anchor.diff:          ProtectKernelTunables = true;
           ProtectKernelModules = true;
           ProtectControlGroups = true;
  -        ReadWritePaths = [ cfg.repositoryRoot cfg.stateDir ];
  +        ReadWritePaths = [ cfg.dump.backupDir cfg.repositoryRoot cfg.stateDir ];
           UMask = "0027";
           # Caps
           CapabilityBoundingSet = "";
  
positive.code:          Type = "oneshot";
           User = cfg.user;
           ExecStart = "${gitea}/bin/gitea dump";
           WorkingDirectory = cfg.stateDir;
         };
      };
  
  
negative.code:     };
  
      systemd.tmpfiles.rules = [
        "d '${cfg.dump.backupDir}' 0750 ${cfg.user} gitea - -"
        "z '${cfg.dump.backupDir}' 0750 ${cfg.user} gitea - -"
        "Z '${cfg.dump.backupDir}' - ${cfg.user} gitea - -"
        "d '${cfg.repositoryRoot}' 0750 ${cfg.user} gitea - -"
        "z '${cfg.repositoryRoot}' 0750 ${cfg.user} gitea - -"
        "Z '${cfg.repositoryRoot}' - ${cfg.user} gitea - -"
  