anchor.diff:  
     };
   
  -  config = lib.mkIf cfg.enable {
  -
  -    networking.firewall.allowedTCPPorts = [
  +  config = mkIf cfg.enable {
  +
  +    networking.firewall.allowedTCPPorts = mkIf cfg.openPorts [
         config.services.zammad.port
         config.services.zammad.websocketPort
       ];
  
positive.code:     User = "zammad";
      Group = "zammad";
      PrivateTmp = true;
      StateDirectory = builtins.baseNameOf cfg.dataDir;
      WorkingDirectory = cfg.dataDir;
  
      EnvironmentFile = cfg.secretsFile;
  
negative.code: { config, lib, pkgs, ... }:
  
  with lib;
  
  let
    cfg = config.services.zammad;
  