anchor.diff:                  }
                 '') ]
               );
  -          }];
  -        };
  +          };
  +        }];
         })
         (mkIf cfg.nntp.enable
  -        { public-inbox-nntpd = {
  +        { public-inbox-nntpd = mkMerge [(serviceConfig "nntpd") {
             after = [ "public-inbox-init.service" "public-inbox-watch.service" ];
             requires = [ "public-inbox-init.service" ];
  -          serviceConfig = mkMerge [(serviceConfig "nntpd") {
  +          serviceConfig = {
               ExecStart = escapeShellArgs (
                 [ "${cfg.package}/bin/public-inbox-nntpd" ] ++
                 cfg.nntp.args ++
                 optionals (cfg.nntp.cert != null) [ "--cert" cfg.nntp.cert ] ++
                 optionals (cfg.nntp.key != null) [ "--key" cfg.nntp.key ]
               );
  -          }];
  -        };
  +          };
  +        }];
         })
         (mkIf (any (inbox: inbox.watch != []) (attrValues cfg.inboxes)
           || cfg.settings.publicinboxwatch.watchspam != null)
  -        { public-inbox-watch = {
  +        { public-inbox-watch = mkMerge [(serviceConfig "watch") {
             inherit (cfg) path;
             wants = [ "public-inbox-init.service" ];
             requires = [ "public-inbox-init.service" ] ++
               optional (cfg.settings.publicinboxwatch.spamcheck == "spamc") "spamassassin.service";
             wantedBy = [ "multi-user.target" ];
  -          serviceConfig = mkMerge [(serviceConfig "watch") {
  +          serviceConfig = {
               ExecStart = "${cfg.package}/bin/public-inbox-watch";
               ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
  -          }];
  -        };
  +          };
  +        }];
         })
         ({ public-inbox-init = let
             PI_CONFIG = gitIni.generate "public-inbox.ini"
               (filterAttrsRecursive (n: v: v != null) cfg.settings);
  -          in {
  +          in mkMerge [(serviceConfig "init") {
             wantedBy = [ "multi-user.target" ];
             restartIfChanged = true;
             restartTriggers = [ PI_CONFIG ];
  
positive.code:     let proto = removeSuffix "d" srv;
          needNetwork = builtins.hasAttr proto cfg && cfg.${proto}.port == null;
      in {
      # Enable JIT-compiled C (via Inline::C)
      Environment = [ "PERL_INLINE_DIRECTORY=/run/public-inbox-${srv}/perl-inline" ];
      # NonBlocking is REQUIRED to avoid a race condition
      # if running simultaneous services.
      NonBlocking = true;
      #LimitNOFILE = 30000;
      User = config.users.users."public-inbox".name;
      Group = config.users.groups."public-inbox".name;
      RuntimeDirectory = [
        "public-inbox-${srv}/perl-inline"
        # Create RootDirectory= in the host's mount namespace.
        "public-inbox-${srv}/root"
      ];
      RuntimeDirectoryMode = "700";
      # Avoid mounting RootDirectory= in the own RootDirectory= of ExecStart='s mount namespace.
      InaccessiblePaths = ["-+/run/public-inbox-${srv}/root"];
      # This is for BindPaths= and BindReadOnlyPaths=
      # to allow traversal of directories they create in RootDirectory=.
      UMask = "0066";
      RootDirectory = "/run/public-inbox-${srv}/root";
      RootDirectoryStartOnly = true;
      WorkingDirectory = stateDir;
      MountAPIVFS = true;
      BindReadOnlyPaths = [
        builtins.storeDir
        "/etc"
        "/run"
        # For Inline::C
        "/bin/sh"
      ];
      BindPaths = [
        stateDir
      ];
      # The following options are only for optimizing:
      # systemd-analyze security public-inbox-'*'
      AmbientCapabilities = "";
      CapabilityBoundingSet = "";
      # ProtectClock= adds DeviceAllow=char-rtc r
      DeviceAllow = "";
      LockPersonality = true;
      MemoryDenyWriteExecute = true;
      NoNewPrivileges = true;
      PrivateDevices = true;
      PrivateMounts = true;
      PrivateNetwork = mkDefault (!needNetwork);
      PrivateTmp = true;
      PrivateUsers = true;
      ProcSubset = "pid";
      ProtectClock = true;
      ProtectControlGroups = true;
      ProtectHome = mkDefault true;
      ProtectHostname = true;
      ProtectKernelLogs = true;
      ProtectKernelModules = true;
      ProtectKernelTunables = true;
      ProtectProc = "invisible";
      ProtectSystem = "strict";
      RemoveIPC = true;
      RestrictAddressFamilies = [ "AF_UNIX" ]
        ++ optionals needNetwork [ "AF_INET" "AF_INET6" ];
      RestrictNamespaces = true;
      RestrictRealtime = true;
      RestrictSUIDSGID = true;
      SystemCallFilter = [
        "@system-service"
        "~@aio" "~@chown" "~@keyring" "~@memlock" "~@resources"
        # Not removing @setuid and @privileged
        # because Inline::C needs them.
        # Not removing @timer
        # because git upload-pack needs it.
      ];
      SystemCallArchitectures = "native";
    };
  in
  
  
negative.code:           type = types.str;
            example = "user/dev discussion of public-inbox itself";
            description = "User-visible description for the repository.";
            apply = pkgs.writeText "public-inbox-description-${name}";
          };
          options.newsgroup = mkOption {
            type = with types; nullOr str;
  