"modules/acme/environment.age".publicKeys    = all;

  inherit (lib) enabled;

  inherit (lib) enabled mkForce;

  # combine AcceptEnv settings for SSH and Git protocol
  services.openssh.settings.AcceptEnv = mkForce "SHELLS COLORTERM GIT_PROTOCOL";

  services.forgejo = enabled {
    lfs = enabled;

  # backup configuration for sqlite database and data
  systemd.services.forgejo-backup = {
    description = "Backup Forgejo data and database";
    after = [ "forgejo.service" ];

    database = {
      type = "sqlite3";
    };

    script = ''
      mkdir -p /var/backup/forgejo
      cp -r /var/lib/forgejo /var/backup/forgejo/$(date +%Y%m%d_%H%M%S)

    # backup configuration for sqlite database and data
    systemd.services.forgejo-backup = {
      description = "Backup Forgejo data and database";
      after = [ "forgejo.service" ];

      # keep only last 7 backups
      ls -1t /var/backup/forgejo/ | tail -n +8 | xargs -r rm -rf
    '';

      script = ''
        mkdir -p /var/backup/forgejo
        cp -r /var/lib/forgejo /var/backup/forgejo/$(date +%Y%m%d_%H%M%S)

    serviceConfig = {
      Type = "oneshot";
      User = "forgejo";
    };
  };

        # keep only last 7 backups
        ls -1t /var/backup/forgejo/ | tail -n +8 | xargs -r rm -rf
      '';

  systemd.timers.forgejo-backup = {
    description = "Run Forgejo backup daily";
    wantedBy = [ "timers.target" ];

      serviceConfig = {
        Type = "oneshot";
        User = "forgejo";
      };

    timerConfig = {
      OnCalendar = "daily";
      Persistent = true;

  };

    systemd.timers.forgejo-backup = {
      description = "Run Forgejo backup daily";
      wantedBy = [ "timers.target" ];

  services.forgejo = enabled {
    lfs = enabled;

      timerConfig = {
        OnCalendar = "daily";
        Persistent = true;
      };

    database = {
      type = "sqlite3";

  };
  # caddy reverse proxy configuration
  services.caddy.virtualHosts.${fqdn} = {
    useACMEHost = domain;
    extraConfig = /* caddy */ ''
      reverse_proxy http://[::1]:${toString port}
      
      import cors
    '';

{ self, config, lib, ... }: let
  inherit (config.networking) domain;
  inherit (lib) enabled mkConst;
in {
  imports = [(self + /modules/acme)];
  options.services.caddy.sslTemplate = mkConst {
    useACMEHost = domain;
  };
  options.services.caddy.headers = mkConst /* caddy */ ''
    header {
      Access-Control-Allow-Origin {$allow_origin}
      Access-Control-Allow-Methods {$allow_methods}
      Strict-Transport-Security {$hsts_header}
      Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' ${domain} *.${domain}; object-src 'self' ${domain} *.${domain}; base-uri 'self';"
      Referrer-Policy "no-referrer"
      X-Frame-Options "DENY"
    }
  '';
  config.networking.firewall = {
    allowedTCPPorts = [ 443 80 ];
    allowedUDPPorts = [ 443 ];
  };
  config.services.caddy = enabled {
    globalConfig = /* caddy */ ''
      {
        admin 0.0.0.0:2019
      }
    '';
    extraConfig = /* caddy */ ''
      (hsts) {
        @https {
          scheme https
        }
        header @https Strict-Transport-Security "max-age=31536000; includeSubdomains; preload"
      }
      (cors) {
        @cors_origin header Origin ~^https://(?:.+\.)?${domain}$
        @cors_methods {
          method OPTIONS
        }
        header @cors_origin {
          Access-Control-Allow-Origin {header.origin}
          Access-Control-Allow-Methods "CONNECT, DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT, TRACE"
        }
        respond @cors_methods "" 204
        ${config.services.caddy.headers}
      }
    '';
  };
  config.security.acme.users = [ "caddy" ];
}

  config.secrets.acmeEnvironment.file = ./environment.age;

  config.age.secrets.acmeEnvironment.file = ./environment.age;

      environmentFile = config.secrets.acmeEnvironment.path;

      environmentFile = config.age.secrets.acmeEnvironment.path;

_: _: super: let
  inherit (super) mkOption;
in {
  mkConst = value: mkOption {
    default  = value;
    readOnly = true;
  };
  mkValue = default: mkOption {
    inherit default;
  };
}

  option     = import ./option.nix     inputs self super;

in filesystem // system // values // { inherit inputs; }

in filesystem // option // system // values // { inherit inputs; }

		../../modules/forgejo.nix

    domain = "plumj.am";