anchor.diff:            mkdir -p ${cfg.stateDir}/conf
             cp -r ${pkgs.gitea.out}/locale ${cfg.stateDir}/conf/locale
           fi
  +      '' + optionalString (usePostgresql && cfg.database.createDatabase) ''
  +        if ! test -e "${cfg.stateDir}/db-created"; then
  +          echo "CREATE ROLE ${cfg.database.user}
  +                  WITH ENCRYPTED PASSWORD '$(head -n1 ${cfg.database.passwordFile})'
  +                  NOCREATEDB NOCREATEROLE LOGIN"   |
  +            ${pkgs.sudo}/bin/sudo -u ${pg.superUser} ${pg.package}/bin/psql
  +          ${pkgs.sudo}/bin/sudo -u ${pg.superUser} \
  +            ${pg.package}/bin/createdb             \
  +            --owner=${cfg.database.user}           \
  +            --encoding=UTF8                        \
  +            --lc-collate=C                         \
  +            --lc-ctype=C                           \
  +            --template=template0                   \
  +            ${cfg.database.name}
  +          touch "${cfg.stateDir}/db-created"
  +        fi
  +      '' + ''
  +        chown ${cfg.user} -R ${cfg.stateDir}
         '';
   
         serviceConfig = {
           Type = "simple";
           User = cfg.user;
           WorkingDirectory = cfg.stateDir;
  +        PermissionsStartOnly = true;
           ExecStart = "${pkgs.gitea.bin}/bin/gitea web";
           Restart = "always";
         };
  
positive.code: 
  let
    cfg = config.services.gitea;
    configFile = pkgs.writeText "app.ini" ''
      APP_NAME = ${cfg.appName}
      RUN_USER = ${cfg.user}
  
negative.code: 
          port = mkOption {
            type = types.int;
            default = (if !usePostgresql then 3306 else pg.port);
            description = "Database host port.";
          };
  
  