anchor.diff:        description = "Grafana Service Daemon";
         wantedBy = ["multi-user.target"];
         after = ["networking.target"];
  +      environment = mapAttrs' (n: v: nameValuePair "GF_${n}" (toString v)) envOptions;
         serviceConfig = {
  -        ExecStart = "${cfg.package}/bin/grafana --config ${cfgFile} web";
  +        ExecStart = "${cfg.package}/bin/grafana -homepath ${cfg.dataDir}";
           WorkingDirectory = cfg.dataDir;
           User = "grafana";
         };
  +      preStart = ''
  +        ln -fs ${cfg.package}/share/grafana/conf ${cfg.dataDir}
  +      '';
       };
   
       users.extraUsers.grafana = {
  
positive.code: 
    b2s = val: if val then "true" else "false";
  
    cfgFile = pkgs.writeText "grafana.ini" ''
      app_name = grafana
      app_mode = production
  
      [server]
      ; protocol (http or https)
      protocol = ${cfg.protocol}
      ; the ip address to bind to, empty will bind to all interfaces
      http_addr = ${cfg.addr}
      ; the http port  to use
      http_port = ${toString cfg.port}
      ; The public facing domain name used to access grafana from a browser
      domain = ${cfg.domain}
      ; the full public facing url
      root_url = ${cfg.rootUrl}
      router_logging = false
      ; the path relative to the binary where the static (html/js/css) files are placed
      static_root_path = ${cfg.staticRootPath}
      ; enable gzip
      enable_gzip = false
      ; https certs & key file
      cert_file = ${cfg.certFile}
      cert_key = ${cfg.certKey}
  
      [analytics]
      # Server reporting, sends usage counters to stats.grafana.org every 24 hours.
      # No ip addresses are being tracked, only simple counters to track
      # running instances, dashboard and error counts. It is very helpful to us.
      # Change this option to false to disable reporting.
      reporting_enabled = true
      ; Google Analytics universal tracking code, only enabled if you specify an id here
      google_analytics_ua_id =
  
      [database]
      ; Either "mysql", "postgres" or "sqlite3", it's your choice
      type = ${cfg.database.type}
      host = ${cfg.database.host}
      name = ${cfg.database.name}
      user = ${cfg.database.user}
      password = ${cfg.database.password}
      ; For "postgres" only, either "disable", "require" or "verify-full"
      ssl_mode = disable
      ; For "sqlite3" only
      path = ${cfg.database.path}
  
      [session]
      ; Either "memory", "file", "redis", "mysql", default is "memory"
      provider = file
      ; Provider config options
      ; memory: not have any config yet
      ; file: session file path, e.g. `data/sessions`
      ; redis: config like redis server addr, poolSize, password, e.g. `127.0.0.1:6379,100,grafana`
      ; mysql: go-sql-driver/mysql dsn config string, e.g. `user:password@tcp(127.0.0.1)/database_name`
      provider_config = data/sessions
      ; Session cookie name
      cookie_name = grafana_sess
      ; If you use session in https only, default is false
      cookie_secure = false
      ; Session life time, default is 86400
      session_life_time = 86400
      ; session id hash func, Either "sha1", "sha256" or "md5" default is sha1
      session_id_hashfunc = sha1
      ; Session hash key, default is use random string
      session_id_hashkey =
  
      [security]
      ; default admin user, created on startup
      admin_user = ${cfg.security.adminUser}
      ; default admin password, can be changed before first start of grafana,  or in profile settings
      admin_password = ${cfg.security.adminPassword}
      ; used for signing
      secret_key = ${cfg.security.secretKey}
      ; Auto-login remember days
      login_remember_days = 7
      cookie_username = grafana_user
      cookie_remember_name = grafana_remember
  
      [users]
      ; disable user signup / registration
      allow_sign_up = ${b2s cfg.users.allowSignUp}
      ; Allow non admin users to create organizations
      allow_org_create = ${b2s cfg.users.allowOrgCreate}
      # Set to true to automatically assign new users to the default organization (id 1)
      auto_assign_org = ${b2s cfg.users.autoAssignOrg}
      ; Default role new users will be automatically assigned (if disabled above is set to true)
      auto_assign_org_role = ${cfg.users.autoAssignOrgRole}
  
      [auth.anonymous]
      ; enable anonymous access
      enabled = ${b2s cfg.auth.anonymous.enable}
      ; specify organization name that should be used for unauthenticated users
      org_name = Main Org.
      ; specify role for unauthenticated users
      org_role = Viewer
  
      [auth.github]
      enabled = false
      client_id = some_id
      client_secret = some_secret
      scopes = user:email
      auth_url = https://github.com/login/oauth/authorize
      token_url = https://github.com/login/oauth/access_token
  
      [auth.google]
      enabled = false
      client_id = some_client_id
      client_secret = some_client_secret
      scopes = https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email
      auth_url = https://accounts.google.com/o/oauth2/auth
      token_url = https://accounts.google.com/o/oauth2/token
  
      [log]
      root_path = data/log
      ; Either "console", "file", default is "console"
      ; Use comma to separate multiple modes, e.g. "console, file"
      mode = console
      ; Buffer length of channel, keep it as it is if you don't know what it is.
      buffer_len = 10000
      ; Either "Trace", "Debug", "Info", "Warn", "Error", "Critical", default is "Trace"
      level = Info
  
      ; For "console" mode only
      [log.console]
      level =
  
      ; For "file" mode only
      [log.file]
      level =
      ; This enables automated log rotate(switch of following options), default is true
      log_rotate = true
      ; Max line number of single file, default is 1000000
      max_lines = 1000000
      ; Max size shift of single file, default is 28 means 1 << 28, 256MB
      max_lines_shift = 28
      ; Segment log daily, default is true
      daily_rotate = true
      ; Expired days of log file(delete after max days), default is 7
      max_days = 7
  
      [event_publisher]
      enabled = false
      rabbitmq_url = amqp://localhost/
      exchange = grafana_events
    '';
  
  in {
    options.services.grafana = {
  
negative.code:         type = types.bool;
        };
      };
  
      extraOptions = mkOption {
        description = ''
          Extra configuration options passed as env variables as specified in
          <link xlink:href="http://docs.grafana.org/installation/configuration/">documentation</link>,
          but without GF_ prefix
        '';
        default = {};
        type = types.attrsOf types.str;
      };
    };
  
    config = mkIf cfg.enable {
  