anchor.diff:          User = "${cfg.user}";
           PermissionsStartOnly = true;
           ExecStart = "${pkgs.mpd}/bin/mpd --no-daemon ${mpdConf}";
  +        Type = "notify";
  +        LimitRTPRIO = 50;
  +        LimitRTTIME = "infinity";
  +        ProtectSystem = true;
  +        NoNewPrivileges = true;
  +        ProtectKernelTunables = true;
  +        ProtectControlGroups = true;
  +        ProtectKernelModules = true;
  +        RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX AF_NETLINK";
  +        RestrictNamespaces = true;
         };
       };
   
  
positive.code:         default = false;
          description = ''
            Whether to enable MPD, the music player daemon.
          '';
        };
  
  
negative.code: 
    config = mkIf cfg.enable {
  
      systemd.sockets.mpd = mkIf cfg.startWhenNeeded {
        description = "Music Player Daemon Socket";
        wantedBy = [ "sockets.target" ];
        listenStreams = [
          "${optionalString (cfg.network.listenAddress != "any") "${cfg.network.listenAddress}:"}${toString cfg.network.port}"
        ];
        socketConfig = {
          Backlog = 5;
          KeepAlive = true;
          PassCredentials = true;
        };
      };
  
      systemd.services.mpd = {
        after = [ "network.target" "sound.target" ];
        description = "Music Player Daemon";
        wantedBy = optional (!cfg.startWhenNeeded) "multi-user.target";
  
        preStart = ''
          mkdir -p "${cfg.dataDir}" && chown -R ${cfg.user}:${cfg.group} "${cfg.dataDir}"
  