nix-config/hosts/12kingdoms-youko/homelab-services/postgresql.nix

{
  config,
  mylib,
  pkgs,
  lib,
  myvars,
  ...
}:
let
  inherit (myvars) username;

  user = "postgres"; # postgresql's default system user
  package = pkgs.postgresql_16;
in
{
  # https://wiki.nixos.org/wiki/PostgreSQL
  # https://search.nixos.org/options?channel=unstable&query=services.postgresql.
  # https://www.postgresql.org/docs/
  services.postgresql = {
    enable = true;
    inherit package;
    # https://www.postgresql.org/docs/16/jit.html
    # JIT compilation is beneficial primarily for long-running CPU-bound queries.
    # Frequently these will be analytical queries. For short queries the added overhead
    # of performing JIT compilation will often be higher than the time it can save.
    enableJIT = true;
    enableTCPIP = true;

    # Ensures that the specified databases exist.
    ensureDatabases = [
      "playground" # for testing
    ];
    ensureUsers = [
      {
        name = "playground";
        ensureDBOwnership = true;
      }
    ];
    initdbArgs = [
      "--data-checksums"
      "--allow-group-access"
    ];

    extensions =
      ps: with ps; [
        # postgis
        # pg_repack
      ];

    # https://www.postgresql.org/docs/16/runtime-config.html
    settings = {
      port = 5432;
      # LAN-only: listen on localhost and the LAN address, never 0.0.0.0.
      listen_addresses = lib.mkForce "localhost,${myvars.networking.hostsAddr.youko.ipv4}";
      # connections
      max_connections = 100;

      # logging
      log_connections = true;
      log_statement = "all";
      logging_collector = true;
      log_disconnections = true;
      log_destination = lib.mkForce "syslog";

      # ssl
      ssl = true;
      ssl_cert_file = "${mylib.relativeToRoot "certs/ecc-server.crt"}";
      ssl_key_file = config.age.secrets."postgres-ecc-server.key".path;
      ssl_min_protocol_version = "TLSv1.3";
      ssl_ecdh_curve = "secp384r1";
      # Using custom DH parameters reduces the exposure
      # dhparam -out dhparams.pem 2048
      # ssl_dh_params_file = "";

      # memory
      shared_buffers = "128MB";
      huge_pages = "try";
    };

    # Map the systemUser to the DBUser
    # allow root & myself to log in via psql -U postgres without any additional authentication.
    identMap = ''
      # ArbitraryMapName systemUser          DBUser
      superuser_map      root                postgres
      superuser_map      postgres            postgres
      superuser_map      postgres-exporter   postgres
      superuser_map      ${username}         postgres
      # Let other names login as themselves
      superuser_map      /^(.*)$             \1
    '';

    # https://www.postgresql.org/docs/current/auth-pg-hba-conf.html
    authentication = lib.mkForce ''
      # TYPE  DATABASE        USER            ADDRESS                 METHOD   OPTIONS

      # "local" is for Unix domain socket connections only
      local   all             all                                     peer     map=superuser_map

      # TCP loopback: application roles may still connect without a password,
      # but the superuser and replication may not. That is the path a
      # compromised local service would take. No password is set for postgres,
      # so these lines deny it over TCP. Immich and the exporter use the Unix
      # socket above, so no configured client needs the loopback trust lines.
      host    all             postgres        127.0.0.1/32            scram-sha-256
      host    all             postgres        ::1/128                 scram-sha-256
      host    all             all             127.0.0.1/32            trust
      host    all             all             ::1/128                 trust

      # Replication connections from loopback require a password too.
      local   replication     all                                     peer     map=superuser_map
      host    replication     all             127.0.0.1/32            scram-sha-256
      host    replication     all             ::1/128                 scram-sha-256

      # Other Remote Access - allow access only the database with the same name as the user
      host    sameuser        all             ${myvars.networking.lanCidr}     scram-sha-256
    '';
    # initialScript =
    #   pkgs.writeText "backend-initScript" ''
    #   '';
  };

  services.prometheus.exporters.postgres = {
    enable = true;
    # loopback only: scraped by VictoriaMetrics on the same host
    listenAddress = "127.0.0.1";
    port = 9187;
    user = "postgres-exporter";
    group = "postgres-exporter";
    dataSourceName = "user=postgres database=postgres host=/run/postgresql sslmode=verify-full";
  };
}