anchor.diff:        '';
       };
   
  +    password = mkOption {
  +      type = types.str;
  +      default = "hydron";
  +      example = "dumbpass";
  +      description = "Password for the hydron database.";
  +    };
  +
  +    passwordFile = mkOption {
  +      type = types.path;
  +      default = "/run/keys/hydron-password-file";
  +      example = "/home/okina/hydron/keys/pass";
  +      description = "Password file for the hydron database.";
  +    };
  +
  +    postgresArgs = mkOption {
  +      type = types.str;
  +      description = "Postgresql connection arguments.";
  +      example = ''
  +        {
  +          "driver": "postgres",
  +          "connection": "user=hydron password=dumbpass dbname=hydron sslmode=disable"
  +        }
  +      '';
  +    };
  +
  +    postgresArgsFile = mkOption {
  +      type = types.path;
  +      default = "/run/keys/hydron-postgres-args";
  +      example = "/home/okina/hydron/keys/postgres";
  +      description = "Postgresql connection arguments file.";
  +    };
  +
       listenAddress = mkOption {
         type = types.nullOr types.str;
         default = null;
  
positive.code: { config, lib, pkgs, ... }:
  
  let cfg = config.services.hydron;
  in with lib; {
    options.services.hydron = {
      enable = mkEnableOption "hydron";
  
negative.code:   };
  
    config = mkIf cfg.enable {
      security.sudo.enable = cfg.enable;
      services.postgresql.enable = cfg.enable;
      services.hydron.passwordFile = mkDefault (pkgs.writeText "hydron-password-file" cfg.password);
      services.hydron.postgresArgsFile = mkDefault (pkgs.writeText "hydron-postgres-args" cfg.postgresArgs);
      services.hydron.postgresArgs = mkDefault ''
        {
          "driver": "postgres",
          "connection": "user=hydron password=${cfg.password} dbname=hydron sslmode=disable"
        }
      '';
  
      systemd.services.hydron = {
        description = "hydron";
        after = [ "network.target" "postgresql.service" ];
        wantedBy = [ "multi-user.target" ];
  
        preStart = ''
          # Ensure folder exists or create it and permissions are correct
          mkdir -p ${escapeShellArg cfg.dataDir}/{.hydron,images}
          ln -sf ${escapeShellArg cfg.postgresArgsFile} ${escapeShellArg cfg.dataDir}/.hydron/db_conf.json
          chmod 750 ${escapeShellArg cfg.dataDir}
          chown -R hydron:hydron ${escapeShellArg cfg.dataDir}
  
          # Ensure the database is correct or create it
          ${pkgs.sudo}/bin/sudo -u ${postgres.superUser} ${postgres.package}/bin/createuser \
            -SDR hydron || true
          ${pkgs.sudo}/bin/sudo -u ${postgres.superUser} ${postgres.package}/bin/createdb \
            -T template0 -E UTF8 -O hydron hydron || true
          ${pkgs.sudo}/bin/sudo -u hydron ${postgres.package}/bin/psql \
            -c "ALTER ROLE hydron WITH PASSWORD '$(cat ${escapeShellArg cfg.passwordFile})';" || true
        '';
  
        serviceConfig = {
  