security.apparmor.enable = true;
  security.apparmor.profiles = [
    (pkgs.mkApparmorProfile rec {
      subject = pbServe;
      runtimeDeps = [ subject pkgs.tzdata ];
      append = [
        "${config.users.users.static.home}** r"
      ];
      rlimit.as = 100 * pkgs.lib.units.megabyte;
    })
  ];