anchor.diff:              ];
             };
   
  +          readWritePaths = mkOption {
  +            type = with types; listOf path;
  +            description = ''
  +              By default, borg cannot write anywhere on the system but
  +              <literal>$HOME/.config/borg</literal> and <literal>$HOME/.cache/borg</literal>.
  +              If, for example, your preHook script needs to dump files
  +              somewhere, put those directories here.
  +            '';
  +            default = [ ];
  +            example = [
  +              "/var/backup/mysqldump"
  +            ];
  +          };
  +
  +          privateTmp = mkOption {
  +            type = types.bool;
  +            description = ''
  +              Set the <literal>PrivateTmp</literal> option for
  +              the systemd-service. Set to false if you need sockets
  +              or other files from global /tmp.
  +            '';
  +            default = true;
  +          };
  +
             doInit = mkOption {
               type = types.bool;
               description = ''
  
positive.code:     ${cfg.preHook}
    '' + optionalString cfg.doInit ''
      # Run borg init if the repo doesn't exist yet
      if ! borg list > /dev/null; then
        borg init \
          --encryption ${cfg.encryption.mode} \
          $extraInitArgs
        ${cfg.postInit}
      fi
    '' + ''
      borg create \
        --compression ${cfg.compression} \
        --exclude-from ${mkExcludeFile cfg} \
        $extraCreateArgs \
        "::$archiveName$archiveSuffix" \
        ${escapeShellArgs cfg.paths}
    '' + optionalString cfg.appendFailedSuffix ''
      borg rename "::$archiveName$archiveSuffix" "$archiveName"
    '' + ''
      ${cfg.postCreate}
    '' + optionalString (cfg.prune.keep != { }) ''
      borg prune \
        ${mkKeepArgs cfg} \
        --prefix ${escapeShellArg cfg.prune.prefix} \
        $extraPruneArgs
  
negative.code:         ProtectSystem = "strict";
          ReadWritePaths =
            [ "${userHome}/.config/borg" "${userHome}/.cache/borg" ]
            ++ cfg.readWritePaths
            # Borg needs write access to repo if it is not remote
            ++ optional (isLocalPath cfg.repo) cfg.repo;
          PrivateTmp = cfg.privateTmp;
        };
        environment = {
          BORG_REPO = cfg.repo;
  