anchor.diff:  let
     cfg = config.services.journalwatch;
     user = "journalwatch";
  +  # for journal access
  +  group = "systemd-journal";
     dataDir = "/var/lib/${user}";
   
     journalwatchConfig = pkgs.writeText "config" (''
  
positive.code: 
      users.users.${user} = {
        isSystemUser = true;
        createHome = true;
        home = dataDir;
        # for journal access
        group = "systemd-journal";
      };
  
      systemd.services.journalwatch = {
        environment = {
          XDG_DATA_HOME = "${dataDir}/share";
          XDG_CONFIG_HOME = "${dataDir}/config";
        };
        serviceConfig = {
          User = user;
          Type = "oneshot";
          PermissionsStartOnly = true;
          ExecStart = "${pkgs.python3Packages.journalwatch}/bin/journalwatch mail";
          # lowest CPU and IO priority, but both still in best-effort class to prevent starvation
          Nice=19;
          IOSchedulingPriority=7;
        };
        preStart = ''
          chown -R ${user}:systemd-journal ${dataDir}
          chmod -R u+rwX,go-w ${dataDir}
          mkdir -p ${dataDir}/config/journalwatch
          ln -sf ${journalwatchConfig} ${dataDir}/config/journalwatch/config
          ln -sf ${journalwatchPatterns} ${dataDir}/config/journalwatch/patterns
        '';
      };
  
      systemd.timers.journalwatch = {
  
negative.code:     ${block.filters}
  
    '') filterBlocks);
  
    # can't use joinSymlinks directly, because when we point $XDG_CONFIG_HOME
    # to the /nix/store path, we still need the subdirectory "journalwatch" inside that
    # to match journalwatch's expectations
    journalwatchConfigDir = pkgs.runCommand "journalwatch-config"
      { preferLocalBuild = true; allowSubstitutes = false; }
      ''
        mkdir -p $out/journalwatch
        ln -sf ${journalwatchConfig} $out/journalwatch/config
        ln -sf ${journalwatchPatterns} $out/journalwatch/patterns
      '';
  
  
  in {
  