anchor.diff:      host     = mandatory str;
       passfile = optional path;
       port     = optional int;
  -    type     = mandatory (enum [ "mysql" ]);
  +    type     = mandatory (enum [ "mysql" "pgsql" ]);
       user     = mandatory str;
     };
   
  
positive.code:     chown -R icingaweb2:icingaweb2 '${cfg.configDir}'
    '';
  
    configureDB = with cfg.resources.icingaweb2db;
      let
        mkMyCnf = pkgs.writeBashScript "my.cnf.sh" ''
          cat <<'__EOF__'
          [client]
          host = ${host}
          ${optionalString (port != null) "port = ${toString port}"}
          user = ${user}
          __EOF__
          ${optionalString (passfile != null) ''
            pwd=$(cat '${passfile}')
            printf 'password = %s\n' "$pwd"
          ''}
        '';
      in pkgs.writeBashScript "configureDB" ''
        set -euo pipefail
        cnf=$(mktemp)
        trap 'rm -f "$cnf"' EXIT
        chmod 0600 "$cnf"
        ${mkMyCnf} > "$cnf"
        #shellcheck disable=SC2016
        while ! mysql --defaults-file="$cnf" -e 'CREATE DATABASE IF NOT EXISTS `${db}`'; do
          sleep 5s
        done
        tt=$(mysql --defaults-file="$cnf" -N -e 'SELECT COUNT(*) FROM information_schema.tables WHERE table_schema = "${db}"')
        if [ "$tt" -eq 0 ]; then
          mysql --defaults-file="$cnf" -v '${db}' < '${pkgs.icingaweb2}/etc/schema/mysql.schema.sql'
          ${optionalString (cfg.initialRootPasswordHash != "") ''
            #shellcheck disable=SC2016
            mysql --defaults-file="$cnf" -e \
              'INSERT INTO icingaweb_user (name, active, password_hash) VALUES ("root", 1, "${cfg.initialRootPasswordHash}")' '${db}'
            ''
          }
        fi
      '';
  
    keys = [ cfg.resources.icingaweb2db.passfile
             cfg.resources.icinga2db.passfile ];
  
negative.code:       after = [ "network.target" "local-fs.target" "keys.target" ];
        wants = [ "keys.target" ];
        wantedBy = [ "multi-user.target" ];
        preStart = configureFiles;
        serviceConfig = {
          ExecStart = configureDB.${cfg.resources.icingaweb2db.type};
          PermissionsStartOnly = true;
          RemainAfterExit = true;
          User = "icingaweb2";
  