{ config, pkgs, ... }:
let
  robots-deny = pkgs.writeText "robots.txt" ''
    User-agent: *
    Disallow: /
  '';

  cgitrc = ''
    # Global configuration
    virtual-root=/

    enable-http-clone=1
    clone-url=https://git.fcuny.net/$CGIT_REPO_URL

    # I've fewer than 150 repos, all should be able to be listed on
    # the main page
    max-repo-count=150

    # limit to year for the stats
    max-stats=year

    snapshots=tar.gz

    source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py
    about-filter=${pkgs.cgit}/lib/cgit/filters/about-formatting.sh

    enable-git-config=1
    enable-index-owner=0

    remove-suffix=1

    # sort repositories by section and branches by date
    repository-sort=age
    branch-sort=age

    readme=:README.md
    readme=:README.org
    readme=:readme.org

    # print the number of modified files
    enable-log-filecount=1
    # print the number of modified lines
    enable-log-linecount=1
    enable-follow-links=1
    enable-blame=1

    root-title=¯\_(ツ)_/¯
    root-desc="source code of my various projects"
    # don't index or follow
    robots="noindex, nofollow"

    project-list=/var/lib/gitolite/projects.list
    scan-path=/var/lib/gitolite/repositories
  '';
in
{
  networking = {
    firewall.allowedTCPPorts = [
      # nginx
      80
      443
    ];
  };

  security.acme = {
    defaults.email = "acme@fcuny.net";
    acceptTerms = true;
  };

  # FIXME: I also ran the following as the git user:
  # git config --global init.defaultBranch main
  # to ensure that new repositories are created with the default
  # branch set to `main'.
  # TODO(fcuny): I could create the configuration file to set the default branch
  services.gitolite = {
    enable = true;
    adminPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi";
    user = "git";
    group = "git";
    extraGitoliteRc = ''
      # Make dirs/files group readable, needed for webserver/cgit. (Default
      # setting is 0077.)
      $RC{UMASK} = 0027;
      $RC{GIT_CONFIG_KEYS} = 'cgit.desc cgit.hide cgit.ignore cgit.owner cgit.section';
      $RC{LOCAL_CODE} = "$rc{GL_ADMIN_BASE}/local";
      push( @{$RC{ENABLE}}, 'symbolic-ref' );
    '';
  };

  services.fcgiwrap = {
    enable = true;
    user = "git";
    group = "git";
  };

  services.nginx = {
    enable = true;

    recommendedProxySettings = true;
    recommendedGzipSettings = true;
    recommendedOptimisation = true;
    recommendedTlsSettings = true;

    virtualHosts = {
      "fcuny.net" = {
        forceSSL = true;
        enableACME = true;
        locations = {
          "/" = {
            root = "/srv/www/fcuny.net";
          };
          "/.well-known/acme-challenge" = {
            root = "/var/lib/acme/acme-challenges";
          };
        };
      };
      "git.fcuny.net" = {
        # make cgit the default site: if a request goes through nginx
        # without a host header, this will be the default site we serve
        # for that request.
        default = true;
        forceSSL = true;
        enableACME = true;
        locations = {
          "/.well-known/acme-challenge" = {
            root = "/var/lib/acme/acme-challenges";
          };
          "~* ^.+.(css|png|ico)$" = {
            root = "${pkgs.cgit}/cgit";
          };
          # as per https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md
          # if you want to map a single file make sure the location starts with a =, e.g =/i.gif instead of /i.gif.
          "=/robots.txt".alias = robots-deny;
          "/".extraConfig = ''
            include ${pkgs.nginx}/conf/fastcgi_params;
            fastcgi_param CGIT_CONFIG ${pkgs.writeText "cgitrc" cgitrc};
            fastcgi_param SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi;
            fastcgi_split_path_info ^(/?)(.+)$;
            fastcgi_param PATH_INFO $fastcgi_path_info;
            fastcgi_param HTTP_HOST $server_name;
            fastcgi_param QUERY_STRING $args;
            fastcgi_pass unix:${config.services.fcgiwrap.socketAddress};
          '';
        };
      };
    };
  };
}