anchor.diff:  
       systemd.services.ekklesia-portal = {
   
  -      after = [ "network.target" ];
  +      description = "Ekklesia E-Democracy Portal";
  +      after = [ "network.target" "postgresql.service" ];
         wantedBy = [ "multi-user.target" ];
         stopIfChanged = false;
  +
  +      preStart = let
  +        replaceDebug = lib.optionalString cfg.debug "-vv";
  +        secrets = cfg.secretFiles // {
  +          browser_session_secret_key = cfg.browserSessionSecretKeyFile;
  +        };
  +        replaceSecret = file: var: secretFile:
  +        "${pkgs.replace}/bin/replace-literal -m 1 ${replaceDebug} -f -e @${var}@ $(< ${secretFile}) ${file}";
  +        replaceCfgSecret = var: secretFile: replaceSecret "$cfgdir/${configFilename}" var secretFile;
  +        secretReplacements = lib.mapAttrsToList (k: v: replaceCfgSecret k v) cfg.secretFiles;
  +      in ''
  +        echo "Prepare config file..."
  +        cfgdir=$RUNTIME_DIRECTORY
  +        chmod u+w -R $cfgdir
  +        cp ${configInput} $cfgdir/${configFilename}
  +
  +        ${lib.concatStringsSep "\n" secretReplacements}
  +
  +        echo "Run database migrations if needed..."
  +        ${serveApp}/bin/migrate
  +        echo "Pre-start finished."
  +      '';
   
         serviceConfig = {
           User = cfg.user;
           Group = cfg.group;
  -        ExecStartPre = "${serveApp}/bin/migrate";
           ExecStart = "${serveApp}/bin/run";
  -        X-ConfigFile = appConfigFile;
  +        RuntimeDirectory = "ekklesia-portal";
  +        StateDirectory = "ekklesia-portal";
  +        RestartSec = "5s";
  +        Restart = "always";
  +        X-ConfigFile = configInput;
  +        X-ServeApp = serveApp;
  +
  +        DeviceAllow = [
  +          "/dev/stderr"
  +          "/dev/stdout"
  +        ];
  +
  +        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
  +        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
  +        DevicePolicy = "strict";
  +        LockPersonality = true;
  +        NoNewPrivileges = true;
  +        PrivateDevices = true;
  +        PrivateTmp = true;
  +        PrivateUsers = true;
  +        ProtectClock = true;
  +        ProtectControlGroups = true;
  +        ProtectHome = true;
  +        ProtectHostname = true;
  +        ProtectKernelLogs = true;
  +        ProtectKernelModules = true;
  +        ProtectKernelTunables = true;
  +        ProtectSystem = "strict";
  +        RemoveIPC = true;
  +        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
  +        RestrictNamespaces = true;
  +        RestrictRealtime = true;
  +        RestrictSUIDSGID = true;
  +        SystemCallArchitectures = "native";
  +        SystemCallFilter = [
  +          # deny the following syscall groups
  +          "~@clock"
  +          "~@debug"
  +          "~@module"
  +          "~@mount"
  +          "~@reboot"
  +          "~@cpu-emulation"
  +          "~@swap"
  +          "~@obsolete"
  +          "~@privileged"
  +          "~@resources"
  +          "~@raw-io"
  +        ];
  +        UMask = "077";
  +
         };
   
  +      unitConfig = {
  +        Documentation = [
  +          "https://github.com/edemocracy/ekklesia-portal"
  +          "https://ekklesiademocracy.org"
  +        ];
  +      };
       };
   
     };
  
positive.code:   options.services.ekklesia.portal = with lib; {
  
      enable = mkEnableOption "Enable the portal component of the Ekklesia e-democracy platform";
  
      user = mkOption {
        type = types.str;
  
negative.code: 
    config = lib.mkIf cfg.enable {
  
      services.ekklesia.portal.configFile = configInput;
  
      environment.systemPackages = [ ekklesiaPortalConfig ekklesiaPortalShowConfig ];
  
      users.users.ekklesia-portal = { };
  