anchor.diff:        "-/etc/hosts"
         "-/etc/localtime"
         "-/run/postgresql"
  -    ] ++ (optional (!hasCustomRedis) config.services.redis.servers.paperless-ng.unixSocket);
  +    ] ++ (optional enableRedis redisServer.unixSocket);
       BindPaths = [
         cfg.consumptionDir
         cfg.dataDir
  
positive.code:     RestrictNamespaces = true;
      RestrictRealtime = true;
      RestrictSUIDSGID = true;
      SupplementaryGroups = optional (!hasCustomRedis) config.services.redis.servers.paperless-ng.user;
      SystemCallArchitectures = "native";
      SystemCallFilter = [ "@system-service" "~@privileged @resources @setuid @keyring" ];
      # Does not work well with the temporary root
  
negative.code:           echo "$superuserState" > "$superuserStateFile"
          fi
        '';
      } // optionalAttrs enableRedis {
        after = [ "redis-paperless-ng.service" ];
      };
  
  