anchor.diff:      };
     };
   
  -  config = mkIf cfg.enable {
  -    users.users.turnserver =
  -      { uid = config.ids.uids.turnserver;
  -        description = "coturn TURN server user";
  -      };
  -    users.groups.turnserver =
  -      { gid = config.ids.gids.turnserver;
  -        members = [ "turnserver" ];
  -      };
  -
  -    systemd.services.coturn = {
  -      description = "coturn TURN server";
  -      after = [ "network-online.target" ];
  -      wants = [ "network-online.target" ];
  -      wantedBy = [ "multi-user.target" ];
  -
  -      unitConfig = {
  -        Documentation = "man:coturn(1) man:turnadmin(1) man:turnserver(1)";
  -      };
  -
  -      serviceConfig = {
  -        Type = "simple";
  -        ExecStart = "${pkgs.coturn}/bin/turnserver -c ${configFile}";
  -        RuntimeDirectory = "turnserver";
  -        User = "turnserver";
  -        Group = "turnserver";
  -        AmbientCapabilities =
  -          mkIf (
  -            cfg.listening-port < 1024 ||
  -            cfg.alt-listening-port < 1024 ||
  -            cfg.tls-listening-port < 1024 ||
  -            cfg.alt-tls-listening-port < 1024 ||
  -            cfg.min-port < 1024
  -          ) "cap_net_bind_service";
  -        Restart = "on-abort";
  -      };
  -    };
  -  };
  +  config = mkIf cfg.enable (mkMerge ([
  +    { assertions = [
  +      { assertion = cfg.static-auth-secret != null -> cfg.static-auth-secret-file == null ;
  +        message = "static-auth-secret and static-auth-secret-file cannot be set at the same time";
  +      }
  +    ];}
  +
  +    {
  +      users.users.turnserver =
  +        { uid = config.ids.uids.turnserver;
  +          description = "coturn TURN server user";
  +        };
  +      users.groups.turnserver =
  +        { gid = config.ids.gids.turnserver;
  +          members = [ "turnserver" ];
  +        };
  +
  +      systemd.services.coturn = let
  +        runConfig = "/run/coturn/turnserver.cfg";
  +      in {
  +        description = "coturn TURN server";
  +        after = [ "network-online.target" ];
  +        wants = [ "network-online.target" ];
  +        wantedBy = [ "multi-user.target" ];
  +
  +        unitConfig = {
  +          Documentation = "man:coturn(1) man:turnadmin(1) man:turnserver(1)";
  +        };
  +
  +        preStart = ''
  +          cat ${configFile} > ${runConfig}
  +          ${optionalString (cfg.static-auth-secret-file != null) ''
  +            STATIC_AUTH_SECRET="$(head -n1 ${cfg.static-auth-secret-file} || :)"
  +            sed -e "s,#static-auth-secret#,$STATIC_AUTH_SECRET,g" \
  +              -i ${runConfig}
  +          '' }
  +          chmod 640 ${runConfig}
  +        '';
  +        serviceConfig = {
  +          Type = "simple";
  +          ExecStart = "${pkgs.coturn}/bin/turnserver -c ${runConfig}";
  +          RuntimeDirectory = "turnserver";
  +          User = "turnserver";
  +          Group = "turnserver";
  +          AmbientCapabilities =
  +            mkIf (
  +              cfg.listening-port < 1024 ||
  +              cfg.alt-listening-port < 1024 ||
  +              cfg.tls-listening-port < 1024 ||
  +              cfg.alt-tls-listening-port < 1024 ||
  +              cfg.min-port < 1024
  +            ) "cap_net_bind_service";
  +          Restart = "on-abort";
  +        };
  +      };
  +    systemd.tmpfiles.rules = [
  +      "d  /run/coturn 0700 turnserver turnserver - -"
  +    ];
  +  }]));
   }
  
positive.code:           by a separate program, so this is why that other mode is 'dynamic'.
          '';
        };
        realm = mkOption {
          type = types.str;
          default = config.networking.hostName;
  
negative.code: ${lib.optionalString cfg.no-auth "no-auth"}
  ${lib.optionalString cfg.use-auth-secret "use-auth-secret"}
  ${lib.optionalString (cfg.static-auth-secret != null) ("static-auth-secret=${cfg.static-auth-secret}")}
  ${lib.optionalString (cfg.static-auth-secret-file != null) ("static-auth-secret=#static-auth-secret#")}
  realm=${cfg.realm}
  ${lib.optionalString cfg.no-udp "no-udp"}
  ${lib.optionalString cfg.no-tcp "no-tcp"}
  