anchor.diff:      } // optionalAttrs (cfg.group == "dovecot2") {
         dovecot2.gid = config.ids.gids.dovecot2;
       } // optionalAttrs (cfg.createMailUser && cfg.mailGroup != null) {
  -      ${cfg.mailGroup} = { };
  +      ${cfg.mailGroup} = {};
       };
   
       environment.etc."dovecot/modules".source = modulesDir;
  
positive.code:         rm -rf ${stateDir}/sieve
        '' + optionalString (cfg.sieveScripts != {}) ''
          mkdir -p ${stateDir}/sieve
          ${concatStringsSep "\n" (mapAttrsToList (to: from: ''
            if [ -d '${from}' ]; then
              mkdir '${stateDir}/sieve/${to}'
              cp -p "${from}/"*.sieve '${stateDir}/sieve/${to}'
            else
              cp -p '${from}' '${stateDir}/sieve/${to}'
            fi
            ${pkgs.dovecot_pigeonhole}/bin/sievec '${stateDir}/sieve/${to}'
          '') cfg.sieveScripts)}
          chown -R '${cfg.mailUser}:${cfg.mailGroup}' '${stateDir}/sieve'
        '';
      };
  
negative.code:       mail_plugins = $mail_plugins ${concatStringsSep " " cfg.mailPlugins.globally.enable}
      ''
  
      (
        concatStringsSep "\n" (
          mapAttrsToList (
            protocol: plugins: ''
              protocol ${protocol} {
                mail_plugins = $mail_plugins ${concatStringsSep " " plugins.enable}
              }
            ''
          ) cfg.mailPlugins.perProtocol
        )
      )
  
      (
        if cfg.sslServerCert == null then ''
          ssl = no
          disable_plaintext_auth = no
        '' else ''
          ssl_cert = <${cfg.sslServerCert}
          ssl_key = <${cfg.sslServerKey}
          ${optionalString (cfg.sslCACert != null) ("ssl_ca = <" + cfg.sslCACert)}
          ssl_dh = <${config.security.dhparams.params.dovecot2.path}
          disable_plaintext_auth = yes
        ''
      )
  
      ''
        default_internal_user = ${cfg.user}
  