anchor.diff:      RestrictNamespaces = true;
       RestrictRealtime = true;
       RestrictSUIDSGID = true;
  +    SupplementaryGroups = optional (!hasCustomRedis) config.services.redis.servers.paperless-ng.user;
       SystemCallArchitectures = "native";
       SystemCallFilter = [ "@system-service" "~@privileged @resources @setuid @keyring" ];
       # Does not work well with the temporary root
  
positive.code: 
    config = mkIf cfg.enable {
      # Enable redis if no special url is set
      services.redis.enable = mkIf (!hasAttr "PAPERLESS_REDIS" env) true;
  
      systemd.tmpfiles.rules = [
        "d '${cfg.dataDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
  
negative.code:   cfg = config.services.paperless-ng;
  
    defaultUser = "paperless";
  
    hasCustomRedis = hasAttr "PAPERLESS_REDIS" cfg.extraConfig;
  
    env = {
      PAPERLESS_DATA_DIR = cfg.dataDir;
      PAPERLESS_MEDIA_ROOT = cfg.mediaDir;
      PAPERLESS_CONSUMPTION_DIR = cfg.consumptionDir;
      GUNICORN_CMD_ARGS = "--bind=${cfg.address}:${toString cfg.port}";
    } // (
      lib.mapAttrs (_: toString) cfg.extraConfig
    ) // (optionalAttrs (!hasCustomRedis) {
      PAPERLESS_REDIS = "unix://${config.services.redis.servers.paperless-ng.unixSocket}";
    });
  
    manage = let
      setupEnv = lib.concatStringsSep "\n" (mapAttrsToList (name: val: "export ${name}=\"${val}\"") env);
  