anchor.diff:        };
       };
   
  +    systemd.services.gitlab-registry-cert = optionalAttrs cfg.registry.enable {
  +      path = with pkgs; [ openssl ];
  +
  +      script = ''
  +        mkdir -p $(dirname ${cfg.registry.keyFile})
  +        mkdir -p $(dirname ${cfg.registry.certFile})
  +        openssl req -nodes -newkey rsa:4096 -keyout ${cfg.registry.keyFile} -out /tmp/registry-auth.csr -subj "/CN=${cfg.registry.issuer}"
  +        openssl x509 -in /tmp/registry-auth.csr -out ${cfg.registry.certFile} -req -signkey ${cfg.registry.keyFile} -days 3650
  +        chown ${cfg.user}:${cfg.group} $(dirname ${cfg.registry.keyFile})
  +        chown ${cfg.user}:${cfg.group} $(dirname ${cfg.registry.certFile})
  +        chown ${cfg.user}:${cfg.group} ${cfg.registry.keyFile}
  +        chown ${cfg.user}:${cfg.group} ${cfg.registry.certFile}
  +      '';
  +
  +      serviceConfig = {
  +        ConditionPathExists = "!${cfg.registry.certFile}";
  +      };
  +    };
  +
  +    # Ensure Docker Registry launches after the certificate generation job
  +    systemd.services.docker-registry = optionalAttrs cfg.registry.enable {
  +      wants = [ "gitlab-registry-cert.service" ];
  +    };
  +
  +    # Enable Docker Registry, if GitLab-Container Registry is enabled
  +    services.dockerRegistry = optionalAttrs cfg.registry.enable {
  +      enable = true;
  +      enableDelete = true; # This must be true, otherwise GitLab won't manage it correctly
  +      extraConfig = {
  +        auth.token = {
  +          realm = "http${if cfg.https == true then "s" else ""}://${cfg.host}/jwt/auth";
  +          service = cfg.registry.serviceName;
  +          issuer = cfg.registry.issuer;
  +          rootcertbundle = cfg.registry.certFile;
  +        };
  +      };
  +    };
  +
       # Use postfix to send out mails.
       services.postfix.enable = mkDefault (cfg.smtp.enable && cfg.smtp.address == "localhost");
   
  
positive.code:           port = 3807;
          };
        };
        extra = {};
        uploads.storage_path = cfg.statePath;
      };
  
negative.code:           This should be a string, not a nix path, since nix paths are
            copied into the world-readable nix store.
          '';
        };
  
        registry = {
          enable = mkOption {
            type = types.bool;
            default = false;
            description = "Enable GitLab container registry.";
          };
          host = mkOption {
            type = types.str;
            default = config.services.gitlab.host;
            description = "GitLab container registry host name.";
          };
          port = mkOption {
            type = types.int;
            default = 4567;
            description = "GitLab container registry port.";
          };
          certFile = mkOption {
            type = types.path;
            default = null;
            description = "Path to GitLab container registry certificate.";
          };
          keyFile = mkOption {
            type = types.path;
            default = null;
            description = "Path to GitLab container registry certificate-key.";
          };
          defaultForProjects = mkOption {
            type = types.bool;
            default = cfg.registry.enable;
            description = "If GitLab container registry should be enabled by default for projects.";
          };
          issuer = mkOption {
            type = types.str;
            default = "gitlab-issuer";
            description = "GitLab container registry issuer.";
          };
          serviceName = mkOption {
            type = types.str;
            default = "container_registry";
            description = "GitLab container registry service name.";
          };
          externalAddress = mkOption {
            type = types.str;
            default = "";
            description = "External address used to access registry from the internet";
          };
          externalPort = mkOption {
            type = types.int;
            description = "External port used to access registry from the internet";
          };
        };
  
        smtp = {
  