{ config, ... }:
{

  services.postgresql = {
    enable = true;
    ensureDatabases = [
      config.services.gitea.user
      config.services.paperless.user
    ];

    ensureUsers = [
      {
        name = config.services.paperless.user;
        ensureDBOwnership = true;
      }
    ];

    # type   database     DBuser  auth-method  mapping
    authentication = ''
      local  all          postgres  peer
      local  gitea        all       ident        map=gitea-users
      local  paperless    all       ident        map=paperless-users
    '';

    # name               sysuser        dbuser
    identMap = ''
      gitea-users        gitea          gitea
      paperless-users    paperless      paperless
    '';
  };

}