anchor.diff:            chmod 440 "${cfg.stateDir}/config/initializers/secret_token.rb"
           fi
   
  -
  -        # ensure everything is owned by ${cfg.user}
  -        chown -R ${cfg.user}:${cfg.group} "${cfg.stateDir}"
  -
  -
           # execute redmine required commands prior to starting the application
  -        # NOTE: su required in case using mysql socket authentication
  -        /run/wrappers/bin/su -s ${pkgs.bash}/bin/bash -m -l redmine -c '${bundle} exec rake db:migrate'
  -        /run/wrappers/bin/su -s ${pkgs.bash}/bin/bash -m -l redmine -c '${bundle} exec rake redmine:plugins:migrate'
  -        /run/wrappers/bin/su -s ${pkgs.bash}/bin/bash -m -l redmine -c '${bundle} exec rake redmine:load_default_data'
  -
  -
  -        # log files don't exist until after first command has been executed
  -        # correct ownership of files generated by calling exec rake ...
  -        chown -R ${cfg.user}:${cfg.group} "${cfg.stateDir}/log"
  +        ${bundle} exec rake db:migrate
  +        ${bundle} exec rake redmine:plugins:migrate
  +        ${bundle} exec rake redmine:load_default_data
         '';
   
         serviceConfig = {
  -        PermissionsStartOnly = true; # preStart must be run as root
           Type = "simple";
           User = cfg.user;
           Group = cfg.group;
  
positive.code:       { name = "redmine";
          group = cfg.group;
          home = cfg.stateDir;
          createHome = true;
          uid = config.ids.uids.redmine;
        });
  
  
negative.code: 
      environment.systemPackages = [ cfg.package ];
  
      # create symlinks for the basic directory layout the redmine package expects
      systemd.tmpfiles.rules = [
        "d '${cfg.stateDir}' 0750 ${cfg.user} ${cfg.group} - -"
        "d '${cfg.stateDir}/cache' 0750 ${cfg.user} ${cfg.group} - -"
        "d '${cfg.stateDir}/config' 0750 ${cfg.user} ${cfg.group} - -"
        "d '${cfg.stateDir}/files' 0750 ${cfg.user} ${cfg.group} - -"
        "d '${cfg.stateDir}/log' 0750 ${cfg.user} ${cfg.group} - -"
        "d '${cfg.stateDir}/plugins' 0750 ${cfg.user} ${cfg.group} - -"
        "d '${cfg.stateDir}/public' 0750 ${cfg.user} ${cfg.group} - -"
        "d '${cfg.stateDir}/public/plugin_assets' 0750 ${cfg.user} ${cfg.group} - -"
        "d '${cfg.stateDir}/public/themes' 0750 ${cfg.user} ${cfg.group} - -"
        "d '${cfg.stateDir}/tmp' 0750 ${cfg.user} ${cfg.group} - -"
  
        "d /run/redmine - - - - -"
        "d /run/redmine/public - - - - -"
        "L+ /run/redmine/config - - - - ${cfg.stateDir}/config"
        "L+ /run/redmine/files - - - - ${cfg.stateDir}/files"
        "L+ /run/redmine/log - - - - ${cfg.stateDir}/log"
        "L+ /run/redmine/plugins - - - - ${cfg.stateDir}/plugins"
        "L+ /run/redmine/public/plugin_assets - - - - ${cfg.stateDir}/public/plugin_assets"
        "L+ /run/redmine/public/themes - - - - ${cfg.stateDir}/public/themes"
        "L+ /run/redmine/tmp - - - - ${cfg.stateDir}/tmp"
      ];
  
      systemd.services.redmine = {
        after = [ "network.target" (if cfg.database.type == "mysql2" then "mysql.service" else "postgresql.service") ];
        wantedBy = [ "multi-user.target" ];
        environment.RAILS_ENV = "production";
        environment.RAILS_CACHE = "${cfg.stateDir}/cache";
        environment.REDMINE_LANG = "en";
  