anchor.diff:           Type = "oneshot";
            User = cfg.user;
            ExecStart = "${gitea}/bin/gitea dump";
  -         WorkingDirectory = cfg.stateDir;
  +         WorkingDirectory = cfg.dump.backupDir;
          };
       };
   
  
positive.code:     };
  
      systemd.tmpfiles.rules = [
        "d '${cfg.repositoryRoot}' 0750 ${cfg.user} gitea - -"
        "z '${cfg.repositoryRoot}' 0750 ${cfg.user} gitea - -"
        "Z '${cfg.repositoryRoot}' - ${cfg.user} gitea - -"
  
negative.code:         ProtectKernelTunables = true;
          ProtectKernelModules = true;
          ProtectControlGroups = true;
          ReadWritePaths = [ cfg.dump.backupDir cfg.repositoryRoot cfg.stateDir ];
          UMask = "0027";
          # Caps
          CapabilityBoundingSet = "";
  