anchor.diff:          TimeoutSec = "infinity";
           Restart = "on-failure";
           WorkingDirectory = gitlabEnv.HOME;
  +        ExecStartPre = pkgs.writeShellScript "gitlab-workhorse-pre-start" ''
  +          set -o errexit -o pipefail -o nounset
  +          shopt -s dotglob nullglob inherit_errexit
  +
  +          ${utils.genJqSecretsReplacementSnippet
  +              cfg.workhorse.config
  +              "${cfg.statePath}/config/gitlab-workhorse.json"}
  +
  +          json2toml "${cfg.statePath}/config/gitlab-workhorse.json" "${cfg.statePath}/config/gitlab-workhorse.toml"
  +          rm "${cfg.statePath}/config/gitlab-workhorse.json"
  +        '';
           ExecStart =
             "${cfg.packages.gitlab-workhorse}/bin/workhorse "
             + "-listenUmask 0 "
  
positive.code:             <https://linux.die.net/man/8/logrotate> for details.
            '';
          };
        };
  
        extraConfig = mkOption {
  
negative.code:           + "-listenAddr /run/gitlab/gitlab-workhorse.socket "
            + "-authSocket ${gitlabSocket} "
            + "-documentRoot ${cfg.packages.gitlab}/share/gitlab/public "
            + "-config ${cfg.statePath}/config/gitlab-workhorse.toml "
            + "-secretPath ${cfg.statePath}/.gitlab_workhorse_secret";
        };
      };
  