anchor.diff:        baseService = {
           path = [ cfg.git.package ];
           serviceConfig.BindPaths = [ "${cfg.settings."git.sr.ht".repos}:/var/lib/sourcehut/gitsrht/repos" ];
  -        serviceConfig.BindReadOnlyPaths = [ "${cfg.settings."git.sr.ht".post-update-script}:/var/lib/sourcehut/gitsrht/bin/post-update-script" ];
         };
         in {
         inherit configIniOfService;
  
positive.code:             # Using this has the side effect of creating empty files in /usr/bin/
              optionals cfg.builds.enable [
                "${pkgs.writeShellScript "buildsrht-keys-wrapper" ''
                  set -ex
                  cd /run/sourcehut/buildsrht/subdir
                  exec -a "$0" ${pkgs.sourcehut.buildsrht}/bin/buildsrht-keys "$@"
                ''}:/usr/bin/buildsrht-keys"
                "${pkgs.sourcehut.buildsrht}/bin/master-shell:/usr/bin/master-shell"
  
negative.code:       # Those paths are mounted using BindPaths= or BindReadOnlyPaths=
        # for services needing access to them.
        "builds.sr.ht::worker".buildlogs = "/var/log/sourcehut/buildsrht/logs";
        "git.sr.ht".post-update-script = "/usr/bin/gitsrht-update-hook";
        "git.sr.ht".repos = "/var/lib/sourcehut/gitsrht/repos";
        "hg.sr.ht".changegroup-script = "/usr/bin/hgsrht-hook-changegroup";
        "hg.sr.ht".repos = "/var/lib/sourcehut/hgsrht/repos";
        # Making this a per service option despite being in a global section,
        # so that it uses the redis-server used by the service.
  