anchor.diff:          (mkIf (!cfg.ssh.enable) {
             DISABLE_SSH = true;
           })
  +        (mkIf cfg.lfs.enable {
  +          LFS_START_SERVER = true;
  +          LFS_CONTENT_PATH = cfg.lfs.contentDir;
  +        })
  +
         ];
   
         session = {
  
positive.code:         RuntimeDirectory = "gitea";
          RuntimeDirectoryMode = "0755";
          # Access write directories
          ReadWritePaths = [ cfg.dump.backupDir cfg.repositoryRoot cfg.stateDir ];
          UMask = "0027";
          # Capabilities
          CapabilityBoundingSet = "";
  
negative.code:       "d '${cfg.dump.backupDir}' 0750 ${cfg.user} gitea - -"
        "z '${cfg.dump.backupDir}' 0750 ${cfg.user} gitea - -"
        "Z '${cfg.dump.backupDir}' - ${cfg.user} gitea - -"
        "d '${cfg.lfs.contentDir}' 0750 ${cfg.user} gitea - -"
        "z '${cfg.lfs.contentDir}' 0750 ${cfg.user} gitea - -"
        "Z '${cfg.lfs.contentDir}' - ${cfg.user} gitea - -"
        "d '${cfg.repositoryRoot}' 0750 ${cfg.user} gitea - -"
        "z '${cfg.repositoryRoot}' 0750 ${cfg.user} gitea - -"
        "Z '${cfg.repositoryRoot}' - ${cfg.user} gitea - -"
  