{ config, ... }:
{

  services.postgresql = {
    enable = true;
    ensureDatabases = [
      config.services.gitea.user
      "vaultwarden"
      config.services.paperless.user
    ];

    ensureUsers = [
      {
        name = "vaultwarden";
        ensureDBOwnership = true;
      }
      {
        name = config.services.paperless.user;
        ensureDBOwnership = true;
      }
    ];

    # type   database     DBuser  auth-method  mapping
    authentication = ''
      local  gitea        all     ident        map=gitea-users
      local  vaultwarden  all     ident        map=vaultwarden-users
      local  paperless    all     ident        map=paperless-users
    '';

    # name               sysuser        dbuser
    identMap = ''
      gitea-users        gitea          gitea
      vaultwarden-users  vaultwarden    vaultwarden
      paperless-users    paperless      paperless
    '';
  };

}