anchor.diff:          rw ${cfg.settings.incomplete-dir}/**,
         ''}
         ${optionalString cfg.settings.watch-dir-enabled ''
  -        rw ${cfg.settings.watch-dir}/**,
  +        r${optionalString cfg.settings.trash-original-torrent-files "w"} ${cfg.settings.watch-dir}/**,
         ''}
         profile dirs {
           rw ${cfg.settings.download-dir}/**,
  
positive.code:           rw ${cfg.settings.incomplete-dir}/**,
          ''}
          ${optionalString cfg.settings.watch-dir-enabled ''
            rw ${cfg.settings.watch-dir}/**,
          ''}
        }
  
        ${optionalString (cfg.settings.script-torrent-done-enabled &&
                          cfg.settings.script-torrent-done-filename != "") ''
          # Stack transmission_directories profile on top of
          # any existing profile for script-torrent-done-filename
          # FIXME: to be tested as I'm not sure it works well with NoNewPrivileges=
  
negative.code:         example = "775";
          description = ''
            The permissions set by <literal>systemd.activationScripts.transmission-daemon</literal>
            on the directories <xref linkend="opt-services.transmission.settings.download-dir"/>
            and <xref linkend="opt-services.transmission.settings.incomplete-dir"/>.
            Note that you may also want to change
            <xref linkend="opt-services.transmission.settings.umask"/>.
          '';
        };
  
        home = mkOption {
          type = types.path;
          default = "/var/lib/transmission";
          description = ''
            The directory where Transmission will create <literal>${settingsDir}</literal>.
            as well as <literal>${downloadsDir}/</literal> unless
            <xref linkend="opt-services.transmission.settings.download-dir"/> is changed,
            and <literal>${incompleteDir}/</literal> unless
            <xref linkend="opt-services.transmission.settings.incomplete-dir"/> is changed.
          '';
        };
  
  