{ ... }:
{

  services.postgresql = {
    enable = true;
    ensureDatabases = [ "vaultwarden" ];

    ensureUsers = [
      {
        name = "vaultwarden";
        ensureDBOwnership = true;
      }
    ];

    # type   database     DBuser  auth-method  mapping
    authentication = ''
      local  vaultwarden  all     ident        map=vaultwarden-users
    '';

    # name               sysuser        dbuser
    identMap = ''
      vaultwarden-users  vaultwarden    vaultwarden
    '';
  };

}