anchor.diff:          nextcloud-setup = let
             c = cfg.config;
             writePhpArrary = a: "[${concatMapStringsSep "," (val: ''"${toString val}"'') a}]";
  +          requiresReadSecretFunction = c.dbpassFile != null
  +            || (c.objectstore != null && (c.objectstore.s3.enable && c.objectstore.s3.arguments.secretFile != null));
  +          objectstoreConfig = let
  +            class = if c.objectstore.s3.enable then "S3" else "";
  +            args = if c.objectstore.s3.enable then c.objectstore.s3.arguments else {};
  +            classLine = '''class' => '\\OC\\Files\\ObjectStore\\${class}','';
  +            argumentLines = optionalString c.objectstore.s3.enable ''
  +              'bucket' => '${args.bucket}',
  +              'autocreate' => ${toString args.autocreate},
  +              'key' => '${args.key}',
  +              ${optionalString (args.secret != null) "'secret' => '${args.secret}',"}
  +              ${optionalString (args.secretFile != null) "'secret' => nix_read_secret('${args.secretFile}'),"}
  +              ${optionalString (args.hostname != null) "'hostname' => '${args.hostname}',"}
  +              ${optionalString (args.port != null) "'port' => ${toString args.port},"}
  +              ${optionalString (args.useSsl != null) "'use_ssl' => ${if args.useSsl then "true" else "false"},"}
  +              ${optionalString (args.region != null) "'region' => '${args.region}',"}
  +              'use_path_style' => ${if args.usePathStyle then "true" else "false"},
  +            '';
  +          in optionalString (c.objectstore != null) '''objectstore' => [
  +            ${classLine}
  +            'arguments' => [
  +              ${argumentLines}
  +            ],
  +          ]'';
             overrideConfig = pkgs.writeText "nextcloud-config.php" ''
               <?php
  -            ${optionalString (c.dbpassFile != null) ''
  -              function nix_read_pwd() {
  -                $file = "${c.dbpassFile}";
  +            ${optionalString requiresReadSecretFunction ''
  +              function nix_read_secret($file) {
                   if (!file_exists($file)) {
                     throw new \RuntimeException(sprintf(
                       "Cannot start Nextcloud, dbpass file %s set by NixOS doesn't seem to "
  
positive.code:           phone-numbers.
          '';
        };
      };
  
      enableImagemagick = mkEnableOption ''
  
negative.code:         }
          { assertion = versionOlder cfg.package.version "21" -> cfg.config.defaultPhoneRegion == null;
            message = "The `defaultPhoneRegion'-setting is only supported for Nextcloud >=21!";
          }
          { assertion = acfg.objectstore == null
              || (lists.count (v: v.enable) (attrsets.attrValues acfg.objectstore)) == 1;
            message = "If using objectstore class as primary storage exactly one class can be enabled.";
          }
          { assertion = let s3 = acfg.objectstore.s3; in acfg.objectstore == null
              || (!s3.enable || ((s3.arguments.secret != null) != (s3.arguments.secretFile != null)));
            message = "S3 storage requires specifying exactly one of secret or secretFile";
          }
        ];
  
  