{ ... }: {

    flake.nixosModules.default = { config, lib, pkgs, ... }: let

    subdomain = "gitea";

    name = "gitea";

    in {

        options.sysconfig.docker."${name}".enable = with lib; mkOption {
            type = with types; bool;
            default = false;
        };

        config = lib.mkIf (config.sysconfig.docker."${name}".enable && config.sysconfig.docker.enable) {


            virtualisation.oci-containers.containers."${name}" = {
                image = "docker.gitea.com/gitea:1.25.4";

# unstable, waiting for 26.05
#pull = "newer";

                hostname = "${subdomain}.esotericbytes.com";

                networks = [
                    "docker-main"
                ];

                labels = {
                    "traefik.enable" = "true";
                    "traefik.http.routers.${name}.entrypoints" = "localsecure";
                    "traefik.http.routers.${name}.rule" = "Host(`${subdomain}.esotericbytes.com`)";
                    "traefik.http.routers.${name}.service" = "${name}";
                    "traefik.http.routers.${name}.tls.certResolver" = "cloudflare";

                    "traefik.http.services.${name}.loadbalancer.server.port" = "3000";


                    "traefik.tcp.routers.${name}-ssh.entrypoints" = "gitea-ssh";
                    "traefik.tcp.routers.${name}-ssh.rule" = "HostSNI(`*`)";
                    "traefik.tcp.routers.${name}-ssh.service" = "${name}-ssh";

                    "traefik.tcp.services.${name}-ssh.loadbalancer.server.port" = "22";
                };

                ports = [
                ];

                extraOptions = [
                    "--ip=192.168.101.20"
                ];

                volumes = [
                    "vol_gitea:/data"
                ];

                environment = {
                };
            };

            virtualisation.oci-containers.containers."${name}-db" = {
                image = "docker.io/library/postgres:14";

# unstable, waiting for 26.05
#pull = "newer";

                hostname = "${name}-db";

                networks = [
                    "docker-main"
                ];

                labels = {
                };

                ports = [
                ];

                extraOptions = [
                    "--ip=192.168.101.21"
                ];

                volumes = [
                    "/etc/gitea/db:/var/lib/postgresql/data"
                ];

                environment = {
                };
            };

            systemd.services."docker-gitea" = {
                serviceConfig = {
                    Restart = lib.mkOverride 90 "always";
                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
                    RestartSec = lib.mkOverride 90 "100ms";
                    RestartSteps = lib.mkOverride 90 9;
                };
                after = [
                    "docker-network-setup.service"
                        "docker-volume-gitea.service" 
                        "docker-gitea-db.service" 
                ];
                requires = [
                    "docker-network-setup.service"
                        "docker-volume-gitea.service" 
                        "docker-gitea-db.service" 
                ];
                partOf = [
                    "docker-compose-gitea-root.target"
                ];
                wantedBy = [
                    "docker-compose-gitea-root.target"
                ];
            };

            systemd.services."docker-gitea-db" = {
                serviceConfig = {
                    Restart = lib.mkOverride 90 "always";
                    RestartMaxDelaySec = lib.mkOverride 90 "1m";
                    RestartSec = lib.mkOverride 90 "100ms";
                    RestartSteps = lib.mkOverride 90 9;
                };
                after = [
                    "docker-network-setup.service"
                ];
                requires = [
                    "docker-network-setup.service"
                ];
                partOf = [
                    "docker-compose-gitea-root.target"
                ];
                wantedBy = [
                    "docker-compose-gitea-root.target"
                ];
            };

            systemd.services."docker-volume-gitea" = {
                path = [ pkgs.docker ];
                serviceConfig = {
                    Type = "oneshot";
                    RemainAfterExit = true;
                };
                script = ''
                    docker volume inspect vol_gitea || docker volume create vol_gitea --driver=local
                    '';
                partOf = [ "docker-compose-gitea-root.target" ];
                wantedBy = [ "docker-compose-gitea-root.target" ];
            };

        };
    };
}