{ pkgs
, ...
}:

{
  services.postgresql = {
    enable = true;
    package = pkgs.postgresql_18;

    ensureDatabases = [
      "forgejo"
    ];

    ensureUsers = [
      { name = "forgejo"; ensureDBOwnership = true; }
    ];

    authentication = ''
      # Socket connections
      local     forgejo     forgejo                       peer

      # Localhost connections
      host      forgejo     forgejo     127.0.0.1/32      trust
      host      forgejo     forgejo     ::1/128           trust

      # Deny everything else
      host      all         all         0.0.0.0/0         reject
      host      all         all         ::0/0             reject
    '';
  };
}