anchor.diff:            echo "Migrating from ${deprecatedDataDir} to ${dataDir}"
             mv -T ${deprecatedDataDir} ${dataDir}
           fi
  -        chown -R ${user}:${user} ${dataDir}
  +        chown -R ${user}:${group} ${dataDir}
           chmod -R ug+rwX,o-rwx ${dataDir}
           '';
         script = ''
  
positive.code:       serviceConfig.UMask = "0007";
      };
  
      services.phpfpm.poolConfigs = let
        # workaround for when both are null and need to generate a string,
        # which is illegal, but as assertions apparently are being triggered *after* config generation,
        # we have to avoid already throwing errors at this previous stage.
        socketOwner = if (cfg.nginx != null) then config.services.nginx.user
        else if (cfg.webServerUser != null) then cfg.webServerUser else "";
      in {
        ${pool} = ''
          listen = "${phpSocket}"
          listen.owner = ${socketOwner}
          listen.group = root
          listen.mode = 0600
          user = ${user}
          env[PIWIK_USER_PATH] = ${dataDir}
          ${cfg.phpfpmProcessManagerConfig}
        '';
      };
  
  
  
negative.code:   cfg = config.services.matomo;
  
    user = "matomo";
    group = "matomo";
    dataDir = "/var/lib/${user}";
    deprecatedDataDir = "/var/lib/piwik";
  
    pool = user;
    # it's not possible to use /run/phpfpm-${pool}/${pool}.sock because /run/phpfpm/ is root:root 0770,
    # and therefore is not accessible by the web server.
    phpSocket = "/run/phpfpm-${pool}/${pool}.sock";
    phpExecutionUnit = "phpfpm-${pool}";
    databaseService = "mysql.service";
  
  