{
  lib,
  config,
  ...
}: let
  const = import ./const.nix;
  httpPort = const.httpPort;
in {
  config = lib.mkIf (config.services.forgejo.enable && config.host.reverse_proxy.enable) {
    host.reverse_proxy.subdomains.${config.services.forgejo.subdomain} = {
      target = "http://localhost:${toString httpPort}";
    };

    networking.firewall.allowedTCPPorts = [
      config.services.forgejo.settings.server.SSH_LISTEN_PORT
    ];
  };
}