anchor.diff:                    cfg.siteSettings
                     "/run/discourse/config/nixos_site_settings.json"
                 }
  -              install -T -m 0400 -o discourse ${discourseConf} /run/discourse/config/discourse.conf
  +              install -T -m 0600 -o discourse ${discourseConf} /run/discourse/config/discourse.conf
                 ${mkSecretReplacement cfg.database.passwordFile}
                 ${mkSecretReplacement cfg.mail.outgoing.passwordFile}
                 ${mkSecretReplacement cfg.redis.passwordFile}
                 ${mkSecretReplacement cfg.secretKeyBaseFile}
  +              chmod 0400 /run/discourse/config/discourse.conf
             )
   
             discourse-rake db:migrate >>/var/log/discourse/db_migration.log
  
positive.code:       ];
        path = cfg.package.runtimeDeps ++ [
          postgresqlPackage
          pkgs.replace
          cfg.package.rake
        ];
        environment = cfg.package.runtimeEnv // {
  
negative.code: 
            mkSecretReplacement = file:
              lib.optionalString (file != null) ''
                replace-secret '${file}' '${file}' /run/discourse/config/discourse.conf
              '';
          in ''
            set -o errexit -o pipefail -o nounset -o errtrace
  