anchor.diff:          };
           description = ''
               With this option, you can customize an nginx virtualHost which already has sensible defaults for piwik.
  +            Either this option or the webServerUser option is mandatory.
               Set this to {} to just enable the virtualHost if you don't need any customization.
               If enabled, then by default, the serverName is piwik.$\{config.networking.hostName\}, SSL is active,
               and certificates are acquired via ACME.
  
positive.code:   };
  
    config = mkIf cfg.enable {
  
      users.extraUsers.${user} = {
        isSystemUser = true;
  
negative.code:       serviceConfig.UMask = "0007";
      };
  
      services.phpfpm.poolConfigs = let
        # workaround for when both are null and need to generate a string,
        # which is illegal, but as assertions apparently are being triggered *after* config generation,
        # we have to avoid already throwing errors at this previous stage.
        socketOwner = if (cfg.nginx != null) then config.services.nginx.user
        else if (cfg.webServerUser != null) then cfg.webServerUser else "";
      in {
        ${pool} = ''
          listen = "${phpSocket}"
          listen.owner = ${socketOwner}
          listen.group = root
          listen.mode = 0600
          user = ${user}
  