# TODO(raitobezarius to maintainers of invidious): I strongly advise to clean up the kemal specific
    # thing for 24.05 and use `ensureDBOwnership`.
    # See https://github.com/NixOS/nixpkgs/issues/216989
    systemd.services.postgresql.postStart = lib.mkAfter ''
      $PSQL -tAc 'ALTER DATABASE "${cfg.settings.db.dbname}" OWNER TO "${cfg.settings.db.user}";'
      $PSQL -tAc 'GRANT USAGE, CREATE ON SCHEMA public TO "${cfg.settings.db.user}";'
    '';
    services.postgresql = {
      enable = true;
      ensureUsers = lib.singleton { name = cfg.settings.db.user; };
      ensureDatabases = lib.singleton cfg.settings.db.dbname;
      # This is only needed because the unix user invidious isn't the same as
      # the database user. This tells postgres to map one to the other.
      identMap = ''
        invidious invidious ${cfg.settings.db.user}
      '';
      # And this specifically enables peer authentication for only this
      # database, which allows passwordless authentication over the postgres
      # unix socket for the user map given above.
      authentication = ''
        local ${cfg.settings.db.dbname} ${cfg.settings.db.user} peer map=invidious
      '';
    };