anchor.diff:          description = "Initialize CA for TaskServer";
           serviceConfig.Type = "oneshot";
           serviceConfig.UMask = "0077";
  +        serviceConfig.PrivateNetwork = true;
  +        serviceConfig.PrivateTmp = true;
   
           script = ''
             silent_certtool() {
  
positive.code:           ExecStart = "@${taskd} taskd server";
            ExecReload = "${pkgs.coreutils}/bin/kill -USR1 $MAINPID";
            PermissionsStartOnly = true;
            User = cfg.user;
            Group = cfg.group;
          };
  
negative.code:         serviceConfig.User = cfg.user;
          serviceConfig.Group = cfg.group;
          serviceConfig.PermissionsStartOnly = true;
          serviceConfig.PrivateNetwork = true;
          serviceConfig.PrivateDevices = true;
          serviceConfig.PrivateTmp = true;
        };
  
        systemd.services.taskserver = {
  