anchor.diff:            type = types.str;
             example = "user/dev discussion of public-inbox itself";
             description = "User-visible description for the repository.";
  +          apply = pkgs.writeText "public-inbox-description-${name}";
           };
           options.newsgroup = mkOption {
             type = with types; nullOr str;
  
positive.code:                 rm -rf $conf_dir
                fi
  
                ln -sf ${pkgs.writeText "description" inbox.description} \
                  ${stateDir}/inboxes/${escapeShellArg name}/description
  
                export GIT_DIR=${stateDir}/inboxes/${escapeShellArg name}/all.git
  
negative.code:     let proto = removeSuffix "d" srv;
          needNetwork = builtins.hasAttr proto cfg && cfg.${proto}.port == null;
      in {
      serviceConfig = {
        # Enable JIT-compiled C (via Inline::C)
        Environment = [ "PERL_INLINE_DIRECTORY=/run/public-inbox-${srv}/perl-inline" ];
        # NonBlocking is REQUIRED to avoid a race condition
        # if running simultaneous services.
        NonBlocking = true;
        #LimitNOFILE = 30000;
        User = config.users.users."public-inbox".name;
        Group = config.users.groups."public-inbox".name;
        RuntimeDirectory = [
            "public-inbox-${srv}/perl-inline"
          ];
        RuntimeDirectoryMode = "700";
        # This is for BindPaths= and BindReadOnlyPaths=
        # to allow traversal of directories they create inside RootDirectory=
        UMask = "0066";
        StateDirectory = ["public-inbox"];
        StateDirectoryMode = "0750";
        WorkingDirectory = stateDir;
        BindReadOnlyPaths = [
            "/etc"
            "/run/systemd"
            "${config.i18n.glibcLocales}"
          ] ++
          mapAttrsToList (name: inbox: inbox.description) cfg.inboxes ++
          # Without confinement the whole Nix store
          # is made available to the service
          optionals (!config.systemd.services."public-inbox-${srv}".confinement.enable) [
            "${pkgs.dash}/bin/dash:/bin/sh"
            builtins.storeDir
          ];
        # The following options are only for optimizing:
        # systemd-analyze security public-inbox-'*'
        AmbientCapabilities = "";
        CapabilityBoundingSet = "";
        # ProtectClock= adds DeviceAllow=char-rtc r
        DeviceAllow = "";
        LockPersonality = true;
        MemoryDenyWriteExecute = true;
        NoNewPrivileges = true;
        PrivateNetwork = mkDefault (!needNetwork);
        ProcSubset = "pid";
        ProtectClock = true;
        ProtectHome = mkDefault true;
        ProtectHostname = true;
        ProtectKernelLogs = true;
        ProtectProc = "invisible";
        #ProtectSystem = "strict";
        RemoveIPC = true;
        RestrictAddressFamilies = [ "AF_UNIX" ] ++
          optionals needNetwork [ "AF_INET" "AF_INET6" ];
        RestrictNamespaces = true;
        RestrictRealtime = true;
        RestrictSUIDSGID = true;
        SystemCallFilter = [
          "@system-service"
          "~@aio" "~@chown" "~@keyring" "~@memlock" "~@resources"
          # Not removing @setuid and @privileged because Inline::C needs them.
          # Not removing @timer because git upload-pack needs it.
        ];
        SystemCallArchitectures = "native";
  
        # The following options are redundant when confinement is enabled
        RootDirectory = "/var/empty";
        TemporaryFileSystem = "/";
        PrivateMounts = true;
        MountAPIVFS = true;
        PrivateDevices = true;
        PrivateTmp = true;
        PrivateUsers = true;
        ProtectControlGroups = true;
        ProtectKernelModules = true;
        ProtectKernelTunables = true;
      };
      confinement = {
        # Until we agree upon doing it directly here in NixOS
        # https://github.com/NixOS/nixpkgs/pull/104457#issuecomment-1115768447
        # let the user choose to enable the confinement with:
        # systemd.services.public-inbox-httpd.confinement.enable = true;
        # systemd.services.public-inbox-imapd.confinement.enable = true;
        # systemd.services.public-inbox-init.confinement.enable = true;
        # systemd.services.public-inbox-nntpd.confinement.enable = true;
        #enable = true;
        mode = "full-apivfs";
        # Inline::C needs a /bin/sh, and dash is enough
        binSh = "${pkgs.dash}/bin/dash";
        packages = [
            pkgs.iana-etc
            (getLib pkgs.nss)
            pkgs.tzdata
          ];
      };
    };
  in
  
  