anchor.diff:          server_name wiki.example.net;
         '';
       };
  -    fpmPool = mkOption {
  -      description = "Options for the PHP FPM pool";
  -      type = attrsOf unspecified;
  -      default = {};
  +    php-fpm = {
  +      package = mkOption {
  +        description = "PHP package to use";
  +        type = package;
  +        default = pkgs.php;
  +      };
  +      pool = mkOption {
  +        description = "Options for the PHP FPM pool";
  +        type = attrsOf unspecified;
  +        default = {};
  +      };
       };
       logo = mkOption {
         description = "The site logo (the image displayed in the upper-left corner of the page)";
  
positive.code:   inherit (lib)
      concatMapStrings concatMapStringsSep concatStringsSep
      filterAttrs genAttrs hasPrefix mapAttrs mapAttrsToList mkDefault
      mkEnableOption mkIf mkOption optionalAttrs optionalString
      recursiveUpdate types;
    inherit (types)
      attrsOf bool either enum int lines listOf nullOr path str
      submodule unspecified;
    inherit (builtins)
      attrNames elem isAttrs isBool isList isString toString;
  
    cfg = config.nixsap.apps.mediawiki;
    user = config.nixsap.apps.mediawiki.user;
  
    defaultPool = {
      listen.owner = config.nixsap.apps.nginx.user;
  
negative.code:       ''}
  
        export MEDIAWIKI_LOCAL_SETTINGS='${localSettings}'
        ${php}/bin/php ${pkgs.mediawiki}/maintenance/update.php
        ${concatMapAttrsSep "" (n: o: ''
          pw=$(cat '${o.password-file}')
            if [ -z "$pw" ]; then
              echo 'WARNING: Using random password, because ${o.password-file} is empty or cannot be read' >&2
              pw=$(${pkgs.pwgen}/bin/pwgen -1 13)
            fi
          ${php}/bin/php ${pkgs.mediawiki}/maintenance/createAndPromote.php \
            --force --${o.role} '${n}' "$pw"
        '') cfg.users}
      '';
  