{ pkgs, ... }:
{
  networking.firewall.allowedTCPPorts = [ 5432 ];

  services.postgresql = {
    enable = true;
    package = pkgs.postgresql_15_jit;
    enableTCPIP = true;
    enableJIT = true;

    settings = {
      password_encryption = "scram-sha-256";
    };

    authentication = ''
      # TYPE  DATABASE  USER        ADDRESS  METHOD
      local   all       all                  peer
      host    all       postgres    all      reject
      host    all       all         all      scram-sha-256
    '';
  }; # end of services.postgreslq
}