anchor.diff:                        ${concatStringsSep "\n" (mapAttrsToList (database: permission: ''
                           echo "GRANT ${permission} ON ${database} TO '${user.name}'@'localhost';"
                         '') user.ensurePermissions)}
  -                    ) | ${cfg.package}/bin/mysql -u root -N
  +                    ) | ${cfg.package}/bin/mysql -N
                     '') cfg.ensureUsers}
                 '';
               in
  -              # ensureDatbases & ensureUsers depends on this script being run as root
  -              # when the user has secured their mysql install
  -              "+${setupScript}";
  +              "${setupScript}";
             # User and group
             User = cfg.user;
             Group = cfg.group;
  
positive.code:           ExecStart = "${cfg.package}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} $_WSREP_NEW_CLUSTER $_WSREP_START_POSITION";
            ExecStartPost =
              let
                setupScript = pkgs.writeScript "mysql-setup" ''
                  #!${pkgs.runtimeShell} -e
  
  
negative.code:                   ${concatMapStrings (database: ''
                      echo "CREATE DATABASE IF NOT EXISTS \`${database}\`;"
                    '') cfg.ensureDatabases}
                    ) | ${cfg.package}/bin/mysql -N
                  ''}
  
                  ${concatMapStrings (user:
  