{config, inputs, pkgs, ...}: let
  domain = "git.kassouni.net";
  repoRoot = "/srv/git";
  theme = inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.cgit-theme;
in {
  users.users.git = {
    isSystemUser = true;
    group = "git";
    home = repoRoot;
    createHome = true;
    homeMode = "750"; 
    shell = "${pkgs.git}/bin/git-shell";
    openssh.authorizedKeys.keys = config.my.gitKeys;
  };
  users.groups.git = { };

  environment.systemPackages = [ pkgs.git ];

  services.openssh.extraConfig = ''
    Match user git
      AllowTcpForwarding no
      AllowAgentForwarding no
      PermitTTY no
  '';

  services.cgit.${domain} = {
    enable = true;
    scanPath = repoRoot;
    group = "git"; # so cgit can traverse a non-world-readable repoRoot
    gitHttpBackend.checkExportOkFiles = true;
    settings = {
      root-title = "git.kassouni.net";
      root-desc = "";
      css = [ "/theme.css" ];
      strict-export = "git-daemon-export-ok";
      remove-suffix = true;
      readme = [ ":README.md" ":README" ":readme.md" ];
      clone-url = "git@${domain}:$CGIT_REPO_URL https://${domain}/$CGIT_REPO_URL";
      source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
      about-filter = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh";
    };
  };

  services.nginx.virtualHosts.${domain} = {
    forceSSL = true;
    enableACME = true;
    locations = {
      "= /theme.css".alias = "${theme}/theme.css";
      "/fonts/".alias = "${theme}/fonts/";
    };
  };
}