anchor.diff:  ${lib.optionalString cfg.no-auth "no-auth"}
   ${lib.optionalString cfg.use-auth-secret "use-auth-secret"}
   ${lib.optionalString (cfg.static-auth-secret != null) ("static-auth-secret=${cfg.static-auth-secret}")}
  +${lib.optionalString (cfg.static-auth-secret-file != null) ("static-auth-secret=#static-auth-secret#")}
   realm=${cfg.realm}
   ${lib.optionalString cfg.no-udp "no-udp"}
   ${lib.optionalString cfg.no-tcp "no-tcp"}
  
positive.code:           by a separate program, so this is why that other mode is 'dynamic'.
          '';
        };
        realm = mkOption {
          type = types.str;
          default = config.networking.hostName;
  
negative.code:     };
    };
  
    config = mkIf cfg.enable (mkMerge ([
      { assertions = [
        { assertion = cfg.static-auth-secret != null -> cfg.static-auth-secret-file == null ;
          message = "static-auth-secret and static-auth-secret-file cannot be set at the same time";
        }
      ];}
  
      {
        users.users.turnserver =
          { uid = config.ids.uids.turnserver;
            description = "coturn TURN server user";
          };
        users.groups.turnserver =
          { gid = config.ids.gids.turnserver;
            members = [ "turnserver" ];
          };
  
        systemd.services.coturn = let
          runConfig = "/run/coturn/turnserver.cfg";
        in {
          description = "coturn TURN server";
          after = [ "network-online.target" ];
          wants = [ "network-online.target" ];
          wantedBy = [ "multi-user.target" ];
  
          unitConfig = {
            Documentation = "man:coturn(1) man:turnadmin(1) man:turnserver(1)";
          };
  
          preStart = ''
            cat ${configFile} > ${runConfig}
            ${optionalString (cfg.static-auth-secret-file != null) ''
              STATIC_AUTH_SECRET="$(head -n1 ${cfg.static-auth-secret-file} || :)"
              sed -e "s,#static-auth-secret#,$STATIC_AUTH_SECRET,g" \
                -i ${runConfig}
            '' }
            chmod 640 ${runConfig}
          '';
          serviceConfig = {
            Type = "simple";
            ExecStart = "${pkgs.coturn}/bin/turnserver -c ${runConfig}";
            RuntimeDirectory = "turnserver";
            User = "turnserver";
            Group = "turnserver";
            AmbientCapabilities =
              mkIf (
                cfg.listening-port < 1024 ||
                cfg.alt-listening-port < 1024 ||
                cfg.tls-listening-port < 1024 ||
                cfg.alt-tls-listening-port < 1024 ||
                cfg.min-port < 1024
              ) "cap_net_bind_service";
            Restart = "on-abort";
          };
        };
      systemd.tmpfiles.rules = [
        "d  /run/coturn 0700 turnserver turnserver - -"
      ];
    }]));
  }
  