{ config, lib, pkgs, ... }:
let
  listNames = config.syscfg.server.db;

  containerNames = lib.mapAttrsToList 
    (name: cfg: name) 
    (lib.filterAttrs (name: cfg: cfg.db or false) config.syscfg.server.containers);

  allApps = lib.unique (listNames ++ containerNames);

in {
  services.postgresql = {
    enable = true;
    ensureDatabases = map (name: "${name}_db") allApps;
    ensureUsers = map (name: { name = "${name}_user"; }) allApps;
    backup = {
        enable = true;
        location = "/var/lib/postgresql/backups";
        startAt = "-- 04:00:00"; # Runs every day at 4 AM
        backupAll = true; # Backs up all databases and roles
    };
  };

  systemd.services.postgresql.postStart = lib.mkAfter ''
    ${lib.concatMapStringsSep "\n" (name: ''
      $PSQL -tAc "ALTER DATABASE ${name}_db OWNER TO ${name}_user;"
      
      if [ -f "${config.sops.secrets."${name}_pass".path}" ]; then
        PASS=$(cat "${config.sops.secrets."${name}_pass".path}")
        $PSQL -tAc "ALTER USER ${name}_user WITH PASSWORD '$PASS';"
      fi
    '') allApps}
  '';
}