diff --git a/configuration.nix b/configuration.nix
index 944820a..873e6c4 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -23,6 +23,14 @@
     hostName = "vps-15813cea";
     useDHCP = false;
     interfaces.ens3.useDHCP = true;
+    interfaces.ens3.ipv6.addresses = [ {
+      address = "2001:41d0:305:2100::3276";
+      prefixLength = 64;
+    } ];
+    defaultGateway6 = {
+      address = "2001:41d0:305:2100::1";
+      interface = "ens3";
+    };
     firewall.allowedTCPPorts = [ 22 80 443 ];
     firewall.allowedTCPPortRanges = [ { from = 40000; to = 49999; } ];
   };
@@ -39,6 +47,10 @@
   services.openssh = {
     enable = true;
     passwordAuthentication = false;
+    listenAddresses = [
+      { addr = "0.0.0.0"; }
+      { addr = "::"; }
+    ];
   };
 
   # Let's Encrypt certificates
@@ -62,6 +74,12 @@
       forceSSL = true;
       enableACME = true;
     };
+
+    virtualHosts."git.beffara.org" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/".proxyPass = "http://unix:/run/gitea/gitea.sock:/";
+    };
   };
 
   # Nextcloud
@@ -99,8 +117,15 @@
   # PostgreSQL database
   services.postgresql = {
     enable = true;
-    ensureDatabases = [ "nextcloud" ];
+    ensureDatabases = [
+      "gitea"
+      "nextcloud"
+    ];
     ensureUsers = [
+      {
+        name = "gitea";
+        ensurePermissions."DATABASE gitea" = "ALL PRIVILEGES";
+      }
       {
         name = "nextcloud";
         ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
@@ -108,6 +133,22 @@
     ];
   };
 
+  # Gitea
+  services.gitea = {
+    enable = true;
+    appName = "Gitea on beffara.org";
+    database = {
+      passwordFile = "/data/gitea/db-pass";
+      type = "postgres";
+    };
+    domain = "git.beffara.org";
+    enableUnixSocket = true;
+    mailerPasswordFile = "/data/gitea/mailer-pass";
+    repositoryRoot = "/data/gitea/repositories";
+    rootUrl = "https://git.beffara.org/";
+    stateDir = "/data/gitea";
+  };
+
   # Initial user account
   users.users.manu = {
     isNormalUser = true;