{config, ...}: {
  age.secrets.woodpecker.file = ../../secrets/woodpecker.age;

  services = let
    port = 3007;
  in {
    woodpecker-server = {
      enable = true;

      environment = {
        WOODPECKER_OPEN = "true";
        WOODPECKER_ORGS = "kitchen";
        WOODPECKER_ADMIN = "chef";
        WOODPECKER_HOST = "https://ci.buffets.kitchen/";
        WOODPECKER_SERVER_ADDR = ":${toString port}";

        WOODPECKER_FORGEJO = "true";
        WOODPECKER_FORGEJO_URL = "https://buffets.kitchen/";
      };

      environmentFile = config.age.secrets.woodpecker.path;
    };

    nginx = {
      virtualHosts."build.buffets.kitchen" = {
        useACMEHost = "buffet.sh";
        forceSSL = true;

        locations = {
          "/" = {
            proxyPass = "http://localhost:${toString port}";
          };
        };
      };
    };
  };
}