anchor.diff:          chmod -R ug+rwX,o-rwx ${dataDir}
           '';
         script = ''
  -            # Use User-Private Group scheme to protect matomo data, but allow administration / backup via matomo group
  +            # Use User-Private Group scheme to protect Matomo data, but allow administration / backup via 'matomo' group
               # Copy config folder
               chmod g+s "${dataDir}"
               cp -r "${cfg.package}/config" "${dataDir}/"
  
positive.code:             (import ../web-servers/nginx/vhost-options.nix { inherit config lib; })
              {
                # enable encryption by default,
                # as sensitive login and matomo data should not be transmitted in clear text.
                options.forceSSL.default = true;
                options.enableACME.default = true;
              }
  
negative.code:       # e.g. after restoring from backup or moving from another system.
        # Note that ${dataDir}/config/config.ini.php might contain the MySQL password.
        preStart = ''
          # migrate data from piwik to Matomo folder
          if [ -d ${deprecatedDataDir} ]; then
            echo "Migrating from ${deprecatedDataDir} to ${dataDir}"
            mv -T ${deprecatedDataDir} ${dataDir}
  