{
  config,
  inputs,
  lib,
  libNginx,
  libPlausible,
  pkgs,
  this,
  ...
}:
with lib;
let
  cfg = config.nixfiles.modules.git;
in
{
  options.nixfiles.modules.git = {
    client.enable = mkEnableOption "Git client";

    server = {
      enable = mkEnableOption "Git server";

      domain = mkOption {
        description = "Domain name sans protocol scheme.";
        type = with types; nullOr str;
        default = "git.${config.networking.domain}";
      };

      package = mkOption {
        description = "Package.";
        type = types.package;
        default = pkgs.cgit;
      };
    };
  };

  config = mkMerge [
    (mkIf cfg.client.enable {
      secrets = {
        glab-cli-config = {
          file = "${inputs.self}/secrets/glab-cli-config";
          path = "${config.dirs.config}/glab-cli/config.yml";
          owner = my.username;
        };
        # NOTE SSO requires relogin every day, so keeping persistent auth tokens
        # doesn't work.
        # gh-hosts = {
        #   file = "${inputs.self}/secrets/gh-hosts";
        #   path = "${config.dirs.config}/gh/hosts.yml";
        #   owner = my.username;
        # };
        hut = {
          file = "${inputs.self}/secrets/hut";
          path = "${config.dirs.config}/hut/config";
          owner = my.username;
        };
      };

      nixfiles.modules.common.shell.aliases = {
        gl = "glab";
        ht = "hut";
      };

      hm = {
        home.packages = with pkgs; [
          git-extras
          glab
          hut
        ];

        programs = {
          git = {
            enable = true;

            package = if this.isHeadful then pkgs.gitFull else pkgs.gitMinimal;

            userName = my.username;
            userEmail = my.email;
            signing = {
              inherit (my.pgp) key;
              signByDefault = true;
            };

            extraConfig =
              {
                color.ui = true;
                core.whitespace = "trailing-space";
                init.defaultBranch = "master";
                status.submoduleSummary = true;
                commit.verbose = true;
                push.autoSetupRemote = true;
                pull.rebase = true;
                rebase = {
                  autoStash = true;
                  autoSquash = true;
                };
                rerere.enabled = true;
                branch.sort = "-committerdate";
                diff = {
                  mnemonicPrefix = true;
                  renames = "copies";
                  submodule = "log";
                };
                submodule.recurse = true;
                sendemail = rec {
                  smtpServer = my.domain.shire;
                  smtpUser = "${my.username}@${smtpServer}";
                  smtpEncryption = "ssl";
                  smtpServerPort = 465;
                  annotate = true;
                  confirm = "always";
                };
                column.ui = "auto";
                github.user = my.username;
                gitlab.user = my.username;
              }
              // mapAttrs' (name: value: nameValuePair ''url "git@${value}:"'' { insteadOf = "${name}:"; }) {
                "bitbucket" = "bitbucket.com";
                "codeberg" = "codeberg.org";
                "github" = "github.com";
                "gitlab" = "gitlab.com";
                "sourcehut" = "git.sr.ht";
              }
              //
                mapAttrs' (name: values: nameValuePair ''url "https://${values}/"'' { insteadOf = "${name}:"; })
                  {
                    "alpine" = "gitlab.alpinelinux.org";
                    "debian" = "salsa.debian.org";
                    "freedesktop" = "gitlab.freedesktop.org";
                    "gnome" = "gitlab.gnome.org";
                    "haskell" = "gitlab.haskell.org";
                    "homotopic" = "gitlab.homotopic.tech";
                    "horizon" = "gitlab.horizon-haskell.net";
                    "kde" = "invent.kde.org";
                    "nixca" = "gitlab.nixca.dev";
                    "notabug" = "notabug.org";
                    "opencode" = "opencode.net";
                    "syndicate" = "git.syndicate-lang.org";
                    "torproject" = "gitlab.torproject.org";
                    "videolan" = "code.videolan.org";
                  };

            aliases =
              let
                git = getExe config.hm.programs.git.package;
                curl = getExe pkgs.curl;
              in
              {
                amend = "commit --amend";
                cat = "cat-file -p";
                fast = "clone --depth=1";
                fixup = "commit --fixup";
                fuck = "!${git} reset --hard && ${git} clean --force -dx";
                get = "pull --all --recurse-submodules --autostash";
                gud = ''commit -m "git gud"'';
                refresh = "clean --force -dx";
                tree = "log --graph --date=relative --pretty=tformat:'%Cred%h%Creset -%C(auto)%d%Creset %s %Cgreen(%an %ad)%Creset'";
                uncommit = "reset --soft HEAD~1";
                untrack = "rm --cache --";
                wtc = "!${curl} -sq whatthecommit.com/index.txt | ${git} commit -F -";
              };

            # All helper tools/editor generated files should go here. This must be
            # kept void of any project-specific or residual files.
            ignores = [
              "*~"
              ".DS_Store"
              ".cache/clangd/"
              ".ccls-cache/"
              ".gdb_history"
              ".netrwhist"
              ".projectile"
              "[._]*.s[a-v][a-z]"
              "[._]*.sw[a-p]"
              "[._]s[a-rt-v][a-z]"
              "[._]ss[a-gi-z]"
              "[._]sw[a-p]"
              "\#*\#"
              "compile_commands*.json"
              "cscope.*"
              "vgcore.*"
            ];
          };

          gh = {
            enable = true;
            settings.git_protocol = "ssh";
          };
        };
      };
    })
    (mkIf cfg.server.enable (
      with cfg.server;
      {
        ark.directories = [ config.services.gitolite.dataDir ];

        nixfiles.modules.nginx = {
          enable = true;
          virtualHosts.${domain}.locations = { };
        };

        services = {
          cgit.${domain} = {
            enable = true;

            package = pkgs.cgit-pink;

            # We make gitolite repos readable by the common group.
            user = "git";
            group = "git";

            scanPath = "${config.services.gitolite.dataDir}/repositories";

            settings = {
              root-title = "git.azahi.cc";
              root-desc = "British scientists have discovered that using GitHub frequently is harmful to one's mental health, especially GitHub Actions...";

              footer = "${pkgs.writeText "cgit-footer" ''
                <p style="text-align: center;">Consider giving <a href="https://nixos.org">Nix/NixOS</a> a try! <3</p>
              ''}";

              about-filter = "${pkgs.writeScript "cgit-about-filter.sh" ''
                #!${pkgs.bash}/bin/sh
                filename=$1
                case "$filename" in
                  *.md)
                    exec ${pkgs.pandoc}/bin/pandoc -f markdown -t html
                    ;;
                  *.org)
                    exec ${pkgs.pandoc}/bin/pandoc -f org -t html
                        ;;
                  *)
                    echo "<pre>"
                    ${pkgs.coreutils}/bin/cat
                    echo "</pre>"
                    ;;
                esac
              ''}";
              source-filter = "${package}/lib/cgit/filters/syntax-highlighting.py";
              commit-filter = "${package}/lib/cgit/filters/commit-links.sh";

              readme = [
                ":README"
                ":readme.md"
                ":readme.org"
              ];

              clone-url = "https://$HTTP_HOST/$CGIT_REPO_URL";

              enable-blame = true;
              enable-commit-graph = true;
              enable-follow-links = true;
              enable-git-config = true;
              enable-gitweb-owner = true;
              enable-html-serving = true;
              enable-http-clone = true;
              enable-index-links = false;
              enable-index-owner = false;
              enable-log-filecount = true;
              enable-log-linecount = true;
              enable-subject-links = true;
              enable-tree-linenumbers = true;

              branch-sort = "age";
              repository-sort = "age";

              remove-suffix = true;

              logo = "/logo.gif";
              logo-link = "https://www.youtube.com/watch?v=dQw4w9WgXcQ";
            };
          };

          gitolite = {
            enable = true;
            user = "git";
            group = "git";
            adminPubkey = my.ssh.key;
            extraGitoliteRc = ''
              # This allows cgit to scan repositories while running under a
              # different user.
              $RC{UMASK} = 0027;

              # This allows hiding repositories via "cgit.ignore"[1].
              #
              # [1]: https://www.omarpolo.com/post/cgit-gitolite.html
              $RC{GIT_CONFIG_KEYS} = '.*';
            '';
          };

          nginx.virtualHosts.${domain}.locations =
            let
              extraHead = ''
                ${libNginx.config.appendHead [
                  ''<meta name="go-import" content="$host$uri git https://$host$uri">''
                  (libPlausible.htmlPlausibleScript { inherit (cfg.server) domain; })
                ]}
              '';
            in
            {
              "/" = {
                extraConfig = mkBefore extraHead;
                fastcgiParams.HTTP_ACCEPT_ENCODING = "";
              };
              "~ /.+/(info/refs|git-upload-pack)" = {
                extraConfig = mkBefore extraHead;
                fastcgiParams.HTTP_ACCEPT_ENCODING = "";
              };
              "= /logo.gif".alias = "${./logo.gif}";
              "= /favicon.ico" = {
                alias = "${./favicon.ico}";
                extraConfig = mkForce "";
              };
              "= /cgit.css" = {
                alias = pkgs.writeText "cgit.css" ''
                  ${readFile "${package}/cgit/cgit.css"}
                  * {
                    line-height: 1.25em;
                  }
                  div#cgit {
                    font-family: ${
                      concatMapStringsSep ", " (f: ''"${f}"'') config.fonts.fontconfig.defaultFonts.monospace
                    }, monospace;
                    -moz-tab-size: 2;
                    tab-size: 2;
                    max-width: 117ch;
                    margin: auto;
                  }
                  div#cgit table#header td.sub {
                    border-top: none;
                  }
                  div#cgit table#header td.sub.right {
                    padding-right: 1em;
                  }
                  div#cgit table.tabs {
                    border-bottom: none;
                  }
                  div#cgit div.content {
                    border-bottom: none;
                  }
                  div#cgit table.list th a {
                    color: inherit;
                  }
                  div#cgit table.list tr:nth-child(even) {
                    background: inherit;
                  }
                  div#cgit table.list tr:hover {
                    background: inherit;
                  }
                  div#cgit table.list tr.nohover-highlight:hover:nth-child(even) {
                    background: inherit;
                  }
                  div#cgit table.blob td.linenumbers a:target {
                    color: goldenrod;
                    text-decoration: underline;
                    outline: none;
                  }
                  div#cgit div#summary {
                    max-width: 80ch;
                  }
                '';
                extraConfig = mkForce "";
              };
            };
        };
      }
    ))
  ];
}