{
  pkgs,
  lib,
  config,
  ...
}:
let
  newPostgres = pkgs.postgresql_18_jit;
  cfg = config.services.postgresql;
  upgrade-pg-cluster = pkgs.writeScriptBin "upgrade-pg-cluster" ''
    set -eux
    systemctl stop postgresql

    export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
    export NEWBIN="${newPostgres}/bin"

    export OLDDATA="${cfg.dataDir}"
    export OLDBIN="${cfg.finalPackage}/bin"

    install -d -m 0700 -o postgres -g postgres "$NEWDATA"
    cd "$NEWDATA"
    sudo -u postgres "$NEWBIN/initdb" -D "$NEWDATA" ${lib.escapeShellArgs cfg.initdbArgs}

    sudo -u postgres "$NEWBIN/pg_upgrade" \
      --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
      --old-bindir "$OLDBIN" --new-bindir "$NEWBIN" \
      "$@"
  '';
in
{
  networking.firewall.allowedTCPPorts = [ 5432 ];

  services.postgresql = {
    enable = true;
    package = pkgs.postgresql_18_jit;
    enableTCPIP = true;
    enableJIT = true;

    settings = {
      password_encryption = "scram-sha-256";
    };

    authentication = ''
      # TYPE  DATABASE  USER        ADDRESS  METHOD
      local   all       all                  peer
      host    all       postgres    all      reject
      host    all       all         all      scram-sha-256
    '';
  }; # end of services.postgreslq

  environment.systemPackages = [ upgrade-pg-cluster ];
}