anchor.diff:          in "${helperTool} process-json '${jsonFile}'";
   
           serviceConfig = {
  -          ExecStart = "@${taskd} taskd server";
  +          ExecStart = let
  +            mkCfgFlag = flag: escapeShellArg "--${flag}";
  +            cfgFlags = concatMapStringsSep " " mkCfgFlag cfg.config;
  +          in "@${taskd} taskd server ${cfgFlags}";
             ExecReload = "${pkgs.coreutils}/bin/kill -USR1 $MAINPID";
             Restart = "on-failure";
             PermissionsStartOnly = true;
  
positive.code:          else findPkiDefinitions newPath val;
      in flatten (mapAttrsToList mkSublist attrs);
    in all isNull (findPkiDefinitions [] manualPkiOptions);
  
    configFile = pkgs.writeText "taskdrc" (''
      # systemd related
      daemon = false
      log = -
  
      # logging
      ${mkConfLine "debug" cfg.debug}
      ${mkConfLine "ip.log" cfg.ipLog}
  
      # general
      ${mkConfLine "ciphers" cfg.ciphers}
      ${mkConfLine "confirmation" cfg.confirmation}
      ${mkConfLine "extensions" cfg.extensions}
      ${mkConfLine "queue.size" cfg.queueSize}
      ${mkConfLine "request.limit" cfg.requestLimit}
  
      # client
      ${mkConfLine "client.allow" cfg.allowedClientIDs}
      ${mkConfLine "client.deny" cfg.disallowedClientIDs}
  
      # server
      server = ${cfg.listenHost}:${toString cfg.listenPort}
      ${mkConfLine "trust" cfg.trust}
  
      # PKI options
      ${if needToCreateCA then ''
        ca.cert = ${cfg.dataDir}/keys/ca.cert
        server.cert = ${cfg.dataDir}/keys/server.cert
        server.key = ${cfg.dataDir}/keys/server.key
        server.crl = ${cfg.dataDir}/keys/server.crl
      '' else ''
        ca.cert = ${cfg.pki.manual.ca.cert}
        server.cert = ${cfg.pki.manual.server.cert}
        server.key = ${cfg.pki.manual.server.key}
        server.crl = ${cfg.pki.manual.server.crl}
      ''}
    '' + cfg.extraConfig);
  
    orgOptions = { name, ... }: {
      options.users = mkOption {
  
negative.code:         gid = config.ids.gids.taskd;
        };
  
        services.taskserver.config = {
          # systemd related
          daemon = false;
          log = "-";
  
          # logging
          debug = cfg.debug;
          ip.log = cfg.ipLog;
  
          # general
          ciphers = cfg.ciphers;
          confirmation = cfg.confirmation;
          extensions = cfg.extensions;
          queue.size = cfg.queueSize;
          request.limit = cfg.requestLimit;
  
          # client
          client.allow = cfg.allowedClientIDs;
          client.deny = cfg.disallowedClientIDs;
  
          # server
          trust = cfg.trust;
          server = {
            listen = "${cfg.listenHost}:${toString cfg.listenPort}";
          } // (if needToCreateCA then {
            cert = "${cfg.dataDir}/keys/server.cert";
            key = "${cfg.dataDir}/keys/server.key";
            crl = "${cfg.dataDir}/keys/server.crl";
          } else {
            cert = "${cfg.pki.manual.server.cert}";
            key = "${cfg.pki.manual.server.key}";
            crl = "${cfg.pki.manual.server.crl}";
          });
  
          ca.cert = if needToCreateCA then "${cfg.dataDir}/keys/ca.cert"
                    else "${cfg.pki.manual.ca.cert}";
        };
  
        systemd.services.taskserver-init = {
          wantedBy = [ "taskserver.service" ];
          before = [ "taskserver.service" ];
  