anchor.diff:  
       assertions = [
         {
  +        assertion = cfg.databaseCreateLocally -> (cfg.user == cfg.databaseUsername);
  +        message = "For local automatic database provisioning services.gitlab.user and services.gitlab.databaseUsername should be identical.";
  +      }
  +      {
  +        assertion = (cfg.databaseHost != "") -> (cfg.databasePasswordFile != null);
  +        message = "When services.gitlab.databaseHost is customized, services.gitlab.databasePasswordFile must be set!";
  +      }
  +      {
           assertion = cfg.initialRootPasswordFile != null;
           message = "services.gitlab.initialRootPasswordFile must be set!";
  -      }
  -      {
  -        assertion = cfg.databasePasswordFile != null;
  -        message = "services.gitlab.databasePasswordFile must be set!";
         }
         {
           assertion = cfg.secrets.secretFile != null;
  
positive.code:           umask u=rwx,g=,o=
  
            ${pkgs.openssl}/bin/openssl rand -hex 32 > ${cfg.statePath}/gitlab_shell_secret
  
            if [[ -h '${cfg.statePath}/config/secrets.yml' ]]; then
              rm '${cfg.statePath}/config/secrets.yml'
  
negative.code: 
            This should be a string, not a nix path, since nix paths are
            copied into the world-readable nix store.
          '';
        };
  
        databaseCreateLocally = mkOption {
          type = types.bool;
          default = true;
          description = ''
            Whether a database should be automatically created on the
            local host. Set this to <literal>false</literal> if you plan
            on provisioning a local database yourself or use an external
            one.
          '';
        };
  
  