1 files changed, 72 insertions, 0 deletions
diff --git a/os/srv/postgres.nix b/os/srv/postgres.nix
new file mode 100644
index 0000000..f669f63
--- /dev/null
+++ b/os/srv/postgres.nix
@@ -0,0 +1,72 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.os.srv.postgres;
+in
+{
+  options.os.srv.postgres.enable = lib.mkEnableOption "";
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.os.srv.sops.enable;
+        message = "Required for password secure password storing";
+      }
+      {
+        assertion = config.os.core.network.enableFirewall;
+        message = "Requires firewall";
+      }
+    ];
+
+    sops.secrets."postgres/authelia_password" = {
+      owner = "postgres";
+      group = "postgres";
+      restartUnits = [ "postgresql.service" ];
+    };
+
+    services.postgresql = {
+      enable = true;
+      package = pkgs.postgresql_18;
+
+      extraPlugins = [ config.services.postgresql.package.pkgs.pgvector ];
+
+      settings = {
+        listen_addresses = config.os.core.network.ips.database-vm;
+
+        max_connections = 100;
+        shared_buffers = "256MB";
+        work_mem = "4MB";
+      };
+
+      ensureDatabases = [ "authelia" ];
+      ensureUsers = [
+        {
+          name = "authelia";
+          ensureDBOwnership = true;
+        }
+      ];
+
+      initialScript = pkgs.writeText "init-postgres-passwords.sql" ''
+        CREATE USER authelia;
+        ALTER USER authelia WITH PASSWORD 'scram-sha-256';
+      '';
+
+      authentication = pkgs.lib.mkForce ''
+        local   all             all                                     trust
+        host    all             all             10.0.0.0/24             scram-sha-256
+      '';
+    };
+
+    systemd.services.postgresql.postStart = lib.mkAfter ''
+      PASS=$(cat ${config.sops.secrets."postgres/authelia_password".path})
+      ${config.services.postgresql.package}/bin/psql -tAc "ALTER USER authelia WITH PASSWORD '$PASS';"
+    '';
+
+    networking.firewall.extraInputRules = ''
+      ip saddr 10.0.0.0/24 tcp dport 5432 accept
+    '';
+  };
+}