{ appConfig, config, lib, pkgs, ... }:
lib.mkMerge [
  {
    services.cgit.default.enable = true;
    services.cgit.default.nginx.virtualHost = appConfig.domain;
    # XXX https://github.com/NixOS/nixpkgs/issues/290524
    services.cgit.default.package = pkgs.symlinkJoin {
      name = "cgit";
      paths = [
        pkgs.cgit
        (pkgs.luajit.withPackages (luaPackages: [ luaPackages.luaossl ]))
        (pkgs.runCommandLocal "cgit-lua-packages" { } ''
          mkdir -p $out/cgit
          ln -s ../lib $out/cgit/lib
          ln -s ../share $out/cgit/share
        ''
        )
      ];
    };
    services.cgit.default.settings = appConfig.settings;
  }
  {
    services.cgit.default.settings.about-filter = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh";
    services.cgit.default.settings.commit-filter = "${pkgs.cgit}/lib/cgit/filters/commit-links.sh";
    services.cgit.default.settings.email-filter = "lua:${pkgs.cgit}/lib/cgit/filters/email-libravatar.lua";
    services.cgit.default.settings.source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
  }
  {
    services.cgit.default.repos = lib.mapAttrs
      (name: attrs: {
        defbranch = "main";
        desc = attrs.description;
        #owner = "aforemny";
        path = "/var/lib/git/${name}";
        readme = "main:README.md";
      })
      appConfig.repositories;
  }
  {
    users.users.git.isSystemUser = true;
    users.users.git.home = "/var/lib/git";
    users.users.git.group = "nogroup";
  }
]