{ config, lib, pkgs, ... }: {

    options.sysconfig.opts.virtualization.gitlab.enable = lib.options.mkOption {
        type = lib.types.bool;
        default = false;
    };

    config = lib.mkIf config.sysconfig.opts.virtualization.gitlab.enable {

        sops.secrets."gitlab/dbpass" = {
        
            path = "/ssd1/Gitlab/dbpass";
        };
        sops.secrets."gitlab/root_pass" = {

            path = "/ssd1/Gitlab/rootpass";
        };
        sops.secrets."gitlab/secrets/secret" = {

            path = "/ssd1/Gitlab/secret";
        };
        sops.secrets."gitlab/secrets/otp" = {

            path = "/ssd1/Gitlab/otp";
        };
        sops.secrets."gitlab/secrets/db" = {

            path = "/ssd1/Gitlab/db";
        };
        sops.secrets."gitlab/secrets/jws" = {

            path = "/ssd1/Gitlab/jws";
        };

        containers.gitlab = {

            autoStart = true;
            privateNetwork = true;
            hostAddress = "192.168.100.10";
            localAddress = "192.168.100.16";
            bindMounts = {
                "/etc/gitlab" = {
                    hostPath = "/ssd1/Gitlab";
                    isReadOnly = false;
                };
            };
            config = {

                systemd.tmpfiles.rules = [
                    "z /etc/gitlab/dbpass - gitlab gitlab"
                    "z /etc/gitlab/rootpass - gitlab gitlab"
                    "z /etc/gitlab/db - gitlab gitlab"
                    "z /etc/gitlab/secret - gitlab gitlab"
                    "z /etc/gitlab/jws - gitlab gitlab"
                    "z /etc/gitlab/otp - gitlab gitlab"
                ];
                
                services.gitlab = {
                    enable = true;
                    https = true;
                    port = 443;
                    host = "localhost";
                    databasePasswordFile = "/etc/gitlab/dbpass";
                    initialRootPasswordFile = "/etc/gitlab/rootpass";

                    secrets = {
                        secretFile = "/etc/gitlab/secret";
                        otpFile = "/etc/gitlab/otp";
                        dbFile = "/etc/gitlab/db";
                        jwsFile = "/etc/gitlab/jws";
                    };
                };


                networking.firewall.allowedTCPPorts = [ 22 80 ];

                system.stateVersion = "24.05";
            };
        };
    };
}