{ pkgs, ... }: {
  services.postgresql = {
    enable = true;
    enableTCPIP = true;
    settings = {
      listen_addresses = pkgs.lib.mkForce "0.0.0.0";
      port = pkgs.lib.mkForce 5432;
    };
    ensureDatabases = [ "orbismmo" ];
    ensureUsers = [{
      name = "orbismmo";
      ensureDBOwnership = true;
    }];
    authentication = pkgs.lib.mkOverride 10 ''
      local all       all     trust
      host all all 0.0.0.0/0 scram-sha-256
      host all all ::0/0 scram-sha-256
    '';
  };
}