{
  config,
  lib,
  pkgs,
  ...
}:
let
  cfg = config.os.srv.postgres;
in
{
  options.os.srv.postgres.enable = lib.mkEnableOption "";
  config = lib.mkIf cfg.enable {
    assertions = [
      {
        assertion = config.os.srv.sops.enable;
        message = "Required for password secure password storing";
      }
      {
        assertion = config.os.core.network.enableFirewall;
        message = "Requires firewall";
      }
    ];

    sops.secrets."postgres/authelia_password" = {
      owner = "postgres";
      group = "postgres";
      restartUnits = [ "postgresql.service" ];
    };

    services.postgresql = {
      enable = true;
      package = pkgs.postgresql_18;

      extraPlugins = [ config.services.postgresql.package.pkgs.pgvector ];

      settings = {
        listen_addresses = config.os.core.network.ips.database-vm;

        max_connections = 100;
        shared_buffers = "256MB";
        work_mem = "4MB";
      };

      ensureDatabases = [ "authelia" ];
      ensureUsers = [
        {
          name = "authelia";
          ensureDBOwnership = true;
        }
      ];

      initialScript = pkgs.writeText "init-postgres-passwords.sql" ''
        CREATE USER authelia;
        ALTER USER authelia WITH PASSWORD 'scram-sha-256';
      '';

      authentication = pkgs.lib.mkForce ''
        local   all             all                                     trust
        host    all             all             10.0.0.0/24             scram-sha-256
      '';
    };

    systemd.services.postgresql.postStart = lib.mkAfter ''
      PASS=$(cat ${config.sops.secrets."postgres/authelia_password".path})
      ${config.services.postgresql.package}/bin/psql -tAc "ALTER USER authelia WITH PASSWORD '$PASS';"
    '';

    networking.firewall.extraInputRules = ''
      ip saddr 10.0.0.0/24 tcp dport 5432 accept
    '';
  };
}