{config, pkgs, ...}: let
  domain = "git.kassouni.net";
  repoRoot = "/srv/git";
in {
  users.users.git = {
    isSystemUser = true;
    group = "git";
    home = repoRoot;
    createHome = true;
    homeMode = "755";
    shell = "${pkgs.git}/bin/git-shell";
    openssh.authorizedKeys.keys = config.my.gitKeys;
  };
  users.groups.git = { };

  services.openssh.extraConfig = ''
    Match user git
      AllowTcpForwarding no
      AllowAgentForwarding no
      PermitTTY no
  '';

  services.cgit.${domain} = {
    enable = true;
    scanPath = repoRoot;
    gitHttpBackend.checkExportOkFiles = true;
    settings.strict-export = "git-daemon-export-ok";
  };

  services.nginx.virtualHosts.${domain} = {
    forceSSL = true;
    enableACME = true;
  };

  security.acme = {
    acceptTerms = true;
    defaults.email = "alex@kassouni.net";
  };

  networking.firewall.allowedTCPPorts = [ 80 443 ];
}