anchor.diff:        };
   
         groupAccess = mkOption {
  -        type = types.bool;
  -        default = false;
  -        description = ''
  -          Allow read access for group (0750 mask for data directory).
  +        type = with types; nullOr bool;
  +        default = null;
  +        description = ''
  +          When true, allow read access for group (<literal>0750</literal> mask for data directory).
             Supported only for PostgreSQL 11+.
  +          </para><para>
  +          When false, force a restrictive <literal>0700</literal> mask on data directory, so
  +          PostgreSQL won't fail due to too permissive mask.
           '';
         };
   
  
positive.code:               ln -sfn "${pkgs.writeText "recovery.conf" cfg.recoveryConfig}" \
                  "${cfg.dataDir}/recovery.conf"
              ''}
              chmod ${dirMode} "${cfg.dataDir}"
  
              exec postgres
            '';
  
negative.code:       ${cfg.extraConfig}
      '';
  
      dirMode = if cfg.groupAccess == true then "0750" else "0700";
  
  in
  
  