nixos-config/services/postgresql/pgbouncer.nix

{ config, lib, ... }:
{
  services.pgbouncer = {
    enable = config.services.postgresql.enable;
    settings = {
      pgbouncer = {
        listen_addr = "localhost";
        auth_type = "scram-sha-256";
        auth_file = config.sops.secrets."services/pgbouncer/settings/pgbouncer/auth".path;
      };
    };
  };
  sops.secrets."services/pgbouncer/settings/pgbouncer/auth" =
    lib.mkIf config.services.postgresql.enable
      {
        sopsFile = ./${config.networking.hostName}.yaml;
      };
}