anchor.diff:          after = [ "network.target" "postgresql.service" ];
   
           preStart = ''
  -          mkdir -p ${cfg.statePath}/{data,config,logs}
  -          ln -sf ${cfg.package}/{bin,fonts,i18n,templates,client} ${cfg.statePath}
  +          mkdir -p "${cfg.statePath}"/{data,config,logs,plugins}
  +          mkdir -p "${cfg.statePath}/plugins"/{client,server}
  +          ln -sf ${cfg.package}/{bin,fonts,i18n,templates,client} "${cfg.statePath}"
           '' + lib.optionalString (mattermostPlugins != null) ''
  -          mkdir -p ${cfg.statePath}/plugins/{client,server}
             rm -rf "${cfg.statePath}/data/plugins"
  -          ln -sf ${mattermostPlugins}/data/plugins ${cfg.statePath}/data
  +          ln -sf ${mattermostPlugins}/data/plugins "${cfg.statePath}/data"
           '' + lib.optionalString (!cfg.mutableConfig) ''
  -          rm -f ${cfg.statePath}/config/config.json
  -          ${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${cfg.package}/config/config.json ${mattermostConfJSON} > ${cfg.statePath}/config/config.json
  -          ${cfg.package}/bin/mattermost config migrate ${cfg.statePath}/config/config.json ${database}
  +          rm -f "${cfg.statePath}/config/config.json"
  +          ${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${cfg.package}/config/config.json ${mattermostConfJSON} > "${cfg.statePath}/config/config.json"
           '' + lib.optionalString cfg.mutableConfig ''
             if ! test -e "${cfg.statePath}/config/.initial-created"; then
               rm -f ${cfg.statePath}/config/config.json
  -            ${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${cfg.package}/config/config.json ${mattermostConfJSON} > ${cfg.statePath}/config/config.json
  -            touch ${cfg.statePath}/config/.initial-created
  +            ${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${cfg.package}/config/config.json ${mattermostConfJSON} > "${cfg.statePath}/config/config.json"
  +            touch "${cfg.statePath}/config/.initial-created"
             fi
           '' + lib.optionalString (cfg.mutableConfig && cfg.preferNixConfig) ''
  -          new_config="$(${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${cfg.statePath}/config/config.json ${mattermostConfJSON})"
  -
  -          rm -f ${cfg.statePath}/config/config.json
  -          echo "$new_config" > ${cfg.statePath}/config/config.json
  +          new_config="$(${pkgs.jq}/bin/jq -s '.[0] * .[1]' "${cfg.statePath}/config/config.json" ${mattermostConfJSON})"
  +
  +          rm -f "${cfg.statePath}/config/config.json"
  +          echo "$new_config" > "${cfg.statePath}/config/config.json"
           '' + lib.optionalString cfg.localDatabaseCreate (createDb {}) + ''
             # Don't change permissions recursively on the data, current, and symlinked directories (see ln -sf command above).
  -          # This dramatically increases startup times for installations with a lot of files.
  +          # This dramatically decreases startup times for installations with a lot of files.
             find . -maxdepth 1 -not -name data -not -name client -not -name templates -not -name i18n -not -name fonts -not -name bin -not -name . \
  -            -exec chown ${cfg.user}:${cfg.group} -R {} \; -exec chmod u+rw,g+r,o-rwx -R {} \;
  -
  -          chown ${cfg.user}:${cfg.group} ${cfg.statePath}/data .
  -          chmod u+rw,g+r,o-rwx ${cfg.statePath}/data .
  +            -exec chown "${cfg.user}:${cfg.group}" -R {} \; -exec chmod u+rw,g+r,o-rwx -R {} \;
  +
  +          chown "${cfg.user}:${cfg.group}" "${cfg.statePath}/data" .
  +          chmod u+rw,g+r,o-rwx "${cfg.statePath}/data" .
           '';
   
           serviceConfig = {
             PermissionsStartOnly = true;
             User = cfg.user;
             Group = cfg.group;
  -          ExecStart = "${cfg.package}/bin/mattermost " + (
  -            escapeShellArgs
  -            (lib.optionals (!cfg.mutableConfig) ["-c" database])
  -          );
  +          ExecStart = "${cfg.package}/bin/mattermost";
             WorkingDirectory = "${cfg.statePath}";
             Restart = "always";
             RestartSec = "10";
  
positive.code:       # The systemd service will fail to execute the preStart hook
        # if the WorkingDirectory does not exist
        system.activationScripts.mattermost = ''
          mkdir -p ${cfg.statePath}
        '';
  
        systemd.services.mattermost = {
  
negative.code:       else {
          PluginSettings = {
            Enable = true;
          };
        }
      );
  