anchor.diff:  
     config = lib.mkIf cfg.enable {
   
  +    services.ekklesia.portal.configFile = configInput;
  +
       environment.systemPackages = [ ekklesiaPortalConfig ekklesiaPortalShowConfig ];
   
       users.users.ekklesia-portal = { };
  
positive.code:       description = "Address for gunicorn app server";
      };
  
      extraConfig = mkOption {
        type = types.attrs;
        default = {};
  
negative.code: 
      systemd.services.ekklesia-portal = {
  
        description = "Ekklesia E-Democracy Portal";
        after = [ "network.target" "postgresql.service" ];
        wantedBy = [ "multi-user.target" ];
        stopIfChanged = false;
  
        preStart = let
          replaceDebug = lib.optionalString cfg.debug "-vv";
          secrets = cfg.secretFiles // {
            browser_session_secret_key = cfg.browserSessionSecretKeyFile;
          };
          replaceSecret = file: var: secretFile:
          "${pkgs.replace}/bin/replace-literal -m 1 ${replaceDebug} -f -e @${var}@ $(< ${secretFile}) ${file}";
          replaceCfgSecret = var: secretFile: replaceSecret "$cfgdir/${configFilename}" var secretFile;
          secretReplacements = lib.mapAttrsToList (k: v: replaceCfgSecret k v) cfg.secretFiles;
        in ''
          echo "Prepare config file..."
          cfgdir=$RUNTIME_DIRECTORY
          chmod u+w -R $cfgdir
          cp ${configInput} $cfgdir/${configFilename}
  
          ${lib.concatStringsSep "\n" secretReplacements}
  
          echo "Run database migrations if needed..."
          ${serveApp}/bin/migrate
          echo "Pre-start finished."
        '';
  
        serviceConfig = {
          User = cfg.user;
          Group = cfg.group;
          ExecStart = "${serveApp}/bin/run";
          RuntimeDirectory = "ekklesia-portal";
          StateDirectory = "ekklesia-portal";
          RestartSec = "5s";
          Restart = "always";
          X-ConfigFile = configInput;
          X-ServeApp = serveApp;
  
          DeviceAllow = [
            "/dev/stderr"
            "/dev/stdout"
          ];
  
          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
          CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
          DevicePolicy = "strict";
          LockPersonality = true;
          NoNewPrivileges = true;
          PrivateDevices = true;
          PrivateTmp = true;
          PrivateUsers = true;
          ProtectClock = true;
          ProtectControlGroups = true;
          ProtectHome = true;
          ProtectHostname = true;
          ProtectKernelLogs = true;
          ProtectKernelModules = true;
          ProtectKernelTunables = true;
          ProtectSystem = "strict";
          RemoveIPC = true;
          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
          RestrictNamespaces = true;
          RestrictRealtime = true;
          RestrictSUIDSGID = true;
          SystemCallArchitectures = "native";
          SystemCallFilter = [
            # deny the following syscall groups
            "~@clock"
            "~@debug"
            "~@module"
            "~@mount"
            "~@reboot"
            "~@cpu-emulation"
            "~@swap"
            "~@obsolete"
            "~@privileged"
            "~@resources"
            "~@raw-io"
          ];
          UMask = "077";
  
        };
  
        unitConfig = {
          Documentation = [
            "https://github.com/edemocracy/ekklesia-portal"
            "https://ekklesiademocracy.org"
          ];
        };
      };
  
    };
  