anchor.diff:      ${block.filters}
   
     '') filterBlocks);
  +
  +  # can't use joinSymlinks directly, because when we point $XDG_CONFIG_HOME
  +  # to the /nix/store path, we still need the subdirectory "journalwatch" inside that
  +  # to match journalwatch's expectations
  +  journalwatchConfigDir = pkgs.runCommand "journalwatch-config"
  +    { preferLocalBuild = true; allowSubstitutes = false; }
  +    ''
  +      mkdir -p $out/journalwatch
  +      ln -sf ${journalwatchConfig} $out/journalwatch/config
  +      ln -sf ${journalwatchPatterns} $out/journalwatch/patterns
  +    '';
   
   
   in {
  
positive.code: let
    cfg = config.services.journalwatch;
    user = "journalwatch";
    dataDir = "/var/lib/${user}";
  
    journalwatchConfig = pkgs.writeText "config" (''
  
negative.code: 
      users.users.${user} = {
        isSystemUser = true;
        home = dataDir;
        group = group;
      };
  
      systemd.tmpfiles.rules = [
        # present since NixOS 19.09: remove old stateful symlink join directory,
        # which has been replaced with the journalwatchConfigDir store path
        "R ${dataDir}/config"
      ];
  
      systemd.services.journalwatch = {
  
        environment = {
          # journalwatch stores the last processed timpestamp here
          # the share subdirectory is historic now that config home lives in /nix/store,
          # but moving this in a backwards-compatible way is much more work than what's justified
          # for cleaning that up.
          XDG_DATA_HOME = "${dataDir}/share";
          XDG_CONFIG_HOME = journalwatchConfigDir;
        };
        serviceConfig = {
          User = user;
          Group = group;
          Type = "oneshot";
          # requires a relative directory name to create beneath /var/lib
          StateDirectory = user;
          StateDirectoryMode = 0750;
          ExecStart = "${pkgs.python3Packages.journalwatch}/bin/journalwatch mail";
          # lowest CPU and IO priority, but both still in best-effort class to prevent starvation
          Nice=19;
          IOSchedulingPriority=7;
        };
      };
  
      systemd.timers.journalwatch = {
  