anchor.diff:  
         # update global options
         remarshal --if toml --of json ${configPath} \
  -        | jq -cM '.check_interval = ${toString cfg.checkInterval} |
  -                  .concurrent = ${toString cfg.concurrent}' \
  +        | jq -cM ${escapeShellArg (concatStringsSep " | " [
  +            ".check_interval = ${toJSON cfg.checkInterval}"
  +            ".concurrent = ${toJSON cfg.concurrent}"
  +            ".sentry_dsn = ${toJSON cfg.sentryDSN}"
  +            ".listen_address = ${toJSON cfg.prometheusListenAddress}"
  +            ".session_server.listen_address = ${toJSON cfg.sessionServer.listenAddress}"
  +            ".session_server.advertise_address = ${toJSON cfg.sessionServer.advertiseAddress}"
  +            ".session_server.session_timeout = ${toJSON cfg.sessionServer.sessionTimeout}"
  +            "del(.[] | nulls)"
  +            "del(.session_server[] | nulls)"
  +          ])} \
           | remarshal --if json --of toml \
           | sponge ${configPath}
   
  
positive.code:               ++ map (v: "--docker-allowed-images ${escapeShellArg v}") service.dockerAllowedImages
                ++ map (v: "--docker-allowed-services ${escapeShellArg v}") service.dockerAllowedServices
              )
            ))} && sleep 1
          fi
        '') hashedServices)}
  
  
negative.code: { config, lib, pkgs, ... }:
  with builtins;
  with lib;
  let
    cfg = config.services.gitlab-runner;
    hasDocker = config.virtualisation.docker.enable;
    hashedServices = mapAttrs'
      (name: service: nameValuePair
        "${name}_${config.networking.hostName}_${
          substring 0 12
          (hashString "md5" (unsafeDiscardStringContext (toJSON service)))}"
        service)
      cfg.services;
    configPath = "$HOME/.gitlab-runner/config.toml";
    configureScript = pkgs.writeShellScriptBin "gitlab-runner-configure" (
      if (cfg.configFile != null) then ''
  