anchor.diff:          CapabilityBoundingSet = "";
           # Security
           NoNewPrivileges = true;
  +        # Process Properties
  +        LimitNOFILE = "${toString ulimitNofile}";
           # Sandboxing
           ProtectSystem = "strict";
           ProtectHome = true;
  
positive.code:     listsAsDuplicateKeys = true;
      mkKeyValue = generators.mkKeyValueDefault { inherit mkValueString; } " ";
    } cfg.settings);
  in
  {
    imports = [
      (mkRemovedOptionModule [ "services" "redis" "user" ] "The redis module now is hardcoded to the redis user.")
      (mkRemovedOptionModule [ "services" "redis" "dbpath" ] "The redis module now uses /var/lib/redis as data directory.")
  
negative.code:         logfile = cfg.logfile;
          syslog-enabled = cfg.syslog;
          databases = cfg.databases;
          maxclients = cfg.maxclients;
          save = map (d: "${toString (builtins.elemAt d 0)} ${toString (builtins.elemAt d 1)}") cfg.save;
          dbfilename = "dump.rdb";
          dir = "/var/lib/redis";
  