anchor.diff:              ''
             }
   
  +          ${utils.genJqSecretsReplacementSnippet
  +              gitlabConfig
  +              "${cfg.statePath}/config/gitlab.yml"
  +          }
  +
             if [[ -h '${cfg.statePath}/config/secrets.yml' ]]; then
               rm '${cfg.statePath}/config/secrets.yml'
             fi
  
positive.code: 
        "L+ /run/gitlab/shell-config.yml - - - - ${pkgs.writeText "config.yml" (builtins.toJSON gitlabShellConfig)}"
  
        "L+ ${cfg.statePath}/config/gitlab.yml - - - - ${pkgs.writeText "gitlab.yml" (builtins.toJSON gitlabConfig)}"
        "L+ ${cfg.statePath}/config/unicorn.rb - - - - ${./defaultUnicornConfig.rb}"
        "L+ ${cfg.statePath}/config/initializers/extra-gitlab.rb - - - - ${extraGitlabRb}"
      ];
  
negative.code: { config, lib, pkgs, utils, ... }:
  
  # TODO: support non-postgresql
  
  