{
  config,
  inputs,
  lib,
  localUsername ? lib.my.username,
  pkgs,
  ...
}:
with lib; let
  cfg = config.nixfiles.modules.git;
in {
  options.nixfiles.modules.git.client.enable =
    mkEnableOption "Git client";

  config = mkIf cfg.client.enable {
    secrets = {
      glab-cli-config = {
        file = "${inputs.self}/secrets/glab-cli-config";
        path = "${config.dirs.config}/glab-cli/config.yml";
        owner = localUsername;
      };
      gh-hosts = {
        file = "${inputs.self}/secrets/gh-hosts";
        path = "${config.dirs.config}/gh/hosts.yml";
        owner = localUsername;
      };
      hut = {
        file = "${inputs.self}/secrets/hut";
        path = "${config.dirs.config}/hut/config";
        owner = localUsername;
      };
    };

    nixfiles.modules.common.shell.aliases = {
      gl = "glab";
      ht = "hut";
    };

    hm = {
      home.packages = with pkgs; [
        git-extras
        glab
        hut
      ];

      programs = {
        git = {
          enable = true;

          package = pkgs.git.override {
            doInstallCheck = false;
            pythonSupport = false;
            sendEmailSupport = true;
            withLibsecret = false;
            withSsh = true;
          };

          userName = my.fullname;
          userEmail = my.email;
          signing = {
            inherit (my.pgp) key;
            signByDefault = true;
          };

          extraConfig =
            {
              color.ui = true;
              core.whitespace = "trailing-space";
              init.defaultBranch = "master";
              status.submoduleSummary = true;
              commit.verbose = 1;
              push.autoSetupRemote = true;
              pull.rebase = true;
              rebase = {
                autoStash = true;
                autoSquash = true;
              };
              diff = {
                mnemonicPrefix = true;
                renames = "copies";
                submodule = "log";
              };
              submodule.recurse = true;
              sendemail = rec {
                smtpServer = my.domain.shire;
                smtpUser = "${my.username}@${smtpServer}";
                smtpEncryption = "ssl";
                smtpServerPort = 465;
                annotate = true;
                confirm = "always";
              };
              github.user = my.username;
              gitlab.user = my.username;
            }
            // mapAttrs'
            (n: v: nameValuePair ''url "git@${v}:"'' {insteadOf = "${n}:";}) {
              "alpine" = "gitlab.alpinelinux.org";
              "bitbucket" = "bitbucket.com";
              "codeberg" = "codeberg.org";
              "freedesktop" = "gitlab.freedesktop.org";
              "github" = "github.com";
              "gitlab" = "gitlab.com";
              "gnome" = "gitlab.gnome.org";
              "haskell" = "gitlab.haskell.org";
              "kde" = "invent.kde.org";
              "notabug" = "notabug.org";
              "opencode" = "opencode.net";
              "sourcehut" = "git.sr.ht";
              "torproject" = "gitlab.torproject.org";
              "videolan" = "code.videolan.org";
            };

          aliases = let
            git = getExe config.hm.programs.git.package;
            curl = getExe pkgs.curl;
          in {
            amend = "commit --amend";
            cat = "cat-file -p";
            fast = "clone --depth=1";
            fixup = "commit --fixup";
            fuck = "!${git} reset --hard && ${git} clean --force -dx";
            get = "pull --all --recurse-submodules --autostash";
            gud = ''commit -m "git gud"'';
            refresh = "clean --force -dx";
            tree = "log --graph --date=relative --pretty=tformat:'%Cred%h%Creset -%C(auto)%d%Creset %s %Cgreen(%an %ad)%Creset'";
            uncommit = "reset --soft HEAD~1";
            untrack = "rm --cache --";
            wtc = "!${curl} -sq whatthecommit.com/index.txt | ${git} commit -F -";
          };

          # All helper tools/editor generated files should go here. This must be
          # kept void of any project-specific or residual files.
          ignores = [
            "*~"
            ".DS_Store"
            ".cache/clangd/"
            ".ccls-cache/"
            ".gdb_history"
            ".netrwhist"
            ".projectile"
            "[._]*.s[a-v][a-z]"
            "[._]*.sw[a-p]"
            "[._]s[a-rt-v][a-z]"
            "[._]ss[a-gi-z]"
            "[._]sw[a-p]"
            "\#*\#"
            "compile_commands*.json"
            "cscope.*"
            "vgcore.*"
          ];
        };

        gh = {
          enable = true;
          settings.git_protocol = "ssh";
        };
      };
    };
  };
}