anchor.diff:            chmod 640 ${runConfig} ${secretKey}
           ''}
   
  -        mkdir -p ${cfg.repositoryRoot}
           # update all hooks' binary paths
           HOOKS=$(find ${cfg.repositoryRoot} -mindepth 4 -maxdepth 6 -type f -wholename "*git/hooks/*")
           if [ "$HOOKS" ]
  
positive.code:         User = cfg.user;
          Group = "gitea";
          WorkingDirectory = cfg.stateDir;
          PermissionsStartOnly = true;
          ExecStart = "${gitea.bin}/bin/gitea web";
          Restart = "always";
        };
  
negative.code:           sed -ri 's,/nix/store/[a-z0-9.-]+/bin/bash,${pkgs.bash}/bin/bash,g' $HOOKS
            sed -ri 's,/nix/store/[a-z0-9.-]+/bin/perl,${pkgs.perl}/bin/perl,g' $HOOKS
          fi
  
          # update command option in authorized_keys
          if [ -r ${cfg.stateDir}/.ssh/authorized_keys ]
          then
            sed -ri 's,/nix/store/[a-z0-9.-]+/bin/gitea,${gitea.bin}/bin/gitea,g' ${cfg.stateDir}/.ssh/authorized_keys
          fi
        '';
  
        serviceConfig = {
  