anchor.diff:          date.timezone = "${config.time.timeZone}"
         '';
   
  +    services.httpd.extraModules = mkBefore [
  +      # HTTP authentication mechanisms: basic and digest.
  +      "auth_basic" "auth_digest"
  +
  +      # Authentication: is the user who he claims to be?
  +      "authn_file" "authn_dbm" "authn_anon"
  +
  +      # Authorization: is the user allowed access?
  +      "authz_user" "authz_groupfile" "authz_host"
  +
  +      # Other modules.
  +      "ext_filter" "include" "env" "mime_magic"
  +      "cern_meta" "expires" "headers" "usertrack" "setenvif"
  +      "dav" "status" "asis" "info" "dav_fs"
  +      "vhost_alias" "imagemap" "actions" "speling"
  +      "proxy" "proxy_http"
  +      "cache" "cache_disk"
  +
  +      # For compatibility with old configurations, the new module mod_access_compat is provided.
  +      "access_compat"
  +    ];
  +
       systemd.services.httpd =
         { description = "Apache HTTPD";
   
  
positive.code:     Group ${mainCfg.group}
  
      ${let
          load = {name, path}: "LoadModule ${name}_module ${path}\n";
          allModules = map (name: {inherit name; path = "${httpd}/modules/mod_${name}.so";}) apacheModules
            ++ optional mainCfg.enableMellon { name = "auth_mellon"; path = "${pkgs.apacheHttpdPackages.mod_auth_mellon}/modules/mod_auth_mellon.so"; }
            ++ optional mainCfg.enablePHP { name = "php${phpMajorVersion}"; path = "${php}/modules/libphp${phpMajorVersion}.so"; }
            ++ optional mainCfg.enablePerl { name = "perl"; path = "${mod_perl}/modules/mod_perl.so"; }
            ++ extraForeignModules;
        in concatMapStrings load (unique allModules)
      }
  
      AddHandler type-map var
  
negative.code: 
    listenToString = l: "${l.ip}:${toString l.port}";
  
    allHosts = [mainCfg] ++ mainCfg.virtualHosts;
  
    enableSSL = any (vhost: vhost.enableSSL) allHosts;
  
    # NOTE: generally speaking order of modules is very important
    modules =
      [ # required apache modules our httpd service cannot run without
        "authn_core" "authz_core"
        "log_config"
        "mime" "autoindex" "negotiation" "dir"
        "alias" "rewrite"
        "unixd" "slotmem_shm" "socache_shmcb"
        "mpm_${mainCfg.multiProcessingModule}"
      ]
      ++ (if mainCfg.multiProcessingModule == "prefork" then [ "cgi" ] else [ "cgid" ])
      ++ optional enableSSL "ssl"
      ++ optional mainCfg.enableMellon { name = "auth_mellon"; path = "${pkgs.apacheHttpdPackages.mod_auth_mellon}/modules/mod_auth_mellon.so"; }
      ++ optional mainCfg.enablePHP { name = "php${phpMajorVersion}"; path = "${php}/modules/libphp${phpMajorVersion}.so"; }
      ++ optional mainCfg.enablePerl { name = "perl"; path = "${mod_perl}/modules/mod_perl.so"; }
      ++ mainCfg.extraModules;
  
  
    allDenied = "Require all denied";
  