anchor.diff:          };
           description = ''
               With this option, you can customize an nginx virtualHost which already has sensible defaults for piwik.
  +            Either this option or the webServerUser option is mandatory.
               Set this to {} to just enable the virtualHost if you don't need any customization.
               If enabled, then by default, the serverName is piwik.$\{config.networking.hostName\}, SSL is active,
               and certificates are acquired via ACME.
  
positive.code:         default = false;
          description = ''
            Enable piwik web analytics with php-fpm backend.
          '';
        };
  
        webServerUser = mkOption {
          type = types.str;
          example = "nginx";
          description = ''
            Name of the owner of the ${phpSocket} fastcgi socket for piwik.
            If you want to use another webserver than nginx, you need to set this to that server's user
            and pass fastcgi requests to `index.php` and `piwik.php` to this socket.
          '';
  
negative.code:   };
  
    config = mkIf cfg.enable {
      warnings = mkIf (cfg.nginx != null && cfg.webServerUser != null) [
        "If services.piwik.nginx is set, services.piwik.nginx.webServerUser is ignored and should be removed."
      ];
  
      assertions = [ {
          assertion = cfg.nginx != null || cfg.webServerUser != null;
          message = "Either services.piwik.nginx or services.piwik.nginx.webServerUser is mandatory";
      }];
  
      users.extraUsers.${user} = {
        isSystemUser = true;
  