anchor.diff:        "d '${cfg.dump.backupDir}' 0750 ${cfg.user} gitea - -"
         "z '${cfg.dump.backupDir}' 0750 ${cfg.user} gitea - -"
         "Z '${cfg.dump.backupDir}' - ${cfg.user} gitea - -"
  +      "d '${cfg.lfs.contentDir}' 0750 ${cfg.user} gitea - -"
  +      "z '${cfg.lfs.contentDir}' 0750 ${cfg.user} gitea - -"
  +      "Z '${cfg.lfs.contentDir}' - ${cfg.user} gitea - -"
         "d '${cfg.repositoryRoot}' 0750 ${cfg.user} gitea - -"
         "z '${cfg.repositoryRoot}' 0750 ${cfg.user} gitea - -"
         "Z '${cfg.repositoryRoot}' - ${cfg.user} gitea - -"
  
positive.code:         RuntimeDirectory = "gitea";
          RuntimeDirectoryMode = "0755";
          # Access write directories
          ReadWritePaths = [ cfg.dump.backupDir cfg.repositoryRoot cfg.stateDir ];
          UMask = "0027";
          # Capabilities
          CapabilityBoundingSet = "";
  
negative.code:             The option is required to configure a service when the external visible port
              differs from the local listening port i.e. if port forwarding is used.
            '';
          };
        };
  
        lfs = {
          enable = mkOption {
            type = types.bool;
            default = false;
            description = "Enables git-lfs support.";
          };
  
          contentDir = mkOption {
            type = types.str;
            default = "${cfg.stateDir}/data/lfs";
            description = "Where to store LFS files.";
          };
        };
  
  