anchor.diff:          in "+${pkgs.writeShellScript "gitlab-pre-start-full-privileges" preStartFullPrivileges}";
   
           ExecStart = pkgs.writeShellScript "gitlab-config" ''
  -          set -eu
  +          set -o errexit -o pipefail -o nounset
  +          shopt -s inherit_errexit
   
             umask u=rwx,g=rx,o=
   
  
positive.code: 
              rm -f '${cfg.statePath}/config/secrets.yml'
  
              export secret="$(<'${cfg.secrets.secretFile}')"
              export db="$(<'${cfg.secrets.dbFile}')"
              export otp="$(<'${cfg.secrets.otpFile}')"
              export jws="$(<'${cfg.secrets.jwsFile}')"
              jq -n '{production: {secret_key_base: $ENV.secret,
                      otp_key_base: $ENV.otp,
                      db_key_base: $ENV.db,
  
negative.code:         RemainAfterExit = true;
  
          ExecStart = pkgs.writeShellScript "gitlab-db-config" ''
            set -o errexit -o pipefail -o nounset
            shopt -s inherit_errexit
            umask u=rwx,g=rx,o=
  
            initial_root_password="$(<'${cfg.initialRootPasswordFile}')"
  