allow no password for postgresql

modules/postgresql.nix

@@ -24,8 +24,10 @@ in
           };
 
           passwordFile = lib.mkOption {
-            type = lib.types.str;
+            type = lib.types.nullOr lib.types.str;
-            description = "Password file for the postgres user.";
+            description = "Optional password file for the postgres user.";
+            default = null;
+            example = "/run/secrets/postgresql/password";
           };
         };
       });
@@ -64,7 +66,9 @@ in
       pwdConfig = passwordCfgs: {
         systemd.services.postgresql.postStart =
           let
-            script = { username, passwordFile, ... }: ''
+            script = { username, passwordFile, ... }:
+              if isNull passwordFile then "" else
+              ''
                 $PSQL -tA <<'EOF'
                   DO $$
                   DECLARE password TEXT;

test/modules/postgresql.nix

@@ -36,7 +36,34 @@ in
     expr = testConfig {};
   };
 
-  testPostgresOnePassword = {
+  testPostgresOneWithoutPassword = {
+    expected = {
+      services.postgresql = {
+        enable = true;
+        Users = [{
+          name = "myuser";
+          ensurePermissions = {
+            "DATABASE mydatabase" = "ALL PRIVILEGES";
+          };
+          ensureClauses = {
+            "login" = true;
+          };
+        }];
+        ensureDatabases = ["mydatabase"];
+      };
+      systemd.services.postgresql.postStart = "";
+    };
+    expr = testConfig {
+      shb.postgresql.passwords = [
+        {
+          username = "myuser";
+          database = "mydatabase";
+        }
+      ];
+    };
+  };
+
+  testPostgresOneWithPassword = {
     expected = {
       services.postgresql = {
         enable = true;