anchor.diff:        serviceConfig.UMask = "0007";
       };
   
  -    services.phpfpm.poolConfigs = {
  +    services.phpfpm.poolConfigs = let
  +      # workaround for when both are null and need to generate a string,
  +      # which is illegal, but as assertions apparently are being triggered *after* config generation,
  +      # we have to avoid already throwing errors at this previous stage.
  +      socketOwner = if (cfg.nginx != null) then config.services.nginx.user
  +      else if (cfg.webServerUser != null) then cfg.webServerUser else "";
  +    in {
         ${pool} = ''
           listen = "${phpSocket}"
  -        listen.owner = ${cfg.webServerUser}
  +        listen.owner = ${socketOwner}
           listen.group = root
           listen.mode = 0600
           user = ${user}
  
positive.code:   };
  
    config = mkIf cfg.enable {
  
      users.extraUsers.${user} = {
        isSystemUser = true;
  
negative.code:         default = false;
          description = ''
            Enable piwik web analytics with php-fpm backend.
            Either the nginx option or the webServerUser option is mandatory.
          '';
        };
  
        webServerUser = mkOption {
          type = types.nullOr types.str;
          default = null;
          example = "lighttpd";
          description = ''
            Name of the web server user that forwards requests to the ${phpSocket} fastcgi socket for piwik if the nginx
            option is not used. Either this option or the nginx option is mandatory.
            If you want to use another webserver than nginx, you need to set this to that server's user
            and pass fastcgi requests to `index.php` and `piwik.php` to this socket.
          '';
  