{pkgs, lib, config, ...}: let 
  inherit (lib) mkIf mkOption mkEnableOption types; 
  cfg = config.wilkuu.services.cgit; 
  cgit_dark = pkgs.fetchFromGitHub {
    owner = "jb3";
    repo = "cgit-dark";
    rev = "f82cde4b29834d31465a5dafa00de527ef6853b0";
    hash =  "sha256-fSOelKDf1lHHRuyg/F81l8rAFrc6u7mAEFBX1Ua3V10=";
  };
in  {
  options.wilkuu.services.cgit = {
    enable = mkEnableOption "remote git and cgit";  
    domain = mkOption {
      description = "Domain to run cgit on"; 
      example = "git.wilkuu.xyz";  
      default = "git.${config.networking.hostName}.local";
      type = types.str;
    }; 
  };
  config = mkIf cfg.enable {
    users.groups.git = {};
    users.users.git = {
      group = "git"; 
      enable = true;
      isSystemUser = true;  
      home = "/srv/git/";
      createHome = true; 
      shell = "${pkgs.git}/bin/git-shell"; 
      openssh.authorizedKeys.keyFiles = [
        ../secrets/${config.networking.hostName}/git_authorized_keys
      ];
    };  

    services.openssh = {
      enable = true; 
      extraConfig = ''
        Match user git
          AllowTcpForwarding no
          AllowAgentForwarding no 
          PasswordAuthentication no 
          KbdInteractiveAuthentication no 
          PermitTTY no 
          X11Forwarding no
      '';
    
    };
    services.openssh.settings.AllowUsers = ["git"];
    services.cgit."${cfg.domain}" = {
      enable = true; 
      group = "git";
      user  = "git"; 
      scanPath = "/srv/git";
      settings = {
        enable-follow-links = true;
        source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
        # css = "${cgit_dark}/cgit-themed.css";
        # css = "https://raw.githubusercontent.com/jb3/cgit-dark/f82cde4b29834d31465a5dafa00de527ef6853b0/cgit-themed.css";
      };
      gitHttpBackend = {
        enable = true; 
        checkExportOkFiles = false; # TODO: Reconsider later
      };
    };
    services.nginx.virtualHosts.${cfg.domain} = {
        forceSSL = true;
        enableACME = true;
    };
  };

}