{ config, pkgs, lib, ... }:
let
  vhostName = "git.fcuny.net";
  stateDir = "/var/lib/gitolite";

  # there's no need for web crawlers on that site
  robots-deny = pkgs.writeText "robots.txt" ''
    User-agent: *
    Disallow: /
  '';

  cgitrc = ''
    # Global configuration
    virtual-root=/

    enable-http-clone=1
    clone-url=https://${vhostName}/$CGIT_REPO_URL

    # I've fewer than 150 repos, all should be able to be listed on
    # the main page
    max-repo-count=150

    # limit to year for the stats
    max-stats=year

    snapshots=tar.gz

    source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py
    about-filter=${pkgs.cgit}/lib/cgit/filters/about-formatting.sh

    enable-git-config=1
    enable-index-owner=0

    remove-suffix=1

    # sort repositories by section and branches by date
    repository-sort=age
    branch-sort=age

    readme=:README.md
    readme=:README.org
    readme=:readme.org

    # print the number of modified files
    enable-log-filecount=1

    # print the number of modified lines
    enable-log-linecount=1
    enable-follow-links=1
    enable-blame=1

    root-title=¯\_(°ペ)_/¯
    root-desc=source code of my various projects

    # don't index or follow
    robots="noindex, nofollow"

    project-list=${stateDir}/projects.list
    scan-path=${stateDir}/repositories
  '';
in
{

  # https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-servers/fcgiwrap.nix
  services.fcgiwrap = {
    enable = true;
    user = "git";
    group = "git";
  };

  services.nginx.virtualHosts."${vhostName}" = {
    # make cgit the default site: if a request goes through nginx
    # without a host header, this will be the default site we serve
    # for that request.
    default = true;
    forceSSL = true;
    enableACME = true;
    listen = [
      {
        addr = "192.168.6.40";
        port = 443;
        ssl = true;
      }
      {
        addr = "192.168.6.40";
        port = 80;
        ssl = false;
      }
    ];
    locations = {
      "~* ^.+.(css|png|ico)$" = { root = "${pkgs.cgit}/cgit"; };
      # as per https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md
      # if you want to map a single file make sure the location starts with a =, e.g =/i.gif instead of /i.gif.
      "=/robots.txt".alias = robots-deny;
      "/".extraConfig = ''
        include ${pkgs.nginx}/conf/fastcgi_params;
        fastcgi_param CGIT_CONFIG ${pkgs.writeText "cgitrc" cgitrc};
        fastcgi_param SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi;
        fastcgi_split_path_info ^(/?)(.+)$;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param HTTP_HOST $server_name;
        fastcgi_param QUERY_STRING $args;
        fastcgi_pass unix:${config.services.fcgiwrap.socketAddress};
        if ($http_user_agent ~* "(Blackbox Exporter)" ) {
          access_log off;
        }
      '';
    };
  };

  # https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/gitolite.nix
  services.gitolite = {
    enable = true;
    dataDir = stateDir;
    adminPubkey = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo=";
    user = "git";
    group = "git";
    extraGitoliteRc = ''
      # Make dirs/files group readable, needed for webserver/cgit. (Default
      # setting is 0077.)
      $RC{UMASK} = 0027;
      $RC{GIT_CONFIG_KEYS} = 'cgit.desc cgit.hide cgit.ignore cgit.owner cgit.section';
      $RC{LOCAL_CODE} = "$rc{GL_ADMIN_BASE}/local";
      push( @{$RC{ENABLE}}, 'symbolic-ref' );
    '';
  };

  my.services.backup.paths = [ stateDir ];
}