anchor.diff:        "d /run/gitlab 0755 ${cfg.user} ${cfg.group} -"
         "d ${gitlabEnv.HOME} 0750 ${cfg.user} ${cfg.group} -"
         "d ${cfg.backupPath} 0750 ${cfg.user} ${cfg.group} -"
  +      "d ${cfg.statePath} 0750 ${cfg.user} ${cfg.group} -"
         "d ${cfg.statePath}/builds 0750 ${cfg.user} ${cfg.group} -"
  -      "d ${cfg.statePath}/config 0750 ${cfg.user} ${cfg.group} -"
  -      "d ${cfg.statePath}/db 0750 ${cfg.user} ${cfg.group} -"
  +      "D ${cfg.statePath}/config 0750 ${cfg.user} ${cfg.group} -"
  +      "D ${cfg.statePath}/config/initializers 0750 ${cfg.user} ${cfg.group} -"
  +      "D ${cfg.statePath}/db 0750 ${cfg.user} ${cfg.group} -"
         "d ${cfg.statePath}/log 0750 ${cfg.user} ${cfg.group} -"
         "d ${cfg.statePath}/repositories 2770 ${cfg.user} ${cfg.group} -"
         "d ${cfg.statePath}/shell 0750 ${cfg.user} ${cfg.group} -"
  +      "d ${cfg.statePath}/tmp 0750 ${cfg.user} ${cfg.group} -"
         "d ${cfg.statePath}/tmp/pids 0750 ${cfg.user} ${cfg.group} -"
         "d ${cfg.statePath}/tmp/sockets 0750 ${cfg.user} ${cfg.group} -"
         "d ${cfg.statePath}/uploads 0700 ${cfg.user} ${cfg.group} -"
  +      "d ${cfg.statePath}/custom_hooks 0700 ${cfg.user} ${cfg.group} -"
         "d ${cfg.statePath}/custom_hooks/pre-receive.d 0700 ${cfg.user} ${cfg.group} -"
         "d ${cfg.statePath}/custom_hooks/post-receive.d 0700 ${cfg.user} ${cfg.group} -"
         "d ${cfg.statePath}/custom_hooks/update.d 0700 ${cfg.user} ${cfg.group} -"
  +      "d ${gitlabConfig.production.shared.path} 0750 ${cfg.user} ${cfg.group} -"
         "d ${gitlabConfig.production.shared.path}/artifacts 0750 ${cfg.user} ${cfg.group} -"
         "d ${gitlabConfig.production.shared.path}/lfs-objects 0750 ${cfg.user} ${cfg.group} -"
         "d ${gitlabConfig.production.shared.path}/pages 0750 ${cfg.user} ${cfg.group} -"
  -    ];
  +      "L+ ${cfg.statePath}/lib - - - - ${cfg.packages.gitlab}/share/gitlab/lib"
  +      "L+ /run/gitlab/config - - - - ${cfg.statePath}/config"
  +      "L+ /run/gitlab/log - - - - ${cfg.statePath}/log"
  +      "L+ /run/gitlab/tmp - - - - ${cfg.statePath}/tmp"
  +      "L+ /run/gitlab/uploads - - - - ${cfg.statePath}/uploads"
  +
  +      "L+ /run/gitlab/shell-config.yml - - - - ${pkgs.writeText "config.yml" (builtins.toJSON gitlabShellConfig)}"
  +
  +      "L+ ${cfg.statePath}/config/gitlab.yml - - - - ${pkgs.writeText "gitlab.yml" (builtins.toJSON gitlabConfig)}"
  +      "L+ ${cfg.statePath}/config/database.yml - - - - ${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)}"
  +      "L+ ${cfg.statePath}/config/secrets.yml - - - - ${pkgs.writeText "secrets.yml" (builtins.toJSON secretsConfig)}"
  +      "L+ ${cfg.statePath}/config/unicorn.rb - - - - ${./defaultUnicornConfig.rb}"
  +
  +      "L+ ${cfg.statePath}/config/initializers/extra-gitlab.rb - - - - ${extraGitlabRb}"
  +    ] ++ optional cfg.smtp.enable
  +      "L+ ${cfg.statePath}/config/initializers/smtp_settings.rb - - - - ${smtpSettings}" ;
   
       systemd.services.gitlab-sidekiq = {
         after = [ "network.target" "redis.service" "gitlab.service" ];
  
positive.code:         gnupg
        ];
        preStart = ''
          cp -rf ${cfg.packages.gitlab}/share/gitlab/db/* ${cfg.statePath}/db
          rm -rf ${cfg.statePath}/config
          mkdir ${cfg.statePath}/config
          if [ -e ${cfg.statePath}/lib ]; then
            rm ${cfg.statePath}/lib
          fi
  
          ln -sf ${cfg.packages.gitlab}/share/gitlab/lib ${cfg.statePath}/lib
          [ -L /run/gitlab/config ] || ln -sf ${cfg.statePath}/config /run/gitlab/config
          [ -L /run/gitlab/log ] || ln -sf ${cfg.statePath}/log /run/gitlab/log
          [ -L /run/gitlab/tmp ] || ln -sf ${cfg.statePath}/tmp /run/gitlab/tmp
          [ -L /run/gitlab/uploads ] || ln -sf ${cfg.statePath}/uploads /run/gitlab/uploads
          cp ${cfg.packages.gitlab}/share/gitlab/VERSION ${cfg.statePath}/VERSION
          cp -rf ${cfg.packages.gitlab}/share/gitlab/config.dist/* ${cfg.statePath}/config
          ln -sf ${extraGitlabRb} ${cfg.statePath}/config/initializers/extra-gitlab.rb
          ${optionalString cfg.smtp.enable ''
            ln -sf ${smtpSettings} ${cfg.statePath}/config/initializers/smtp_settings.rb
          ''}
          ${pkgs.openssl}/bin/openssl rand -hex 32 > ${cfg.statePath}/config/gitlab_shell_secret
  
          # JSON is a subset of YAML
          ln -sf ${pkgs.writeText "gitlab.yml" (builtins.toJSON gitlabConfig)} ${cfg.statePath}/config/gitlab.yml
          ln -sf ${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} ${cfg.statePath}/config/database.yml
          ln -sf ${pkgs.writeText "secrets.yml" (builtins.toJSON secretsConfig)} ${cfg.statePath}/config/secrets.yml
          ln -sf ${./defaultUnicornConfig.rb} ${cfg.statePath}/config/unicorn.rb
  
          # Install the shell required to push repositories
          ln -sf ${pkgs.writeText "config.yml" (builtins.toJSON gitlabShellConfig)} /run/gitlab/shell-config.yml
          [ -L ${cfg.statePath}/shell/hooks ] ||  ln -sf ${cfg.packages.gitlab-shell}/hooks ${cfg.statePath}/shell/hooks
          ${cfg.packages.gitlab-shell}/bin/install
  
          chown -R ${cfg.user}:${cfg.group} ${cfg.statePath}/
          chmod -R ug+rwX,o-rwx+X ${cfg.statePath}/
          chown -R ${cfg.user}:${cfg.group} /run/gitlab
  
          if ! test -e "${cfg.statePath}/db-created"; then
            if [ "${cfg.databaseHost}" = "127.0.0.1" ]; then
  
negative.code:         if ! test -e "${cfg.statePath}/db-seeded"; then
            ${pkgs.sudo}/bin/sudo -u ${cfg.user} ${gitlab-rake}/bin/gitlab-rake db:seed_fu \
              GITLAB_ROOT_PASSWORD='${cfg.initialRootPassword}' GITLAB_ROOT_EMAIL='${cfg.initialRootEmail}'
            ${pkgs.sudo}/bin/sudo -u ${cfg.user} touch "${cfg.statePath}/db-seeded"
          fi
  
          # We remove potentially broken links to old gitlab-shell versions
          rm -f ${cfg.statePath}/repositories/**/*.git/hooks
  
          ${pkgs.sudo}/bin/sudo -u ${cfg.user} -H ${pkgs.git}/bin/git config --global core.autocrlf "input"
        '';
  
        serviceConfig = {
  