{
  config,
  lib,
  pkgs,
  ...
}:
let
  cfg = config.hm.conf.git;
in
{
  options.hm.conf.git.enable = lib.mkEnableOption "enables git vcs";
  config = lib.mkIf cfg.enable {
    programs.git = {
      enable = true;
      lfs.enable = true;
      signing = {
        key = "EF69F2FB25C8B5A66918EA91A38ACEAB9656CD94";
        signByDefault = true;
      };
      settings = {
        user = {
          name = "adikro";
          email = "adikro@disroot.org";
        };
        init.defaultBranch = "main";
        push.autoSetupRemote = true;
        pull.rebase = true;
        "url \"git@codeberg.org:\"".insteadOf = "https://codeberg.org/";
      };
      ignores = [
        "*.swp"
        "result"
        ".direnv/"
        "secrets/*.tmp"
      ];
      hooks.pre-commit = pkgs.writeShellScript "sops-pre-commit" ''
        for file in secrets/*.yaml; do
          if [[ -f "$file" ]]; then
            if ! ${pkgs.ripgrep}/bin/rg -q "sops" "$file"; then
              echo "--------------------------------------------------------"
              echo "ABORTING COMMIT: Unencrypted file detected: $file"
              echo "Please run 'sops -e -i $file' before committing."
              echo "--------------------------------------------------------"
              exit 1
            fi
          fi
        done
      '';
    };
  };
}