anchor.diff:    };
   
     config = mkIf cfg.enable {
  +    security.sudo.enable = cfg.enable;
  +    services.postgresql.enable = cfg.enable;
  +    services.hydron.passwordFile = mkDefault (pkgs.writeText "hydron-password-file" cfg.password);
  +    services.hydron.postgresArgsFile = mkDefault (pkgs.writeText "hydron-postgres-args" cfg.postgresArgs);
  +    services.hydron.postgresArgs = mkDefault ''
  +      {
  +        "driver": "postgres",
  +        "connection": "user=hydron password=${cfg.password} dbname=hydron sslmode=disable"
  +      }
  +    '';
  +
       systemd.services.hydron = {
         description = "hydron";
  -      after = [ "network.target" ];
  +      after = [ "network.target" "postgresql.service" ];
         wantedBy = [ "multi-user.target" ];
   
         preStart = ''
  -        # Ensure folder exists and permissions are correct
  -        mkdir -p ${escapeShellArg cfg.dataDir}/images
  +        # Ensure folder exists or create it and permissions are correct
  +        mkdir -p ${escapeShellArg cfg.dataDir}/{.hydron,images}
  +        ln -sf ${escapeShellArg cfg.postgresArgsFile} ${escapeShellArg cfg.dataDir}/.hydron/db_conf.json
           chmod 750 ${escapeShellArg cfg.dataDir}
           chown -R hydron:hydron ${escapeShellArg cfg.dataDir}
  +
  +        # Ensure the database is correct or create it
  +        ${pkgs.sudo}/bin/sudo -u ${postgres.superUser} ${postgres.package}/bin/createuser \
  +          -SDR hydron || true
  +        ${pkgs.sudo}/bin/sudo -u ${postgres.superUser} ${postgres.package}/bin/createdb \
  +          -T template0 -E UTF8 -O hydron hydron || true
  +        ${pkgs.sudo}/bin/sudo -u hydron ${postgres.package}/bin/psql \
  +          -c "ALTER ROLE hydron WITH PASSWORD '$(cat ${escapeShellArg cfg.passwordFile})';" || true
         '';
   
         serviceConfig = {
  
positive.code: { config, lib, pkgs, ... }:
  
  let cfg = config.services.hydron;
  in with lib; {
    options.services.hydron = {
      enable = mkEnableOption "hydron";
  
negative.code:       '';
      };
  
      password = mkOption {
        type = types.str;
        default = "hydron";
        example = "dumbpass";
        description = "Password for the hydron database.";
      };
  
      passwordFile = mkOption {
        type = types.path;
        default = "/run/keys/hydron-password-file";
        example = "/home/okina/hydron/keys/pass";
        description = "Password file for the hydron database.";
      };
  
      postgresArgs = mkOption {
        type = types.str;
        description = "Postgresql connection arguments.";
        example = ''
          {
            "driver": "postgres",
            "connection": "user=hydron password=dumbpass dbname=hydron sslmode=disable"
          }
        '';
      };
  
      postgresArgsFile = mkOption {
        type = types.path;
        default = "/run/keys/hydron-postgres-args";
        example = "/home/okina/hydron/keys/postgres";
        description = "Postgresql connection arguments file.";
      };
  
      listenAddress = mkOption {
        type = types.nullOr types.str;
        default = null;
  