anchor.diff:    // (if cfg.smtp.authenticate then { SMTP_LOGIN  = cfg.smtp.user; } else {})
     // cfg.extraConfig;
   
  -  systemCallsList = [ "@clock" "@cpu-emulation" "@debug" "@keyring" "@module" "@mount" "@obsolete" "@raw-io" "@reboot" "@setuid" "@swap" ];
  +  systemCallsList = [ "@cpu-emulation" "@debug" "@keyring" "@mount" "@obsolete" "@privileged" "@setuid" ];
   
     cfgService = {
       # User and group
  
positive.code:         RuntimeDirectory = "mastodon-streaming";
          RuntimeDirectoryMode = "0750";
          # System Call Filtering
          SystemCallFilter = "~" + lib.concatStringsSep " " (systemCallsList ++ [ "@privileged" "@resources" ]);
        } // cfgService;
      };
  
  
negative.code:         EnvironmentFile = "/var/lib/mastodon/.secrets_env";
          WorkingDirectory = cfg.package;
          # System Call Filtering
          SystemCallFilter = [ ("~" + lib.concatStringsSep " " (systemCallsList ++ [ "@resources" ])) "@chown" ];
        } // cfgService;
        after = [ "mastodon-init-dirs.service" "network.target" ] ++ (if databaseActuallyCreateLocally then [ "postgresql.service" ] else []);
        wantedBy = [ "multi-user.target" ];
  