anchor.diff:    mkListener = l: ''{port: ${toString l.port}, bind_address: "${l.bind_address}", type: ${l.type}, tls: ${fromBool l.tls}, x_forwarded: ${fromBool l.x_forwarded}, resources: [${concatStringsSep "," (map mkResource l.resources)}]}'';
     fromBool = x: if x then "true" else "false";
     configFile = pkgs.writeText "homeserver.yaml" ''
  +${optionalString (cfg.tls_certificate_path != null) ''
   tls_certificate_path: "${cfg.tls_certificate_path}"
  +''}
   ${optionalString (cfg.tls_private_key_path != null) ''
   tls_private_key_path: "${cfg.tls_private_key_path}"
   ''}
  +${optionalString (cfg.tls_dh_params_path != null) ''
   tls_dh_params_path: "${cfg.tls_dh_params_path}"
  +''}
   no_tls: ${fromBool cfg.no_tls}
   ${optionalString (cfg.bind_port != null) ''
   bind_port: ${toString cfg.bind_port}
  
positive.code:         '';
        };
        tls_certificate_path = mkOption {
          type = types.str;
          default = "/var/lib/matrix-synapse/homeserver.tls.crt";
          description = ''
            PEM encoded X509 certificate for TLS.
            You can replace the self-signed certificate that synapse
  
negative.code:         Group = "matrix-synapse";
          WorkingDirectory = "/var/lib/matrix-synapse";
          PermissionsStartOnly = true;
          ExecStart = "${cfg.package}/bin/homeserver --config-path ${configFile} --keys-directory /var/lib/matrix-synapse";
        };
      };
    };
  