anchor.diff:        after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
         preStart = ''
  -        if ! test -e /var/lib/matrix-synapse; then
  -          mkdir -p /var/lib/matrix-synapse
  -          chmod 700 /var/lib/matrix-synapse
  -          chown -R matrix-synapse:matrix-synapse /var/lib/matrix-synapse
  -          ${cfg.package}/bin/homeserver --config-path ${configFile} --keys-directory /var/lib/matrix-synapse/ --generate-keys
  -        fi
  +        ${cfg.package}/bin/homeserver \
  +          --config-path ${configFile} \
  +          --keys-directory /var/lib/matrix-synapse \
  +          --generate-keys
         '';
         serviceConfig = {
           Type = "simple";
  
positive.code:   mkListener = l: ''{port: ${toString l.port}, bind_address: "${l.bind_address}", type: ${l.type}, tls: ${fromBool l.tls}, x_forwarded: ${fromBool l.x_forwarded}, resources: [${concatStringsSep "," (map mkResource l.resources)}]}'';
    fromBool = x: if x then "true" else "false";
    configFile = pkgs.writeText "homeserver.yaml" ''
  tls_certificate_path: "${cfg.tls_certificate_path}"
  ${optionalString (cfg.tls_private_key_path != null) ''
  tls_private_key_path: "${cfg.tls_private_key_path}"
  ''}
  tls_dh_params_path: "${cfg.tls_dh_params_path}"
  no_tls: ${fromBool cfg.no_tls}
  ${optionalString (cfg.bind_port != null) ''
  bind_port: ${toString cfg.bind_port}
  
negative.code:       };
        tls_private_key_path = mkOption {
          type = types.nullOr types.str;
          default = null;
          example = "/var/lib/matrix-synapse/homeserver.tls.key";
          description = ''
            PEM encoded private key for TLS. Specify null if synapse is not
            speaking TLS directly.
          '';
        };
        tls_dh_params_path = mkOption {
          type = types.nullOr types.str;
          default = null;
          example = "/var/lib/matrix-synapse/homeserver.tls.dh";
          description = ''
            PEM dh parameters for ephemeral keys
          '';
  