anchor.diff:              Group = config.services.mysql.group;
             };
             script = ''
  -            set -eu
  +            set -o errexit -o pipefail -o nounset -o errtrace
  +            shopt -s inherit_errexit
   
               db_password="$(<'${cfg.databasePasswordFile}')"
               ( echo "CREATE USER IF NOT EXISTS 'keycloak'@'localhost' IDENTIFIED BY '$db_password';"
  
positive.code:             Group = "postgres";
            };
            script = ''
              set -eu
  
              PSQL=${config.services.postgresql.package}/bin/psql
  
  
negative.code:             serviceConfig = {
                ExecStartPre = let
                  startPreFullPrivileges = ''
                    set -o errexit -o pipefail -o nounset -o errtrace
                    shopt -s inherit_errexit
  
                    install -T -m 0400 -o keycloak -g keycloak '${cfg.databasePasswordFile}' /run/keycloak/secrets/db_password
                  '' + lib.optionalString (cfg.certificatePrivateKeyBundle != null) ''
                    install -T -m 0400 -o keycloak -g keycloak '${cfg.certificatePrivateKeyBundle}' /run/keycloak/secrets/ssl_cert_pk_bundle
                  '';
                  startPre = ''
                    set -o errexit -o pipefail -o nounset -o errtrace
                    shopt -s inherit_errexit
  
                    install -m 0600 ${cfg.package}/standalone/configuration/*.properties /run/keycloak/configuration
                    install -T -m 0600 ${keycloakConfig} /run/keycloak/configuration/standalone.xml
  