anchor.diff:                ${optionalString (c.dbuser != null) "'dbuser' => '${c.dbuser}',"}
                 ${optionalString (c.dbtableprefix != null) "'dbtableprefix' => '${toString c.dbtableprefix}',"}
                 ${optionalString (c.dbpass != null) "'dbpassword' => '${c.dbpass}',"}
  -              ${optionalString (c.dbpassFile != null) "'dbpassword' => nix_read_pwd(),"}
  +              ${optionalString (c.dbpassFile != null) "'dbpassword' => nix_read_secret('${c.dbpassFile}'),"}
                 'dbtype' => '${c.dbtype}',
                 'trusted_domains' => ${writePhpArrary ([ cfg.hostName ] ++ c.extraTrustedDomains)},
                 'trusted_proxies' => ${writePhpArrary (c.trustedProxies)},
                 ${optionalString (c.defaultPhoneRegion != null) "'default_phone_region' => '${c.defaultPhoneRegion}',"}
  +              ${objectstoreConfig}
               ];
             '';
             occInstallCmd = let
  
positive.code:         }
          { assertion = versionOlder cfg.package.version "21" -> cfg.config.defaultPhoneRegion == null;
            message = "The `defaultPhoneRegion'-setting is only supported for Nextcloud >=21!";
          }
        ];
  
  
negative.code:         nextcloud-setup = let
            c = cfg.config;
            writePhpArrary = a: "[${concatMapStringsSep "," (val: ''"${toString val}"'') a}]";
            requiresReadSecretFunction = c.dbpassFile != null
              || (c.objectstore != null && (c.objectstore.s3.enable && c.objectstore.s3.arguments.secretFile != null));
            objectstoreConfig = let
              class = if c.objectstore.s3.enable then "S3" else "";
              args = if c.objectstore.s3.enable then c.objectstore.s3.arguments else {};
              classLine = '''class' => '\\OC\\Files\\ObjectStore\\${class}','';
              argumentLines = optionalString c.objectstore.s3.enable ''
                'bucket' => '${args.bucket}',
                'autocreate' => ${toString args.autocreate},
                'key' => '${args.key}',
                ${optionalString (args.secret != null) "'secret' => '${args.secret}',"}
                ${optionalString (args.secretFile != null) "'secret' => nix_read_secret('${args.secretFile}'),"}
                ${optionalString (args.hostname != null) "'hostname' => '${args.hostname}',"}
                ${optionalString (args.port != null) "'port' => ${toString args.port},"}
                ${optionalString (args.useSsl != null) "'use_ssl' => ${if args.useSsl then "true" else "false"},"}
                ${optionalString (args.region != null) "'region' => '${args.region}',"}
                'use_path_style' => ${if args.usePathStyle then "true" else "false"},
              '';
            in optionalString (c.objectstore != null) '''objectstore' => [
              ${classLine}
              'arguments' => [
                ${argumentLines}
              ],
            ]'';
            overrideConfig = pkgs.writeText "nextcloud-config.php" ''
              <?php
              ${optionalString requiresReadSecretFunction ''
                function nix_read_secret($file) {
                  if (!file_exists($file)) {
                    throw new \RuntimeException(sprintf(
                      "Cannot start Nextcloud, dbpass file %s set by NixOS doesn't seem to "
  