{ pkgs, ... }: {
  services.forgejo = {
    enable = true;
    settings = {
      server = {
        ROOT_URL = "https://git.per-aspera.space";
        HTTP_ADDR = "0.0.0.0";
        HTTP_PORT = 3000;
        SSH_DOMAIN = "git.per-aspera.space";
        SSH_PORT = 2222;
      };
      service = { DISABLE_REGISTRATION = false; };
    };
  };

  networking.firewall.allowedTCPPorts = [ 3000 2222 ];
}