anchor.diff:          User = cfg.user;
           Group = cfg.group;
           RuntimeDirectory = optional (cfg.socket == defaultSock) "opendkim";
  -        PermissionsStartOnly = true;
         };
       };
   
  
positive.code:           cat ${cfg.selector}.txt
            echo "-------------------------------------------------------------"
          fi
          chown ${cfg.user}:${cfg.group} ${cfg.selector}.private
        '';
  
        serviceConfig = {
  
negative.code: 
      environment.systemPackages = [ pkgs.opendkim ];
  
      systemd.tmpfiles.rules = [
        "d '${cfg.keyPath}' - ${cfg.user} ${cfg.group} - -"
      ];
  
      systemd.services.opendkim = {
        description = "OpenDKIM signing and verification daemon";
        after = [ "network.target" ];
        wantedBy = [ "multi-user.target" ];
  
        preStart = ''
          cd "${cfg.keyPath}"
          if ! test -f ${cfg.selector}.private; then
            ${pkgs.opendkim}/bin/opendkim-genkey -s ${cfg.selector} -d all-domains-generic-key
  