anchor.diff:      PrivateMounts = true;
       # System Call Filtering
       SystemCallArchitectures = "native";
  -    SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @reboot @resources @setuid @swap";
     };
   
     envFile = pkgs.writeText "mastodon.env" (lib.concatMapStrings (s: s + "\n") (
  
positive.code:       serviceConfig = {
          Type = "oneshot";
          WorkingDirectory = cfg.package;
        } // cfgService;
  
        after = [ "network.target" ];
  
negative.code:         # Runtime directory and mode
          RuntimeDirectory = "mastodon-web";
          RuntimeDirectoryMode = "0750";
          # System Call Filtering
          SystemCallFilter = "~" + lib.concatStringsSep " " (systemCallsList ++ [ "@privileged" ]);
        } // cfgService;
        path = with pkgs; [ file imagemagick ffmpeg ];
      };
  