anchor.diff:            echo  > ${cfg.privateConfig} '[syncserver]'
             echo >> ${cfg.privateConfig} "secret = $(head -c 20 /dev/urandom | sha1sum | tr -d ' -')"
           fi
  -        chown ${cfg.user}:${cfg.group} ${cfg.privateConfig}
  +        chown ${user}:${group} ${cfg.privateConfig}
         '' + optionalString (cfg.sqlUri == defaultSqlUri) ''
           if ! test -e $(dirname ${defaultDbLocation}); then
             mkdir -m 700 -p $(dirname ${defaultDbLocation})
  -          chown ${cfg.user}:${cfg.group} $(dirname ${defaultDbLocation})
  +          chown ${user}:${group} $(dirname ${defaultDbLocation})
           fi
           # Move previous database file if it exists
           oldDb="/var/db/firefox-sync-server.db"
           if test -f $oldDb; then
             mv $oldDb ${defaultDbLocation}
  -          chown ${cfg.user}:${cfg.group} ${defaultDbLocation}
  +          chown ${user}:${group} ${defaultDbLocation}
           fi
         '';
         serviceConfig.ExecStart = "${syncServerEnv}/bin/paster serve ${syncServerIni}";
       };
   
  -    users.extraUsers = optionalAttrs (cfg.user == "syncserver")
  -      (singleton {
  -        name = "syncserver";
  -        group = cfg.group;
  -        isSystemUser = true;
  -      });
  +    users.users.syncserver = {
  +      group = "syncserver";
  +      isSystemUser = true;
  +    };
   
  -    users.extraGroups = optionalAttrs (cfg.group == "syncserver")
  -      (singleton {
  -        name = "syncserver";
  -      });
  +    users.groups.syncserver = {};
     };
   }
  
positive.code:         '';
        };
  
        user = mkOption {
          type = types.str;
          default = "syncserver";
          description = "User account under which syncserver runs.";
        };
  
        group = mkOption {
          type = types.str;
          default = "syncserver";
          description = "Group account under which syncserver runs.";
        };
  
        publicUrl = mkOption {
          type = types.str;
          default = "http://localhost:5000/";
  
negative.code:       path = [ pkgs.coreutils syncServerEnv ];
  
        serviceConfig = {
          User = user;
          Group = group;
          PermissionsStartOnly = true;
        };
  
  