{ config, self, ... }:
let
  d = self.lib.data.services.buildbot;
  g = self.lib.data.services.git;
  sec = config.age.secrets;
  inherit (self.lib.secrets) mkServiceSecrets;
in
{
  services = {
    buildbot-nix.master = {
      enable = true;
      dbUrl = "postgresql://buildbot@localhost/buildbot";
      workersFile = sec.buildbot-workers.path;
      authBackend = "gitea";
      gitea = {
        enable = true;
        tokenFile = sec.buildbot-gitea-token.path;
        oauthSecretFile = sec.buildbot-oauth-secret.path;
        instanceUrl = g.extUrl;
        oauthId = "2bfd5c46-43a7-4d98-b443-9176dc0a9452";
        topic = "buildbot-enable";
      };
      admins = [ "pyrox" ];
      domain = d.extUrl;
      useHttps = true;
    };
    postgresql = {
      ensureUsers = [
        {
          name = "buildbot";
          ensureDBOwnership = true;
          ensureClauses.login = true;
        }
      ];
      ensureDatabases = [ "buildbot" ];
    };
    buildbot-master.port = 6915;
  };
  age.secrets = mkServiceSecrets "buildbot" ./secrets [
    "gitea-token"
    "oauth-secret"
    "worker-password"
    "workers"
  ];
}