anchor.diff:  
         mailer = mkIf (cfg.mailerPasswordFile != null) {
           PASSWD = "#mailerpass#";
  +      };
  +
  +      oauth2 = {
  +        JWT_SECRET = "#oauth2jwtsecret#";
         };
       };
   
  
positive.code:         {
            DOMAIN = cfg.domain;
            STATIC_ROOT_PATH = cfg.staticRootPath;
            LFS_JWT_SECRET = "#jwtsecret#";
            ROOT_URL = cfg.rootUrl;
          }
          (mkIf cfg.enableUnixSocket {
  
negative.code:               ${gitea}/bin/gitea generate secret SECRET_KEY > ${secretKey}
            fi
  
            # Migrate LFS_JWT_SECRET filename
            if [[ -e ${oldLfsJwtSecret} && ! -e ${lfsJwtSecret} ]]; then
                mv ${oldLfsJwtSecret} ${lfsJwtSecret}
            fi
  
            if [ ! -e ${oauth2JwtSecret} ]; then
                ${gitea}/bin/gitea generate secret JWT_SECRET > ${oauth2JwtSecret}
            fi
  
            if [ ! -e ${lfsJwtSecret} ]; then
                ${gitea}/bin/gitea generate secret LFS_JWT_SECRET > ${lfsJwtSecret}
            fi
  
            if [ ! -e ${internalToken} ]; then
                ${gitea}/bin/gitea generate secret INTERNAL_TOKEN > ${internalToken}
            fi
  
            SECRETKEY="$(head -n1 ${secretKey})"
            DBPASS="$(head -n1 ${cfg.database.passwordFile})"
            OAUTH2JWTSECRET="$(head -n1 ${oauth2JwtSecret})"
            LFSJWTSECRET="$(head -n1 ${lfsJwtSecret})"
            INTERNALTOKEN="$(head -n1 ${internalToken})"
            ${if (cfg.mailerPasswordFile == null) then ''
              MAILERPASSWORD="#mailerpass#"
            '' else ''
              MAILERPASSWORD="$(head -n1 ${cfg.mailerPasswordFile} || :)"
            ''}
            sed -e "s,#secretkey#,$SECRETKEY,g" \
                -e "s,#dbpass#,$DBPASS,g" \
                -e "s,#oauth2jwtsecret#,$OAUTH2JWTSECRET,g" \
                -e "s,#lfsjwtsecret#,$LFSJWTSECRET,g" \
                -e "s,#internaltoken#,$INTERNALTOKEN,g" \
                -e "s,#mailerpass#,$MAILERPASSWORD,g" \
                -i ${runConfig}
            chmod 640 ${runConfig} ${secretKey} ${oauth2JwtSecret} ${lfsJwtSecret} ${internalToken}
          ''}
  
          # update all hooks' binary paths
  