anchor.diff:  
       # Redis is required for the sidekiq queue runner.
       services.redis.enable = mkDefault true;
  +
       # We use postgres as the main data store.
  -    services.postgresql.enable = mkDefault true;
  +    services.postgresql = optionalAttrs cfg.databaseCreateLocally {
  +      enable = true;
  +      ensureUsers = singleton { name = cfg.databaseUsername; };
  +    };
  +    # The postgresql module doesn't currently support concepts like
  +    # objects owners and extensions; for now we tack on what's needed
  +    # here.
  +    systemd.services.postgresql.postStart = mkAfter (optionalString cfg.databaseCreateLocally ''
  +      $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${cfg.databaseName}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${cfg.databaseName}" OWNER "${cfg.databaseUsername}"'
  +      current_owner=$($PSQL -tAc "SELECT pg_catalog.pg_get_userbyid(datdba) FROM pg_catalog.pg_database WHERE datname = '${cfg.databaseName}'")
  +      if [[ "$current_owner" != "${cfg.databaseUsername}" ]]; then
  +          $PSQL -tAc 'ALTER DATABASE "${cfg.databaseName}" OWNER TO "${cfg.databaseUsername}"'
  +          if [[ -e "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}" ]]; then
  +              echo "Reassigning ownership of database ${cfg.databaseName} to user ${cfg.databaseUsername} failed on last boot. Failing..."
  +              exit 1
  +          fi
  +          touch "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
  +          $PSQL "${cfg.databaseName}" -tAc "REASSIGN OWNED BY \"$current_owner\" TO \"${cfg.databaseUsername}\""
  +          rm "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
  +      fi
  +      $PSQL '${cfg.databaseName}' -tAc "CREATE EXTENSION IF NOT EXISTS pg_trgm"
  +    '');
  +
       # Use postfix to send out mails.
       services.postfix.enable = mkDefault true;
   
  
positive.code:   gitlabSocket = "${cfg.statePath}/tmp/sockets/gitlab.socket";
    gitalySocket = "${cfg.statePath}/tmp/sockets/gitaly.socket";
    pathUrlQuote = url: replaceStrings ["/"] ["%2F"] url;
    pgSuperUser = config.services.postgresql.superUser;
  
    databaseConfig = {
      production = {
  
negative.code: 
      assertions = [
        {
          assertion = cfg.databaseCreateLocally -> (cfg.user == cfg.databaseUsername);
          message = "For local automatic database provisioning services.gitlab.user and services.gitlab.databaseUsername should be identical.";
        }
        {
          assertion = (cfg.databaseHost != "") -> (cfg.databasePasswordFile != null);
          message = "When services.gitlab.databaseHost is customized, services.gitlab.databasePasswordFile must be set!";
        }
        {
          assertion = cfg.initialRootPasswordFile != null;
          message = "services.gitlab.initialRootPasswordFile must be set!";
        }
        {
          assertion = cfg.secrets.secretFile != null;
  