{
  config,
  repos,
  ...
}:
{
  services.pgdog = {
    enable = true;
    package = repos.unstable.pgdog;
    openFirewall = true;

    environmentFile = config.sops.secrets.pgdog_env.path;
    usersFile = config.sops.secrets.pgdog_users.path;

    settings = {
      general = {
        port = config.ports.pgdog;
        load_balancing_strategy = "least_active_connections";
        read_write_split = "include_primary";

        connect_attempt_delay = 5000;
        shutdown_timeout = 15000;

        log_dedup_window = 10000;
        log_dedup_threshold = 3;

        # Start running the LSN check immediately.
        lsn_check_delay = 0;

        # Run LSN check every second.
        lsn_check_interval = 1000;

        ban_replica_lag = 10000; # ban after its behind 10 seconds.
        ban_replica_lag_bytes = 10000000; # ban after its behind 10MiB
      };
      databases = [
        {
          name = "ente_db";
          host = "snow-den.mrsnowy.dev";
          port = 5432;
          role = "auto";
        }
        {
          name = "ente_db";
          host = "localhost";
          port = 5432;
          role = "auto";
        }

        {
          name = "knotmirror_db";
          host = "snow-den.mrsnowy.dev";
          port = 5432;
          role = "auto";
        }
        {
          name = "knotmirror_db";
          host = "localhost";
          port = 5432;
          role = "auto";
        }

        {
          name = "vaultwarden_db";
          host = "snow-den.mrsnowy.dev";
          port = 5432;
          role = "auto";
        }
        {
          name = "vaultwarden_db";
          host = "localhost";
          port = 5432;
          role = "auto";
        }

        {
          name = "caddy_db";
          host = "snow-den.mrsnowy.dev";
          port = 5432;
          role = "auto";
        }
        {
          name = "caddy_db";
          host = "localhost";
          port = 5432;
          role = "auto";
        }
      ];
    };
  };

  users.groups = {
    pgdog_secrets = { };
  };

  systemd.services.pgdog = {
    after = [ "sops-install-secrets.service" ];
    wants = [ "sops-install-secrets.service" ];

    serviceConfig = {
      SupplementaryGroups = [ "pgdog_secrets" ];
    };
  };
}