anchor.diff:  
         security = {
           SECRET_KEY = "#secretkey#";
  +        INTERNAL_TOKEN = "#internaltoken#";
           INSTALL_LOCK = true;
         };
   
  
positive.code: 
        mailer = mkIf (cfg.mailerPasswordFile != null) {
          PASSWD = "#mailerpass#";
        };
      };
  
  
negative.code:       wantedBy = [ "multi-user.target" ];
        path = [ gitea pkgs.git ];
  
        # In older versions the secret naming for JWT was kind of confusing.
        # The file jwt_secret hold the value for LFS_JWT_SECRET and JWT_SECRET
        # wasn't persistant at all.
        # To fix that, there is now the file oauth2_jwt_secret containing the
        # values for JWT_SECRET and the file jwt_secret gets renamed to
        # lfs_jwt_secret.
        # We have to consider this to stay compatible with older installations.
        preStart = let
          runConfig = "${cfg.stateDir}/custom/conf/app.ini";
          secretKey = "${cfg.stateDir}/custom/conf/secret_key";
          oauth2JwtSecret = "${cfg.stateDir}/custom/conf/oauth2_jwt_secret";
          oldLfsJwtSecret = "${cfg.stateDir}/custom/conf/jwt_secret"; # old file for LFS_JWT_SECRET
          lfsJwtSecret = "${cfg.stateDir}/custom/conf/lfs_jwt_secret"; # new file for LFS_JWT_SECRET
          internalToken = "${cfg.stateDir}/custom/conf/internal_token";
        in ''
          # copy custom configuration and generate a random secret key if needed
          ${optionalString (cfg.useWizard == false) ''
  