anchor.diff:  
         serviceConfig = {
           Type = "oneshot";
  -        PermissionsStartOnly = "true";
           User = "postgres";
         };
   
  
positive.code: 
        requires = [ "postgresql.service" ];
  
        preStart = ''
          mkdir -m 0700 -p ${cfg.location}
          chown postgres ${cfg.location}
        '';
  
        script = ''
          umask 0077 # ensure backup is only readable by postgres user
  
  
negative.code:         message = "config.services.postgresqlBackup.backupAll cannot be used together with config.services.postgresqlBackup.databases";
        }];
      }
      (mkIf cfg.enable {
        systemd.tmpfiles.rules = [
          "d '${cfg.location}' 0700 postgres - - -"
        ];
      })
      (mkIf (cfg.enable && cfg.backupAll) {
        systemd.services.postgresqlBackup =
          postgresqlBackupService "all" "${config.services.postgresql.package}/bin/pg_dumpall";
  