{ ... }: {

  services.postgresql = {
    enable = true;
    ensureDatabases = [ "vaultwarden" "hedgedoc" ];

    ensureUsers = [
      {
        name = "vaultwarden";
        ensureDBOwnership = true;
      }
      {
        name = "hedgedoc";
        ensureDBOwnership = true;
      }
    ];

    # type   database     DBuser    auth-method  mapping
    authentication = ''
      local  all          postgres  peer
      local  vaultwarden  all       ident        map=vaultwarden-users
      local  hedgedoc     all       ident        map=hedgedoc-users
    '';

    # name               sysuser        dbuser
    identMap = ''
      vaultwarden-users  vaultwarden    vaultwarden
      hedgedoc-users     hedgedoc       hedgedoc
    '';
  };

}