anchor.diff:      systemd.services.jitsi-meet-init-secrets = {
         wantedBy = [ "multi-user.target" ];
         before = [ "jicofo.service" "jitsi-videobridge2.service" ] ++ (optional cfg.prosody.enable "prosody.service");
  -      path = [ config.services.prosody.package ];
         serviceConfig = {
           Type = "oneshot";
         };
   
         script = let
           secrets = [ "jicofo-component-secret" "jicofo-user-secret" "jibri-auth-secret" "jibri-recorder-secret" ] ++ (optional (cfg.videobridge.passwordFile == null) "videobridge-secret");
  -        videobridgeSecret = if cfg.videobridge.passwordFile != null then cfg.videobridge.passwordFile else "/var/lib/jitsi-meet/videobridge-secret";
         in
         ''
           cd /var/lib/jitsi-meet
  
positive.code:         '';
        };
      };
      systemd.services.prosody.serviceConfig = mkIf cfg.prosody.enable {
        EnvironmentFile = [ "/var/lib/jitsi-meet/secrets-env" ];
        SupplementaryGroups = [ "jitsi-meet" ];
      };
  
      users.groups.jitsi-meet = {};
  
negative.code:         chmod 640 secrets-env
        ''
        + optionalString cfg.prosody.enable ''
          # generate self-signed certificates
          if [ ! -f /var/lib/jitsi-meet.crt ]; then
            ${getBin pkgs.openssl}/bin/openssl req \
  