anchor.diff:          User = cfg.user;
           Group = cfg.group;
           PrivateTmp = true;
  -        PermissionsStartOnly = true;
           LimitNOFILE = 102642;
         };
       };
  
positive.code:     users.users."${cfg.user}" = {
        isSystemUser = true;
        group = cfg.group;
      };
  
      users.groups."${cfg.group}" = {};
  
negative.code:       preStart = ''
          mkdir -p ${cfg.home}/nexus3/etc
  
          if [ ! -f ${cfg.home}/nexus3/etc/nexus.properties ]; then
            echo "# Jetty section" > ${cfg.home}/nexus3/etc/nexus.properties
            echo "application-port=${toString cfg.listenPort}" >> ${cfg.home}/nexus3/etc/nexus.properties
  