anchor.diff:          User = cfg.user;
           Group = cfg.group;
           PrivateTmp = true;
  -        PermissionsStartOnly = true;
           ExecStart = "${pkg}/start_crowd.sh -fg";
         };
       };
  
positive.code: 
      users.groups."${cfg.group}" = {};
  
      systemd.services.atlassian-crowd = {
        description = "Atlassian Crowd";
  
  
negative.code:         rm -rf ${cfg.home}/work
          mkdir -p ${cfg.home}/{logs,database,work}
  
          sed -e 's,port="8095",port="${toString cfg.listenPort}" address="${cfg.listenAddress}",' \
          '' + (lib.optionalString cfg.proxy.enable ''
            -e 's,compression="on",compression="off" protocol="HTTP/1.1" proxyName="${cfg.proxy.name}" proxyPort="${toString cfg.proxy.port}" scheme="${cfg.proxy.scheme}" secure="${boolToString cfg.proxy.secure}",' \
  