend handle all clones
					strict-export = "git-daemon-export-ok";
				};
			};
			services.nginx.virtualHosts."cgit".default = true;

			# Enable git program
			programs.git.enable = true;

			# Enable git daemon
			services.gitDaemon = {
				enable = true;
				basePath = scanPath;
				exportAll = false;  # only export repos containing git-daemon-export-ok
				listenAddress = "0.0.0.0";
				port = 9418;
			};

			system.stateVersion = "26.05";
		};
	};
}