anchor.diff:          '';
         };
   
  +      settings = mkOption {
  +        type = with types; attrsOf (attrsOf (oneOf [ bool int str ]));
  +        default = {};
  +        description = ''
  +          Gitea configuration. Refer to <link xlink:href="https://docs.gitea.io/en-us/config-cheat-sheet/"/>
  +          for details on supported values.
  +        '';
  +        example = literalExample ''
  +          {
  +            "cron.sync_external_users" = {
  +              RUN_AT_START = true;
  +              SCHEDULE = "@every 24h";
  +              UPDATE_EXISTING = true;
  +            };
  +            mailer = {
  +              ENABLED = true;
  +              MAILER_TYPE = "sendmail";
  +              FROM = "do-not-reply@example.org";
  +              SENDMAIL_PATH = "${pkgs.system-sendmail}/bin/sendmail";
  +            };
  +            other = {
  +              SHOW_FOOTER_VERSION = false;
  +            };
  +          }
  +        '';
  +      };
  +
         extraConfig = mkOption {
  -        type = types.str;
  -        default = "";
  +        type = with types; nullOr str;
  +        default = null;
           description = "Configuration lines appended to the generated gitea configuration file.";
         };
       };
  
positive.code:     RUN_USER = ${cfg.user}
      RUN_MODE = prod
  
      [database]
      DB_TYPE = ${cfg.database.type}
      ${optionalString (usePostgresql || useMysql) ''
        HOST = ${if cfg.database.socket != null then cfg.database.socket else cfg.database.host + ":" + toString cfg.database.port}
        NAME = ${cfg.database.name}
        USER = ${cfg.database.user}
        PASSWD = #dbpass#
      ''}
      ${optionalString useSqlite ''
        PATH = ${cfg.database.path}
      ''}
      ${optionalString usePostgresql ''
        SSL_MODE = disable
      ''}
  
      [repository]
      ROOT = ${cfg.repositoryRoot}
  
      [server]
      DOMAIN = ${cfg.domain}
      HTTP_ADDR = ${cfg.httpAddress}
      HTTP_PORT = ${toString cfg.httpPort}
      ROOT_URL = ${cfg.rootUrl}
      STATIC_ROOT_PATH = ${cfg.staticRootPath}
      LFS_JWT_SECRET = #jwtsecret#
  
      [session]
      COOKIE_NAME = session
      COOKIE_SECURE = ${boolToString cfg.cookieSecure}
  
      [security]
      SECRET_KEY = #secretkey#
      INSTALL_LOCK = true
  
      [log]
      ROOT_PATH = ${cfg.log.rootPath}
      LEVEL = ${cfg.log.level}
  
      [service]
      DISABLE_REGISTRATION = ${boolToString cfg.disableRegistration}
  
      ${optionalString (cfg.mailerPasswordFile != null) ''
        [mailer]
        PASSWD = #mailerpass#
      ''}
  
      ${cfg.extraConfig}
    '';
  in
  
  
negative.code: 
      users.groups.gitea = {};
  
      warnings =
        optional (cfg.database.password != "") ''
          config.services.gitea.database.password will be stored as plaintext in the Nix store. Use database.passwordFile instead.'' ++
        optional (cfg.extraConfig != null) ''
          services.gitea.`extraConfig` is deprecated, please use services.gitea.`settings`.
        '';
  
      # Create database passwordFile default when password is configured.
      services.gitea.database.passwordFile =
  