anchor.diff:          ExecStart = "${(removeSuffix "\n" cmd)} start";
           ExecStop = "${(removeSuffix "\n" cmd)} stop";
           User = "unifi";
  -        PermissionsStartOnly = true;
           UMask = "0077";
           WorkingDirectory = "${stateDir}";
         };
  
positive.code:       environment.LD_LIBRARY_PATH = with pkgs.stdenv; "${cc.cc.lib}/lib";
  
        preStart = ''
          # Ensure privacy of state and data.
          chown unifi "${stateDir}" "${stateDir}/data"
          chmod 0700 "${stateDir}" "${stateDir}/data"
  
          # Create the volatile webapps
          rm -rf "${stateDir}/webapps"
          mkdir -p "${stateDir}/webapps"
          chown unifi "${stateDir}/webapps"
          ln -s "${cfg.unifiPackage}/webapps/ROOT" "${stateDir}/webapps/ROOT"
        '';
  
  
negative.code:         where = where;
        }) mountPoints;
  
      systemd.tmpfiles.rules = [
        "e '${stateDir}' 0700 unifi - - -"
        "e '${stateDir}/data' 0700 unifi - - -"
      ];
  
      systemd.services.unifi = {
        description = "UniFi controller daemon";
        wantedBy = [ "multi-user.target" ];
  