anchor.diff:              };
             }
           '';
  +        type = with types; submodule {
  +          freeformType = format.type;
  +          options = {
  +            log = {
  +              ROOT_PATH = mkOption {
  +                default = "${cfg.stateDir}/log";
  +                defaultText = literalExpression ''"''${config.${opt.stateDir}}/log"'';
  +                type = types.str;
  +                description = "Root path for log files.";
  +              };
  +              LEVEL = mkOption {
  +                default = "Info";
  +                type = types.enum [ "Trace" "Debug" "Info" "Warn" "Error" "Critical" ];
  +                description = "General log level.";
  +              };
  +            };
  +
  +            server = {
  +              DISABLE_SSH = mkOption {
  +                type = types.bool;
  +                default = false;
  +                description = "Disable external SSH feature.";
  +              };
  +
  +              SSH_PORT = mkOption {
  +                type = types.int;
  +                default = 22;
  +                example = 2222;
  +                description = ''
  +                  SSH port displayed in clone URL.
  +                  The option is required to configure a service when the external visible port
  +                  differs from the local listening port i.e. if port forwarding is used.
  +                '';
  +              };
  +            };
  +
  +            service = {
  +              DISABLE_REGISTRATION = mkEnableOption "the registration lock" // {
  +                description = ''
  +                  By default any user can create an account on this <literal>gitea</literal> instance.
  +                  This can be disabled by using this option.
  +
  +                  <emphasis>Note:</emphasis> please keep in mind that this should be added after the initial
  +                  deploy unless <link linkend="opt-services.gitea.useWizard">services.gitea.useWizard</link>
  +                  is <literal>true</literal> as the first registered user will be the administrator if
  +                  no install wizard is used.
  +                '';
  +              };
  +            };
  +
  +            session = {
  +              COOKIE_SECURE = mkOption {
  +                type = types.bool;
  +                default = false;
  +                description = ''
  +                  Marks session cookies as "secure" as a hint for browsers to only send
  +                  them via HTTPS. This option is recommend, if gitea is being served over HTTPS.
  +                '';
  +              };
  +            };
  +          };
  +        };
         };
   
         extraConfig = mkOption {
  
positive.code:       ];
  
        session = {
          COOKIE_NAME = "session";
          COOKIE_SECURE = cfg.cookieSecure;
        };
  
        security = {
          SECRET_KEY = "#secretkey#";
          INTERNAL_TOKEN = "#internaltoken#";
          INSTALL_LOCK = true;
        };
  
        log = {
          ROOT_PATH = cfg.log.rootPath;
          LEVEL = cfg.log.level;
        };
  
        service = {
          DISABLE_REGISTRATION = cfg.disableRegistration;
        };
  
        mailer = mkIf (cfg.mailerPasswordFile != null) {
  
negative.code:         type = types.bool;
          default = false;
          description = lib.mdDoc "Configure Gitea to listen on a unix socket instead of the default TCP port.";
        };
  
        staticRootPath = mkOption {
  