anchor.diff:        "-/etc/hosts"
         "-/etc/localtime"
         "-/run/postgresql"
  -    ];
  +    ] ++ (optional (!hasCustomRedis) config.services.redis.servers.paperless-ng.unixSocket);
       BindPaths = [
         cfg.consumptionDir
         cfg.dataDir
  
positive.code:     NoNewPrivileges = true;
      PrivateDevices = true;
      PrivateMounts = true;
      # Needs to connect to redis
      # PrivateNetwork = true;
      PrivateTmp = true;
      PrivateUsers = true;
      ProcSubset = "pid";
  
negative.code:             '${cfg.passwordFile}' '${cfg.dataDir}/superuser-password'
          '';
          Type = "oneshot";
          # Needs to talk to mail server for automated import rules
          PrivateNetwork = false;
        };
      };
  
  