diff --git a/postgres/main.tf b/postgres/main.tf
new file mode 100644
index 0000000..75f628d
--- /dev/null
+++ b/postgres/main.tf
@@ -0,0 +1,33 @@
+locals {
+  user_count = length(var.users)
+  db_count   = length(var.databases)
+}
+
+resource "stackit_postgresflex_instance" "this" {
+  project_id      = var.project_id
+  name            = var.name
+  version         = var.ver
+  flavor          = var.flavor
+  storage         = var.storage
+  replicas        = var.replicas
+  acl             = var.acl
+  backup_schedule = var.backup_schedule
+}
+
+resource "stackit_postgresflex_user" "user" {
+  count = local.user_count
+
+  project_id  = var.project_id
+  instance_id = var.instance_id != "" ? var.instance_id : stackit_postgresflex_instance.this.instance_id
+  username    = var.users[count.index].username
+  roles       = var.users[count.index].roles
+}
+
+resource "stackit_postgresflex_database" "db" {
+  count = local.db_count
+
+  project_id  = var.project_id
+  instance_id = stackit_postgresflex_instance.this.instance_id
+  name        = var.databases[count.index].name
+  owner       = var.databases[count.index].owner
+}
diff --git a/postgres/outputs.tf b/postgres/outputs.tf
new file mode 100644
index 0000000..216884c
--- /dev/null
+++ b/postgres/outputs.tf
@@ -0,0 +1,11 @@
+output "instance_id" {
+  value = stackit_postgresflex_instance.this.instance_id
+}
+
+output "user_ids" {
+  value = stackit_postgresflex_user.user[*].user_id
+}
+
+output "database_ids" {
+  value = stackit_postgresflex_database.db[*].database_id
+}
diff --git a/postgres/providers.tf b/postgres/providers.tf
new file mode 100644
index 0000000..6e038c3
--- /dev/null
+++ b/postgres/providers.tf
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.9.0"
+  required_providers {
+    stackit = {
+      source  = "stackitcloud/stackit"
+      version = "0.56.0"
+    }
+  }
+}
diff --git a/postgres/variables.tf b/postgres/variables.tf
new file mode 100644
index 0000000..061dd3f
--- /dev/null
+++ b/postgres/variables.tf
@@ -0,0 +1,86 @@
+variable "project_id" {
+  type = string
+}
+
+variable "name" {
+  type = string
+
+  validation {
+    condition     = length(regexall("^[a-z]([-a-z0-9]*[a-z0-9])?$", var.name)) > 0
+    error_message = <<EOT
+      The name must be a valid DNS-1035 label:
+      - only lower-case letters, digits or '-'
+      - must start with a letter
+      - must end with a letter or digit
+      EOT
+  }
+}
+
+variable "instance_id" {
+  type    = string
+  default = ""
+}
+
+variable "ver" {
+  type = number
+}
+
+variable "flavor" {
+  type = object({
+    cpu = number,
+    ram = number
+  })
+}
+
+variable "storage" {
+  type = object({
+    class = string,
+    size  = number
+  })
+}
+
+variable "replicas" {
+  type = number
+}
+
+variable "acl" {
+  type = list(string)
+}
+
+variable "backup_schedule" {
+  type = string
+
+}
+
+variable "users" {
+  type = list(object({
+    username = string
+    roles    = set(string)
+  }))
+  default = []
+  validation {
+    condition     = alltrue([
+      for user in var.users : user.username != "admin"
+    ])
+    error_message = "The username 'admin' is reserved and cannot be used."
+  }
+}
+
+variable "databases" {
+  type = list(object({
+    name  = string
+    owner = string
+  }))
+  default = []
+    validation {
+    condition = alltrue([
+      for db in var.databases : length(regexall("^[a-z]([-a-z0-9]*[a-z0-9])?$", db.name)) > 0
+    ])
+    error_message = <<EOT
+      The name must be a valid DNS-1035 label:
+      - only lower-case letters, digits or '-'
+      - must start with a letter
+      - must end with a letter or digit
+      EOT
+  }
+}