let
  forgejoPort = 8082;
in {
  services.forgejo = {
    enable = true;
    lfs.enable = false;
    settings.server = {
      DOMAIN = "git.distrust.network";
      HTTP_PORT = forgejoPort;
      ROOT_URL = "https://git.distrust.network/";
    };
  };

  services.caddy.virtualHosts."git.distrust.network".extraConfig = ''
    reverse_proxy localhost:${toString forgejoPort}
  '';

  services.tor.relay.onionServices."forgejo".map = [
    {
      port = 80;
      target = {port = forgejoPort;};
    }
  ];
}