{ config, ... }:
{

  services.postgresql = {
    enable = true;
    ensureDatabases = [
      config.services.gitea.user
      "vaultwarden"
    ];

    ensureUsers = [
      {
        name = "vaultwarden";
        ensureDBOwnership = true;
      }
    ];

    # type   database     DBuser  auth-method  mapping
    authentication = ''
      local  gitea        all     ident        map=gitea-users
      local  vaultwarden  all     ident        map=vaultwarden-users
    '';

    # name               sysuser        dbuser
    identMap = ''
      gitea-users        gitea          gitea
      vaultwarden-users  vaultwarden    vaultwarden
    '';
  };

}