anchor.diff:            echo "$superuserState" > "$superuserStateFile"
           fi
         '';
  +    } // optionalAttrs (!hasCustomRedis) {
  +      after = [ "redis-paperless-ng.service" ];
       };
   
       # Password copying can't be implemented as a privileged preStart script
  
positive.code: 
    config = mkIf cfg.enable {
      # Enable redis if no special url is set
      services.redis.enable = mkIf (!hasAttr "PAPERLESS_REDIS" env) true;
  
      systemd.tmpfiles.rules = [
        "d '${cfg.dataDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
  
negative.code:     RestrictNamespaces = true;
      RestrictRealtime = true;
      RestrictSUIDSGID = true;
      SupplementaryGroups = optional (!hasCustomRedis) config.services.redis.servers.paperless-ng.user;
      SystemCallArchitectures = "native";
      SystemCallFilter = [ "@system-service" "~@privileged @resources @setuid @keyring" ];
      # Does not work well with the temporary root
  