anchor.diff:  
                 export JAVA_OPTS=-Djboss.server.config.user.dir=/run/keycloak/configuration
                 add-user-keycloak.sh -u admin -p '${cfg.initialAdminPassword}'
  -            '' + lib.optionalString (cfg.sslCertificate != null && cfg.sslCertificateKey != null) ''
  +            '' + optionalString (cfg.sslCertificate != null && cfg.sslCertificateKey != null) ''
                 pushd /run/keycloak/ssl/
                 cat "$CREDENTIALS_DIRECTORY/ssl_cert" <(echo) \
                     "$CREDENTIALS_DIRECTORY/ssl_key" <(echo) \
  
positive.code:               # with `expression` to evaluate.
                prefixExpression = string:
                  let
                    matchResult = builtins.match ''"\$\{.*}"'' string;
                  in
                    if matchResult != null then
                      "expression " + string
  
negative.code:               driver-xa-datasource-class-name = "org.postgresql.xa.PGXADataSource";
              };
              "data-source=KeycloakDS" = {
                connection-url = "jdbc:postgresql://${cfg.database.host}:${toString cfg.database.port}/keycloak";
                driver-name = "postgresql";
                "connection-properties=ssl".value = boolToString cfg.database.useSSL;
              } // (optionalAttrs (cfg.database.caCert != null) {
                "connection-properties=sslrootcert".value = cfg.database.caCert;
                "connection-properties=sslmode".value = "verify-ca";
              });
            };
          })
          (optionalAttrs (cfg.database.type == "mysql") {
            "subsystem=datasources" = {
              "jdbc-driver=mysql" = {
                driver-module-name = "com.mysql";
  