anchor.diff:    options.services.ekklesia.portal = with lib; {
   
       enable = mkEnableOption "Enable the portal component of the Ekklesia e-democracy platform";
  +
  +    debug = mkOption {
  +      type = types.bool;
  +      default = false;
  +      description = ''
  +        (UNSAFE) Activate debugging mode for this module.
  +        Currently shows how secrets are replaced in the pre-start script.
  +      '';
  +    };
   
       user = mkOption {
         type = types.str;
  
positive.code: 
    config = lib.mkIf cfg.enable {
  
      environment.systemPackages = [ ekklesiaPortalConfig ekklesiaPortalShowConfig ];
  
      users.users.ekklesia-portal = { };
  
negative.code:       description = "Address for gunicorn app server";
      };
  
      configFile = mkOption {
        internal = true;
        type = with types; nullOr path;
        default = null;
      };
  
      browserSessionSecretKeyFile = mkOption {
        type = types.str;
        description = "Path to file containing the secret key for browser session signing";
        default = "/var/lib/ekklesia-portal/browser-session-secret-key";
      };
  
      secretFiles = mkOption {
        type = types.attrs;
        default = {};
        description = ''
          Arbitrary secrets that should be read from a file and
          inserted in the config on startup. Expects an attrset with
          the variable name to replace and a file path to the secret.
        '';
        example = {
          some_secret_api_key = "/var/lib/ekklesia-portal/some-secret-api-key";
        };
      };
  
      extraConfig = mkOption {
        type = types.attrs;
        default = {};
  