{ config, lib, pkgs, ... }:
let
  listNames = config.syscfg.server.db;

  containerNames = lib.mapAttrsToList 
    (name: cfg: name) 
    (lib.filterAttrs (name: cfg: cfg.db or false) config.syscfg.server.containers);

  allApps = lib.unique (listNames ++ containerNames);

in {
  config = lib.mkIf ( builtins.length allApps > 0) {
    services.postgresql = {
      enable = true;
      enableTCPIP = true; # Required to listen on network interfaces
      authentication = pkgs.lib.mkOverride 10 ''
        # TYPE  DATABASE        USER            ADDRESS                 METHOD
        local   all             all                                     trust
        host    all             all             127.0.0.1/32            trust
        host    all             all             10.0.0.0/8              scram-sha-256
        host    all             all             ::1/128                 trust
      '';
      ensureDatabases = map (name: "${name}_db") allApps;
      ensureUsers = map (name: { name = "${name}_user"; }) allApps;
    };
    services.postgresqlBackup = {
      enable = true;
      location = "/var/lib/postgresql/backups";
      startAt = "*-*-* 04:00:00"; # Runs every day at 4 AM
      backupAll = true; # Backs up all databases and roles
    };

    systemd.services.postgresql.postStart = lib.mkAfter ''
        PSQL="${pkgs.postgresql}/bin/psql"
        ${lib.concatMapStringsSep "\n" (name: ''
          until $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname = '${name}_user'" | grep -q 1; do
            echo "Waiting for user ${name}_user..."
            sleep 1
          done
          $PSQL -tAc "ALTER DATABASE ${name}_db OWNER TO ${name}_user;"
          
          if [ -f "${config.sops.secrets."${lib.toUpper name}".path}" ]; then
            PASS=$(grep "^DB_PASSWORD=" ... | cut -d'=' -f2- | tr -d '"' | tr -d "'")
            $PSQL -tAc "ALTER USER ${name}_user WITH PASSWORD '$PASS';"
          fi
        '') allApps}
    '';
    # systemd.services.init-db-permissions = {
    #   description = "Set DB passwords and ownership after Postgres is ready";
    #   after = [ "postgresql.service" ];
    #   requires = [ "postgresql.service" ];
    #   partOf = [ "postgresql.service" ];
    #   wantedBy = [ "multi-user.target" ];
      
    #   serviceConfig = {
    #     Type = "oneshot";
    #     User = "postgres"; # Runs as postgres user directly
    #     RemainAfterExit = true;
    #     ExecStartPre = "${pkgs.coreutils}/bin/sleep 2"; 
    #   };

    #   script = ''

    #   '';
    # };
  };
}